MT-GAIP: Multi-Target Group Action Inverse Problem

• MT-GAIP is defined as the inversion problem of finding a hidden group relation among multiple supersingular elliptic curves, extending the classical GAIP framework.
• It underpins the security of isogeny-based schemes like CSI-SDVS by ensuring strong unforgeability, non-transferability, and privacy through group action inversion.
• MT-GAIP also inspires orbit recovery in signal processing, where invariant statistics from transformed copies enable robust multi-target detection.

The Multi-Target Group Action Inverse Problem (MT-GAIP) is a multi-instance inversion problem for a group action. In the isogeny-based cryptographic setting of CSIDH and CSI-FiSh, it asks for a hidden class-group relation connecting some pair among several supersingular elliptic curves, and it functions as the explicit privacy assumption behind the isogeny-based strong designated verifier signature scheme $\mathsf{CSI\text{-}SDVS}$ (Renan, 20 Jul 2025). In a broader orbit-recovery usage, the same viewpoint treats MT-GAIP as recovery of an orbit representative from invariant statistics of many transformed copies under a group action, such as translations and rotations in multi-target detection (Bendory et al., 2021, Beinhorn et al., 14 Sep 2025).

1. Formal definition in the class-group action setting

In the CSIDH/CSI-FiSh framework, the algebraic environment is an order $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$ in an imaginary quadratic field, its ideal class group $\mathrm{Cl}(\mathfrak{O})$, and the set $\mathcal{E}ll_p(\mathfrak{O})$ of $\mathbb{F}_p$-isomorphism classes of supersingular elliptic curves $E/\mathbb{F}_p$ satisfying

$$\operatorname{End}_{\mathbb{F}_p}(E)\cong \mathfrak{O}.$$

The class group acts on $\mathcal{E}ll_p(\mathfrak{O})$ through

$$*:\mathrm{Cl}(\mathfrak{O})\times \mathcal{E}ll_p(\mathfrak{O})\to \mathcal{E}ll_p(\mathfrak{O}),$$

via $\mathfrak{a}*E:=E/S_{\mathfrak{a}}$, where the subgroup

$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$0

defines an isogeny with kernel $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$1. This action is free and transitive, hence a principal homogeneous action (Renan, 20 Jul 2025).

In the CSIDH-friendly case described for $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$2, $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$3 is cyclic with generator $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$4. Writing $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$5, every class is $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$6 for some $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$7, and the shorthand

$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$8

is adopted (Renan, 20 Jul 2025).

Against this background, the single-target Group Action Inverse Problem (GAIP) asks: given curves $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$9 and $\mathrm{Cl}(\mathfrak{O})$0 with endomorphism ring $\mathrm{Cl}(\mathfrak{O})$1, find an ideal $\mathrm{Cl}(\mathfrak{O})$2 such that

$\mathrm{Cl}(\mathfrak{O})$3

MT-GAIP generalizes this to several targets. Given supersingular elliptic curves $\mathrm{Cl}(\mathfrak{O})$4 over $\mathrm{Cl}(\mathfrak{O})$5 with $\mathrm{Cl}(\mathfrak{O})$6 for all $\mathrm{Cl}(\mathfrak{O})$7, the problem is to find an ideal $\mathrm{Cl}(\mathfrak{O})$8 such that

$\mathrm{Cl}(\mathfrak{O})$9

Equivalently, in the abstract notation $\mathcal{E}ll_p(\mathfrak{O})$0 and $\mathcal{E}ll_p(\mathfrak{O})$1, one is given multiple targets $\mathcal{E}ll_p(\mathfrak{O})$2 and must recover a nontrivial relation between two of them under the action of $\mathcal{E}ll_p(\mathfrak{O})$3 (Renan, 20 Jul 2025).

The $\mathcal{E}ll_p(\mathfrak{O})$4 instantiation fixes a prime

$\mathcal{E}ll_p(\mathfrak{O})$5

with small distinct odd primes $\mathcal{E}ll_p(\mathfrak{O})$6 and $\mathcal{E}ll_p(\mathfrak{O})$7, and uses the base supersingular curve

$\mathcal{E}ll_p(\mathfrak{O})$8

Its class number satisfies $\mathcal{E}ll_p(\mathfrak{O})$9. Concretely, each public curve has the form $\mathbb{F}_p$0 for an unknown exponent $\mathbb{F}_p$1, and an MT-GAIP solver must detect indices $\mathbb{F}_p$2 and a class $\mathbb{F}_p$3 such that

$\mathbb{F}_p$4

or equivalently $\mathbb{F}_p$5 (Renan, 20 Jul 2025).

2. Relation to GAIP and hardness assumptions

Conceptually, GAIP is a single-pair inversion problem, while MT-GAIP is a multi-target or multi-instance variant in which the adversary may succeed on any one of many possible pairs. In the class-group notation above, GAIP fixes one pair $\mathbb{F}_p$6 and asks for $\mathbb{F}_p$7 with $\mathbb{F}_p$8; MT-GAIP receives $\mathbb{F}_p$9 and asks for indices $E/\mathbb{F}_p$0 and $E/\mathbb{F}_p$1 with $E/\mathbb{F}_p$2 (Renan, 20 Jul 2025).

A central point in the CSIDH-based setting is that MT-GAIP is not presented as a fundamentally stronger assumption than GAIP. The cited SeaSign analysis is summarized by the statement that MT-GAIP is tightly reducible to GAIP when the structure of the class group is known, which is the case when $E/\mathbb{F}_p$3 is known and cyclic. In that regime, solving MT-GAIP efficiently implies an efficient solution to GAIP, and conversely, up to tight reductions. The role of MT-GAIP is therefore not to postulate extra asymptotic hardness, but to capture the natural security condition that arises when many group-action instances are simultaneously present (Renan, 20 Jul 2025).

The scheme parameters are chosen so that $E/\mathbb{F}_p$4, while the number of targets $E/\mathbb{F}_p$5, or effectively the coordinate count $E/\mathbb{F}_p$6, is polynomial in $E/\mathbb{F}_p$7. Within this parameterization, the best known classical algorithms for GAIP and MT-GAIP have complexity $E/\mathbb{F}_p$8, reflecting square-root behavior typical of hidden-shift or group-action inversion problems. The best known quantum algorithms are described through Kuperberg’s hidden shift algorithm, which yields subexponential complexity; the paper further notes that concrete security analyses for this setting study the impact of those attacks on CSIDH parameter choices (Renan, 20 Jul 2025).

This relation between GAIP and MT-GAIP is directly reflected in the protocol structure. In $E/\mathbb{F}_p$9, the signer public key, verifier public key, and ephemeral or simulated curves all live in the same action space: $$\operatorname{End}_{\mathbb{F}_p}(E)\cong \mathfrak{O}.$$0

$$\operatorname{End}_{\mathbb{F}_p}(E)\cong \mathfrak{O}.$$1

$$\operatorname{End}_{\mathbb{F}_p}(E)\cong \mathfrak{O}.$$2

and, in simulation,

$$\operatorname{End}_{\mathbb{F}_p}(E)\cong \mathfrak{O}.$$3

From an adversarial viewpoint, these form a pool of curves of the form $$\operatorname{End}_{\mathbb{F}_p}(E)\cong \mathfrak{O}.$$4 for many unknown exponents $$\operatorname{End}_{\mathbb{F}_p}(E)\cong \mathfrak{O}.$$5, and MT-GAIP abstracts the difficulty of discovering any nontrivial action relation among them (Renan, 20 Jul 2025).

3. Role in $$\operatorname{End}_{\mathbb{F}_p}(E)\cong \mathfrak{O}.$$6 security

The isogeny-based strong designated verifier signature scheme $$\operatorname{End}_{\mathbb{F}_p}(E)\cong \mathfrak{O}.$$7 is built from the CSIDH ideal class group action and CSI-FiSh-style signature techniques, and its security claims are Strong Unforgeability under Chosen-Message Attacks (SUF-CMA), Non-Transferability (NT), and Privacy of Signer’s Identity (PSI), all in the random oracle model (Renan, 20 Jul 2025).

For SUF-CMA, the proof is phrased in the Hard Homogeneous Space model. A successful forger enables the simulator to solve the parallelization problem $$\operatorname{End}_{\mathbb{F}_p}(E)\cong \mathfrak{O}.$$8 given $$\operatorname{End}_{\mathbb{F}_p}(E)\cong \mathfrak{O}.$$9. In the concrete protocol, a valid forgery $\mathcal{E}ll_p(\mathfrak{O})$0 on a message $\mathcal{E}ll_p(\mathfrak{O})$1 satisfies

$\mathcal{E}ll_p(\mathfrak{O})$2

and for the correct forgery one can derive

$\mathcal{E}ll_p(\mathfrak{O})$3

Hence

$\mathcal{E}ll_p(\mathfrak{O})$4

Recovering $\mathcal{E}ll_p(\mathfrak{O})$5 from the public curves $\mathcal{E}ll_p(\mathfrak{O})$6 and $\mathcal{E}ll_p(\mathfrak{O})$7 is a nontrivial instance of parallelization or vectorization in the same group action. The proof is therefore framed in HHS language, but the underlying hardness is again the same class-group inversion phenomenon captured by GAIP-type assumptions (Renan, 20 Jul 2025).

NT is established differently. The real-signature and simulated-signature experiments are shown to be identically distributed. In the real case, the signer samples $\mathcal{E}ll_p(\mathfrak{O})$8 uniformly in $\mathcal{E}ll_p(\mathfrak{O})$9, sets $$*:\mathrm{Cl}(\mathfrak{O})\times \mathcal{E}ll_p(\mathfrak{O})\to \mathcal{E}ll_p(\mathfrak{O}),$$0, and hashes curve coefficients corresponding to $$*:\mathrm{Cl}(\mathfrak{O})\times \mathcal{E}ll_p(\mathfrak{O})\to \mathcal{E}ll_p(\mathfrak{O}),$$1. In the simulation, the verifier samples $$*:\mathrm{Cl}(\mathfrak{O})\times \mathcal{E}ll_p(\mathfrak{O})\to \mathcal{E}ll_p(\mathfrak{O}),$$2 uniformly in $$*:\mathrm{Cl}(\mathfrak{O})\times \mathcal{E}ll_p(\mathfrak{O})\to \mathcal{E}ll_p(\mathfrak{O}),$$3, sets $$*:\mathrm{Cl}(\mathfrak{O})\times \mathcal{E}ll_p(\mathfrak{O})\to \mathcal{E}ll_p(\mathfrak{O}),$$4, and hashes curves of the form $$*:\mathrm{Cl}(\mathfrak{O})\times \mathcal{E}ll_p(\mathfrak{O})\to \mathcal{E}ll_p(\mathfrak{O}),$$5. In both distributions, each $$*:\mathrm{Cl}(\mathfrak{O})\times \mathcal{E}ll_p(\mathfrak{O})\to \mathcal{E}ll_p(\mathfrak{O}),$$6 is uniform over $$*:\mathrm{Cl}(\mathfrak{O})\times \mathcal{E}ll_p(\mathfrak{O})\to \mathcal{E}ll_p(\mathfrak{O}),$$7, each curve input to the hash is uniformly distributed in $$*:\mathrm{Cl}(\mathfrak{O})\times \mathcal{E}ll_p(\mathfrak{O})\to \mathcal{E}ll_p(\mathfrak{O}),$$8, and the hash output is a random oracle value. NT therefore relies on distributional equivalence rather than directly invoking MT-GAIP (Renan, 20 Jul 2025).

PSI is the property for which MT-GAIP is invoked explicitly. The PSI game uses two signers with secrets $$*:\mathrm{Cl}(\mathfrak{O})\times \mathcal{E}ll_p(\mathfrak{O})\to \mathcal{E}ll_p(\mathfrak{O}),$$9 and $\mathfrak{a}*E:=E/S_{\mathfrak{a}}$0, one verifier with secret $\mathfrak{a}*E:=E/S_{\mathfrak{a}}$1, both signer key pairs, and the verifier public key. The adversary receives a challenge signature produced by one of the two signers and must identify which signer generated it. A natural distinguishing strategy would be to compute

$\mathfrak{a}*E:=E/S_{\mathfrak{a}}$2

for each candidate signer $\mathfrak{a}*E:=E/S_{\mathfrak{a}}$3 and then, if the verifier secret were known, derive

$\mathfrak{a}*E:=E/S_{\mathfrak{a}}$4

and test whether the corresponding hash value matches the challenge. The obstacle is that the adversary does not know $\mathfrak{a}*E:=E/S_{\mathfrak{a}}$5 (Renan, 20 Jul 2025).

Without $\mathfrak{a}*E:=E/S_{\mathfrak{a}}$6, the adversary only sees many curves of the form

$\mathfrak{a}*E:=E/S_{\mathfrak{a}}$7

together with

$\mathfrak{a}*E:=E/S_{\mathfrak{a}}$8

To succeed, it would need to compute, for the correct signer index $\mathfrak{a}*E:=E/S_{\mathfrak{a}}$9,

$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$00

or equivalently recover

$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$01

That task is precisely the recovery of a hidden action relation among multiple observed curves. The theorem is therefore stated as: if MT-GAIP is hard, then $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$02 satisfies PSI security (Renan, 20 Jul 2025).

4. Multi-target structure, compactness, and protocol design

The “multi-target” qualifier is technically motivated by the protocol architecture. $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$03 employs vectors of size $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$04 in keys and signatures: $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$05

$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$06

and signatures contain $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$07, while the hash input depends on $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$08 curves $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$09. The adversary thus observes many simultaneously related curves of the form $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$10, and MT-GAIP is the natural abstraction for exploiting any relation among them (Renan, 20 Jul 2025).

The same abstraction extends to a multi-key, multi-signature environment. Public curves arise from multiple signers, multiple verifiers, and multiple transcripts, so the relevant attack surface is a large pool of group-action instances rather than a single isolated inversion problem. PSI, in particular, compares two candidate signers simultaneously and turns anonymity into a question of identifying which signer’s public curves are related to the verifier’s curves through hidden exponents. The use of MT-GAIP therefore reflects protocol semantics rather than merely proof convenience (Renan, 20 Jul 2025).

This architecture is also tied to the compactness claim of the scheme. The class-group action permits a scalar-like representation of secrets, with

$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$11

and curves represented by a single Montgomery coefficient $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$12. Since $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$13 and $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$14, the sizes are linear in $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$15: $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$16

$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$17

$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$18

The paper contrasts this with the typical $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$19 size behavior of existing post-quantum SDVS constructions based on lattices, where dimensions scale with $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$20 (Renan, 20 Jul 2025).

The concrete parameter choice follows CSI-FiSh and CSI-SharK by taking $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$21 for 128-bit security, balancing soundness, key size, and computation; larger values such as $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$22 are noted as a way to reduce statistical soundness error at linear size cost. On this basis, $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$23 is described as having both keys and signatures of size $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$24, as among the most compact PQC-based SDVS schemes, and as the only post-quantum secure construction based on isogenies (Renan, 20 Jul 2025).

5. Complexity-theoretic status and related problem variants

A complementary line of work studies GAIP-type problems as computational problems for effective group actions. In that framework, a group action $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$25 is required to support polynomial-time membership, equality, sampling, group operations, inversion, and action evaluation, while $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$26 has efficient membership testing and unique representation. For regular actions, the map $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$27, $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$28, is a bijection, and GAIP is the total search problem: given $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$29, find $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$30 such that

$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$31

The paper also defines the Multiple Group Action Inverse Problem (mGAIP), in which one receives polynomially many pairs

$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$32

and must find a single $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$33 satisfying

$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$34

as well as the Pseudorandom Group Action Inverse Problem (pGAIP) and the orbit-membership decision problem dGAIP for non-transitive actions (D'Alconzo, 2022).

For regular effective actions, GAIP, mGAIP, and pGAIP are shown to be nonadaptively $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$35-random self-reducible. This yields a worst-case/average-case equivalence: solving a noticeable fraction of random instances suffices, via self-reduction, to solve arbitrary instances with high probability. The same work concludes that if GAIP, mGAIP, or pGAIP were NP-hard, then the Polynomial Hierarchy would collapse at the third level. For dGAIP, an interactive proof places the problem in $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$36, and since dGAIP is also in $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$37, it lies in $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$38; if dGAIP were NP-complete, then the Polynomial Hierarchy would collapse to the second level (D'Alconzo, 2022).

These results position GAIP-type assumptions as structurally similar to Graph Isomorphism and other NP-intermediate candidates rather than as NP-complete problems. Indeed, dGAIP subsumes orbit problems such as Graph Isomorphism, permutation code equivalence, deck checking, and Boolean isomorphism under suitable group actions (D'Alconzo, 2022).

That paper does not formally define the cryptographic MT-GAIP of the CSIDH literature. Instead, it introduces mGAIP, where many pairs share one hidden group element, and then describes a more general multi-target GAIP with independent secrets as a natural extension. The stated guidance is that the same random self-reduction ideas operate componentwise and that decision analogues would likely inherit similar $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$39 or $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$40 upper bounds. This suggests that multi-target GAIP variants should be viewed as parallel or multi-instance extensions of GAIP rather than as qualitatively different complexity classes (D'Alconzo, 2022).

6. Broader orbit-recovery interpretations in signal processing and inverse problems

Outside isogeny-based cryptography, group-action inversion appears in multi-target detection and related orbit-recovery models. In the two-dimensional detection model with rotations, the measurement is

$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$41

where $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$42 is a single underlying target, $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$43 is its discretized rotation, $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$44 are i.i.d. uniform on $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$45, translations satisfy a separation condition, and the noise is i.i.d. Gaussian. This can be written as a group-action model with

$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$46

acting by $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$47. In that paper’s terminology, “multi-target” means many occurrences of one target in the measurement rather than multiple distinct templates (Bendory et al., 2021).

The principal methodological move is to avoid estimating the individual group elements and instead estimate group-invariant statistics. The invariant features are rotationally and translationally averaged first-, second-, and third-order autocorrelations. In one dimension, the third-order invariant

$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$48

determines $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$49 up to circular shift when the discrete Fourier coefficients are all nonzero. The empirical third-order autocorrelation of the measurement,

$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$50

has expectation proportional to $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$51 up to explicit noise-bias terms, and its variance decays like

$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$52

Thus, for fixed noise variance, density, and support size, the target is consistently estimable as the measurement size grows, without recovering the shifts or rotations of individual copies (Bendory et al., 2021).

In two dimensions, the analogous invariant is the discrete rotationally averaged third-order autocorrelation

$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$53

and the reconstruction algorithm expands the target in a steerable Dirichlet eigenbasis

$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$54

expresses the Fourier transform of $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$55 as a rotation-averaged bispectrum, and minimizes a nonconvex least-squares objective by BFGS. The 2D theory is not accompanied by a full identifiability theorem analogous to the 1D theorem, but noise-free and noisy experiments show accurate recovery from the invariant statistics (Bendory et al., 2021).

A subsequent moment-based line of work casts multi-target detection explicitly as recovery from low-order moments, again in a translation group-action model

$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$56

or, in super-resolution form,

$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$57

The order-$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$58 autocorrelations $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$59 are homogeneous polynomials of degree $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$60 in the pixels of $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$61, and the inverse problem is formulated through the moment equations

$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$62

The corresponding loss

$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$63

defines a polynomial inverse problem whose conditioning deteriorates in high noise and in super-resolution settings (Beinhorn et al., 14 Sep 2025).

That work regularizes the invariant-matching problem with a score-based diffusion prior. The optimization target is

$\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$64

where the prior gradient is approximated by a score network $\mathfrak{O}\subset \mathbb{Q}(\sqrt{-p})$65. The proposed accelerated gradient scheme combines the moment gradient with an adaptively scaled score term. Empirically, the paper reports two main findings: diffusion priors substantially improve recovery from third-order moments, and they make the super-resolution multi-target detection problem feasible, while the underlying identifiability basis remains the earlier result that autocorrelations up to third order uniquely determine a generic two-dimensional target in the well-separated model (Beinhorn et al., 14 Sep 2025).

Taken together, these signal-processing papers suggest a broader use of the MT-GAIP viewpoint: a group action generates many transformed copies of an unknown object, low-order invariants are estimated directly from aggregate noisy data, and inversion proceeds by recovering the orbit representative rather than the individual nuisance transformations. In cryptography, MT-GAIP names a precise class-group inversion problem; in orbit recovery, it serves as a natural conceptual template for invariant-based reconstruction under group actions (Bendory et al., 2021, Beinhorn et al., 14 Sep 2025).