Adaptive Scheduling Optimization for Isogeny Mapping in SQIsign Based on Lightweight Learning to Rank

Abstract

The post-quantum signature scheme SQIsign achieves extremely compact public keys and signatures, making it attractive for bandwidth-constrained environments. However, its signing efficiency is limited by the high random failure rate of the ideal-to-isogeny mapping procedure and the substantial cost of each retry. Existing optimizations mainly reduce the number or cost of isogeny computations, while overlooking how to schedule commitment retries when multiple candidate ideals are available. We formulate commitment-stage scheduling as a lightweight learning-to-rank problem and provide an instrumented scheduling framework for SQIsign signing only. The pipeline uses two features, trains a weighted logistic regression scorer offline by maximum likelihood with class weighting, and deploys the same scorer online in Rank-ML mode. Live instrumentation on Apple M2 (n = 20,000 candidate attempts at NIST-I) quantifies the commitment bottleneck (86.4% failure; 7.36 mean attempts per session) and shows constant features at a fixed commitment degree (live AUC $=0.50$). Synthetic training supports the scorer when feature variance is present (test AUC $\approx 0.634$). A remeasured four-way ablation with Batch-only control ($n=100$, seed 42) separates batch overhead from learned ordering: Rank-ML is indistinguishable from Batch-only at deployment, while Baseline remains fastest for its wall-clock signing time at batch size 10. These results clarify when lightweight ML scheduling applies in SQIsign and provide a reproducible evaluation template separating live, synthetic, remeasured, and proxy evidence.

1. Introduction

In 1994, Shor proposed polynomial-time quantum algorithms for integer factorization and discrete logarithms, theoretically shaking the security foundations of RSA [1] and ECC [2]. With the continuous advancement of quantum hardware, the standardization and deployment of post-quantum cryptography (PQC [3]) have shifted from a long-term vision to an urgent imperative. NIST launched a global call for proposals in 2016 and released their first batch of standardized schemes in 2024: the key encapsulation mechanism ML-KEM (FIPS 203) [4] and the digital signature schemes ML-DSA (FIPS 204) [5] and SLH-DSA (FIPS 205) [6], with HQC [3] subsequently incorporated into the supplementary round as well.

In the current round of the post-quantum signature competition, SQIsign [7] has attracted considerable attention because of its extremely compact public key and signature sizes, making it particularly suitable for bandwidth-constrained scenarios. Proposed by De Feo et al. in 2022, the scheme is based on the Deuring correspondence [8], and its security relies on the computational hardness of the supersingular isogeny problem [9]. However, a fundamental bottleneck in the signing process remains unresolved. The ideal-to-isogeny mapping exhibits a random failure rate of up to approximately 85%, while each mapping attempt incurs a high computational cost. As a result, in a typical signing process, more than eight out of ten attempts consume substantial computational resources without producing a valid result. Existing protocol-level optimization approaches, including ApresSQIsign [10] and the SQIsign2D series [11], primarily reduce either the frequency or the cost of isogeny computations, thereby addressing the questions of “when to compute” and “how to compute.” However, they largely overlook a more fundamental question: “which candidate should be computed first?” When multiple candidate ideals are available, an effective strategy should prioritize the candidates that are more likely to succeed, rather than allocating expensive computations uniformly across candidates with a high probability of failure.

Motivated by this gap, we formulate candidate scheduling during the commitment stage of signing as a lightweight learning-to-rank problem and propose an adaptive scheduling framework that applies exclusively to the signature generation process of SQIsign, rather than to key generation. Our study integrates (i) an open instrumented pipeline, (ii) live characterization of retry behavior, and (iii) a controlled four-way ablation study that isolates the effects of batch scheduling and learned ranking. Simple number-theoretic features are used as candidate predictors, and their effectiveness in practice depends on the insertion point of the commitment stage. We evaluate their discriminative capability on synthetic data (AUC $\approx 0.634$) and further report the deployment performance under a fixed commitment degree (live AUC $=0.50$). Offline training is performed using weighted logistic MLE, whereas online deployment ranks candidates with Rank-ML using the same scoring function. No pairwise ranking loss is introduced during training. The inference overhead is approximately ${10}^2$ CPU cycles per candidate, whereas a single failed isogeny construction may require up to ${10}^6$ CPU cycles. The implications for timing side-channel security are analyzed explicitly rather than being ignored.

The main contributions of this work are summarized as follows:

1.

Commitment scheduling formulation and instrumented framework. We formulate SQIsign commitment retry as a lightweight learning-to-rank scheduling problem and provide an instrumented signing pipeline with live logging, synthetic training, and four scheduler modes (Baseline, Binary-ML, Batch-only, Rank-ML).

2.

Live empirical characterization of the commitment bottleneck. On Apple M2, we collect 20,000 live candidate attempts at NIST-I, reporting 86.4% failure, 7.36 mean attempts per session, and alignment with remeasured prime trial counts (≈146–172 per sign).

3.

Deployment mismatch and degeneracy diagnosis. We show that at the default post-RandomIdealGivenNorm insertion point, norm bit length and trace parity are constant (live AUC $=0.50$), the deployed scorer outputs identical probabilities (unique_probs $=1$), and Rank-ML degenerates to the batch-internal FIFO order.

4.

Controlled scheduler ablation. A remeasured four-way comparison separates batch overhead from learned ordering: Rank-ML is indistinguishable from Batch-only under a fixed degree, while synthetic data (AUC $\approx 0.634$) demonstrates that the scorer works when feature variance exists.

The experiments are conducted on Apple M2 under the NIST-I parameter set and are organized into four categories of evidence: live, synthetic, remeasured, and proxy. Live experiments quantify the bottleneck of the commitment stage, revealing an approximately 86% failure rate and an average of 7.36 attempts per signing session, while also confirming that the evaluated features remain constant in practice (AUC $=0.50$). Synthetic experiments produce an AUC of approximately 0.634 under controlled feature variation. The remeasured four-way scheduler ablation demonstrates that Rank-ML achieves performance comparable to Batch-only under fixed-degree deployment, whereas Baseline provides the lowest execution time at a batch size of 10.

The remainder of this paper is organized as follows. Section 1 introduces the post-quantum background, the commitment-stage efficiency bottleneck of SQIsign, the learning-to-rank scheduling formulation, and the main contributions of this work. Section 2 reviews existing isogeny-based SQIsign optimizations and the gap in candidate ordering, thereby motivating the proposed ML scheduling framework. Section 3 outlines the SQIsign signing workflow, analyzes the Commitment retry mechanism, and describes how the Rank-ML scheduler is integrated between RandomIdealGivenNorm and RandomEquivalentPrimeIdeal. Section 4 presents the key algorithms and optimization techniques, including failure analysis of RandomEquivalentPrimeIdeal and IdealToIsogeny, the shift from binary classification to learning-to-rank, lightweight feature engineering, the weighted logistic regression model, the online scheduling workflow, and complexity analysis. Section 5 details the experimental design and result analysis on Apple M2, covering the four comparison schemes (Baseline, Binary-ML, Batch-only, and Rank-ML), the training and reproducibility protocol, and four categories of evidence—live, synthetic, remeasured, and proxy—including live bottleneck characterization, synthetic feature validation, the remeasured four-way scheduler ablation, Monte Carlo proxy ablation, limitations, and timing side-channel discussion. Finally, Section 6 summarizes the established results and explicit non-claims, discusses the relation to existing SQIsign optimizations, and outlines future research directions.

2. Related Work

2.1. Performance Optimization of Isogeny-Based Cryptography

In recent years, existing optimization work on SQIsign has mainly focused on two directions: low-level arithmetic acceleration and IdealToIsogeny algorithm improvements.

On the arithmetic side, several studies have achieved substantial speedups through optimized finite-field implementations, SIMD/vectorized instructions [12], and hardware acceleration. For example, optimized assembly implementations significantly reduced SQIsign verification latency on modern CPUs, while FPGA-based accelerators demonstrated [13] that isogeny computations can be greatly accelerated at the hardware level. These works successfully improved the efficiency of individual cryptographic operations, especially during verification.

On the algorithmic side, Lin et al. [14] improved the IdealToIsogeny procedure by exploiting relationships between elliptic-curve discrete logarithm problems and reduced Tate pairings [15]. Their method replaces part of the expensive elliptic-curve [16] computation with finite-field operations, reducing the overall cost of each IdealToIsogeny invocation and achieving measurable speedups in key generation, signing, and verification.

However, despite these advances, an important efficiency bottleneck remains unresolved. Existing methods mainly optimize how fast a single attempt can be executed, but they do not address a more fundamental question: which candidate ideal should be attempted first. In practice, the RandomEquivalentPrimeIdeal and IdealToIsogeny stages exhibit a very high failure rate, meaning that most expensive isogeny computations are ultimately wasted on unsuccessful candidates.

Moreover, prior approaches still suffer from several limitations. Arithmetic-level acceleration reduces the runtime of each computation, but cannot avoid unnecessary failed attempts. Algorithmic improvements inside IdealToIsogeny similarly accelerate every invocation equally, regardless of whether the candidate ideal will eventually succeed. As a result, a large amount of computational effort is still spent exploring low-quality candidates.

This unresolved inefficiency directly motivates our work. Instead of further optimizing the internal implementation of IdealToIsogeny, we introduce a lightweight ranking-based scheduling strategy before expensive isogeny computations begin. When features vary across candidates at the deployment insertion point, inexpensive numerical features and a lightweight scorer can guide attempt order; our live and ablation study identifies when this signal is absent under a fixed commitment degree. Existing protocol-level schemes such as ApresSQIsign and SQIsign2D address complementary bottlenecks (faster or fewer isogeny calls), whereas our focus is candidate ordering within the commitment retry loop; these two lines of work are potentially composable but are not jointly benchmarked in this revision.

2.2. ML Applied to SQIsign Signature Optimization

In the signature generation process of SQIsign, the combined random failure rate of RandomEquivalentPrimeIdeal and IdealToIsogeny reaches approximately 85%. Consequently, the probability that a candidate ideal successfully completes the subsequent isogeny mapping process [17] is below 15%. As a result, more than eight out of every ten expensive algebraic computations fail to produce a valid outcome. Existing protocol-level optimization approaches reduce the overall frequency of isogeny computations but continue to evaluate candidate ideals in a uniformly random order, thereby distributing computational resources evenly across computation paths with a high probability of failure. Low-level implementation optimizations reduce the cost of individual isogeny computations but likewise cannot distinguish the quality of candidate ideals. Consequently, these optimizations accelerate both successful and unsuccessful computations equally. In summary, neither line of research provides an effective mechanism for estimating the quality of candidate ideals before isogeny construction. A substantial fraction of CPU cycles during signing is therefore consumed by algebraic transformations that ultimately fail, rather than by successful isogeny computations.

Motivated by this observation, this paper formulates candidate scheduling during the Commitment stage of SQIsign as a lightweight learning-to-rank problem and proposes an adaptive scheduling framework. Observable number-theoretic features exhibit a predictive capability only when feature variance is present, achieving a synthetic AUC of approximately 0.634. However, at the default insertion point immediately after RandomIdealGivenNorm under a fixed commitment degree, the discriminative capability disappears, resulting in a live AUC of $0.50$. A weighted logistic regression model is trained offline, and the resulting scoring function is used online to rank candidate ideals according to their predicted success probabilities before sequential evaluation until the first successful candidate is identified. The inference overhead is approximately ${10}^2$ CPU cycles per candidate, whereas a single failed isogeny construction may require up to ${10}^6$ CPU cycles. The proposed framework does not modify any cryptographic component and is fully orthogonal to existing protocol-level and implementation-level optimization approaches.

Although the proposed framework can be integrated into the signing pipeline without modifying the underlying cryptographic procedure and can improve candidate ordering when informative online features are available, the current deployment with two features under a fixed commitment degree does not produce measurable latency improvements. At present, the framework relies only on two coarse-grained features, namely norm bit length and trace parity. Although this design keeps the inference overhead extremely low, it does not exploit richer algebraic information from ideal class groups and therefore provides a limited discriminative capability at the current insertion point. Furthermore, the model parameters remain fixed after offline training and are not updated according to runtime statistics. These limitations motivate the future research directions discussed in Section 6.

3. Overall System Framework

The SQIsign system comprises three functional modules: key generation, signature generation, and signature verification. The optimization proposed in this paper is integrated into the Commitment stage of the signature generation process (Figure 1). Specifically, it is inserted between RandomIdealGivenNorm and RandomEquivalentPrimeIdeal, as illustrated in Figure 2.

The key generation and signature verification modules follow the standard SQIsign workflow and are not affected by the proposed scheduler. All ML experiments presented in this paper are conducted exclusively on the Commitment stage of the signature generation process. Therefore, the following section provides only a brief overview of the signature generation process to establish the context in which the proposed scheduler is integrated.

The SQIsign signing algorithm is essentially a non-interactive zero-knowledge proof obtained through the Fiat–Shamir transformation. Its procedure can be divided into three stages: Commitment, Challenge, and Response. In the following, we analyze the cryptographic operations involved in each stage, explain the random failure and retry mechanism in the Commitment stage, and clarify how the lightweight learning-to-rank scheduler is integrated into this mechanism.

3.1. Commitment Phase

The objective of the Commitment phase is to generate a random curve $E_{\mathrm{com}}$ while preserving, for the prover, a secret isogeny ${\varphi }_{\mathrm{com}}$ from the fixed public curve $E_0$ to $E_{\mathrm{com}}$.

1.

Sampling the initial commitment ideal: Invoke RandomIdealGivenNorm$(D_{\mathrm{mix}},\mathrm{true})$, where $D_{\mathrm{mix}}$ denotes the smallest prime greater than $2^{4\lambda }$. This algorithm outputs a left ${\mathcal{O}}_0$-ideal $I_{\mathrm{com}}$ with norm $D_{\mathrm{mix}}$. The choice of $D_{\mathrm{mix}}$ ensures that the distribution of $E_{\mathrm{com}}$ is statistically close to uniform, thereby preventing leakage of private-key information.

2.

Ideal normalization: The norm of $I_{\mathrm{com}}$ is excessively large and therefore unsuitable for efficient isogeny computation. To address this issue, RandomEquivalentPrimeIdeal$\left(I_{\mathrm{com}}\right)$ is invoked to transform it into an equivalent ideal with a small prime norm while preserving the ideal equivalence class. This algorithm constructs candidate elements $\beta \in I_{\mathrm{com}}$ through randomized sampling over an LLL-reduced basis and checks whether $\mathrm{nrd}\left(\beta \right)/\mathrm{nrd}\left(I_{\mathrm{com}}\right)$ is prime. In essence, this process searches for prime values in the value set of a high-dimensional quadratic form. Owing to the restricted candidate space, this step exhibits a non-negligible probability of failure.

3.

Ideal-to-isogeny conversion: The small-norm ideal obtained in the previous step is then passed to $\mathtt{IdealToIsogeny}$, which constitutes the most computationally intensive module in the entire signing procedure. It first invokes $\mathtt{SuitableIdeals}$ to search, among several precomputed special maximal orders, for short element pairs satisfying coprimality conditions. Subsequently, $\mathtt{FixedDegreeIsogeny}$ and the two-dimensional $(2,2)$-isogeny chain $\mathtt{Isogeny}\mathtt{22}\mathtt{Chain}$ are used to explicitly construct the isogeny mapping ${\varphi }_{\mathrm{com}}:E_0\to E_{\mathrm{com}}$ and to compute the images of the basis points $(P_0,Q_0)$. This module also contains multiple sources of random failure, including norm equation-solving failures and intermediate splitting failures within the $(2,2)$-isogeny chain. Once a failure occurs, all intermediate computational results are discarded.

4.

Retry loop and integration point of the ML scheduler: Both Step 2 and Step 3 involve relatively high random failure probabilities, resulting in an overall success rate of only approximately $15\%$. Consequently, the entire Commitment phase is enclosed within a $\mathtt{while}\mathtt{true}$ loop. If either $\mathtt{RandomEquivalentPrimeIdeal}$ or $\mathtt{IdealToIsogeny}$ returns failure, the algorithm executes $\mathtt{continue}$ and immediately jumps back to the beginning of the loop, where $\mathtt{RandomIdealGivenNorm}$ is invoked again to generate a completely new candidate $I_{\mathrm{com}}$. In other words, a single failure causes the current ideal to be discarded and the entire process to restart, rather than retrying locally at the failure point.

The lightweight learning-to-rank scheduler proposed in this paper is integrated at the entry point of the retry loop, immediately after RandomIdealGivenNorm and before RandomEquivalentPrimeIdeal. At this point, a new candidate ideal $I_{\mathrm{com}}$ has been generated, whereas the computationally expensive ideal normalization and isogeny construction procedures have not yet begun. Consequently, feature extraction and score computation introduce only negligible overhead. The scheduler extracts two lightweight features, namely the norm bit length and trace parity, evaluates them using a pretrained logistic regression model, and ranks candidate ideals according to their predicted success probabilities before they are processed by RandomEquivalentPrimeIdeal and IdealToIsogeny. The candidates are then evaluated sequentially in the resulting order until one successfully completes the entire signing procedure, at which point the current retry process terminates.

The norm bit length feature is motivated by the variability introduced during RandomEquivalentPrimeIdeal. However, in the current deployment, feature extraction is performed immediately after RandomIdealGivenNorm, where $\mathrm{COM}\_\mathrm{DEGREE}$ fixes the value of ${log}_2\mathrm{nrd}\left(I\right)$. Consequently, live execution logs exhibit constant feature values, resulting in no discriminative signal for online ranking at the current insertion point. Improving online ranking performance therefore requires either an alternative insertion point or more informative features.

3.2. Challenge Phase

Once the Commitment phase succeeds, the commitment curve $E_{\mathrm{com}}$ and the corresponding images of the basis points are obtained. The Challenge phase is then initiated, during which the challenge value is generated using a hash function as follows:

$$\mathrm{chl}=\mathtt{HASH}(\mathrm{pk}\Vert j\left(E_{\mathrm{com}}\right)\Vert \mathrm{msg})$$

(1)

where $\mathrm{pk}$ denotes the public key and $\mathrm{msg}$ denotes the message to be signed. The hash function $\mathtt{HASH}$ is implemented through multiple iterations of $\mathtt{SHAKE}\mathtt{256}$ (grinding technique), ensuring that the security level still reaches $\lambda$ bits even when the challenge space $2^{e_{\mathrm{chl}}}$ is slightly smaller than the security parameter $\lambda$.

3.3. Response Phase

The Response phase uses the knowledge of $\mathrm{End}\left(E_{\mathrm{pk}}\right)$ contained in the private key to generate an isogeny ${\varphi }_{\mathrm{rsp}}$ from $E_{\mathrm{com}}$ to the challenge curve $E_{\mathrm{chl}}$, thereby proving possession of the private key. This phase can be decomposed into the following steps:

1.

Construction of the challenge ideal. Using the private-key basis transformation matrix ${\mathbf{M}}_{\mathrm{sk}}$, the challenge value $\mathrm{chl}$ is mapped to a kernel point on $E_0$. The corresponding left ${\mathcal{O}}_0$-ideal $I_{\mathrm{chl}}^{\prime }$ is then obtained through $\mathtt{KernelDecomposedToIdeal}$. Subsequently, the ideal pushforward operation ${\left[I_{\mathrm{sk}}\right]}_{*}$ is applied to derive the challenge ideal $I_{\mathrm{chl}}$ defined over the endomorphism ring of the private-key curve.

2.

Sampling the response isogeny. Compute the intersection ideal $\overline{I_{\mathrm{com}}}\cap (I_{\mathrm{sk}}·I_{\mathrm{chl}})$, which corresponds to all isogenies from $E_{\mathrm{com}}$ to $E_{\mathrm{chl}}$. A quaternion ${\alpha }_{\mathrm{rsp}}$ satisfying the norm bound is then sampled from this ideal using lattice-basis sampling via $\mathtt{RandomEquivalentQuaternion}$, thereby determining the response isogeny ${\varphi }_{\mathrm{rsp}}$.

3.

Decomposition and representation. The quaternion ${\alpha }_{\mathrm{rsp}}$ is processed by ComputeBacktrackingAndNormalize to remove the common prefix shared with the challenge isogeny, yielding the backtracking length $n_{\mathrm{bt}}$. Subsequently, the response isogeny degree $d_{\mathrm{rsp}}$ is decomposed into an odd component $q_{\mathrm{rsp}}$ and an even component $2^{r_{\mathrm{rsp}}}$.

• The odd component ${\varphi }_{\mathrm{rsp}}^{\mathrm{odd}}$ is embedded into a two-dimensional $(2^{e_{\mathrm{rsp}}^{\prime }},2^{e_{\mathrm{rsp}}^{\prime }})$-isogeny. To achieve this, an auxiliary isogeny $I_{\mathrm{aux}}$ is sampled, and $\mathtt{IdealToIsogeny}$, together with $\mathtt{SplitAuxiliaryIsogeny}$, is used to construct the four points $(P_{\mathrm{chl}},P_{\mathrm{aux}})$ and $(Q_{\mathrm{chl}},Q_{\mathrm{aux}})$ defining the kernel of this two-dimensional isogeny.
• If the even component is nontrivial ($r_{\mathrm{rsp}}>0$), the kernel point is extracted through $\mathtt{IdealToKernel}$, and the corresponding isogeny is explicitly computed using the short 2-isogeny chain $\mathtt{TwoIsogenyChainSmall}$.

4.

Signature generation. The challenge isogeny is computed and the curves are unified through $\mathtt{ComputeChallengeIsogeny}$, while $\mathtt{SetChangeOfBasisMatrix}$ outputs the basis transformation matrix and auxiliary hints. The final signature is encapsulated as

$$\sigma =(E_{\mathrm{aux}},n_{\mathrm{bt}},r_{\mathrm{rsp}},{\mathbf{M}}_{\mathrm{chl}},\mathrm{chl},{\mathrm{hint}}_{\mathrm{aux}},{\mathrm{hint}}_{\mathrm{chl}})$$

(2)

The complete signing procedure shows that the frequent random retries in the Commitment stage constitute the primary performance bottleneck. The proposed ML scheduler follows the principle of “low-cost prediction guiding high-cost decisions.” During each Commitment attempt, the system first generates a set of candidate ideals, denoted by $\mathcal{I}=\{I_1,\dots ,I_k\}$. The scheduler then extracts lightweight features from each candidate, computes a predicted success score using a pretrained model, and ranks the candidates in descending order of the predicted scores. The ranked candidates are subsequently processed by RandomEquivalentPrimeIdeal and IdealToIsogeny in sequence. As soon as one candidate successfully completes the entire procedure, the current retry round terminates, and the protocol proceeds to the subsequent Challenge and Response stages. When informative feature variation exists across candidates, this ranking strategy can reduce the number of attempts compared with blind search. However, under the current deployment with a fixed commitment degree, the remeasured ablation results indicate that no measurable improvement is achieved.

4. Key Algorithms and Optimization Techniques

The signing procedure of SQIsign can be viewed as the transformation of a left ideal I into an isogeny mapping ${\varphi }_I:E_0\to E_I$. This transformation consists of two stages: equivalent ideal normalization and isogeny construction. The first stage transforms the input ideal I into an equivalent ideal J with a small prime norm, thereby reducing the computational cost of the subsequent isogeny construction. The second stage constructs the explicit isogeny mapping from J, including fixed-degree isogeny computation and two-dimensional isogeny chain evaluation. Together, these two stages dominate both the computational cost and the reliability of the signing process while introducing two fundamental challenges:

• High computational cost: Both subprocedures involve complex algebraic operations, including LLL reduction, norm computation, norm equation solving, and isogeny chain evaluation in $\theta$-coordinates. Consequently, the cost of a single attempt is substantial, requiring approximately ${10}^6$ CPU cycles.
• Random failures and retries: Due to the randomness inherent in ideal sampling, the above procedures do not always succeed. A failure in either stage requires the current ideal to be discarded and a new one to be resampled, resulting in repeated executions within the main signing loop and significantly increasing both the average latency and runtime variance.

From a system-level perspective, the primary performance bottleneck arises not from the cost of an individual computation but from the large number of unsuccessful attempts caused by low-quality candidate ideals. Therefore, if candidate ideals can be evaluated at a negligible cost before entering the computationally expensive stages, candidates with higher predicted success probabilities can be prioritized for evaluation. Such a strategy has the potential to transform a purely random retry process into a data-driven scheduling process, thereby reducing the expected computational cost. This observation provides the primary motivation for the lightweight ML scheduler proposed in this paper.

4.1. Algorithm Analysis

Before constructing the prediction model, we provide a more comprehensive analysis of the two algorithms, Algorithms 1 and 2, thereby establishing the theoretical foundation for subsequent feature selection and the ranking strategy design.

4.1.1. RandomEquivalentPrimeIdeal

The RandomEquivalentPrimeIdeal algorithm transforms an input ideal I into an equivalent ideal J with a small prime norm. Its mathematical principle is based on the Deuring correspondence: Through the mapping

$${\chi }_I\left(\beta \right)=I·{\displaystyle \frac{\beta }{\mathrm{nrd}\left(I\right)}},$$

(3)

an element $\beta \in I$ is converted into an equivalent ideal. If $\mathrm{nrd}\left(\beta \right)/\mathrm{nrd}\left(I\right)$ is prime, then the target ideal J is obtained.

Algorithm 1 RandomEquivalentPrimeIdeal(I).

Require: I, a left $\mathcal{O}$-ideal Ensure: $J\sim I$ of small prime norm, or failure   1: $\mathrm{counter}\leftarrow 0$   2: Compute LLL-reduced basis ${\alpha }_1,\dots ,{\alpha }_4$   3: while $\mathrm{counter}<{(2B+1)}^4$ do   4:       $\mathrm{counter}\leftarrow \mathrm{counter}+1$   5:       Sample $c_i\in [-B,B]$   6:       $\beta \leftarrow {\sum }_i{c}_i{\alpha }_i$   7:       $J\leftarrow {\chi }_I\left(\beta \right)$   8:       if $\mathrm{nrd}\left(J\right)$ is prime then   9:          return J 10:       end if 11: end while 12: return failure

The failure of this procedure arises from two primary factors. First, the quality of the LLL-reduced basis determines the achievable norm range of $\beta$, which directly influences the probability of obtaining a prime norm. Second, the search space is bounded by ${(2B+1)}^4$. When the value of B is fixed or constrained, some ideals may not admit any suitable $\beta$ within the bounded search space.

4.1.2. IdealToIsogeny

After obtaining a small prime-norm ideal, the IdealToIsogeny algorithm constructs the corresponding isogeny mapping. Using the “two-dimensional isogeny embedding” technique, it transforms an arbitrary odd-degree isogeny into a sequence of $(2,2)$-isogeny chains. The procedure can be divided into three stages:

• SuitableIdeals: Select short elements ${\beta }_1,{\beta }_2$ such that the corresponding degrees $d_1,d_2$ are coprime and satisfy $u{d}_1+v{d}_2=2^e$.
• FixedDegreeIsogeny: Construct the u-isogeny and v-isogeny, which relies on solving norm equations.
• Isogeny22Chain: Combine the above results into a $(2^e,2^e)$ two-dimensional isogeny and compute the final mapping.

Algorithm 2 RandomEquivalentPrimeIdeal(I).

Require: I, a left $\mathcal{O}$-ideal Ensure: $J\sim I$ of small prime norm, or failure   1: $\mathrm{counter}\leftarrow 0$   2: Compute the LLL-reduced basis ${\alpha }_1,\dots ,{\alpha }_4$   3: while $\mathrm{counter}<{(2B+1)}^4$ do   4:       $\mathrm{counter}\leftarrow \mathrm{counter}+1$   5:       Sample coefficients       $c_i\in [-B,B]$   6:       Compute       $\beta \leftarrow {\sum }_i{c}_i{\alpha }_i$   7:       Construct       $J\leftarrow {\chi }_I\left(\beta \right)$   8:       if $\mathrm{nrd}\left(J\right)$ is prime then   9:          return J 10:       end if 11: end while 12: return failure

This algorithm contains multiple sources of failure (see Figure 3), including failures in the SuitableIdeals search, failures in FixedDegreeIsogeny, and intermediate splitting failures in Isogeny22Chain (with probability $O(1/p)$). All these failure points are closely related to the algebraic structure of the input ideal I.

4.2. Optimization Motivation and Paradigm Shift

4.2.1. From Binary Classification to Learning-to-Rank

The preceding failure analysis raises a fundamental question: can the likelihood of success for a candidate ideal be estimated before entering the computationally expensive stages? The most direct approach is to train a binary classification model that makes a hard “valid/invalid” decision for each candidate ideal, thereby filtering out candidates with a high probability of failure before expensive computations are performed. However, experimental results reveal two fundamental limitations of this approach:

1.

Cost imbalance: Even if the model correctly identifies a candidate with a high probability of failure, the inference cost c has already been incurred. Improving prediction accuracy typically requires more informative features and more complex models, causing c to increase and potentially approach or even exceed the computation cost C of processing some successful candidates. Under such conditions, the prediction stage itself becomes a performance bottleneck, which contradicts the fundamental objective of using low-cost prediction to guide high-cost computation.

2.

Objective mismatch: The objective of this task is not to assign accurate labels to every candidate ideal but to identify a feasible candidate from a candidate set as quickly as possible. A binary classification model attempts to answer the question “Is this candidate valid?” In contrast, the practical objective is to determine “Which candidate should be evaluated first?” Learning-to-rank directly optimizes the relative ordering of candidates and therefore is better aligned with the objective of the scheduling task.

Based on these observations, this work shifts the deployment paradigm from absolute classification to relative ranking. During offline training, a weighted logistic regression model is fitted using binary success labels, whereas during online deployment, the resulting scores are used to rank candidate ideals (Rank-ML) without optimizing a pairwise ranking loss. Candidate ideals with the highest predicted scores are evaluated first. Once a candidate successfully completes the procedure, the retry process terminates immediately, and the remaining lower-ranked candidates are not evaluated.

4.2.2. Theoretical Foundation for Machine Learning Integration

The introduction of ML into isogeny mapping scheduling is based on two key observations. First, when feature variation exists across candidate ideals, observable number-theoretic features can correlate with the outcome of isogeny construction and therefore serve as low-cost proxy variables. This observation is validated on synthetic data, whereas under a fixed commitment degree, the live deployment exhibits no discriminative capability (AUC $=0.50$). Second, the cost of feature extraction and model inference, denoted by c, is approximately ${10}^2$ CPU cycles per candidate, which is substantially lower than the cost of a single IdealToIsogeny attempt, denoted by C, at approximately ${10}^6$ CPU cycles. Therefore, the proposed framework satisfies the principle of “low-cost prediction guiding high-cost decisions.”

When an informative online ranking signal is available and the expected reduction in retry cost exceeds the inference overhead, the scheduling strategy can provide a positive net performance benefit. However, under the current deployment with a fixed commitment degree, the remeasured ablation results show that learned candidate ordering does not produce measurable performance improvements.

4.3. Scheme Design and Feature Engineering

Based on the preceding analysis, this paper proposes a lightweight learning-to-rank scheduling framework. The design is guided by two fundamental constraints. First, the overhead of feature extraction and model inference must satisfy $c\ll C$, where c denotes the prediction cost and C denotes the cost of a single isogeny attempt. Second, the scheduling strategy is designed to prioritize candidates with higher predicted success probabilities so as to reduce the expected cumulative computational cost by minimizing unsuccessful attempts.

4.3.1. Feature Selection

To ensure extremely low inference overhead, this work employs only two lightweight number-theoretic features that can be extracted in $O\left(1\right)$ time from the ideal structure (

Table 1. Lightweight number-theoretic features adopted in practice.

Feature Name	Symbol	Extraction Method
Norm bit length	$l=\lfloor {log}_2\left(\mathrm{nrd}\left(I\right)\right)\rfloor$	Read after ideal generation
Trace parity	$\mathrm{tr}\left(I\right)mod2$	Read after ideal generation

):

• Norm bit length $l=\lfloor {log}_2\left(\mathrm{nrd}\left(I\right)\right)\rfloor$: This feature measures the magnitude of the ideal norm. Values that are excessively small or large may reduce the probability of obtaining an equivalent prime-norm ideal within the bounded search space, thereby affecting the success rate of RandomEquivalentPrimeIdeal.
• Trace parity $\mathrm{tr}\left(I\right)mod2$: In the arithmetic of quaternion orders, trace parity is associated with the structural properties of quaternion elements, including invertibility and membership in particular sublattices. These properties may influence the selection of short elements during the execution of SuitableIdeals.

The final feature vector is defined as $\mathbf{x}={[x_1,x_2,1]}^{\top }$, where $x_1$ denotes the normalized norm bit length and $x_2$ denotes trace parity (Table 1). No additional features, including kernel-order parity, ${\mathrm{val}}_2\left(\mathrm{nrd}\left(I\right)\right)$, or any other engineered feature, are used during either training or deployment.

The statistical correlation analysis and AUC results are obtained from the synthetic feature-learning dataset, in which norm bit length and trace parity are intentionally varied across candidate ideals. In contrast, under instrumented live SQIsign execution with a fixed commitment degree, both features remain nearly constant, resulting in a live logistic regression AUC of $0.50$. Therefore, these two features should be regarded as candidate predictors whose effectiveness depends on the feature variation introduced by the commitment sampling stage. They are validated under controlled offline conditions with engineered feature variation but do not provide a discriminative capability for live candidate ideals generated under a fixed $\mathrm{COM}\_\mathrm{DEGREE}$.

4.3.2. Learning-to-Rank Model

The model adopts logistic regression to map Z-score-normalized feature vectors into success-probability scores, $\mathrm{prob}\in [0,1]$. Offline training uses weighted maximum-likelihood estimation on binary success labels as follows:

$$\mathcal{L}\left(\mathbf{w}\right)={\displaystyle \sum _{i=1}^N}\left[\alpha y_{i}logp\left({\mathbf{x}}_i\right)+(1-y_i)log(1-p\left({\mathbf{x}}_i\right))\right],$$

(4)

where $y_i\in \{0,1\}$ denotes whether candidate $I_i$ completes the commitment attempt (RandomEquivalentPrimeIdeal followed by IdealToIsogeny), $p\left({\mathbf{x}}_i\right)=\sigma \left({\mathbf{w}}^{\top }{\mathbf{x}}_i\right)$, and $\alpha =N_{\mathrm{neg}}/N_{\mathrm{pos}}$ balances the heavily imbalanced dataset. At signing time, the same scorer is deployed as a learning-to-rank scheduler: candidates are sorted by $p\left({\mathbf{x}}_i\right)$ and attempted sequentially until the first success.

During training, the model optimizes a weighted binary logistic objective using maximum likelihood estimation (MLE) on commitment success labels. During deployment, the learned scores are used exclusively for relative ordering: candidate ideals are ranked according to their predicted success scores and evaluated sequentially until the first successful candidate is found (Rank-ML). No pairwise ranking loss is used during training. Therefore, the term “learning-to-rank” refers exclusively to the online scheduling strategy rather than to the training objective.

The linear structure of the logistic regression model ensures that online inference requires only two multiplications and one addition, thereby satisfying the inference overhead budget of approximately ${10}^2$ CPU cycles.

The model parameters are optimized offline using L-BFGS. The learned parameters, together with the feature normalization parameters, are then embedded directly into the signing implementation as C-language macros, ensuring that online inference introduces neither external dependencies nor additional runtime initialization overhead.

4.4. Workflow Analysis

The optimized Deuring-correspondence workflow is illustrated in Figure 4. The proposed learning-to-rank scheduler is inserted after RandomIdealGivenNorm and before the computationally expensive RandomEquivalentPrimeIdeal–IdealToIsogeny pipeline, where it ranks candidate ideals before the expensive algebraic computations begin.

During the random sampling stage, candidate ideals are first generated by RandomIdealGivenNorm. Rather than forwarding each candidate immediately to the subsequent expensive procedures, the scheduler first extracts two lightweight features, namely the norm bit length and trace parity, and computes a predicted success score using the pretrained logistic regression model.

The candidate ideals are then ranked in descending order of their predicted scores and processed sequentially. Each candidate is first passed to RandomEquivalentPrimeIdeal and, if successful, subsequently to IdealToIsogeny for isogeny construction. As soon as one candidate successfully completes the entire procedure, the current retry round terminates, and the remaining candidates are discarded without further evaluation.

When informative feature variation exists during online deployment, this integration strategy provides two potential advantages. First, it can reduce unnecessary high-cost computations by postponing the evaluation of lower-ranked candidates. Second, ranking-based sequential evaluation can shorten the expected search path within a candidate batch compared with random ordering. However, under the current deployment with a fixed commitment degree, the remeasured ablation results show that learned candidate ordering does not produce measurable performance improvements. Nevertheless, the framework integrates cleanly into the existing signing pipeline and is validated on synthetic data with engineered feature variation.

4.5. Online Scheduling and Complexity Analysis

The formal objective of the scheduling strategy is to minimize the expected cumulative computational cost. Let C denote the computational cost of a complete IdealToIsogeny attempt, and let c denote the cost of feature extraction and model inference, where $c\ll C$. Define the success efficiency per unit cost of a candidate ideal as

$$U\left(I\right)={\displaystyle \frac{P(Y=1\mid I)}{C\left(I\right)}}.$$

(5)

The scheduler should therefore prioritize candidates with larger values of $U\left(I\right)$.

Since $C\left(I\right)$ is approximately constant within the same stage, the problem reduces to learning a ranking over $P(Y=1\mid I)$, as follows:

$$f\left(I_i\right)>f\left(I_j\right)\Rightarrow U\left(I_i\right)>U\left(I_j\right).$$

(6)

Assume that the average success probability of the candidates under the original random strategy is p. After introducing ranking-based scheduling, let the average success probability of the top-k candidates satisfy $p_{\mathrm{top}}>p$. Then, the expected number of attempts and the expected execution time become

$$\mathbb{E}\left[{\tau }^{\prime }\right]={\displaystyle \frac{1}{p_{\mathrm{top}}}}<{\displaystyle \frac{1}{p}},\mathbb{E}\left[T^{\prime }\right]={\displaystyle \frac{C}{p_{\mathrm{top}}}}.$$

(7)

In each round, the system generates K candidate ideals, extracts features, computes ranking scores, and then sequentially invokes IdealToIsogeny according to the resulting priority order. Once a candidate succeeds, the algorithm immediately returns the result.

Inference overhead analysis: The cost of a single feature extraction and model inference is approximately ${10}^2$ CPU cycles. Therefore, the total inference overhead for K candidates is approximately

$$K·c\approx {10}^3\mathrm{cycles},$$

which remains substantially lower than the cost of a single failed IdealToIsogeny attempt ($C\approx {10}^6$ cycles). Setting $K=10$ matches the batch size used in Rank-ML and Batch-only ablation.

5. Experimental Design and Result Analysis

5.1. Signing Commitment Scheduling

To reduce the computational cost of the subsequent ideal-equivalence transformation and isogeny construction during signing, this work introduces a candidate-ideal scheduling framework based on lightweight features and learning-to-rank in the Commitment stage. When informative feature variation exists across the candidate ideals, the framework evaluates each initial candidate at a negligible cost and prioritizes candidates according to their predicted success probabilities. Under the current deployment with a fixed commitment degree, this discriminative signal disappears. The overall procedure is summarized as follows:

1.

Feature extraction: For each sampled commitment candidate ideal $I_{\mathrm{com}}$, two lightweight number-theoretic features are extracted: the norm bit length $\ell \left(\mathrm{nrd}\left(I_{\mathrm{com}}\right)\right)$ and the trace parity $\mathrm{tr}\left(I_{\mathrm{com}}\right)mod2$. Both features can be computed in $O\left(1\right)$ time.

2.

Ranking prediction: The extracted features are provided as input to a pretrained weighted logistic regression model, which produces a predicted success score $p\in [0,1]$. This score estimates the probability that the candidate ideal will successfully complete the subsequent RandomEquivalentPrimeIdeal and IdealToIsogeny procedures.

3.

Adaptive scheduling: In Rank-ML, a batch of candidate ideals is ranked according to p and evaluated sequentially until the first successful candidate is found. In Binary-ML, candidate ideals with $p<\tau$ (typically $\tau =0.5$) are discarded before entering the computationally expensive stages.

The optimized Commitment workflow follows the principle of using low-cost prediction to guide computationally expensive decisions. A single model inference requires only approximately ${10}^2$ CPU cycles, whereas one failed ideal-to-isogeny conversion incurs a computational cost of approximately ${10}^5$–${10}^6$ CPU cycles.

When informative feature variation exists across candidate ideals, the probability of successful isogeny construction can correlate with the norm bit length and trace parity. Under the current deployment with a fixed commitment degree, however, these features remain constant across candidates, and this relationship cannot be identified from live execution data. Formally, we model

$$Pr\left[\mathtt{IdealToIsogeny}\left(I\right)\mathrm{succeeds}\right]=f\left(\ell \left(\mathrm{nrd}\right(I\left)\right),\mathrm{tr}\left(I\right)mod2\right)$$

(8)

and fit f on synthetic data where variance is engineered.

The pipeline is validated through the following steps:

1.

Live instrumentation records commitment retry statistics (failure rates and attempt counts per signing session). When live features lack variance, a synthetic session-structured dataset supplies supervised labels for offline training.

2.

A weighted logistic regression model is trained on the synthetic dataset $\mathcal{D}$ such that successful samples receive higher predicted probabilities than failed samples on the held-out test split.

3.

During online deployment, a priority-queue scheduling strategy computes scores for a batch of candidate ideals and attempts them sequentially in descending score order until the first success.

The evaluation is organized into three complementary components: live bottleneck characterization, synthetic feature validation, and a remeasured four-way scheduler ablation. Under the current deployment with a fixed commitment degree, the remeasured signing experiments show that learned candidate ordering does not reduce either the number of unsuccessful attempts or the end-to-end signing latency. The Baseline configuration remains the fastest at a batch size of 10.

The proposed model does not modify the underlying cryptographic algorithms. Instead, it changes only the order in which candidate ideals are evaluated when informative score differences exist across candidates. Because such reordering may alter the timing distribution of the signing procedure, the associated timing side-channel implications are analyzed explicitly in Section 5.3.8 rather than being excluded by assumption.

5.2. Comparison Schemes and Evaluation Metrics

To fairly evaluate the incremental benefits introduced by ML-based scheduling, all schemes are tested under the same hardware and compilation environment as follows:

• Baseline (Random): The original blind-search strategy, which randomly samples ideals until success without applying any filtering mechanism.
• Binary-ML: Uses the same logistic regression model to output a probability p, with a threshold $\tau =0.5$. Candidates satisfying $p<\tau$ are discarded directly. This scheme represents the conventional binary-classification approach.
• Batch-only ($K=10$): Pre-samples a batch of ten candidates per round and attempts them in generation (FIFO) order without score-based reordering. This control isolates batch overhead from learned ordering.
• Rank-ML (Ours): The learning-to-rank and priority-queue scheduling method proposed in this work.

Evaluation metrics include wall-clock signing time, prime-trial counts, commit rounds, and candidate attempts.

5.3. Offline Training Pipeline

To enable the scheduling model to produce reproducible estimates of the success probability of each candidate ideal, this work adopts an offline supervised learning approach to train a lightweight logistic regression model. The training pipeline consists of four stages: data collection, feature processing, model training, and parameter export.

5.3.1. Data Collection

We distinguish four experimental data categories in this revision, each with an explicit label in the text and tables: live (instrumented SQIsign running on Apple M2), synthetic (session-structured CSV generated for feature learning when live features lack variance), measured (historical end-to-end signing benchmarks on Apple M2), and proxy (Monte Carlo ablation calibrated to measured baseline cost). The live and measured results must not be numerically compared to the proxy simulations.

Two datasets feed the training pipeline.

(i) Live commitment-statistics logs (live). We instrument the SQIsign Commitment loop on Apple M2 and record one row per candidate ideal attempt (sample → RandomEquivalentPrimeIdeal → IdealToIsogeny). During instrumentation only, primality search is bounded by a trial cap of 22 so that candidate-level failures are observable; this cap is not used in the signing benchmarks. This reproduces the heavy-tailed retry statistics of the Commitment loop on Apple M2. At NIST-I, 20,000 live rows (seed 42) yield an 86.4% candidate failure rate and 7.36 mean attempts per session; at NIST-III, 5000 supplementary rows (same cap and seed) yield 91.0% failure and 11.06 attempts per session. In both parameter sets, IdealToIsogeny failures are not observed under this instrumentation, and norm bit length and trace parity remain nearly constant within each level because the commitment degree is fixed per security level. Rank-ML signing was functionally verified at NIST-I and NIST-III before benchmarking; historical Mcycle comparisons are reported in Appendix B only.

(ii) Feature-learning dataset (synthetic). Because live logs at a fixed commitment degree lack feature variance, supervised feature validation uses a session-structured synthetic dataset (20,000 rows, 10% positive rate on the train split after session-wise 80/20 partitioning, seed 42) fitted with weighted logistic regression. Table 2 summarizes live retry statistics. For each commitment attempt, the logged fields are summarized in Table 3.

Table 2. Live commitment candidate statistics (live data; instrumented collection, trial cap 22, seed 42, Apple M2).

Metric	NIST-I (lvl1)	NIST-III (lvl3)	Reference
Rows collected	20,000	5000	—
Candidate failure rate	86.4%	91.0%	≈85%
Mean attempts per session	7.36	11.06	—
Norm bit length (unique values)	512 (1)	768 (1)	—
Trace parity (unique values)	0 only	0 only	—
IdealToIsogeny failures	0	0	discussed theoretically
Live logistic AUC	0.50	0.50	—

Notes: All entries are live measurements from instrumented commitment logging on Apple M2. Mean attempts per session counts candidate rows under instrumentation trial cap 22; remeasured ablation “candidate attempts” in Table 4 uses a different end-to-end signing counter and is not directly comparable. Lvl3 confirms the same constant-feature behavior as lvl1. Measured signing latencies: primary remeasured ablation in Table 4; historical Mcycles in Appendix B.

Table 2. Live commitment candidate statistics (live data; instrumented collection, trial cap 22, seed 42, Apple M2).

Metric	NIST-I (lvl1)	NIST-III (lvl3)	Reference
Rows collected	20,000	5000	—
Candidate failure rate	86.4%	91.0%	≈85%
Mean attempts per session	7.36	11.06	—
Norm bit length (unique values)	512 (1)	768 (1)	—
Trace parity (unique values)	0 only	0 only	—
IdealToIsogeny failures	0	0	discussed theoretically
Live logistic AUC	0.50	0.50	—

Notes: All entries are live measurements from instrumented commitment logging on Apple M2. Mean attempts per session counts candidate rows under instrumentation trial cap 22; remeasured ablation “candidate attempts” in Table 4 uses a different end-to-end signing counter and is not directly comparable. Lvl3 confirms the same constant-feature behavior as lvl1. Measured signing latencies: primary remeasured ablation in Table 4; historical Mcycles in Appendix B.

Table 3. Summary of candidate-ideal log fields.

Feature Name	Symbol	Extraction Method
Attempt index	$attempt\_id$	Identified during each signing attempt
Norm bit length	$l=\lfloor {log}_2\left(\mathrm{nrd}\left(I\right)\right)\rfloor$	Read after ideal generation
Trace parity	$\mathrm{tr}\left(I\right)mod2$	Read after ideal generation
Success flag	$success$	Indicates whether the candidate completes both RandomEquivalentPrimeIdeal and IdealToIsogeny in one attempt (label used for offline training)

Table 3. Summary of candidate-ideal log fields.

Feature Name	Symbol	Extraction Method
Attempt index	$attempt\_id$	Identified during each signing attempt
Norm bit length	$l=\lfloor {log}_2\left(\mathrm{nrd}\left(I\right)\right)\rfloor$	Read after ideal generation
Trace parity	$\mathrm{tr}\left(I\right)mod2$	Read after ideal generation
Success flag	$success$	Indicates whether the candidate completes both RandomEquivalentPrimeIdeal and IdealToIsogeny in one attempt (label used for offline training)

Table 4. Remeasured four-way scheduler ablation (NIST-I, Apple M2, $n=100$, seed 42). Wall-clock signing time uses CLOCK_MONOTONIC; Mcycle counters are unavailable without elevated privileges on this platform. “Candidate attempts” counts successful commitment batches per signing session in the benchmark build (no instrumentation trial cap); the live “attempts per session” in Table 2 uses a different counting protocol.

Method	Sign Time (ms)	Prime Trials	Commit Rounds	Candidate Attempts
Baseline (Random)	$75.8\pm 14.5$	$145.5\pm 147.2$	$1.0\pm 0.0$	$1.0\pm 0.0$
Binary-ML	$79.2\pm 18.6$	$171.6\pm 176.7$	$1.0\pm 0.0$	$1.0\pm 0.0$
Batch-only ($K=10$)	$104.1\pm 14.2$	$167.8\pm 170.1$	$1.0\pm 0.0$	$1.0\pm 0.0$
Rank-ML (Ours)	$104.2\pm 19.9$	$156.0\pm 134.6$	$1.0\pm 0.0$	$1.0\pm 0.0$

Table 4. Remeasured four-way scheduler ablation (NIST-I, Apple M2, $n=100$, seed 42). Wall-clock signing time uses CLOCK_MONOTONIC; Mcycle counters are unavailable without elevated privileges on this platform. “Candidate attempts” counts successful commitment batches per signing session in the benchmark build (no instrumentation trial cap); the live “attempts per session” in Table 2 uses a different counting protocol.

Method	Sign Time (ms)	Prime Trials	Commit Rounds	Candidate Attempts
Baseline (Random)	$75.8\pm 14.5$	$145.5\pm 147.2$	$1.0\pm 0.0$	$1.0\pm 0.0$
Binary-ML	$79.2\pm 18.6$	$171.6\pm 176.7$	$1.0\pm 0.0$	$1.0\pm 0.0$
Batch-only ($K=10$)	$104.1\pm 14.2$	$167.8\pm 170.1$	$1.0\pm 0.0$	$1.0\pm 0.0$
Rank-ML (Ours)	$104.2\pm 19.9$	$156.0\pm 134.6$	$1.0\pm 0.0$	$1.0\pm 0.0$

Figure 5 visualizes the live failure rate and retry count differences between NIST-I and NIST-III.

Table 5. Illustrative live commitment log at NIST-I.

Session_Id	Attempt_Id	Norm_Bitlength	Trace_Parity	Success
1	0	512	0	0
1	1	512	0	0
1	2	512	0	0
1	3	512	0	0
1	4	512	0	0
1	5	512	0	1
2	0	512	0	1

Notes: Each row denotes one candidate ideal attempt within a signing session. success = 1 indicates that the candidate completes both RandomEquivalentPrimeIdeal and IdealToIsogeny in that attempt; success = 0 indicates failure at the commitment-candidate level (predominantly during bounded primality search during data collection).

presents an illustrative fragment of the live commitment log, containing both failed and successful candidate attempts within one signing session. Supervised model fitting uses the synthetic feature-learning dataset described in part (ii); live logs validate retry statistics rather than feature discriminability.

Live statistics (Table 2 and Figure 5) show that most candidate failures originate from RandomEquivalentPrimeIdeal under bounded primality search, while the overall retry rate matches the ≈85% candidate failure level discussed in Section 2 at both NIST-I and NIST-III. Table 5 illustrates the resulting class imbalance through mixed success/fail rows at NIST-I. The feature-learning metrics (

Table 6. Predictive validation of commitment ideal features (synthetic dataset, test split; session-wise 80/20 split, seed 42).

Metric	Value	Interpretation
Distribution and basic correlations
Positive rate (train)	0.100	Class imbalance in commitment attempts
Norm bit length correlation	0.122	Point-biserial correlation with success
Trace parity correlation	0.066	Point-biserial correlation with success
Predictive performance
Test AUC	0.634	Discrimination of weighted logistic scorer
Top-quantile success rate	0.179	Success rate in highest-score quantile (Q5)
Low-quantile success rate	0.051	Success rate in lowest-score quantile (Q1)

) are synthetic; the live logs at either security level are insufficient for logistic feature learning because norm bit length and trace parity are nearly constant when the commitment degree is fixed. In the subsequent training stage, success labels from the synthetic dataset are used to fit the weighted logistic scorer that guides the online Rank-ML scheduling strategy.

5.3.2. Feature Preprocessing

The two raw features exhibit different scales and distributions. This work applies Z-score normalization to the norm bit length feature as follows:

$$x_1={\displaystyle \frac{l-{\mu }_l}{{\sigma }_l}},$$

(9)

where ${\mu }_l$ and ${\sigma }_l$ denote the mean and standard deviation of the norm bit length in the training dataset, respectively.

The trace parity is a discrete binary variable in $\{0,1\}$ and is directly used as the feature $x_2$. The final feature vector is therefore defined as

$$\mathbf{x}={[x_1,x_2,1]}^{\top }$$

(10)

where the constant term 1 corresponds to the bias term.

5.3.3. Model Training

This work adopts a linear logistic regression model whose output probability is given by

$$p\left(\mathbf{x}\right)={\displaystyle \frac{1}{1+e^{-{\mathbf{w}}^{\top }\mathbf{x}}}},$$

(11)

where $\mathbf{w}\in {\mathbb{R}}^3$ denotes the learnable weight vector.

The training objective is to maximize the log-likelihood function as follows:

$$\mathcal{L}\left(\mathbf{w}\right)={\displaystyle \sum _{i=1}^N}\left[\alpha y_{i}logp\left({\mathbf{x}}_i\right)+(1-y_i)log(1-p\left({\mathbf{x}}_i\right))\right],$$

(12)

where $y_i\in \{0,1\}$ denotes the ground-truth label of the i-th sample.

The optimal weight vector ${\mathbf{w}}^{\ast }$ is obtained using the L-BFGS optimization algorithm. To address the class-imbalance issue, a weighting factor

$$\alpha ={\displaystyle \frac{N_{\mathrm{neg}}}{N_{\mathrm{pos}}}}$$

(13)

is assigned to positive samples so as to balance the contributions of the two classes to the loss function.

5.3.4. Weight Export

After training is completed, the learned weights ${\mathbf{w}}^{\ast }$ together with the normalization parameters $({\mu }_l,{\sigma }_l)$ are hard-coded into the SQIsign source code in the form of C-language macros. During online inference, for each newly generated candidate ideal, the corresponding features are extracted and the score is computed according to the following equations:

$$\begin{array}{cc}\hfill \mathrm{score}& =w_0·{\displaystyle \frac{{log}_2\left(\mathrm{norm}\right)-\mu }{\sigma }}+w_1·(\mathrm{trace}mod2)+w_2,\hfill \\ \hfill \mathrm{prob}& ={\displaystyle \frac{1}{1+exp(-\mathrm{score})}}.\hfill \end{array}$$

(14)

The resulting probability value $\mathrm{prob}$ is then used as the scheduling priority for candidate ideals during the online ranking process.

5.3.5. Feature Predictive Validation

To verify that the two selected features carry a predictive signal rather than random noise, we report point-biserial correlations on the training split, test set AUC, and success rates by predicted-probability quantile on the synthetic feature-learning dataset (part (ii) above). The results are summarized in Table 6 and Figure 6. Although the features are coarse, they exhibit a statistically meaningful correlation with commitment success and produce monotonic top-k success rates after ranking.

5.3.6. Reproducibility Protocol

Our experimental design separates four stages with distinct evidential roles: live retry-statistics collection, synthetic feature learning and model fitting, measured signing benchmarks, and Monte Carlo ablation proxies.

Table 7. Four-layer experimental evidence framework used throughout this study. Each layer serves a distinct evidential purpose: live data characterize deployment behavior, synthetic data validate feature predictiveness, measured experiments evaluate implementation performance, and proxy analysis isolates scheduling effects. Results from different layers are reported separately and are not compared numerically across layers.

Evidence Layer	Purpose	Method	Configuration
Live	Characterize deployment behavior.	Instrumented SQIsign commitment logging; collected retry counts, failure rates, and feature distributions.	Apple M2; trial cap 22; NIST-I: 20,000 attempts; NIST-III: 5000 attempts; seed 42.
Synthetic	Validate feature predictiveness under controlled feature variance.	Session-structured dataset generation; weighted logistic regression training; feature validation.	20,000 samples; 10% train-split positive rate; session-wise 80/20 split; seed 42.
Measured	Evaluate implementation-level performance.	Historical signing benchmarks; remeasured scheduler ablation (Baseline, Binary-ML, Batch-only, Rank-ML).	Apple M2; Clang 17 (-O3); 10 benchmark runs; ablation $n=100$ sessions.
Proxy	Analyze scheduling effects independently of implementation artifacts.	Monte Carlo simulation calibrated to measured baseline costs.	Baseline anchor cost: 207.085 Mc.

and 

Table 8. Mapping of experimental evidence to claims (live, synthetic, remeasured, proxy).

Stage	Type	What Varies?	Supported Claim
Live collection	live	Retry counts; constant norm/trace	Failure rate ≈86%; AUC $=0.50$
Synthetic training	synthetic	Engineered feature variance	AUC $\approx 0.634$; quantile monotonicity
Rank-ML binary	remeasured	Real scheduler code + synthetic weights	Functional signing; degenerate ranking at fixed degree
Four-way ablation	remeasured	Baseline/Binary/Batch/Rank	Rank ≈ Batch; Baseline fastest (ms)
Historical benchmark	measured (historical)	Earlier Mcycle integration	Retained in Appendix B only
MC ablation	proxy	Simulated scheduling dynamics	Relative tail behavior only

summarize each stage together with its random seed, sample size, platform, and the table or figure where the results are reported. Live and proxy results are never numerically compared to measured signing latencies.

Live data collection. On Apple M2, we enable commitment-stage instrumentation and log every candidate ideal attempt together with its norm bit length, trace parity, and success label. At NIST-I, we collect 20,000 attempts (seed 42); at NIST-III, we collect 5000 supplementary attempts under the same settings. The resulting failure rates and mean attempts per session are summarized in Table 2 and Figure 5.

Synthetic training and deployment. When live features lack variance, model training and feature validation rely on the synthetic pipeline in Table 6 and Table 7. The fitted coefficients used in this revision are $w_0=0.418$, $w_1=0.465$, $w_2=-0.321$, ${\mu }_l=61.520$, and ${\sigma }_l=1.236$, and are hard-coded into the Rank-ML signing implementation.

Benchmarks and ablation. Table 4 reports the primary remeasured four-way ablation under the current implementation, including a Batch-only control with an identical batch size but no score-based ordering. Historical end-to-end Mcycle measurements from an earlier integration pass are relegated to Appendix B and are explicitly labeled as not reproduced. Monte Carlo ablation in

Table 9. Ablation results of different scheduling strategies.

Method	Commit & Latency Metrics						Scheduling Behavior
	Mean Commits	Std Commits	Mean Forwards	Proxy (Mc)	Std (Mc)	P90 (Mc)	Mean Rounds	Std Rounds
Baseline (Random)	3.511	2.978	0	207.085	175.648	412.865	3.511	2.978
Binary-ML ($\tau =0.5$)	1.384	0.730	4.387	81.746	43.089	118.235	4.387	3.818
Rank-ML (Ours, $K=10$)	1.560	2.060	10.355	92.247	121.553	118.210	1.036	0.192

Remark: The Binary-ML and Rank-ML rows are obtained through Monte Carlo simulation (proxy) and calibrated using an earlier Baseline signing-cost anchor (207.085 Mc). The proxy column models relative scheduling cost under the simulation assumptions; it is not a remeasurement of Table 4 and must not be read as evidence for live deployment ranking benefit.

reports proxy scheduling behavior metrics only and must not be compared numerically to remeasured signing latency.

Deployment degeneracy check. On 1000 commitment ideals sampled at NIST-I, the deployed scorer assigns a single distinct success probability (unique_probs $=1$, prob_stddev $=0$), confirming that online ranking collapses when norm bit length and trace parity are constant.

Scope and limitations. Measured latency claims must distinguish historical Mcycle tables from remeasured wall-clock ablation; live data establish retry statistics but not feature discriminability; and synthetic data support feature validation only under engineered variance. Extension to richer features, different insertion points, additional parameter sets, and constant-time side-channel hardening are left for future work.

5.3.7. Limitations

1.

Fixed commitment degree. SQIsign samples commitment ideals at a protocol-fixed norm, so the selected features are constant in live deployment and provide no online ranking signal (live AUC $=0.50$).

2.

Training–deployment mismatch. Model weights are fit on synthetic feature distributions (${\mu }_l\approx 61.5$) that do not match the live norm bit length (512 at NIST-I). With live features $(l,\mathrm{tr})=(512,0)$ and deployed coefficients ($w_0=0.418$, $w_1=0.465$, $w_2=-0.321$, ${\mu }_l=61.520$, ${\sigma }_l=1.236$), the normalized input is $x_1=(512-{\mu }_l)/{\sigma }_l\approx 364.4$ and $x_2=0$, yielding an identical score $\approx 0.418\times 364.4-0.321$ for every candidate; qsort then breaks ties via generation index (FIFO within each batch).

3.

Batch overhead. Rank-ML and Batch-only pre-sample ten candidates per round; under degenerate ranking, this adds wall-clock overhead relative to Baseline without demonstrating a learned ordering benefit.

4.

Historical vs. remeasured benchmarks. Appendix B and

Table A2. Reconciliation of NIST-I signing Mcycle figures (Apple M2). Each row uses a different benchmark protocol; cross-row numerical comparison is invalid unless explicitly remeasured under one protocol.

Label	Table	Sign (Mc)	Protocol Summary
B	Table 10	121.623	Standard SQIsign ref signing: benchmark_lvl1, no ML scheduler, perf counter (sudo), $n=10$. Contextual platform baseline only.
C	Eng. note	127.464 (Baseline)/121.635 (Rank)	Paired ML-integration builds on the same branch: Baseline vs. Rank-ML scheduler mode, benchmark_lvl1, sudo perf counter, $n=10$, seed documented in repository note. Internally pairwise comparable; ≈4.6% gap, not 35.7%.
A	Table A3	189.2 (Baseline)/121.6 (Rank)	Early scheduler-comparison campaign: reports mean attempts (6.8/3.1) alongside Mcycles; build and averaging path differ from Protocols B–C (instrumentation/integration snapshot). Retained for transparency only; not reproduced and not numerically comparable to 127.5 or 121.6 Mc rows without remeasurement.
Primary (2025)	Table 4	75.8–104.2 (ms)	Remeasured four-way ablation: wall-clock (CLOCK_MONOTONIC), $n=100$, seed 42; Mcycles unavailable without sudo on remeasure host.

Notes: (1) 121.623 Mc (B) matches standard optimized SQIsign signing and is almost identical to historical Rank-ML 121.6 Mc (A), reinforcing that Table A3 must not be read as isolated ML speedup over an optimized baseline. (2) 189.2 Mc (A) and 127.5 Mc (C) differ because they come from different integration snapshots and benchmark definitions, not because the same binary was re-run. (3) Live retry collection reports 7.36 mean attempts per session; Table A3 attempt columns (6.8/3.1) use yet another counting protocol and are likewise not reproduced in Table 4.

document three incompatible Mcycle protocols (121.623/≈127.5/189.2 Mc); Table 4 is the primary remeasured scheduler comparison.

5.3.8. Security Discussion

Signature semantics. The scheduler does not modify SQIsign signature semantics: verification equations, message hashing, and key material are unchanged. Only the order in which commitment candidates are attempted may change.

Public versus secret-dependent variables. The scheduling features (norm bit length and trace parity) are computed from pseudorandomly sampled commitment ideals and their observable number-theoretic invariants, not directly from private-key bits. Nevertheless, failure events in RandomEquivalentPrimeIdeal and IdealToIsogeny depend on the sampled ideal and on protocol randomness, so total signing time can correlate with unobservable outcomes even when individual feature values appear public.

Timing and side-channels. Reordering, filtering, and early termination change runtime distributions, branch behavior, and memory-access patterns in the Commitment loop. Rank-ML early termination may leak which candidate index first succeeds through timing; Binary-ML hard filtering may leak discard decisions when candidates are skipped before expensive stages. We therefore treat timing side-channel resistance as an open engineering question rather than as a property inherited from unchanged verification logic. Both Rank-ML and Binary-ML would require constant-time scheduling engineering in high-assurance deployments; a formal constant-time analysis remains future work.

5.4. Experimental Setup

The proposed implementation is evaluated end-to-end on a 64-bit ARM platform. The test environment comprises an Apple M2 CPU (nominal frequency 3.5 GHz) running macOS 15.6. All schemes are compiled with Clang 17 using optimization flags -O3 -march = native. To fairly evaluate the incremental benefits introduced by machine learning-based scheduling, all schemes are tested under the same hardware and compilation environment. In addition, all underlying arithmetic operations are accelerated using NEON vectorization.

The following comparison schemes are included in the evaluation:

• Baseline (Random): The original blind-search strategy, which randomly samples candidate ideals until success without introducing any filtering or ranking mechanism.
• Binary-ML: Uses the same logistic regression model as Rank-ML to predict success probabilities, with a threshold $\tau =0.5$. Candidates with predicted probabilities below the threshold are discarded directly. This scheme represents the conventional binary-classification approach.
• Batch-only ($K=10$): Pre-samples ten candidates per round and attempts them in generation (FIFO) order without score-based reordering, isolating batch overhead from learned ordering.
• Rank-ML (Ours): The learning-to-rank and priority-queue scheduling strategy proposed in this work. In each round, a batch of candidate ideals is generated, ranked in descending order according to their predicted scores, and then attempted sequentially until a successful candidate is found.

5.4.1. Baseline Performance Evaluation

Figure 7 presents a visual summary of the computational costs of key generation, signing, and verification under the three NIST parameter sets (reported for standard SQIsign context only; the proposed scheduler is evaluated only on Commitment-stage scheduling during signing, not on key generation). The corresponding numerical results are reported in

Table 10. Performance of SQIsign on Apple M2 (Megacycles). Protocol B in Appendix B (Table A2): standard benchmark_lvl1, no ML scheduler, Apple perf counter with elevated privileges, 10 runs, Clang 17, -O3. Not comparable to historical 189.2 Mc baseline in Table A3.

Parameter Set	Key Generation (Mc)	Signing (Mc)	Verification (Mc)
NIST-I	52.021	121.623	8.488
NIST-III	159.550	329.944	23.874
NIST-V	246.784	601.630	48.598

.

5.4.2. Remeasured Scheduler Ablation (Primary Results)

Table 4 and Figure 8 report the primary remeasured four-way scheduler comparison at NIST-I on Apple M2 ($n=100$ signing runs, seed 42, batch size 10). Under the current fixed-commitment-degree deployment, all modes complete signing in a single commitment round on average ($\overline{\mathrm{commit}\_\mathrm{rounds}}=1.0$), so the historical attempt reduction from 6.8 to 3.1 documented in Appendix B is not reproduced and must not be interpreted as a consequence of the live feature AUC.

The remeasured ablation shows three consistent patterns. First, Rank-ML is statistically indistinguishable from Batch-only in wall-clock signing time (104.2 ms vs. 104.1 ms) and in mean candidate attempts ($1.0$), confirming that online ranking adds no measurable benefit once deployment scores collapse to a constant (unique_probs $=1$). Second, Baseline remains fastest (75.8 ms ± 14.5 ms) because its batch pre-sampling of ten candidates per round introduces overhead that outweighs any benefit from learned ordering. Third, the prime-trial counts (≈146–172 per signing session) align with live instrumentation (≈151), validating that the benchmark captures the same retry-heavy commitment path even when ML ranking is inactive.

Historical Mcycle measurements from an earlier integration pass (Appendix B) are retained for transparency only; Table A2 explains why 189.2 Mc, ≈127.5 Mc, and 121.623 Mc must not be treated as one consistent baseline.

5.4.3. Monte Carlo Proxy Ablation

To reveal behavioral differences among scheduling strategies along the retry path under simulated feature variance, this work constructs a Monte Carlo simulation framework anchored to an earlier Baseline cost estimate. Table 4 reports remeasured end-to-end signing behavior on Apple M2, whereas Table 9 reports Monte Carlo proxy metrics only; the two tables must not be read as directly comparable latency numbers. Historical Mcycle values in Appendix B are likewise not reproduced under fixed-degree deployment. The proxy ablation results are summarized in Table 9, while the scheduling behavior comparison is presented in

Table 11. Comparison of scheduling behaviors between Binary-ML and Rank-ML.

Metric	Binary-ML	Rank-ML (Ours)
Average commit count	1.384	1.560
Average forward progressions	4.387	1.036
P90 latency (Mc)	118.235	118.210
Scheduling strategy	Threshold filtering	Priority ranking
Search behavior	Discard low-score candidates	Sequential attempts by priority

.

The Monte Carlo ablation (Table 9 and Table 11) illustrates proxy behavioral differences between Binary-ML and Rank-ML under simulated feature variance. These proxy dynamics are not observed in the remeasured fixed-degree deployment, where Rank-ML ≈ Batch-only.

1.

Significant compression of outer retry rounds: Binary-ML reduces the average number of commitments per round through hard-threshold filtering (1.384 versus 3.511 for the Baseline). However, due to the rigidity of threshold-based filtering, the overall signing process still requires more outer retry rounds, with substantial variance (mean rounds = 4.387; std rounds = 3.818).

In contrast, Rank-ML replaces hard rejection with ranking-based scheduling. By sequentially attempting candidates within the same round, it achieves more forward progressions (mean forwards = 10.355) and fewer outer retry rounds (mean rounds = 1.036) in the proxy model only; these dynamics are not observed under fixed-degree remeasured deployment (Table 4).

2.

Structural improvement in tail latency: Both ML-based strategies significantly improve the P90 latency compared with the Baseline (412.865 Mc) in the proxy model. Rank-ML achieves a slightly lower P90 latency (118.210 Mc) than Binary-ML (118.235 Mc). More importantly, although the proxy mean latency of Rank-ML (92.247 Mc) is higher than that of Binary-ML (81.746 Mc) within the simulation, this ordering compares proxy values only and must not be extrapolated to remeasured wall-clock signing (Table 4). The relevant takeaway is that Rank-ML exhibits a smaller relative gap between its proxy P90 and proxy mean, suggesting milder tail behavior under the simulated scheduling dynamics.

The reason lies in the “ranking-first, sequential-attempt” strategy of Rank-ML, which avoids the “all-or-nothing” effect inherent in threshold-based filtering. Even low-score candidates retain a chance to be attempted, thereby preventing additional retry overhead caused by mistakenly discarding valid candidates.

5.5. Result Analysis

Based on the remeasured ablation and live/synthetic evidence, we analyze three aspects: deployment degeneracy, batch overhead, and what each evidence type supports.

1.

Deployment degeneracy: Live logs show a constant norm bit length (512) and trace parity (0) at the NIST-I fixed commitment degree, yielding live logistic AUC $=0.50$. A dedicated deployment check on 1000 commitment ideals confirms that the hard-coded scorer outputs a single distinct probability (unique_probs $=1$). Consequently, Rank-ML online ordering collapses to generation order within each batch and is empirically indistinguishable from Batch-only (Table 4).

2.

Batch overhead vs. learned ordering: Batch pre-sampling ($K=10$) increases wall-clock signing time relative to Baseline (≈104 ms vs. ≈76 ms) without reducing mean candidate attempts below $1.0$ in the remeasured runs. Binary-ML sits between the Baseline and batch modes in latency while incurring higher prime-trial variance. These results isolate scheduling overhead from any hypothetical ML benefit and explain why historical Mcycle gains (Appendix B) cannot be treated as causal under the current feature design.

3.

Evidence composition: The live data establish retry statistics and prime-trial scale; the synthetic data support feature validation when variance is engineered; remeasured ablation confirms functional integration and degenerate ranking; and the proxy Monte Carlo results in Table 9 illustrate relative tail behavior under simulated scheduling dynamics only. Together, they demonstrate the feasibility of the scheduling framework while clarifying that the present two-feature deployment does not yet deliver a measurable learned ordering benefit.

6. Conclusions and Future Work

This work addresses the high random failure rate in the ideal-to-isogeny conversion process of SQIsign and provides the first reproducible instrumented study of commitment-stage scheduling with explicit separation of live, synthetic, remeasured, and proxy evidence.

6.1. Summary of Contributions

6.1.1. What We Establish

(i) Live bottleneck characterization: At NIST-I, 86.4% candidate failure and 7.36 mean attempts per session are achieved (Table 2). (ii) Integratable framework: Weighted logistic MLE offline training and Rank-ML/Binary-ML/Batch-only scheduler modes function correctly at NIST-I and NIST-III. (iii) Deployment diagnosis: At the default post-RandomIdealGivenNorm insertion point, features are constant, the scorer degenerates (unique_probs $=1$), and Rank-ML is empirically indistinguishable from Batch-only (Table 4). (iv) Conditional feasibility: On synthetic data with engineered variance, the same scorer achieves AUC $\approx 0.634$ (Table 6).

6.1.2. What We Do Not Claim

We do not claim live feature ranking, historical 6.8→3.1 attempt reductions, or 35.7% Mcycle speedups as consequences of the current two-feature deployment. The historical Mcycle measurements are documented in Appendix B for transparency only.

6.1.3. Takeaway for Practitioners

ML scheduling for SQIsign requires (a) feature extraction at a point where protocol-fixed parameters do not collapse variance and (b) batch-only controls in any benchmark protocol. Table 8 is intended as a reusable template for future ML-for-cryptography scheduling studies on Apple M2 at NIST-I within our reported data budget.

6.2. Relation to Existing SQIsign Optimizations

Our scheduler is orthogonal to protocol-level accelerators such as ApresSQIsign and dimension-reduction variants such as SQIsign2D. These approaches primarily reduce the cost or invocation pattern of individual isogeny computations, whereas our study examines whether lightweight ordering can reduce wasted commitment work before the expensive RandomEquivalentPrimeIdeal and IdealToIsogeny stages where an online feature signal exists. We therefore view the methods as complementary rather than competing. This revision intentionally isolates the scheduling mechanism through Baseline, Binary-ML, Batch-only, and Rank-ML comparisons on a common SQIsign lvl1 implementation. We additionally verify that the same instrumented commitment pipeline and Rank-ML signing path function correctly at NIST-III, with supplementary live retry statistics reported in Table 2. We do not claim that remeasured latency ordering would automatically persist when stacked on top of every existing optimized baseline or at every NIST parameter set; such combined evaluation requires unified integration engineering and is left for future work.

6.3. Future Research Directions

The framework is integratable, but the present deployment point yields no live ranking signal; we prioritize the following directions.

First, relocate feature extraction to stages where norm bit length varies (e.g., after prime-norm reduction), and re-run Rank-ML versus Batch-only ablation before making any performance claim. Second, extend the expressive power of feature representations while maintaining low inference overhead, including structural statistics of ideal generators or compact nonlinear scorers, evaluated only under documented live variance. Third, explore constant-time scheduling engineering and side-channel validation for Rank-ML early termination and Binary-ML filtering in high-assurance deployments. Fourth, extend the evidence map evaluation template to additional platforms, parameter sets, and combined stacks with ApresSQIsign or SQIsign2D implementations.