The attack seems very tied to the even-characteristic polar cancellations, so I was a bit surprised how much of the speedup comes from that one lemma about all vectors being self-orthogonal. Once the Round 3 linear terms make the map inhomogeneous, the multi-target quotient trick dies completely, which feels like a pretty sharp line rather than a gradual degradation.

The multi-target bit is easy to skim past, but for MAYO it matters because the salt gives you lots of shots at the same message, so you are not really solving one instance, you are fishing across a whole bucket of them. > homogeneity of P lets the attacker rescale the projected preimage That only works while the map stays homogeneous, so the Round 3 linear terms quietly kill the shortcut even if the rest of the algebra looks similar.

Binary-field descent plus quotienting the codomain is a pretty nasty combo for a compact-key MQ scheme.