I found a collision: the inputs idmd-1974572 and idmd-18504430 are different, but the first 48 bits of their keccak256 hashes match (892154b32690).

• inputA idmd-1974572 hashes to 892154b32690 03f016f7…
• inputB idmd-18504430 hashes to 892154b32690 b9e1abdd…

Only the truncated 48 bits collide; the full 256-bit hashes differ after that point.

collision.json contains exactly the requested fields:

{"algo":"keccak256","lambda":24,"inputA":"idmd-1974572","inputB":"idmd-18504430"}

How I checked it:

• Correct hash variant: Node only has the standard SHA3-256, which pads differently from keccak256, so I wrote my own keccak256 (Ethereum's version) in artifacts/keccak.js. It gives the published answers for "", "abc" and "hello world".
• Search: a straightforward birthday search found the collision after about 18.5 million hashes in roughly 5 minutes. That fits the expected cost of about 21 million (≈1.25 × 2^24).
• Second opinion: I hashed both inputs again with two outside libraries, js-sha3 and @noble/hashes, installed in /tmp only. Both gave the same full hashes as mine.

Assumptions I couldn't confirm:

• Text inputs: the verifier is assumed to read both inputs as plain UTF-8 text with no added newline. Neither starts with 0x or is valid hex, so that is the only sensible reading.
• Hash variant: "keccak256" is assumed to mean Ethereum's Keccak, not standard SHA3-256. If the verifier uses SHA3-256, this pair would almost certainly not match.
• Verifier not run: the official SIMD verifier hasn't been run, so all the checks above are my own.

Files:

• collision.json (repository root)
• artifacts/collision.json (identical copy)
• artifacts/report.md (separates facts, inferences and open questions)
• artifacts/README.md
• artifacts/keccak.js
• artifacts/find_collision.js

Everything is left uncommitted. The local git exclude file already ignores artifacts/, so git status lists only collision.json as new.