Step 1 · the target
A semiprime N = p · q
Self-generated small semiprime (a research bench — the algorithm never uses p or q; we only
reveal them to score the oracle). Pollard's rho finds a factor in ≈ √p steps.
prime size
N
p × q
√p (baseline rho horizon)
Step 2 · baseline
Pollard's rho (the thing we'd beat)
The exact recurrence
xₙ₊₁ = xₙ² + c (mod N) with Floyd cycle detection.factor found
steps
Step 3 · the guarantee
Certification can't lie (Thm 5.1)
Feed Helix B a flood of arbitrary candidate pairs. Every reported factor is exact;
false factors are impossible by construction.
false factors
genuine factors certified
Step 4 · the whole question
Oracle Bias ε — does the oracle enrich useful collisions?
A “useful” pair (i,j) has
xᵢ ≡ xⱼ (mod p) (so the GCD reveals p). We build a window of
states, then measure how often each oracle's top-K candidates are useful, versus a uniform-random baseline.
ε = hit-rate(oracle) − hit-rate(uniform). Positive ε is the only thing that could yield acceleration.
oracle
baseline useful-pair density
uniform hit-rate
selected oracle hit-rate
Oracle Bias ε
Gold line = uniform baseline. Bar past it (green) = positive bias (would help); short of it (red)
= the oracle is worse than random. The reference run measures ε ≤ 0 for the geometric scores:
features built from
xᵢ mod N carry no information about xᵢ mod p.Step 5 · the cost wall
Even with a perfect oracle: the reconstruction wall
To certify candidate (i,j) you must produce the states
xᵢ, xⱼ. Building a length-L window
already costs L walk-steps — about what baseline rho spends to find the collision outright. Beating it needs
random access to xᵢ without walking 0…i (true sublinear reconstruction); no such closed form is known
for iterating x²+c (and one would itself break factoring). Checkpointing trades memory for the walk
but doesn't remove it.baseline rho — steps to factor
Helix — window build (L)
Helix — reconstructions
Helix — TOTAL ops
verdict
Step 6 · the open door
Reconstruction oracle — break the wall here, if it can be broken
The whole acceleration reduces to one function: compute
xᵢ without walking 0…i.
For a linear map (x→ax+b) this exists and is O(log i) — a matrix power. For
x→x²+c the i-fold composition has degree 2ⁱ, so no closed form is known (see
jump_ahead.py). If the Einstein-Tile / prime-triplet / telescoping construction yields a concrete
jumpAhead(i, x0, c, N), paste it: we check it against the true xᵢ and chart its cost.
Exact AND sub-linear = the wall is broken (and you've done something far bigger than this page).exact on all tested indices
cost scaling (index ×100)
verdict
Step 7 · scaling to crypto sizes
What happens at 144, 256, 288 bits?
The live bench above tops out around 28-bit primes — not from slowness, but because the
ε-experiment is only defined while the window reaches the birthday horizon
√p. Pick a
modulus size: this computes where √p lands and whether either the baseline factoring or the
ε-measurement can run at all.
modulus N
prime size p,q ≈ N/2
collision horizon √p
baseline rho work ≈ √p ops
time @ 10⁹ ops/s
ε-experiment window needed
can baseline rho factor it?
is the Oracle-Bias ε measurable?