ML-DSA · Fiat–Shamir with aborts

The secret is half the gap between the two averages

Each dot is one signature. The real response is z = y + c·s₁, where the challenge c = H(μ, w₁) is a polynomial of ±1 coefficients built from the message and the commitment. Here it is collapsed to a single challenge sign per signature: a + shifts the average by +s, a − by −s. The distance between the two average markers is 2s — turn on the bound and they slide together, and the secret disappears.
Press Run to stream signatures, or Step to fire one.
Signatures
0
True secret s
5
Recovered ŝ = gap ÷ 2
—
Leaky?
OPEN
The averages jump around at first and settle as signatures pile up — that's the leak growing sharper over time. The green band is what the bound keeps. Switch it on: every dot outside is thrown away (greyed), the accepted dots become an even blue/orange mix, both averages fall to zero, and the gap — the secret — is gone. 1-D teaching reduction of z = y + c·s₁: the challenge c is really a ±1 polynomial from H(μ, w₁), collapsed here to one sign per signature. Real y is uniform, as shown.