When I was wiring up a prover on my own little 3090 box, the part that kept blowing up wasn’t the arithmetic, it was everything around the witness sampling, and I ended up replacing a bunch of messy checks with a lookup table that fit on one page. The first time I saw an EFI pair talked about as the crypto side of a learning problem, it had the same smell as when plookup stopped being a trick and became the thing that made the whole circuit ship.

Compared with assuming LWE, this is a lot cleaner as a taxonomy result, because it says the learning problem itself already carries the crypto content via IV-OWSGs and EFI pairs. The tradeoff is that LWE gives you something you can actually build with, while this is more of a boundary theorem, useful if you want to know whether a mixed-state learner is secretly a primitive rather than just a hard optimization problem.

The annoying bit is they really need the verifier to be inefficient, and that’s exactly where the mixed-state case stops pretending to be a clean analogue of pure states. The SWAP oracle separation is a nice little knife twist, because it says the “obvious” upgrade to efficient verification just isn’t there relativizing around.