Claude Found Seed-indpendent collisions in most popular hash functions

I now have enough from the source article. Let me write the article based on the facts gathered:

- Author: Thomas Dybdahl Ahle (Normal Computing) - Used Claude Fable to analyze popular fast hash functions from SMhasher - Found most of them have inputs that perform terribly — at least 20 bits below expectation on adversarial inputs - Found seed-independent collisions (same two inputs collide for every key) - Also found flooding-grade key-free multicollisions for many hashes - Specific hashes mentioned: CityHash64, FarmHash64, gxhash, MurmurHash3, MuseAir, komihash, SpookyHash V2, aHash, t1ha2, a5hash, HighwayHash, wyhash final v4.3, rapidhash v1/v3, XXH3-64 0.8.3, XXH3-128, MUM v3, pengyhash, nmhash32, mx3, mir, fasthash, UMASH, HalftimeHash, ChainHash, SipHash, Go maphash, Abseil Hash, .NET Marvin, foldhash, XXH64, XXH32, MurmurHash64A, MurmurHash2 - xxHash boasts 60 GB/s - ChainHash: 28.25 B/cycle on Xeon, 30.15 on M2, 35.09 on EPYC, with 63-bit machine-checked guarantee - Findings disclosed upstream before publication; maintainers replied for xxHash, komihash, MuseAir, foldhash - On Intel Xeon and AMD EPYC, the fastest hash measured has a proof; on Apple M2 Pro, a proven hash is second only to gxhash (which has key-free collisions) - AI changes the threat model — software that used to be secure from obscurity is now easy to break - Verified some proofs in Lean; found mistakes in published proofs - XXH3-64: about 2^-21.58 of secrets (6868 / 5·2^32, pooled over two independent programs) - Updated: 29 September 2026

Thomas Dybdahl Ahle, a researcher at Normal Computing, published a detailed audit of fast non-cryptographic hash functions, using Claude Fable to analyse a broad selection of popular hashes from SMhasher — the large benchmark project that empirically tests hash statistical properties. The audit found that most of them have crafted inputs on which they perform terribly, at least 20 bits below expectation on adversarial inputs, even when the attacker never learns the secret seed. For several hashes, Ahle found concrete seed-independent collision pairs: two distinct inputs that produce the same output for every key, not just some keys.

This piece covers the mechanism behind those collisions, the classification of hash weaknesses the audit introduced, which specific libraries are named, and what the findings mean for engineers choosing a hash function for hash tables, deduplication, or data integrity. It is aimed at developers who use fast hash functions in production systems and want to understand which of the popular options have concrete, reproducible weaknesses.

Claude Found Seed-independent collisions: what actually changed

For years the conventional wisdom was that seeded fast hash functions were safe against adversarial inputs because an attacker who does not know the seed cannot reliably manufacture collisions. The audit, updated 29 September 2026, directly challenges that assumption with reproducible examples. Ahle used Claude Fable to analyse functions drawn from SMhasher and found that many of the most popular options — including CityHash64, FarmHash64, MurmurHash3 x64\_128, wyhash final v4.3, XXH3-64 0.8.3, rapidhash v1 and v3, and komihash, among others — expose pairs of distinct inputs that collide across every key.

A seed-independent collision is the most severe category Ahle identifies: the same two distinct inputs collide for every key, meaning a rotation of seed or randomisation of the hash state at startup offers no protection. The audit further found flooding-grade, key-free multicollisions for gxhash, MUM, mir, mx3, and fasthash — meaning arbitrarily many inputs can be made to collide without ever learning the secret. All findings were disclosed to upstream maintainers before publication, with responses logged for xxHash, komihash, MuseAir, and foldhash.

Claude Found Seed-independent collisions: how it works

The research classifies hash weaknesses into four distinct categories based on how many inputs are affected and how many keys are compromised. A seed-independent pair is the simplest: two fixed inputs that always collide regardless of key. Few-way collisions affect a small set of inputs for some keys. Weak-key multicollisions scale that up to a large fixed set colliding for a fraction of keys. Full multicollisions, the most dangerous category, extend that large set to every key simultaneously.

Claude Fable was applied to read the source of each hash and search for structural patterns — arithmetic paths where the seed is mixed in after a computation that can already be made to cancel out between two inputs. In CityHash64, the code annotated "Exploit: collision before any seed" shows the mechanism directly: when the 8-byte input path reads the same word for both its reads, the subsequent HashLen16 call produces a deterministic intermediate value before the seed is introduced on the following line. Similar algebraic shortcuts appeared across many hash families, reflecting what the author describes as recurring patterns of bad design shared across implementations.

Claude Found Seed-independent collisions: why it matters now

The audit's first takeaway names the root cause explicitly: AI changes the threat model. Software that used to be secure mostly through obscurity — relying on an attacker not being able to work out collision inputs without the seed — is now easier to break because large language models can read unfamiliar hash implementations and reason about algebraic structure at a speed and cost that was not practical for human cryptanalysts doing ad hoc review. What previously required expensive manual cryptanalysis of each hash variant now scales with the size of the model's context window.

The practical implication is that the threat previously categorised as theoretical or low-priority is now operationally relevant for systems using these functions as security-relevant primitives. Denial-of-service attacks that exploit hash-table flooding, and integrity checks relying on hash equality without collision resistance, are the directly relevant applications. The maintainers of xxHash, komihash, MuseAir, and foldhash responded that only true multicollision attacks — where a large set of inputs all collide with high probability — are worth patching, since changing the hash is hard to do backwards-compatibly.

Claude Found Seed-independent collisions: who is affected

Engineers using any of the named hashes in applications that treat hash equality as a security property are directly affected. The list spans multiple languages and ecosystems: xxHash (xxHash 0.8.3, XXH3-64, XXH3-128, XXH64, XXH32) and its downstream users, the Rust ecosystem's aHash and foldhash-fast 0.2.0 and foldhash-quality 0.2.0, Google's CityHash64 and FarmHash64, MurmurHash2, MurmurHash64A and MurmurHash3 x64\_128, Go maphash, Abseil Hash, .NET Marvin, SpookyHash V2, t1ha2, a5hash-64 and a5hash-128, HighwayHash, gxhash, MuseAir and MuseAir v2, komihash, pengyhash v0.3, nmhash32 v2, nmhash32x v2, mx3 v3, MUM v3, and mir.

Applications where the hash function is purely a performance mechanism — load distribution in hash tables with no adversarial input, checksum-style deduplication of trusted content — are less exposed. Applications where external parties influence the input and where the hash output is used for equality, deduplication, approximate membership filters, or sharding decisions face a more concrete risk. The collision for XXH3-64, for example, was measured at a rate of approximately 2^-21.58 of secrets (6,868 collisions across 5 × 2^32 keys, pooled across two independent programs), which is well above the expected birthday-bound rate for a 64-bit function.

Claude Found Seed-independent collisions: what to watch

Engineers who want a fast hash with a machine-checked proof now have concrete alternatives. ChainHash achieves 28.25 bytes per cycle on Intel Xeon, 30.15 on Apple M2 Pro, and 35.09 on AMD EPYC, with a Lean-verified 63-bit guarantee derived from 64 uniformly random key bytes. UMASH-64 and UMASH-128 have both headline bounds now proved by different routes. On Intel Xeon and AMD EPYC, the fastest hash measured in the benchmark already has a proof. On Apple M2 Pro, a proven hash is second only to gxhash — which itself has key-free collisions.

Builders verifying their own stack should check whether their chosen hash appears in the SMhasher-sourced appendix of this audit, confirm whether it appears with a rust diamond (an attacker-found upper cap on the collision score) or a cross (a seed-independent pair), and consult the upstream maintainer threads linked for xxHash, komihash, MuseAir, and foldhash for the maintainers' own assessment of fix priority. The audit also verified several published proofs in Lean, found mistakes in some of them, and in a few cases required code changes rather than just proof corrections — making independently machine-checked proofs a stronger signal than published but unaudited collision bounds.