CRYSTALS - Kyber: A CCA-Secure Module-Lattice-Based KEM
Open accessAbstract
Rapid advances in quantum computing, together with the announcement by the National Institute of Standards and Technology (NIST) to define new standards for digitalsignature, encryption, and key-establishment protocols, have created significant interest in post-quantum cryptographic schemes. This paper introduces Kyber (part of CRYSTALS - Cryptographic Suite for Algebraic Lattices - a package submitted to NIST post-quantum standardization effort in November 2017), a portfolio of post-quantum cryptographic primitives built around a key-encapsulation mechanism (KEM), based on hardness assumptions over module lattices. Our KEM is most naturally seen as a successor to the NEWHOPE KEM (Usenix 2016). In particular, the key and ciphertext sizes of our new construction are about half the size, the KEM offers CCA instead of only passive security, the security is based on a more general (and flexible) lattice problem, and our optimized implementation results in essentially the same running time as the aforementioned scheme. We first introduce a CPA-secure public-key encryption scheme, apply a variant of the Fujisaki-Okamoto transform to create a CCA-secure KEM, and eventually construct, in a black-box manner, CCA-secure encryption, key exchange, and authenticated-key-exchange schemes. The security of our primitives is based on the hardness of Module-LWE in the classical and quantum random oracle models, and our concrete parameters conservatively target more than 128 bits of postquantum security.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
CRYSTALS-Kyber is a key encapsulation mechanism based on the module learning-with-errors problem.
“CRYSTALS-Kyber is a Key Encapsulation Mechanism (KEM) based on the module learning-with-errors (MLWE) problem [12,13].”
From A Practical Performance Benchmark of Post-Quantum Cryptography Across Heterogeneous Computing Environments (2025) · cites this paper as [12]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
An algorithm for the machine calculation of complex Fourier series
Cooley, J. W., & Tukey, J. W. (1965) · Mathematics of Computation · doi:10.1090/s0025-5718-1965-0178586-1 · Cited by 13,154 · see citing works
A fast quantum mechanical algorithm for database search
Grover, L. K. (1996) · Proceedings of the twenty-eighth annual ACM symposium on Theory of computing - STOC '96 · doi:10.1145/237814.237866 · Cited by 8,830 · see citing works
Bellare, M., & Rogaway, P. (1993) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/168588.168596 · Cited by 4,695 · see citing works
On lattices, learning with errors, random linear codes, and cryptography
Regev, O. (2005) · ACM Symposium on Theory of Computing (STOC) · doi:10.1145/1060590.1060603 · Cited by 2,383 · see citing works
Superconducting Circuits for Quantum Information: An Outlook
Devoret, M., & Schoelkopf, R. J. (2013) · Science · doi:10.1126/science.1231930 · Cited by 2,122 · see citing works
NTRU: A ring-based public key cryptosystem
Hoffstein, J., Pipher, J., & Silverman, J. H. (1998) · Lecture Notes in Computer Science · doi:10.1007/bfb0054868 · Cited by 1,947 · cited 1× · see citing works
“Based on the idea from the NTRU cryptosystem [43] of working with elements over polynomial rings rather than over the integers, and following a series of works on this topic [58], [56], [63], [71], Lyubashevsky et al.”
On Ideal Lattices and Learning with Errors over Rings
Lyubashevsky, V., Peikert, C., & Regev, O. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-13190-5_1 · Cited by 1,908 · see citing works
Self-citation(Leveled) fully homomorphic encryption without bootstrapping
Brakerski, Z., Gentry, C., & Vaikuntanathan, V. (2012) · Conference on Innovations in Theoretical Computer Science · doi:10.1145/2090236.2090262 · Cited by 1,825 · see citing works
Analysis of Key-Exchange Protocols and Their Use for Building Secure Channels
Canetti, R., & Krawczyk, H. (2001) · Lecture notes in computer science · doi:10.1007/3-540-44987-6_28 · Cited by 1,706 · see citing works
Secure Integration of Asymmetric and Symmetric Encryption Schemes
Fujisaki, E., & Okamoto, T. (1999) · Lecture notes in computer science · doi:10.1007/3-540-48405-1_34 · Cited by 1,156 · see citing works
Non-Interactive Zero-Knowledge Proof of Knowledge and Chosen Ciphertext Attack
Rackoff, C., & Simon, D. R. (2007) · Springer eBooks · doi:10.1007/3-540-46766-1_35 · Cited by 1,046 · see citing works
Report on Post-Quantum Cryptography
Chen, L., Jordan, S., Liu, Y.-K., Moody, D., Peralta, R., Perlner, R., & Smith-Tone, D. (2016) · doi:10.6028/nist.ir.8105 · Cited by 1,034 · see citing works
Cramer, R., & Shoup, V. (2003) · SIAM Journal on Computing · doi:10.1137/s0097539702403773 · Cited by 988 · see citing works
Public-key cryptosystems from the worst-case shortest vector problem
Peikert, C. (2009) · ACM Symposium on Theory of Computing (STOC) · doi:10.1145/1536414.1536461 · Cited by 821 · see citing works
Worst-case to average-case reductions for module lattices
Roux-Langlois, A., & Stehlé, D. (2014) · Designs Codes and Cryptography · doi:10.1007/s10623-014-9938-4 · Cited by 651 · see citing works
A public-key cryptosystem with worst-case/average-case equivalence
Ajtai, M., & Dwork, C. (1997) · ACM Symposium on Theory of Computing (STOC) · doi:10.1145/258533.258604 · Cited by 649 · see citing works
Classical hardness of learning with errors
Brakerski, Z., Roux-Langlois, A., Peikert, C., et al. (2013) · ACM Symposium on Theory of Computing (STOC) · doi:10.1145/2488608.2488680 · Cited by 634 · see citing works
Fast Cryptographic Primitives and Circular-Secure Encryption Based on Hard Learning Problems
Applebaum, B., Cash, D., Peikert, C., & Sahai, A. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-03356-8_35 · Cited by 570 · see citing works
Post-quantum key exchange - a new hope.
Alkım, E., Ducas, L., Pöppelmann, T., & Schwabe, P. (2015) · Cited by 512 · see citing works
Self-citationThe Fast Fourier Transform in a Finite Field
Pollard, J. M. (1971) · Mathematics of Computation · doi:10.1090/s0025-5718-1971-0301966-0 · Cited by 469 · see citing works
Random Oracles in a Quantum World
Boneh, D., Dagdelen, Ö., Fischlin, M., Lehmann, A., Schaffner, C., & Zhandry, M. (2011) · Lecture notes in computer science · doi:10.1007/978-3-642-25385-0_3 · Cited by 467 · see citing works
A Modular Analysis of the Fujisaki-Okamoto Transformation
Hofheinz, D., Hövelmanns, K., & Kiltz, E. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-70500-2_12 · Cited by 452 · see citing works
Self-citationEfficient Public Key Encryption Based on Ideal Lattices
Stehlé, D., Steinfeld, R., Tanaka, K., & Xagawa, K. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-10366-7_36 · Cited by 371 · see citing works
Lattice Cryptography for the Internet
Peikert, C. (2014) · Lecture notes in computer science · doi:10.1007/978-3-319-11659-4_12 · Cited by 361 · see citing works
Post-Quantum Key Exchange for the TLS Protocol from the Ring Learning with Errors Problem
Bos, J. W., Costello, C., Naehrig, M., & Stebila, D. (2015) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2015.40 · Cited by 340 · see citing works
Self-citationBos, J. W., Costello, C., Ducas, L., Mironov, I., Naehrig, M., Nikolaenko, V., Raghunathan, A., & Stebila, D. (2016) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2976749.2978425 · Cited by 324 · see citing works
Self-citationGeneralized Compact Knapsacks Are Collision Resistant
Lyubashevsky, V., & Micciancio, D. (2006) · Lecture notes in computer science · doi:10.1007/11787006_13 · Cited by 282 · see citing works
Self-citationSpeeding up the Number Theoretic Transform for Faster Ideal Lattice-Based Cryptography
Longa, P., & Naehrig, M. (2016) · Lecture notes in computer science · doi:10.1007/978-3-319-48965-0_8 · Cited by 274 · see citing works
More on average case vs approximation complexity
Alekhnovich, M. (2004) · Annual Symposium on Foundations of Computer Science · doi:10.1109/sfcs.2003.1238204 · Cited by 248 · see citing works
Efficient Algorithms for Supersingular Isogeny Diffie-Hellman
Costello, C., Longa, P., & Naehrig, M. (2016) · Lecture notes in computer science · doi:10.1007/978-3-662-53018-4_21 · Cited by 234 · see citing works
Efficient Collision-Resistant Hashing from Worst-Case Assumptions on Cyclic Lattices
Peikert, C., & Rosen, A. (2006) · Lecture notes in computer science · doi:10.1007/11681878_8 · Cited by 230 · see citing works
A Simple Provably Secure Key Exchange Scheme Based on the Learning with Errors Problem.
Ding, J. (2012) · Cited by 215 · see citing works
The Security Impact of a New Cryptographic Library
Bernstein, D. J., Lange, T., & Schwabe, P. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-33481-8_9 · Cited by 208 · see citing works
Self-citationA Hybrid Lattice-Reduction and Meet-in-the-Middle Attack Against NTRU
Howgrave-Graham, N. (2007) · Springer eBooks · doi:10.1007/978-3-540-74143-5_9 · Cited by 193 · see citing works
A Subfield Lattice Attack on Overstretched NTRU Assumptions
Albrecht, M. R., Bai, S., & Ducas, L. (2016) · Lecture notes in computer science · doi:10.1007/978-3-662-53018-4_6 · Cited by 191 · see citing works
Self-citationThe Fast Fourier Transform in a Finite Field
Pollard, J. M. (1971) · Mathematics of Computation · doi:10.2307/2004932 · Cited by 190 · see citing works
Authenticated Key Exchange from Ideal Lattices
Zhang, J., Zhang, Z., Ding, J., Snook, M., & Dagdelen, Ö. (2015) · Lecture notes in computer science · doi:10.1007/978-3-662-46803-6_24 · Cited by 184 · see citing works
Towards Practical Lattice-Based Public-Key Encryption on Reconfigurable Hardware
Pöppelmann, T., & Güneysu, T. E. (2014) · Lecture notes in computer science · doi:10.1007/978-3-662-43414-7_4 · Cited by 163 · see citing works
Recovering Short Generators of Principal Ideals in Cyclotomic Rings
Cramer, R., Ducas, L., Peikert, C., & Regev, O. (2016) · Lecture notes in computer science · doi:10.1007/978-3-662-49896-5_20 · Cited by 136 · see citing works
Self-citationRevisiting Lattice Attacks on Overstretched NTRU Parameters
Kirchner, P., & Fouque, P.-A. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-56620-7_1 · Cited by 133 · see citing works
Post-Quantum Security of the Fujisaki-Okamoto and OAEP Transforms
Ebrahimi, E., & Unruh, D. (2016) · Lecture notes in computer science · doi:10.1007/978-3-662-53644-5_8 · Cited by 124 · see citing works
Tightly-Secure Key-Encapsulation Mechanism in the Quantum Random Oracle Model
Saito, T., Xagawa, K., & Yamakawa, T. (2018) · Lecture notes in computer science · doi:10.1007/978-3-319-78372-7_17 · Cited by 124 · see citing works
PKCS #1: RSA Cryptography Specifications Version 2.2
Kaliski, B. S., Jönsson, J., & Rusch, A. (2016) · doi:10.17487/rfc8017 · Cited by 123 · see citing works
McBits: Fast Constant-Time Code-Based Cryptography
Bernstein, D. J., Chou, T., & Schwabe, P. (2013) · Lecture notes in computer science · doi:10.1007/978-3-642-40349-1_15 · Cited by 123 · see citing works
Self-citationShort Stickelberger Class Relations and Application to Ideal-SVP
Cramer, R., Ducas, L., & Wesolowski, B. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-56620-7_12 · Cited by 109 · see citing works
Self-citationOn the Hardness of Learning with Rounding over Small Modulus
Bogdanov, A., Guo, S., Masny, D., et al. (2015) · Lecture notes in computer science · doi:10.1007/978-3-662-49096-9_9 · Cited by 106 · see citing works
Efficient One-Round Key Exchange in the Standard Model
Boyd, C., Cliff, Y., Nieto, J. G., et al. (2008) · Lecture notes in computer science · doi:10.1007/978-3-540-70500-0_6 · Cited by 104 · see citing works
Bai, S., Roux-Langlois, A., Lepoint, T., et al. (2015) · Lecture notes in computer science · doi:10.1007/978-3-662-48797-6_1 · Cited by 101 · see citing works
Self-citationBiasse, J., & Song, F. (2015) · ACM-SIAM Symposium on Discrete Algorithms (SODA) · doi:10.1137/1.9781611974331.ch64 · Cited by 100 · see citing works
High-Speed Key Encapsulation from NTRU
Hülsing, A., Rijneveld, J., Schanck, J. M., & Schwabe, P. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-66787-4_12 · Cited by 99 · see citing works
Self-citationChoosing Parameters for NTRUEncrypt
Hoffstein, J., Pipher, J. C., Schanck, J. M., Silverman, J. H., Whyte, W., & Zhang, Z. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-52153-4_1 · Cited by 95 · see citing works
Self-citationStrongly Secure Authenticated Key Exchange from Factoring, Codes, and Lattices
Fujioka, A., Suzuki, K., Xagawa, K., & Yoneyama, K. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-30057-8_28 · Cited by 93 · see citing works
New lattice based cryptographic constructions
Regev, O. (2003) · ACM Symposium on Theory of Computing (STOC) · doi:10.1145/780542.780603 · Cited by 84 · see citing works
NewHope without reconciliation.Preprint
Alkım, E., Ducas, L., Pöppelmann, T., & Schwabe, P. (2016) · IACR Cryptology ePrint Archive · Cited by 76 · see citing works
Self-citationChaCha20-Poly1305 Cipher Suites for Transport Layer Security (TLS)
Langley, A., Chang, W., Mavrogiannopoulos, N., et al. (2016) · doi:10.17487/rfc7905 · Cited by 74 · see citing works
Lizard: Cut Off the Tail! A Practical Post-quantum Public-Key Encryption from LWE and LWR
Cheon, J. H., Kim, D., Lee, J., & Song, Y. (2018) · Lecture notes in computer science · doi:10.1007/978-3-319-98113-0_9 · Cited by 74 · see citing works
(Tightly) QCCA-Secure Key-Encapsulation Mechanism in the Quantum Random Oracle Model
Xagawa, K., & Yamakawa, T. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-25510-7_14 · Cited by 64 · see citing works
Albrecht, M. R., Bai, S., & Ducas, L. (2016) · IACR Cryptology ePrint Archive · Cited by 42 · see citing works
Self-citationAdiantum: length-preserving encryption for entry-level processors
Crowley, P., & Biggers, E. (2018) · DOAJ (DOAJ: Directory of Open Access Journals) · doi:10.13154/tosc.v2018.i4.39-61 · Cited by 37 · see citing works
Speeding up R-LWE Post-quantum Key Exchange
Gueron, S., & Schlieker, F. (2016) · Lecture notes in computer science · doi:10.1007/978-3-319-47560-8_12 · Cited by 32 · see citing works
Optimal Key Consensus in Presence of NoisePreprint
Jin, Z., & Zhao, Y. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1611.06150 · Cited by 30 · see citing works
Improved cryptographic hash functions with worst-case/average-case connection
Micciancio, D. (2002) · doi:10.1145/509907.509995 · Cited by 28 · see citing works
Revisiting the Hybrid Attack: Improved Analysis and Refined Security Estimates
Wunderer, T. (2016) · TUbilio (Technical University of Darmstadt) · Cited by 22 · see citing works
A Practical Post-Quantum Public-Key Cryptosystem Based on $$\textsf {spLWE}$$
Cheon, J. H., Han, K., Kim, J., et al. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-53177-9_3 · Cited by 20 · see citing works
SPRING: Fast Pseudorandom Functions from Rounded Ring Products
Banerjee, A., Brenner, H., Leurent, G., Peikert, C., & Rosen, A. (2015) · Lecture notes in computer science · doi:10.1007/978-3-662-46706-0_3 · Cited by 18 · see citing works
Lizard: Cut off the Tail! // Practical Post-Quantum Public-Key Encryption from LWE and LWR.Preprint
Cheon, J. H., Kim, D., Lee, J., et al. (2016) · IACR Cryptology ePrint Archive · Cited by 15 · see citing works
Improved cryptographic hash functions with worst-case/average-case connection
Micciancio, D. (2002) · doi:10.1145/509994.509995 · Cited by 5 · see citing works
A Quantum Attack on LWE with Arbitrary Error Distribution.Preprint
Göpfert, F., van Vredendaal, C., & Wunderer, T. (2017) · IACR Cryptology ePrint Archive · Cited by 2 · see citing works
Flagged first, then by citations
Research works printed but not linked: 7
- Abhishek Banerjee, Chris Peikert, and Alon Rosen. 2012. Pseudorandom Func- tions and Lattices. In EUROCRYPT 2012 (LNCS), David Pointcheval and Thomas Johansson (Eds.), Vol. 7237. Springer, Heidelberg, 719-737.
- Daniel J. Bernstein. 2008. ChaCha, a variant of Salsa20. In Workshop Record of SASC 2008: The State of the Art of Stream Ciphers. http://cr.yp.to/papers.html# chacha.
- Joppe W. Bos, Craig Costello, Léo Ducas, Ilya Mironov, Michael Naehrig, Valeria Nikolaenko, Ananth Raghunathan, and Douglas Stebila. 2016. Frodo: Take off the Ring! Practical, Quantum-Secure Key Exchange from LWE. In ACM CCS 16, Edgar R. Weippl, Stefan Katzenbeisser, Christopher Kruegel, Andrew C. Myers, and Shai Halevi (Eds.). ACM Press, 1006-1018.
- Peter Campbell, Michael Groves, and Dan Shepherd. 2014. Soliloquy: A caution- ary tale. In ETSI 2nd Quantum-Safe Crypto Workshop. 1-9.
- Tim Güneysu, Tobias Oder, Thomas Pöppelmann, and Peter Schwabe. 2013. Software speed records for lattice-based signatures. In Post-Quantum Cryp- tography (LNCS), Philippe Gaborit (Ed.), Vol. 7932. Springer, 67-82. http: //cryptojedi.org/papers/#lattisigns.
- Menezes (Ed.). LNCS, Vol. 4622. Springer, 150-169. http://www.iacr.org/archive/ crypto2007/46220150/46220150.pdf.
- Thijs Laarhoven. 2015. Search problems in cryptography. Ph.D. Dissertation. Eindhoven University of Technology. http://www.thijs.com/docs/phd-final.pdf.
Cited by
Sorted by citations
Fernandez-Carames, T. M., & Fraga-Lamas, P. (2020) · IEEE Access · doi:10.1109/access.2020.2968985 · Cited by 607 · see citing works
Status report on the third round of the NIST Post-Quantum Cryptography Standardization process
Alagic, G., Apon, D., Cooper, D., Dang, Q., Dang, T., Kelsey, J., Lichtinger, J., Liu, Y.-K., Miller, C., Moody, D., et al. (2022) · doi:10.6028/nist.ir.8413-upd1 · Cited by 301 · see citing works
Abbasi, M., Cardoso, F., Váz, P., Silva, J., & Martins, P. (2025) · Cryptography · doi:10.3390/cryptography9020032 · Cited by 76 · see citing works
“CRYSTALS-Kyber is a Key Encapsulation Mechanism (KEM) based on the module learning-with-errors (MLWE) problem [12,13].”
Anonymous lattice-based authentication protocol for vehicular communications
Shahidinejad, A., Abawajy, J., & Huda, S. (2024) · Vehicular Communications · doi:10.1016/j.vehcom.2024.100803 · Cited by 11 · see citing works
Post-Quantum Key Encapsulation Mechanisms: A Comparative Review of ML-KEM, BIKE, and HQC
Reazaei, P., Rashid, A. S. K., Mand, A. A., & Saberikamarposhti, M. (2026) · 2026 22nd IEEE International Colloquium on Signal Processing & Its Applications (CSPA) · doi:10.1109/cspa68262.2026.11517877 · Cited by 1 · see citing works
Segar, N., & Vijayan, V. (2026) · Frontiers in Artificial Intelligence · doi:10.3389/frai.2026.1804943
“These algorithms derive security from the computational hardness of lattice problems, specifically the Module Learning with Errors (MLWE) problem, which is believed resistant to both classical and quantum attacks (Bos et al., 2018; Ducas et al., 2018).”
- Authors
- Bos, J., Ducas, L., Kiltz, E., Lepoint, T., Lyubashevsky, V., Schanck, J. M., Schwabe, P., Seiler, G., & Stehle, D.
- Affiliations
- NXP (Belgium) (BE)
- Ruhr University Bochum (DE)
- SRI International (US)
- IBM Research - Zurich (CH)
- University of Waterloo (CA)
- Radboud University Nijmegen (NL)
- Venue
- 2018 IEEE European Symposium on Security and Privacy (EuroS&P)
- Publisher
- IEEE
- Published
- 2018-04
- Pages
- 353-367
- OpenAlex
- W2866028610
- Cited by
- 1,192
- References
- 68
- Citations by year
- 2026: 205 · 2025: 287 · 2024: 237 · 2023: 148 · 2022: 97 · 2021: 78 · 2020: 63 · 2019: 42 · 2018: 24 · 2017: 10 · 2016: 1
- FWCI
- 21.12
- Type
- conference paper
- Language
- en
- Open access
- green
- ir.cwi.nl
- Licence
- public-domain
- Locations
- IEEE European Symposium on Security and Privacy (publishedVersion)
- Centrum Wiskunde & Informatica (CWI), the national research institute for mathematics and computer science in the Netherlands (submittedVersion, public-domain)
- Radboud Repository (Radboud University) (submittedVersion, public-domain)
- Data Archiving and Networked Services (DANS) (submittedVersion, other-oa)
- HAL (submittedVersion)
- Radboud Repository (Radboud University) (submittedVersion)
- Funders
- Bpifrance
- Government of Canada
- Schweizerischer Nationalfonds zur Förderung der Wissenschaftlichen Forschung (166734)
- Nederlandse Organisatie voor Wetenschappelijk Onderzoek
- Horizon 2020 Framework Programme
- Natural Sciences and Engineering Research Council of Canada
- FP7 Ideas: European Research Council (335086)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptography and Data Security
- Physical Sciences › Computer Science › Artificial Intelligence › Quantum Information and Cryptography
- Physical Sciences › Computer Science › Information Systems › Cryptography and Residue Arithmetic
- Keywords
- Kyber, crystals, module lattices, key encapsulation mechanism, post-quantum cryptography, CCA security, module learning with errors, Fujisaki-Okamoto transform, authenticated key agreement, key exchange, public-key encryption, NIST post-quantum standardization, quantum random oracle model
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
