The focal point of the week was the September 15 panel discussion titled “AI in Mathematical Research,” moderated by Tony Feng of UC Berkeley and Google DeepMind. The panelists included Fields Medalists Peter Scholze and Jacob Tsimerman, along with Michael Harris of Columbia University and Geordie Williamson of the University of Sydney. Rather than presenting a united front, the panel surfaced sharply divergent positions on how the mathematical community should respond to the rapid encroachment of machine intelligence into a discipline that has, for centuries, prized human insight, proof and understanding above all else. The onstage discussion, organizers noted, became the starting point for countless conversations among participants throughout the remainder of the week.

Scholze delivered one of the most pointed assessments of the entire Forum. “AI wants to accelerate everything, and I don’t see any inherent value in acceleration at all,” he said. His argument cut against the prevailing narrative that faster discovery is automatically better discovery. Scholze contended that even in the absence of AI, mathematics is already advancing so quickly that genuinely understanding its progress has become a bottleneck in its own right. In a field where a single landmark proof, such as his own work on perfectoid spaces, can take the community years to absorb and verify, the prospect of machine-generated conjectures and proofs arriving at an even greater pace raises an uncomfortable possibility: a mathematics that grows faster than any human, or even the collective of humans, can comprehend it.

Jessica Fintzen and Albrecht Schmidt, Scientific Co-Chairs of the Heidelberg Laureate Forum Foundation, reflected on the range of views the panel exposed. According to the co-chairs, the discussion spanned everything from embracing the use of AI, to cautioning against supporting companies whose values might not be aligned with those of the mathematical community, to trying to pinpoint what mathematics should really be about. They emphasized that the onstage debate addressed many questions that the mathematical and broader community must face, and that it served as a catalyst for conversations among HLF participants throughout the week. That framing captured the spirit of the Forum itself: not a search for consensus, but a structured confrontation with a technological shift whose consequences no one in the room claimed to fully predict.

Those questions extended well beyond the single panel. In a Spark Talk on “AI Safety and Mathematics,” Tsimerman, who received this year’s Fields Medal, argued that societies manage real risks by looking at them clearly and steering away from bad outcomes, not by ignoring them. His position framed AI safety not as a reason for disengagement but as a discipline in its own right, one in which mathematicians have a distinctive role to play. Torsten Hoefler, recipient of the 2024 ACM Prize in Computing, posed the question “Can We Build an AI Scientist?” and offered a prediction with sweeping implications: “everything that is verifiable will be automated.” For a discipline built on verification, that forecast lands with particular force, suggesting that the parts of mathematical work reducible to formal checking may eventually belong entirely to machines, leaving humans the tasks of conjecture, taste and interpretation.

Fields Medalist Martin Hairer presented “First Proof,” an initiative designed to measure how useful AI genuinely is to mathematical research by giving it the kinds of problems that talented mathematicians would actually work on. The approach addresses a persistent weakness in public claims about AI capability, where benchmarks often fail to correspond to the difficulty and texture of real research mathematics. By testing systems against problems of genuine current interest, Hairer’s framework aims to replace anecdote and hype with calibrated evidence, offering the community a way to track whether machine assistance is becoming a practical tool for working mathematicians or remains confined to well-trodden territory.

While AI dominated the conversation, the Forum also confronted a second technological threat with a very different character. Charles H. Bennett and Gilles Brassard, recipients of the 2025 ACM A.M. Turing Award for their pioneering role in the quantum revolution in computer science, delivered a joint lecture titled “The Quantum Information Revolution from Wiesner to Turing.” Brassard issued a caution that the quantum threat to today’s public-key cryptography is widely misunderstood. The danger, he explained, does not begin when a large quantum computer finally appears. Because encrypted data can be harvested now and decrypted later, adversaries need only record today’s traffic and wait. As he put it, “if a quantum computer arrives tomorrow, then my data is gone today.” The warning underscores why the migration to post-quantum cryptographic standards is treated by security researchers as an urgent present-day task rather than a distant concern.

Questions of trust in computation also ran through the program. Yael Tauman Kalai, recipient of the 2022 ACM Prize in Computing, took up a problem that grows more pressing as computation is increasingly outsourced to untrusted servers and, increasingly, to AI systems: when a massive computation is performed remotely, how can anyone be sure the result is correct? Her lecture presented succinct cryptographic proofs, compact certificates that are quick to check even for computations that are prohibitively expensive to rerun, as one answer. The technique connects directly to the week’s AI debates, since verifiable computation offers a potential safeguard for a future in which machine-generated results must be trusted at scale.

The scientific program showcased the breadth of both disciplines. Shayan Oveis Gharan, recipient of the 2026 IMU Abacus Medal, lectured on the polynomial paradigm and its applications in algorithms. Yu Deng, a 2026 Fields Medalist, gave a Spark Talk addressing critical problems in statistical physics and partial differential equations. Efim Zelmanov, Fields Medalist in 1994, opened the final day with a sweeping look at 200 years of abstract algebra. Nobel laureate Brian P. Schmidt, whose Nobel Prize in Physics recognized the discovery of the universe’s accelerating expansion, delivered this year’s Lindau Lecture, “The State of the Universe,” tracing how scientists came to understand that the cosmos is expanding. Attendees also watched livestreams marking the 100th birthday of Jean-Pierre Serre, the first recipient of the Abel Prize, including a lecture by Pierre Deligne in Serre’s honor and a talk by Serre himself from the celebrations in Paris.

The next generation made its own mark on the week. Dorothee Bär, Germany’s Federal Minister of Research, Technology and Space, addressed the Opening Ceremony by video, praising the Forum as a place where knowledge that cannot be learned from a paper passes in person from one generation to the next, and closing with an appeal: “Mathematics has outlived every border ever drawn around it. Please keep it that way.” The young researchers carried that spirit into the Forum’s first-ever Un-Conference on the final day, a bottom-up format for which participants had pitched and voted on discussion topics throughout the week. The results confirmed that the laureates’ concerns were widely shared: many sessions dealt with AI, including its impact on academia, how to reshape education in the age of AI, and technofascism and Silicon Valley ideology, while others took up the role of mathematics and computer science for society and the value of pure mathematics. The entire scientific program is available on the HLF’s YouTube channel, with in-depth coverage on the HLFF Blog, and journalists can register for accreditation for the 14th Forum in 2027 from March onwards. What the week made plain is that the debate over AI in mathematics is no longer a speculative exercise; it is a live argument being conducted at the very top of the discipline, and the outcome will shape how human knowledge itself is made.

Subject of Research: Debates on artificial intelligence in mathematical research at the 13th Heidelberg Laureate Forum

Article Title: Leading mathematicians and computer scientists weigh AI's growing role in mathematics at the 13th Heidelberg Laureate Forum

Article References: Leading mathematicians and computer scientists weigh AI's growing role in mathematics at the 13th Heidelberg Laureate Forum. (n.d.). Original publication

Image Credits: AI Generated

DOI: Not provided

Keywords: Heidelberg Laureate Forum, artificial intelligence, mathematics, Fields Medal, Peter Scholze, quantum cryptography, post-quantum security, verifiable computation, AI safety, Turing Award, young researchers, Un-Conference

Group signatures, first proposed by David Chaum and Eugene van Heyst in 1991, allow a member of a group to sign messages anonymously on behalf of the collective. Anyone holding the group’s public key can verify that a valid group member signed the message, but the signer’s individual identity remains hidden within the anonymity set. To prevent abuse of this anonymity, a designated opener typically holds the power to reveal who signed a given message. The tension at the heart of the technology is obvious: anonymity is valuable, but so is accountability, and traditional designs concentrate enormous tracing power in the hands of the group manager.

The new work builds on a concept pioneered by Diaz and Lehmann at the PKC 2021 conference: group signatures with user-controlled and sequential linkability, or GS-UCSL. In such schemes, signers themselves decide which signatures can be linked, rather than depending on a central authority to perform the linking. Linkability matters in practical settings. A vehicle broadcasting sensor readings to a data lake, for example, may need to prove that a sequence of anonymous reports arrived in the original chronological order, because the ordering itself carries meaning. A fuel-level sequence of 35, 45, 30 and then 40 liters within a short window might signal tampering, whereas 45, 40, 35 and 30 would look normal. Contact tracing systems face similar demands when pseudonymous data spans multiple rotating pseudonyms. The original GS-UCSL scheme, however, suffered three fatal limitations: it was not post-quantum secure, it offered no mechanism to revoke malicious signers, and it omitted traceability entirely.

Dong and Yao’s answer rests on lattice cryptography, the mathematical foundation underlying most post-quantum proposals. Lattice problems such as Module Learning With Errors (MLWE) and Module Short Integer Solution (MSIS) are believed to resist attacks even by large-scale quantum computers running Shor’s algorithm, which would demolish schemes built on integer factorization or discrete logarithms. The authors prove their scheme’s anonymity, traceability, existential unforgeability under chosen-message attack, and non-frameability in the random oracle model, grounding each property in the hardness of these lattice assumptions. Parameter analysis with the Lattice Estimator tool suggests attack costs far beyond practical reach, with the cheapest known attacks requiring on the order of 2 to the power 128 operations or more.

One of the scheme’s most distinctive features is its approach to revocation. Existing revocable group signatures typically rely on revocation lists, whose verification cost grows with the number of revoked members, or on revocation tokens distributed through secure channels, which impose heavy communication overhead. The new design instead uses a revocation polynomial. The group manager encodes each legitimate signer’s revocation secret into a polynomial and publishes it; a signer proves membership in a zero-knowledge proof by evaluating the polynomial at their own secret value. When a malicious member must be expelled, the manager simply resamples the secret and recomputes the polynomial from the remaining values. No revocation list needs to be checked at verification time, no member keys need to be reissued, and the privacy of revoked users is preserved. Verification cost remains constant regardless of how many users have been revoked.

To curb the group manager’s tracing power, the scheme borrows key-oblivious encryption, a primitive introduced by Kohlweiss and Miers and later instantiated on lattices by Ling and colleagues. During registration, the manager rerandomizes each user’s encryption public key. Thanks to the key-oblivious property, no one without the original secret key and the randomness can tell whether a given randomized key is traceable. The manager silently tags some users as traceable and others as non-traceable, and the users themselves cannot detect which category they fall into. When signing, each user encrypts identity information under their own randomized key; only traceable users’ identities can later be recovered by the opener. This splits the group into traceable and non-traceable types without anyone’s awareness, restraining the manager from arbitrarily unmasking every signer. A cuckoo hash table, which guarantees worst-case constant-time insertion, lookup and deletion, serves as the manager’s private registry of traceable users.

Linkability in the scheme comes in three flavors, all under user control. Implicit linkability assigns each signature a pseudonym derived from a scope value and the signer’s secret key: signatures within the same scope are automatically linkable, while those across different scopes remain unlinkable unless the signer proves otherwise. Explicit linkability lets a signer voluntarily claim a set of signatures after the fact. Sequential linkability goes further, allowing a signer to produce a proof that a chain of linked signatures was generated in strict chronological order with no omissions. The mechanism uses lightweight hash chains derived from the signer’s secret key and a state counter, with unique sequential values checked against an append-only bulletin board to defeat replay, reordering and selective disclosure attacks. Recovering the signer’s secret from a pseudonym would require solving the MSIS problem, which is computationally infeasible.

Efficiency was a central design goal. The scheme integrates signature aggregation with non-interactive zero-knowledge proofs of knowledge to enable batch verification of sequentially linked signatures. In experiments implemented in SageMath on a laptop with an Intel Core i7-8650U processor, the authors report that aggregating 500 linked signatures compresses the signature size by roughly 81 percent and cuts verification time by about 83 percent. Setup, key generation, verification and opening all complete within one second; signing and revocation finish within about 3.5 seconds. Joining 500 users simultaneously offline took roughly 982 seconds in total, though a single user’s join takes only a few seconds. Communication overhead grows only mildly and linearly with group size, and verification time stays constant regardless of the number of revoked users, which the authors highlight as critical for large-scale deployments such as vehicular networks and blockchain-based data sharing.

The formal security analysis proceeds through sequences of games. Anonymity reduces to the hiding property of an underlying lattice commitment scheme by Baum and colleagues plus the indistinguishability of a verifiable encryption scheme by Lyubashevsky and Neven. Traceability, unforgeability and non-frameability share a unified proof structure: any adversary who forges a signature can be used, via the general forking lemma, to extract a solution to the MSIS problem, with the three properties distinguished by the adversary’s goals and oracle access rather than by structurally different proofs. The authors also validated the protocol with the automated verification tool Scyther, which confirmed the security of the message flows among the group manager, signer and verifier. They acknowledge that the security proofs rely on the random oracle model, consistent with all state-of-the-art lattice-based group signatures of this scope, and note that achieving such comprehensive functionality in the standard model remains an open problem. Hash functions are instantiated with the NIST-standardized, post-quantum-secure SHAKE-256.

The researchers acknowledge remaining limitations and outline future work. Currently, the group manager must recompute the revocation polynomial after every revocation operation, which costs time, and the manager must store each legitimate signer’s revocation secret, so storage demand grows with the signer base. The team plans to optimize polynomial updates and to seek smaller secret keys and lighter management overhead. Even so, the authors conclude that LCGS-UCSL achieves comprehensive functionality with competitive efficiency, marking the first post-quantum-secure group signature scheme to combine user-controlled sequential linkability, lightweight polynomial revocation, oblivious traceability classification and batch verification. For privacy-critical sequential scenarios ranging from intelligent transportation to contact tracing and time-series data authentication, the scheme offers a blueprint for staying anonymous, staying accountable, and staying secure against the quantum computers of the future.

Subject of Research: A post-quantum lattice-based group signature scheme with user-controlled and sequential linkability and efficient revocation

Article Title: An efficient lattice-based conditional privacy-preserving group signature with user-controlled and sequential linkability

Article References: Dong, S., & Yao, Y. (2026). An efficient lattice-based conditional privacy-preserving group signature with user-controlled and sequential linkability. Cybersecurity, 9(1), Article 210. https://doi.org/10.1186/s42400-026-00613-3

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00613-3

Keywords: group signatures, lattice cryptography, post-quantum security, user-controlled linkability, sequential linkability, revocation, zero-knowledge proofs, key-oblivious encryption, cuckoo hashing, anonymity, traceability, batch verification