Imagine you're packing a suitcase with a strict weight limit. You've been separately weighing your shirts, then your pants, then your shoes — each pile just under budget. But nobody checked whether rearranging items across piles could free up space. That's what this paper does to the Regular Syndrome Decoding (RSD) problem: it shows that coordinating two guessing strategies across all "blocks" of the problem — rather than treating them as independent choices — dramatically lowers the real computational cost of breaking RSD instances. The committed claim: many RSD parameter sets used in deployed cryptographic protocols (Ferret, Wolverine, committed VOLE, PCG benchmarks) are substantially weaker than believed, with at least one parameter set per application falling below the 128-bit security target and losses approaching 67 bits. This is not a theoretical curiosity — these protocols are building blocks for MPC-in-the-Head signatures, pseudorandom correlation generators, and zero-knowledge proofs that are being standardized and deployed now. The mechanism is a hybrid algebraic attack pipeline with three stages: guess, reduce, solve. Prior work treated the two guessing phases (choosing which coordinates are zero across regular blocks, and which syndrome-derived variables to eliminate) as largely independent. Kim et al. show that jointly optimizing these guesses — balancing the "guessing penalty" across all blocks while retaining enough equations for linearization — yields a much tighter attack. They call this a "block balancing principle," and it systematically coordinates the entire guess-reduce-solve pipeline rather than stitching together locally optimal choices. On the ladder: the strongest prior algebraic attacks on RSD are the starting point. This paper improves attack cost estimates by up to 29.77 bits on non-binary fields and 25.91 bits on binary fields for PCG benchmarks. For the revised 128-bit parameter sets proposed by Liu et al. (2024), all estimated attack costs land below 2^111 field operations — a gap of at least 17 bits below the claimed security level. The paper is honest about the fact that these are analytical cost estimates, not implemented attacks, but the methodology is concrete and systematic. Integrity-wise, this is a cryptanalysis paper, so the "experiment" is a mathematical cost analysis — no physical attack was executed. The validation comes from applying the refined attack model to published parameter sets and comparing against prior best-known attack costs. The authors target the exact parameter sets used in real protocols, not toy instances. The comparison is against the best prior algebraic attacks and information-set decoding, not stale baselines. The 42-page treatment is detailed enough for independent verification, but no code or implementation is mentioned. The milestone question is concrete: the field needs new parameter sets for RSD-based protocols that survive this refined attack model. The paper's own numbers suggest that simply inflating parameters by 20-30% won't suffice — the block balancing principle is structural, not marginal. Protocol designers using Ferret, Wolverine, or VOLE-based constructions need to re-derive parameters against this attack before deployment. The obvious experiment not run: an actual implementation of the attack, even at reduced scale, to validate that the analytical cost model translates to real computation. This is standard in cryptanalysis — analytical models can overestimate or underestimate real attack costs depending on memory access patterns, parallelism overhead, and constant factors. The honest read is (a): the authors are theorists presenting a refined cost model, and implementation is a separate engineering project they either lack resources for or consider outside scope. But without it, the "below 128-bit" claims carry an asterisk.
