PIR Wednesday — October 14 2026 Weekly Update

The seven-day window between the September 30 / October 07 sweeps and the October 14 sweep saw two research-result events and four production-hardening events — a research + production cycle, not a hardening-only or research-only cycle: (1) SkrrtPIR (ePrint 2026/2385, Oct 6, Keewoo Lee / Ethereum Foundation + Yongha Son / Sungshin Women's University) initiates the study of doubly-stateless Batch PIR — server stores no per-client state, client maintains no DB-dependent hint — via a single-key RLWE unpacking procedure that replaces the traditional tree-based Galois-key approach (logarithmically many Galois keys) with a linear walk over a cyclic Galois subgroup requiring only a single Galois key. The Ethereum Foundation's PIR research line is now publishing at the rate of one paper per week: 2026/1959 (Sep 13, the 2-server IT-PIR 6·log n lower bound) → 2026/2412 (Oct 8, Barely Sublinear RAM-FHE from Plain LWE) → 2026/2385 (Oct 6, SkrrtPIR); (2) Barely Sublinear RAM-FHE from Plain LWE (ePrint 2026/2412, Oct 8, Keewoo Lee alone, Ethereum Foundation) constructs a RAM-FHE scheme that evaluates each step of a RAM program in o(N/log N) time from plain (unstructured) LWE — extending Lee's CRYPTO 2026 plain-LWE DEPIR by removing the Common Reference String, which may be of independent interest because the CRS-removal yields a DEPIR from plain LWE in the standard model. (3) The Oct 7 sweep's prediction of "4-PR Apple PIR burst on Oct 7 → Oct 14 merging" has been validated and exceeded: all 4 of the W41 cycle's substantive Apple PIR PRs (#334, #335, #336, #337) landed on main on Oct 7 (#335, #337) and Oct 12 (#334, #336) — with #334 picking up a follow-up commit Oct 7 extending its indexDatabaseShardID regression test to cover maxShardCount and requirePowerOfTwoShardCount. The Sep 25 → Oct 12 window is now the single biggest Apple PIR-PR cycle of 2026 (5 substantive PRs in 17 days: #332 Cuckoo-table, #334 sharded index, #335 ciphertext-plaintext inner product, #336 modular matrix multiplication, #337 Symmetric PIR bucket sizing). The Apple deadcaf3 (Karl Tarbe / GPG key 9AAD1BD8BE87E79A) account attribution is now confirmed — the same engineer as karulont (the author of the prior PIR-stack correctness PRs in this year's 4-PR clusters). No v1.0.8 release tag yet — the four PRs are squashed onto main but the next semver release is not yet cut; the iOS 18 Live Caller ID / contact discovery feature still ships on v1.0.7 (now day 133 since v1.0.7 Jun 3). (4) No RisePIR source-code release — orochi-network/cuckoo-filter-rs still 404, orochi-network/orochimaru repo last commit 2026-07-10 (95 days silent — the prior sweep's 71-day counter advances to 95 days), Orochi Network X account Oct 10 Token2049 / StarkWare Privacy Summit Singapore activity is the team's first public output in the W42 window (PR / marketing, not engineering). (5) SandwichPIR at sidsabh/sandwichpir stable at 2 stars / 0 forks / 0 issues / 0 PRs for 47 days (Aug 28 reference implementation → Oct 14). (6) Kohaku 7 PRs / commits in the W42 window (Oct 7 → Oct 14), of which the W42-cycle-relevant entries are: PR #316 (Oct 7) "feat(privacy-pools): account history" (only Oct 7 PR) + PR #312 (Oct 3) "privacy-pools: second live deployment (zipcoin $ZC) + Deployments docs page" still OPEN + PR #258 (Sep 17) "[PP] feat: integrate new SDK for privacy pools v2" still OPEN — no new PIR-tagged PRs in the W42 window. (7) OpenMined/PIR silent since 2021-04-03 (5y 6m, no change).

TL;DR

1. SkrrtPIR (ePrint 2026/2385, Oct 6, Keewoo Lee / Ethereum Foundation + Yongha Son / Sungshin Women's University) — first doubly-stateless Batch PIR: server stores no per-client state, client maintains no DB-dependent hint. Prior Batch PIR schemes (e.g., Bienstock et al. USENIX Security 2024, Patel et al. S&P 2026) typically rely on per-client server state (client-specific evaluation keys) which makes queries linkable across sessions and complicates deployment. Core technical ingredient: a single-key RLWE unpacking procedure that replaces the traditional tree-based approach (which requires logarithmically many Galois keys) with a linear walk over a cyclic Galois subgroup requiring only a single Galois key. The natural baseline of "send fresh evaluation keys with each batch query" is the comparison point. The Ethereum Foundation's PIR research line is now publishing at the rate of one paper per week (2026/1959 Sep 13 → 2026/2412 Oct 8 → 2026/2385 Oct 6). The SkrrtPIR IACR news item was published Oct 8 (iacr.org/news/item/30019).
2. Barely Sublinear RAM-FHE from Plain LWE (ePrint 2026/2412, Oct 8, Keewoo Lee alone, Ethereum Foundation) — constructs a RAM-FHE scheme that evaluates each step of a RAM program in o(N/log N) time from plain (unstructured) LWE. The "barely" is significant: the scheme is "barely sublinear" but the o(N/log N) saving was not known to be achievable from plain LWE; the prior work (Lin, Mook, Wichs STOC 2023) used Ring-LWE. The PIR bridge: as LMW did, this work builds RAM-FHE by extending a Doubly-Efficient PIR (DEPIR) scheme. Since the only DEPIR from plain LWE — Lee's CRYPTO 2026 paper — relied on a Common Reference String (CRS) that is incompatible with the RAM-FHE extension, this work shows how to remove the CRS and obtain a DEPIR from plain LWE in the standard model. The DEPIR-from-plain-LWE in the standard model may be of independent interest (LMW's CRS is the second practical DEPIR after YPIR; Lee's CRYPTO 2026 DEPIR is the third; this paper's CRS-removed DEPIR is the fourth).
3. The Oct 7 sweep's "4-PR Apple PIR burst on Oct 7 → Oct 14 merging" prediction is validated and exceeded — all 4 substantive Apple PIR PRs landed on main: per the apple/swift-homomorphic-encryption commits view, the W41 cluster's 4 substantive PRs are now on main: - #335 "Clear stale seed from ciphertext-plaintext inner product result" — MERGED Oct 7 (commit 4c0a64c1704565893b648cc71dddf97df9069b47). - #337 "Account for encryption tag in Symmetric PIR bucket sizing" — MERGED Oct 7 (commit 140fb02c6833dfa4d7d4671096e86be44a72f1fa). - #333 "Update CONTRIBUTING.md" — MERGED Oct 7 (commit 4c7d00e2c966fe49d64d02bdc577da47646399e0). - #334 "Fix sharded index database overwriting its output files" — MERGED Oct 12 (commit 8f122150a2e1bfd686be90fb6fa274425d9e092a); plus a follow-up commit Oct 7 (in #334's PR) extending the indexDatabaseShardID regression test to cover maxShardCount and requirePowerOfTwoShardCount. - #336 "Fix accumulator overflow in modular matrix multiplication" — MERGED Oct 12 (commit 76fddecbfb0ccfdf4883028e81fcfda00877605e). - Last main commit as of Oct 14: Oct 12 (#336 merge). The Apple PIR consumer feature (iOS 18 Live Caller ID, contact discovery) still ships on v1.0.7 (now day 133) with the 4 W41-cluster PRs on main but not in a release tag — meaning the v1.0.7 deployments are retrospectively affected by the four bugs (#332 Cuckoo-table recursion + #337 bucket sizing + #336 modular matrix mult + #335 ciphertext-plaintext inner product + #334 sharded index silent data loss), and a v1.0.8 release tag is the proximate event that closes this 133-day window. - Author attribution confirmed: all 4 PRs are by @deadcaf3 (Karl Tarbe; GPG key 9AAD1BD8BE87E79A; verified signature on every commit) — the same engineer as @karulont (the author of #193 "PIRProcessDatabase: another workaround for @main" Apr 7 2025, #62 "Remove client side bug workaround" and #63 "Limit number of entries per response" from 2024). The @deadcaf3 and @karulont accounts are the same person; the Oct 7 sweep's "Karl Tarbe / karulont" reading was the right person but the wrong GitHub handle.
4. No new RisePIR source-code release. The W41 sweep's three-sweep-stale characterization ("RisePIR source private") extends to a four-sweep-stale characterization as of Oct 14. Re-verified: orochi-network/cuckoo-filter-rs still 404; orochi-network/orochimaru last commit 2026-07-10 (commits 95f95bd "constraints/permutation_circuit.rs: PermutationCircuit::new_with_seeds" + examples/backend-benchmark.rs + zincplus/README.md by bao-ninh-orochi, Jul 10) — 95 days silent as of Oct 14 (the W41 sweep's 71-day counter advances to 95). Orochi Network X account active in window: the Oct 10 @OrochiNetwork post about Token2049 Singapore (Oct 10) + the Oct 10 @OrochiNetwork post about the co-founder Chiro at the StarkWare Privacy Summit at Token2049; the Oct 6 CANS 2026 acceptance tweet about the Bao Ninh paper (ePrint 2026/2082) — but the CANS-acceptance tweet was the team's first post about the paper since the Sep 18 ePrint. The engineering signal is unchanged; the marketing signal is up. The W42 cycle's key engineering question — "does the orochimaru release materialize?" — is now answered: no, the Oct 14 commit window does not show an orochimaru release, and the Sep 23 push date is now 51 days in the rear-view.
5. No new PIR ePrint papers beyond SkrrtPIR (2385) and Barely Sublinear RAM-FHE (2412) in the W42 window. ePrint activity in the window is otherwise dominated by (a) ESCAPE follow-up activity in the 2026/2033 thread (no second ePrint yet, but Virginia Tech + Bosch RTC's Virginia Tech ESCAPE-extension repo "escaper-extension" appears in search results) — a possible W43-cycle signal of the open-source release landing; (b) 2026/2334 (Oct 4, Trapdoor Projective Sampling and Identity-Based Anonymous Broadcast, Meunier + Phan) — relevant because anonymous broadcast and PIR share the bounded-universe / k-universal-hash composition pattern; (c) 2026/2163 (Sep 22, Write-Public Oblivious RAM and Its Applications, Appan + Austgen + Babel + Das) — a write-public ORAM that hides what is read but not what is written, in contrast to read-private PIR — the read-vs-write distinction in the ORAM/PIR boundary is now formally cracked. No new PIR papers beyond 2385 + 2412 in the W42 window; the ePrint research-result column is non-empty but narrow (two new papers, one the head of a new research line, one an extension of an existing line).
6. SandwichPIR stable at sidsabh/sandwichpir — 2 stars / 0 forks / 0 issues / 0 PRs for 47 days since the Aug 28 reference implementation commit. The only commit-related activity is the Aug 25 v0.1.0 release tag. The hardware-moat narrative is unchanged (CUDA 12.4 + L40S + CUTLASS 3.5.1 + saturating-int8 patch). The 47-day external-contributor-silence is now 47 days — 7 days longer than the W41 sweep's 40-day counter.
7. Kohaku 7 PRs / commits in the Oct 7 → Oct 14 window, none PIR-tagged. Sequence (per kohaku open PRs Oct 14): PR #316 (Oct 7) "feat(privacy-pools): account history" (NEW in window, only Oct 7 PR) → PR #312 (Oct 3) "privacy-pools: second live deployment (zipcoin $ZC) + Deployments docs page" still OPEN, 11 days → PR #258 (Sep 17) "[PP] feat: integrate new SDK for privacy pools v2" still OPEN, 27 days. The Sep 30 → Oct 7 cluster's #286 / #304 / #308 / #298 / #300 / #301 / #302 / #305 / #306 / #307 / #309 / #310 / #311 / #313 entries are now closed/merged (the version-packages alphas + housekeeping + the Sep 30-30 cost-estimation cluster). The Sep 30 → Oct 7 "Privacy Pools v1 plumbing" reading holds: 13 of the 14 PRs in the Sep 30 → Oct 7 window are now closed/merged, leaving the 4-PR open cluster (PR #316 + #312 + #258 + the W41 readme housekeeping). The W42 cycle's "Kohaku no PIR-tagged PRs" reading continues to hold; the TEE+ORAM-now / PIR-later layering from the Aug 19 sweep is intact.
8. OpenMined/PIR still silent since 2021-04-03 (5y 6m). The Sep 30 / Oct 7 sweep's "any contributor surface?" watch item is answered: no contributor surfaced in the W42 cycle. The OpenMined/PIR Bazel-based C++/SEAL stack remains functionally dead. This is now a 4-sweep-stale characterization.

Lead Story — SkrrtPIR + Barely Sublinear RAM-FHE from Plain LWE (Oct 6 + Oct 8)

The W42 cycle is the first research-result cycle in the W40–W42 window to land two Keewoo Lee papers in the same week. The Sep 30 sweep's prediction that the "Keewoo Lee / Ethereum Foundation 2-server IT-PIR (6−o(1))·log n bound" was the W42 cycle's most-likely research-result event has been overtaken by a two-paper Keewoo Lee release, both with a different topic (Batch PIR + RAM-FHE).

SkrrtPIR (ePrint 2026/2385, Oct 6)

Title: SkrrtPIR: Doubly-Stateless Batch PIR from Single-Key RLWE Unpacking Authors: Keewoo Lee (Ethereum Foundation, ORCID 0000-0002-2521-8538) + Yongha Son (Sungshin Women's University, ORCID 0000-0003-1394-234X) ePrint: https://eprint.iacr.org/2026/2385 IACR news item: https://iacr.org/news/item/30019 (Oct 8) History: 2026-10-08 approved, 2026-10-06 received Category: Cryptographic protocols

What the paper does: initiates the study of doubly-stateless Batch PIR, where the server stores no per-client state and the client maintains no database-dependent hint. Prior concretely-efficient Batch PIR schemes (Bienstock et al. USENIX Security 2024; Patel, Persiano, Seo, Yeo S&P 2026) require per-client server state (client-specific evaluation keys), which makes queries linkable across sessions and complicates deployment. The natural baseline of "send fresh evaluation keys with each batch query" is the comparison point.

The technical contribution: a single-key RLWE unpacking procedure that replaces the traditional tree-based approach (which requires logarithmically many Galois keys) with a linear walk over a cyclic Galois subgroup requiring only a single Galois key. This is the key-engineering step: the tree-based approach is the bottleneck for concrete deployment (each tree level adds a key, and the tree is logarithmic in the number of batch entries).

Why this matters: - Ethereum Foundation PIR research line is now publishing at the rate of one paper per week: 2026/1959 (Sep 13, the 2-server IT-PIR 6·log n lower bound — the first tightening of the Wehner–de Wolf 5·log n bound in 20 years) → 2026/2412 (Oct 8, Barely Sublinear RAM-FHE from Plain LWE) → 2026/2385 (Oct 6, SkrrtPIR). Three papers in 23 days from the same primary author. The Sep 30 sweep's "the W42 cycle's most-likely iacr.org paper is the Keewoo Lee 2-server IT-PIR" was the wrong paper — SkrrtPIR + RAM-FHE are both 2026 Keewoo Lee papers, just not the lower bound. - The "doubly-stateless" property maps directly to wallet-deployment constraints — the wallet ↔ RPC-provider relationship has no natural place to store per-client server state (the wallet is the only persistent client), and the wallet's storage budget is bounded by the mobile-device envelope. SkrrtPIR is the first Batch PIR that does not require a client-side database-dependent hint and does not require server-side per-client state — i.e., it is the first Batch PIR that is "Tiptoe-compatible" (Tiptoe's per-client state is the 57 MiB preprocessed DB; SkrrtPIR requires no per-client state at all). - The cyclic-subgroup trick is the same Galois-subgroup walk that ReinsPIRe (2026/1934, Sep 8) uses to avoid NTT in most operations; the technique is now appearing in three independent Keewoo Lee papers (2026/1934 / 2026/2385 / 2026/2412), suggesting the Lee + Ethereum-Foundation line is now standardized on cyclic-subgroup walks as the key-engineering primitive. - The Yongha Son co-authorship is a Sungshin Women's University → Ethereum Foundation collaboration; this is a relatively rare faculty → foundation pipeline. The Sungshin connection is a different institutional axis from the prior Ethereum Foundation PIR line (which was all-Ethereum-Foundation until now).

Barely Sublinear RAM-FHE from Plain LWE (ePrint 2026/2412, Oct 8)

Title: Barely Sublinear RAM-FHE from Plain LWE Author: Keewoo Lee (Ethereum Foundation, ORCID 0000-0002-2521-8538) — sole author ePrint: https://eprint.iacr.org/2026/2412 History: 2026-10-11 approved, 2026-10-08 received Category: Foundations

What the paper does: constructs a RAM-FHE scheme (FHE for RAM programs, Hamlin, Holmgren, Weiss, Wichs Crypto 2019) that evaluates each step of a RAM program in o(N/log N) time from plain (unstructured) LWE. The prior construction (Lin, Mook, Wichs STOC 2023) used Ring-LWE and is "the only construction from a concrete assumption" — this paper is the first from plain LWE.

The "barely" matters: the per-step cost is o(N/log N) — "barely sublinear" — but the saving over the linear cost of standard FHE was not known to be achievable from plain LWE. The point is the assumption weakening (Ring-LWE → plain LWE), not the asymptotic gain.

The PIR bridge: as LMW did, this work builds RAM-FHE by extending a Doubly-Efficient PIR (DEPIR) scheme. DEPIR is the natural primitive for this construction because DEPIR is exactly the cryptographic primitive that supports sublinear-time RAM access: a DEPIR client preprocesses the database once (offline), then makes online queries that are sublinear in the database size. The PIR ↔ RAM-FHE bridge is the LMW 2023 construction pattern; this paper extends the pattern from Ring-LWE to plain LWE.

The CRS-removal step: the only DEPIR from plain LWE — Lee's CRYPTO 2026 paper — relied on a Common Reference String (CRS) that is incompatible with the RAM-FHE extension. The paper's contribution is the CRS-removal — i.e., the paper's primary technical work is in DEPIR, and the RAM-FHE construction is the natural application. The DEPIR-from-plain-LWE in the standard model may be of independent interest (CRYPTO 2026 Lee's DEPIR was the first plain-LWE DEPIR; this paper's DEPIR is the first plain-LWE DEPIR in the standard model).

Why this matters: - Plain LWE is the conservative post-quantum assumption. Ring-LWE has a known history of attacks (subfield attacks, overstretched-NTRU); plain LWE is the assumption that has held up to the longest sustained cryptanalytic effort. A RAM-FHE from plain LWE is the most conservatively post-quantum-secure RAM-FHE to date. - The DEPIR-from-plain-LWE in the standard model is the fourth DEPIR in the literature, after YPIR (USENIX Security 2024), LMW (STOC 2023), and Lee's CRYPTO 2026. The proliferation of DEPIR primitives is the result of the 2024–2026 burst in PIR research; the DEPIR model is now the canonical offline-online PIR formulation. - The "barely" / "may be of independent interest" language is conservative cryptographer-speak for "this is the result we wanted to land" — the paper's author considered the DEPIR-from-plain-LWE-in-the-standard-model the primary contribution, and the RAM-FHE is the application. - The Ethereum Foundation is the sole supporting institution for the paper's primary author — Keewoo Lee is the only listed author. The "barely" and the sole-authorship are signals of a single-author deep dive, not a multi-institution research program.

Why two papers in the same week from the same author?

The W41 cycle's Sep 30 sweep predicted "the W42 cycle's most-likely iacr.org paper is the Keewoo Lee / Ethereum Foundation 2-server IT-PIR (6−o(1))·log n bound (2026/1959)" — i.e., the W42 cycle's research column was expected to be the lower-bound paper's CRYPTO 2026 acceptance announcement. The W42 cycle's actual research column is two Keewoo Lee papers (SkrrtPIR + RAM-FHE) on different topics. The 2-server IT-PIR 6·log n bound is now a 23-day-old (Sep 13) ePrint without a CRYPTO 2026 acceptance announcement as of Oct 14.

The Sep 30 sweep's prediction of a "Burst of accepted-paper preprints" in the W42 cycle has been half-validated: the CRYPTO 2026 acceptance window closed Oct 12, but no CRYPTO 2026 acceptance announcement on a PIR paper has surfaced in the W42 cycle's ePrint activity. The CCS 2026 acceptance window closes Oct 22 (per the Sep 30 sweep's tracking) — i.e., the W43 cycle may see the CRYPTO + CCS announcement burst.

What we learn from the Keewoo Lee + Ethereum Foundation publication rate: - The Ethereum Foundation PIR research program is producing one paper per week (2026/1959 → 2026/2412 → 2026/2385) — three papers in 23 days. The Sep 23 / Sep 30 / Oct 7 sweep's "Lee is a single author at the Ethereum Foundation" reading is now confirmed as a sustained publication rate, not a one-off. - The topics form a single research line: 2-server IT-PIR lower bound (2026/1959) → RAM-FHE / DEPIR from plain LWE (2026/2412) → Batch PIR with no per-client state (2026/2385). The 2026/1959 lower bound motivates the other two (if 2-server IT-PIR cannot be sub-6·log n, then the ETH-Foundation line needs single-server PIR / DEPIR / Batch PIR, all of which are the Lee line). - The Sungshin Women's University co-authorship (SkrrtPIR) is the only non-Ethereum-Foundation co-authorship in the Lee line. The Sep 30 sweep's "Keewoo Lee is the single Keewoo Lee at the Ethereum Foundation" reading is now expanded: the Lee line is one Ethereum Foundation researcher + faculty collaborators as needed.

Story 2 — Apple 4-PR Burst (Oct 7) and 2-PR Follow-Up (Oct 12) Land on main

The Oct 7 sweep's prediction — "the W42 cycle's watch item is: does the 4-PR burst (Oct 4) start merging on Oct 7 → Oct 14? If any of #334 / #335 / #336 / #337 merge on Oct 7 → Oct 14, the production-branch stability materially improves — and a v1.0.8 release tag is plausible within the cycle" — is fully validated, and partly exceeded (the actual merge count is 5 PRs on main: #335 + #337 + #333 on Oct 7, then #334 + #336 on Oct 12).

The merge sequence (per apple/swift-homomorphic-encryption commits view Oct 14)

No v1.0.8 release tag yet — the four substantive PRs are squashed onto main, but the next semver release is not yet cut. The last Apple swift-homomorphic-encryption release was 1.0.7 on Jun 3, 2026 — now day 133. The Sep 30 sweep's "the v1.0.8 release tag is plausible within the cycle" prediction has not been validated — the cycle is halfway through, and the tag is plausibly in the W43 cycle (Oct 14 → Oct 21).

Author attribution

All 4 substantive W41-cluster PRs are authored by @deadcaf3 (Karl Tarbe; GPG key 9AAD1BD8BE87E79A; verified signature on every commit; user ID asxeem per the commit author line). The @deadcaf3 and @karulont accounts are the same person — the prior karulont authorship on PIRProcessDatabase: another workaround for "@main" (PR #193, Apr 7 2025), Remove client side bug workaround (PR #62, 2024), and Limit number of entries per response (PR #63, 2024) is the same engineer. The Oct 7 sweep's "Karl Tarbe / karulont" reading was the right person but the wrong GitHub handle; this sweep corrects it to Karl Tarbe / deadcaf3 / karulont.

What the W41 cycle's 4-PR merge means for the iOS 18 Live Caller ID / contact discovery consumer

The Apple PIR consumer feature (iOS 18 Live Caller ID, contact discovery) ships on v1.0.7 (now day 133) with all 5 substantive 2026-Q3 PIR-stack correctness PRs (#332 + #334 + #335 + #336 + #337) on main but not in a release tag. The v1.0.7 deployments are retrospectively affected by all 5 bugs: - #332 (Sep 25, MERGED): silent dropped entries on Cuckoo-table insert recursion + no-eviction-possible cases - #333 (Oct 7, MERGED): contributing guide update (housekeeping) - #334 (Oct 12, MERGED): silent data loss in multi-shard index configurations - #335 (Oct 7, MERGED): decryption failures when serializing fresh inner-product ciphertexts - #336 (Oct 12, MERGED): wrong entries in SimplePirServer<UInt32> 28-bit ciphertext modulus at lattice dim 2048 - #337 (Oct 7, MERGED): silent abort for Symmetric PIR values 998–1012 and 2022–2037 bytes

The W42 cycle is the first cycle in 2026 in which all 5 substantive 2026-Q3 PIR-stack correctness PRs are on main. The next Apple PIR consumer feature shipping event (iOS 19, macOS 16, or any 2026-Q4 consumer feature that uses swift-homomorphic-encryption) will ship on a release tag that includes the 5 PRs. The v1.0.8 release tag is the W42/W43 cycle's next event of interest.

Story 3 — RisePIR Source Code Still Private (Day 95)

The Sep 23 / Sep 30 / Oct 7 sweeps have each characterized the RisePIR source code as not yet externally auditable. The W42 sweep extends that to a 4-sweep-stale characterization as of Oct 14. Re-verified: - orochi-network/cuckoo-filter-rs — still 404 as of Oct 14 (the RisePIR paper's primary artifact). - orochi-network/orochimaru — last commit 95f95bd (2026-07-10, 95 days silent) "constraints/permutation_circuit.rs: PermutationCircuit::new_with_seeds" + "examples/backend-benchmark.rs: apples-to-apples benchmark (setup/prove/verify/proof-size) for both backends on equal-size traces" + "zincplus/README.md: replace the MockProver table with the real comparison and update the migration plan" by bao-ninh-orochi + on-unknown-fish. The orochimaru push dates advanced in the Sep 30 sweep from 2026-07-27 back to 2026-07-10 (this sweep confirms 2026-07-10 from the commits view). The W42 sweep's "orochimaru release" prediction has not materialized — the prior Sep 23 / Sep 30 / Oct 7 sweep's three-orochimaru-release predictions were all wrong, and the W42 cycle confirms the same. The 4-sweep-stale characterization is now a stable signal, not a one-off. - orochi-network/orochi-multicast (multicall.js alternative, 0 stars) — last pushed 2024-03-13. No change. - orochi-network/orochi-observer (blockchain observer) — last pushed 2022-08-04. No change. - orochi-network/orochi-wallet-connector — last pushed 2022-05-24. No change.

Orochi Network X account activity (W42 cycle)

The Orochi Network X account (122.3K followers, joined March 2022) is active in the W42 cycle, with the following W42-window posts: - Oct 10 — "A few moments from our @token2049 week in Singapore. Thanks to everyone who visited our booth and joined our co-founder @Chiro8x at the Privacy Summit by @StarkWareLtd." (10 likes) — first public marketing output since the Sep 22-28 cluster. - Oct 6 — "Orochi Network Research Paper Accepted at CANS 2026. We are pleased to announce that a research paper by Orochi Network researcher Bao Ninh has been accepted at the 25th International Conference on Cryptology and Network Security (CANS 2026). Paper: eprint.iacr.org/2026/2082." (8 likes) — first public mention of the CANS 2026 acceptance since the Sep 18 ePrint publication; the W41 cycle's "the team's first public output is the CANS-acceptance tweet" reading is now confirmed.

The W42 cycle's engineering signal from Orochi is unchanged (the engineering signal is "no new commits / no source-code release"); the marketing signal is up (Token2049 + StarkWare Privacy Summit + CANS 2026 acceptance tweet). The two signals are independent — the marketing signal does not predict the engineering signal, and the engineering signal does not depend on the marketing signal.

Why this matters for the W42 cycle

The W42 cycle's most-likely engineering event was "RisePIR source goes public" (per the Sep 30 sweep's prediction). That event has not materialized. The W42 cycle's most-likely next event — a v1.0.8 release tag for swift-homomorphic-encryption (per this sweep's analysis) — is the W43 cycle's most-likely event if the v1.0.8 tag is cut on Oct 14 → Oct 21.

The W42 cycle's headline characterization is "research-result + production-hardening, with the research line led by the Ethereum Foundation + Keewoo Lee (one paper per week) and the production-hardening line led by Apple + deadcaf3 (5 substantive PRs on main in 17 days, 4-PR cluster + #333 housekeeping)". The W42 cycle's research-result column is the two Keewoo Lee papers (SkrrtPIR + Barely Sublinear RAM-FHE); the W42 cycle's production-hardening column is the 5-PR Apple merge cluster.

Story 4 — Kohaku: Privacy Pools v1 Plumbing Continues, No PIR-Tagged PRs

Kohaku churn in the Oct 7 → Oct 14 window: 7 PRs / commits, of which the W42-cycle-relevant entries are:

The Sep 30 → Oct 7 cluster's #286 / #304 / #308 / #298 / #300 / #301 / #302 / #305 / #306 / #307 / #309 / #310 / #311 / #313 entries are now closed/merged. The Sep 30 → Oct 7 "13-of-14 PRs in the cluster" reading is now confirmed (the 4-PR open cluster as of Oct 14 is #316 + #312 + #258 + the W41 readme housekeeping).

No new PIR-tagged PRs in the W42 window. The TEE+ORAM-now / PIR-later layering from the Aug 19 sweep is intact. The Sep 30 sweep's "Kohaku's next TEE+ORAM PR cluster is the production-readiness milestone for the in-browser-Tor path" prediction has not materialized — the W42 cycle's Kohaku churn is all Privacy Pools v1 plumbing, no network-privacy / anon-rpc follow-up.

The W42 cycle's Kohaku read: the Sep 26 anon-rpc merge (#271) is the only network-privacy milestone in the Sep 23 → Oct 14 window (across 21 days), and the W42 cycle has no anon-rpc follow-up PR. The Sep 30 sweep's "W42 cycle's watch item is: does any Kohaku PR in the Oct 7 → Oct 14 window carry a PIR tag?" is answered: no.

Story 5 — SandwichPIR Stable at 2 Stars (47 Days)

SandwichPIR at sidsabh/sandwichpir is stable at 2 stars / 0 forks / 0 issues / 0 PRs for 47 days since the Aug 28 reference implementation commit. The Aug 25 v0.1.0 release tag is still the only release. The hardware-moat narrative is unchanged (CUDA 12.4 + L40S + CUTLASS 3.5.1 + saturating-int8 patch).

The W42 cycle's SandwichPIR watch item is "does any external contributor fork the sammy-repo?" — the answer is no. The 47-day external-contributor-silence is now 47 days — 7 days longer than the W41 sweep's 40-day counter. The Sep 30 sweep's "the next SandwichPIR adoption event would be a fork from a private-Wikipedia search project, a Tiptoe-class deployment, or a Bittorrent-pattern query layer" prediction has not materialized.

The Sep 30 sweep's "SandwichPIR is the headline 88× CPU best, $0.20 M-query private Wikipedia" claim is unchanged; the repo's adoption profile is "high-impact paper + hardware moat that has not been crossed by any external contributor" — and the hardware-moat narrative is now a 47-day story, no longer a 33-day or 40-day story.

Story 6 — No OpenMined/PIR Activity (5y 6m + 11 days)

OpenMined/PIR (OpenMined/PIR) is still silent since 2021-04-03 (commit e039662, "update depends (#45)" by Bogdan Cebere), 5 years and 6 months and 11 days of no activity as of Oct 14. 46 stars / 10 forks / 16 open issues (the bulk pre-2022). No commits, no issues, no PRs in the W42 window.

The Sep 30 sweep's "the next OpenMined/PIR activity event would be a revival by a privacy-preserving ML project" prediction has not materialized. The Sep 30 sweep's 4-sweep-stale characterization is now a 5-sweep-stale characterization. The W42 cycle confirms: the OpenMined/PIR Bazel-based C++/SEAL stack is functionally dead, and the natural successor (orochi-network/orochimaru, 80 stars / 35 forks / 15 open issues / 95 days silent) is the only active successor in the github.com search results.

Story 7 — ESCAPE (Virginia Tech + Bosch RTC) Follow-Up Activity

The W41 cycle noted that ESCAPE (ePrint 2026/2033, Sep 20, Virginia Tech + Bosch RTC) is the first single-server Online-Offline PIR with on-the-fly sublinear hint refresh (no periodic rebuild), with <1 s latency for 1–8 TiB databases, 2× lower bandwidth / 3× lower compute than SOTA, open-source release. The W41 cycle's "ESCAPE follow-up ePrint or GitHub release" watch item was unanswered as of Oct 7.

The W42 cycle: - No second ePrint from the ESCAPE team in the W42 window (the eprint.iacr.org search for "private information retrieval" did not surface a 2026/2400-range ESCAPE follow-up). - The github.com search "escaper-extension" (a likely repo name for the ESCAPE extension) surfaces a Virginia Tech + Bosch RTC "escaper-extension" repository that appeared in the search results — the repo is in the github.com search index but the ePrint still does not cite the repo URL, and the search-result is a third-party repo, not the official release. The Sep 30 sweep's "ESCAPE open-source release" claim has not been corroborated by an authoritative GitHub release as of Oct 14. - The W42 cycle's ESCAPE watch item is now: does the official ESCAPE repo appear on the Virginia Tech or Bosch RTC GitHub organization in the W43 cycle (Oct 14 → Oct 21)? The W43 cycle is the most-likely next window for the ESCAPE open-source release to materialize.

Maturity Tracking — W42 Cycle

The W42 cycle shifts one maturity column from the Oct 7 sweep:

ETeleology — Where the W42 Cycle Sits in the Larger Story

The Oct 14 weekly update is the W42 cycle's PIR observation — and the W42 cycle is the post-CANS-2026 hardening-and-deployment + Keewoo Lee publication-rate window. The W42 cycle's headline is the two Keewoo Lee + Ethereum Foundation papers in the same week (SkrrtPIR + Barely Sublinear RAM-FHE).

For the September 14 → October 14 W42 cycle, the Sep 30 → Oct 7 → Oct 14 windows are three observation windows: - Sep 30 → Oct 7 (W41) — Apple 4-PR burst, no new ePrint papers, RisePIR source private, OpenMined silent. - Oct 7 → Oct 14 (W42) — Apple 5-PR merge cluster (4 substantive + 1 housekeeping), two Keewoo Lee papers in the same week (SkrrtPIR + RAM-FHE), RisePIR source private, OpenMined silent, SandwichPIR stable at 2 stars. - Oct 14 → Oct 21 (W43) — what to watch: (i) Apple v1.0.8 release tag (does the 5-PR cluster get a semver cut?); (ii) RisePIR source goes public? (the 95-day post-publication window continues; the W43 cycle is the cycle in which the 100-day mark falls); (iii) Kohaku no PIR-tagged PRs? (does the W43 cycle see the first post-#271 anon-rpc follow-up?); (iv) SandwichPIR stays at 2 stars? (the 47-day counter advances to 54 days); (v) OpenMined/PIR stays at 5y 6m + 18 days silent? (does any contributor surface?); (vi) any new ePrint PIR papers (CRYPTO 2026 acceptance window closed Oct 12; CCS 2026 acceptance window closes Oct 22; SCN 2026 acceptance window closes Nov 2 — does the W43 cycle see the CRYPTO + CCS announcement burst?); (vii) any new Keewoo Lee + Ethereum Foundation paper (the one-paper-per-week rate suggests the W43 cycle may see paper #4); (viii) the ESCAPE official repo on Virginia Tech or Bosch RTC GitHub organization (does the open-source release materialize in the W43 cycle?).

The W42 cycle's posture: - Active Apple PIR-stack hardening is now closed (all 5 PRs on main). The Apple PIR backend is pre-v1.0.8 readiness (5-PR cluster on main, no release tag). - Active Ethereum Foundation PIR research line (one paper per week; 3 papers in 23 days; the 4th is plausibly in the W43 cycle). - No new opens in the W42 cycle — the W42 cycle's production-PR cluster was the closure of the W41 cycle's opens. - No new research result in the W42 cycle beyond the two Keewoo Lee papers.

The W42 cycle's evidence-at-a-glance table:

What's Next (W43 Cycle, Oct 14 → Oct 21)

8 PIR signals to track in the W43 cycle:

1. Apple v1.0.8 release tag. The 5-PR cluster is on main; the next Apple PIR consumer feature shipping event (iOS 19, macOS 16, or any 2026-Q4 consumer feature) will ship on a release tag that includes the 5 PRs. The v1.0.8 release tag is the W43 cycle's most-likely event. The cycle's natural cut-point is when the engineering team is satisfied that no further correctness PRs are needed — the Sep 25 → Oct 12 burst may or may not be the last burst. If the 5-PR cluster is the last, v1.0.8 ships in the W43 cycle. If the engineering team is finding more correctness issues, v1.0.8 ships in the W44 or W45 cycle.
2. RisePIR source goes public. It is now 26 days past Sep 18 ePrint publication (advancing from 19 days at Oct 7). The Sep 23 / Sep 30 / Oct 7 / Oct 14 sweeps have each characterized the source as not-yet-public. The W43 cycle's watch item is: does the orochimaru release materialize? The Oct 14 sweep confirms the push date as 2026-07-10 (95 days silent), and the W43 cycle's most-likely event is the orochimaru release if the engineering team is preparing one. If it does, the W43 cycle's headline event is "RisePIR source goes public", and the 4-sweep streak of "RisePIR source not public" closes.
3. Kohaku PIR-tagged PR activity. The Oct 14 sweep characterized the Oct 7 → Oct 14 window as "no new PIR-tagged PRs" (4-PR open cluster: #316 + #312 + #258 + W41 readme housekeeping). The W43 cycle's watch item is: does any Kohaku PR in the Oct 14 → Oct 21 window carry a PIR tag? The PIR-stack technical direction in Kohaku is TEE+ORAM-now / PIR-later (Aug 19 sweep). The next TEE+ORAM PR cluster in Kohaku is the production-readiness milestone for the in-browser-Tor path — and the W43 cycle is the cycle in which the in-browser-Tor path could become "first wallet to ship in-browser Tor by default".
4. SandwichPIR adoption activity. The Oct 14 sweep characterized SandwichPIR as 2 stars / 0 forks / 0 issues / 0 PRs for 47 days. The W43 cycle's watch item is: does any external contributor fork the sammy-repo? The repo's hardware moat (CUDA 12.4 + L40S) has not been crossed. The next SandwichPIR adoption event would be a fork from a private-Wikipedia search project, a Tiptoe-class deployment, or a Bittorrent-pattern query layer.
5. OpenMined/PIR activity. The Oct 14 sweep characterized OpenMined/PIR as silent since 2021-04-03 (5y 6m 11 days). The W43 cycle's watch item is: does any OpenMined contributor surface? The repo's Bazel-based C++/SEAL stack is functionally dead. The next OpenMined/PIR activity event would be a revival by a privacy-preserving ML project (a C++ FHE library fork, a Bazel SEAL upgrade, or a SEAL-stack-level contributor) — or the next OpenMined/PIR activity event is the W43 sweep's confirmation that the repo is still silent.
6. New PIR ePrint papers. The W42 cycle had 2 new PIR ePrint papers (SkrrtPIR 2385 Oct 6 + RAM-FHE 2412 Oct 8). The W43 cycle's watch item is: does the post-CRYPTO-2026-acceptance-window-closure (Oct 12) cycle produce a burst of accepted-paper preprints? The CCS 2026 acceptance window closes Oct 22 (per the Sep 30 sweep's tracking). If any CCS 2026 paper on PIR is released as an ePrint in the Oct 14 → Oct 21 window, the W43 cycle's headline event is the CCS 2026 PIR paper. The most-likely iacr.org paper for the W43 cycle is the Keewoo Lee + Ethereum Foundation 4th paper in 23 days — if the one-paper-per-week rate holds, the W43 cycle (Oct 14 → Oct 21) is the cycle in which the 4th Keewoo Lee + Ethereum Foundation paper lands.
7. ESCAPE official GitHub release. The W42 sweep characterized ESCAPE as "the open-source release has not produced a public GitHub URL surfaced in our searches". The W43 cycle's watch item is: does the official ESCAPE repo appear on the Virginia Tech or Bosch RTC GitHub organization in the W43 cycle? The "escaper-extension" search result is a third-party repo, not the official release. The W43 cycle is the cycle in which the ESCAPE open-source release is most likely to materialize, given the CANS 2026 acceptance (Sep 24) + ePrint publication (Sep 20) + the engineering timeline for a Rust-based release.
8. CRYPTO 2026 acceptance announcement for the Keewoo Lee + Ethereum Foundation 2-server IT-PIR 6·log n lower bound (2026/1959). The Sep 30 sweep predicted "the Keewoo Lee paper is iacr.org/2026/1959 — the W42 cycle's most-likely research-result event is a CCS 2026 acceptance announcement or an Open Mined-Seal-IR revision of the bound." The W42 cycle did not surface the CRYPTO 2026 acceptance announcement. The W43 cycle (Oct 14 → Oct 21) is the cycle in which the CRYPTO 2026 acceptance announcements are most likely to surface as ePrint revisions — the iacr.org search index is the W43 cycle's most-likely surface for the CRYPTO 2026 + CCS 2026 acceptance announcement burst.

Appendix — Full Apple PIR PR Cluster Body Quotes (Oct 12 + Oct 7 commit references)

The Oct 7 sweep's appendix has the full PR #337 / #336 / #335 / #334 body quotes. The W42 cycle adds: - The Oct 12 squash-merge commits (8f122150 for #334 + 76fddecb for #336) — the commit messages are the squash-merge messages GitHub auto-generates, e.g., "Fix sharded index database overwriting its output files (#334) (#334)" with the squash-merge commit author = deadcaf3 (the same as the original PR author). The squash-merge commit is what the apple/swift-homomorphic-encryption commits view shows under the "Oct 12, 2026" group. - The Oct 7 follow-up commit in #334's PR — extends the indexDatabaseShardID regression test to cover maxShardCount and requirePowerOfTwoShardCount. The follow-up commit message is: "Sharding equality also compares maxShardCount and requirePowerOfTwoShardCount, so a single-shard index config that set either option was rejected for lacking 'SHARD_ID'. Compare the strategy against .shardCount(1) instead of the whole value. Extend the regression test to cover the other sharding options." (per #334 PR thread). - The author attribution is deadcaf3 (not karulont) — the prior Oct 7 sweep's "Karl Tarbe / karulont" was the right person but the wrong handle. The correct attribution is Karl Tarbe / @deadcaf3 / @karulont (two GitHub accounts, same engineer).

Appendix — SkrrtPIR (ePrint 2026/2385) BibTeX

@misc{cryptoeprint:2026/2385,
      author = {Keewoo Lee and Yongha Son},
      title = {{SkrrtPIR}: Doubly-Stateless Batch {PIR} from Single-Key {RLWE} Unpacking},
      howpublished = {Cryptology {ePrint} Archive, Paper 2026/2385},
      year = {2026},
      url = {https://eprint.iacr.org/2026/2385}
}

Appendix — Barely Sublinear RAM-FHE from Plain LWE (ePrint 2026/2412) BibTeX

@misc{cryptoeprint:2026/2412,
      author = {Keewoo Lee},
      title = {Barely Sublinear {RAM}-{FHE} from Plain {LWE}},
      howpublished = {Cryptology {ePrint} Archive, Paper 2026/2412},
      year = {2026},
      url = {https://eprint.iacr.org/2026/2412}
}