Naïve composition of two unidirectional FEPs leaks private half-close events: when A half-closes after epoch 2 while B's response continues through epoch 6, the zero output in the A→B direction exposes A's private state even though all transmitted bytes appear uniformly random. This attack was confirmed empirically — naive composition leaked in 3/3 close-witness trials versus 0/3 for BiFEP.

The Rust BiFEP reference implementation (≈20.4k lines: 2,195 datastream, 989 datagram, 813 shared, 16,375 harness) achieves 28.2 MiB/s goodput at 37.0 µs per epoch operation for datastreams, and 420 MiB/s at 1.36 µs per atomic send/receive for datagrams; all 62,119 conformance assertions passed across 491 trials and 5,321 logical epochs, with 0 forged semantics across 360 datastream and 120 datagram active-integrity trials.

§VII; §VIII-A,B,C; Table II; Table V evaluation

The BiFEP datastream construction uses a 'wrapper' layer with authenticated DATA, DUMMY, and FIN frames over an independently keyed inner FEP per direction, revealing only a public sending schedule ΓX(t) and quantized closing epoch from the set Ecl — the exact private half-close time is hidden behind continued cover traffic. Empirical passive diagnostics on the Rust implementation show byte entropy of 7.999279–7.999749 bits/byte, maximum absolute byte correlation of 0.004668, and a random-forest ROC-AUC of 0.485 (95% CI [0.428, 0.542]) distinguishing DATA from ChaCha20 — not significantly better than chance.

§IV; §VIII-D, Table IV defense

For datagram-mode BiFEP (UDP), a configurable linger depth L prevents permanent one-sided close: without linger (L=0), one-sided ACK loss causes the peer that closed first to go silent at epoch 4, making the missing ACK permanently undeliverable and leaving the remote endpoint live indefinitely (e⋆=⊥). With one-bucket linger (L=1), the closing endpoint continues retransmitting FIN+ACK through the next close bucket, resolving all one-sided ACK-loss scenarios in Table VI within epochs 8–12 across all six tested drop counts.

§V-D, Eq. (12); §VIII-F, Table VI; Figure 3 defense

None of the six surveyed deployed protocols — TLS 1.3, QUIC v1, WireGuard, Shadowsocks 2022, obfs4, and Tor — provides the full set of BiFEP security properties (exact shaping, delivery, protocol-state integrity, private half-close, and cross-direction isolation) at the specification level.

§I (abstract contribution bullet); §VIII-G (referenced protocol comparison) evaluation

Based on analysis of over 100,000 leaked Geedge Networks documents, InterSecLab (2025) found that Geedge supplied China-GFW-equivalent censorship and surveillance systems to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The systems include deep packet inspection, real-time mobile user monitoring, fine-grained traffic control, regionally customizable censorship rules, and — per WIRED's reporting — ML-based extraction of metadata from encrypted traffic to determine whether a flow is likely from a VPN or circumvention tool.

2026-anon-2026-27-vpn §8 (InterSecLab / WIRED section) dpiml-classifierfully-encrypted-detecttraffic-shape

The scheme's core mechanism samples a candidate set of tokens at each generation step and constructs a bijective map from possible message bit strings to those tokens. Selecting the output token via this map provably preserves the original model's sampling distribution, yielding output that is computationally indistinguishable from unmodified model output.

2026-bai-provable-secure-steganography Abstract / core mechanism traffic-shapefully-encrypted-detect

AEGIS, a flow-physics-only ML classifier using a Hyperbolic Liquid State Space Model evaluated on a 400GB adversarial corpus including VLESS Reality, GhostBear, and AMOI-morphed traffic, achieves F1-score 0.9952, 99.50% TPR, and 0.2141% FPR at 262.27 µs inference latency on an RTX 4090. The system discards all payload bytes and classifies traffic exclusively on 6-dimensional flow physics: packet size, inter-arrival time, directionality, TCP window size, TCP flags, and payload ratio.

2026-ferrel-aegis-adversarial-entropy-guided §V, Table III ml-classifiertraffic-shapefully-encrypted-detect

Encrypted traffic exhibits a 'full-frequency' spectral property where both low- and high-frequency components are highly active with comparable intensity, unlike natural images which are dominated by low-frequency components. Fourier Transform analysis across CIC-IoT2023, DoHBrw2020, and ISCX-Tor2016 confirms this distinction is pervasive. This signature is an inherent consequence of encryption disrupting byte-level semantics into a visually disordered, noise-like spatial pattern.

2026-lian-decompose-understand-fuse §II ml-classifiertraffic-shaperandom-payload-detectfully-encrypted-detect

FreeUp operates under a zero-positive (unsupervised) learning paradigm — trained exclusively on normal traffic with no labeled anomaly examples — yet achieves 95.53% AUC on Tor traffic and 85.44% AUC on DNS-over-HTTPS tunneling detection. This demonstrates that frequency-aware anomaly detectors generalize to novel circumvention protocols without requiring any labeled attack data, eliminating the labeling bottleneck that previously limited ML-based censorship detection.

2026-lian-decompose-understand-fuse §III, §V-B ml-classifierfully-encrypted-detecttraffic-shape

The hash-based filtering strategy shifts covert channel security from algorithm secrecy to key secrecy per Kerckhoffs's principle: even when the covert algorithm is fully exposed, an adversary without the pre-shared key cannot identify which sparse subset (~1/2^L) of packets carries covert data, transforming the detection problem from statistical pattern recognition to exhaustive key-space search. The authors recommend a minimum Input Key length of 128 bits.

2026-zou-hiding-trees-forest §3.2, §4.1, §4.2.4 ml-classifiertraffic-shapefully-encrypted-detect