The reference split was following the order clients arrive in¶

Found by reading the defence curve rather than the code: Qt's detection ran below chance and fell further with noise (0.386 at four times the update norm, 0.336 at sixteen), which no amount of masking explains. A detector that is anti-correlated is measuring something other than membership.

The attacker's clients were split into reference and participants by taking the first half of a sorted list. Clients arrive grouped by project, so for an organization spanning several projects, Qt's C++, documentation and Python, the reference came from different projects than the participants: the score then measured the distance between two projects, and rounds holding the target scored lower than rounds without it. The split is now random, seeded, in both the Gram-based attack and the vector-space defence curve, and a test builds an organization of two projects in listing order and fails if the detector runs backwards.

The corrected mixed-round figures are in the entry above. What the bug did not touch: the per-client attribution, which uses every other client rather than a split, and the paired-subset difference, which holds a target out by name.