Periodically rebuilding only the internal service-side path of the introduction circuit (entry guard → vanguard → middle relay) approximately every 10 minutes — while keeping the publicly advertised Introduction Point fixed — limits evidence accumulation to one rebuild interval without requiring a descriptor update. Under this mitigation the effective circuit lifetime visible to an intersection attacker drops from 18–24h to ~10 min, matching ordinary Tor circuit lifetimes.

In the 30 November 2025 Onionoo snapshot, approximately 75% of both guard and middle relay selection-probability mass lies within Fourteen-Eyes jurisdictions, with Germany, the United States, and the Netherlands hosting the largest shares. Because path selection is bandwidth-weighted, a state-level adversary from one of these jurisdictions is statistically likely to have ISP-level visibility at most relays a target introduction circuit passes through.

Appendix D, Fig. 7 evaluation

An adaptive intersection attack exploiting the 18–24h fixed lifetime of Tor onion-service introduction circuits reconstructed the complete four-hop introduction circuit in all nine live-network experiments. The median reconstruction required 260 iterations with an estimated median wall-clock time of 2.24h (12% of the 18h circuit lifetime) when per-relay visibility cost v=0; the slowest run completed in 6.63h (37% of 18h).

§4.2, Table 1 detection

A persistent 'tail' of recurring candidates — not the early phase — dominates convergence cost and introduces high variance: three Vanguard stages at identical consensus weight 1200 converged at iterations 12, 142, and 251. In 13 of 36 stages, the intersection held ≥3 candidates at the penultimate iteration and collapsed to a singleton in one step, suggesting the tail is caused by persistent third-party guard/vanguard traffic rather than random noise.

§4.2, Table 2 detection

Across all 36 stages in the nine end-to-end experiments, the median iteration at which the running intersection shrank to ≤10 candidates was 3, and 64% of stages reached this threshold within 5 iterations. Per-stage candidate sets shrank by 72–87% after the first intersection and by 85–96% by the third iteration, driven by the short (~0.5–1.8s) observation windows that prevent unrelated circuits from injecting persistent false candidates.

§4.2 detection

A three-stage detection pipeline exploiting the "dual-role" behavioral fingerprint of single-IP circumvention relays achieved 23.2% recall (96/414 ground-truth relays) with a 0.18% false-positive rate against 97,651 benign TLS servers, for an overall accuracy of 99.5%. The ground-truth set covered OpenVPN, WireGuard, and SOCKS relays identified in a 17 TB single-day backbone trace (WIDE Project, April 9, 2025).

2026-almutairi-server §3.4, Table 1 traffic-shapedpiflow-correlation

Monte Carlo simulations across four EoL exclusion rounds (2021–2023) show that natural relay churn is the dominant driver of Tor client anonymity loss, with EoL exclusions giving AS and IXP adversaries an advantage equivalent to only ~4 days (AS adversary) or ~9 days (relay adversary) of the network running without exclusion. In the 2021 exclusion event, up to ~1% of additional clients were compromised; by 2023 this figure dropped to ~0.30%, attributed to improved operator update discipline and Tor Project communications.

2026-dejaeghere-sociotechnical-aspects-tor §5.1–5.3, Figure 5–7 flow-correlation

NATA (Non-invasive Active Traffic-correlation Analysis) injects low-frequency bandwidth waveforms (sinusoidal, square-wave, triangular) into Tor TCP connections at an upstream gateway without endpoint compromise, payload decryption, or Tor-browser modification. BM-Net, a selective state-space classifier trained on the exit-side observations, achieves a 99.65% binary detection F1 score distinguishing watermarked from natural traffic on a 20,000-trace real-world dataset.

2026-fan-activeflowmark-assessing-tor §IV, §VI.D, Table III flow-correlationtraffic-shapeml-classifier

BM-Net achieves a 99.65% binary detection F1 score for distinguishing bandwidth-watermarked Tor flows from natural traffic, outperforming all evaluated baselines (next best: TikTok at 75.96% F1). The accuracy gap stems from active perturbation imposing a deterministic low-frequency throughput constraint rather than relying on subtle natural metadata, making the detection task fundamentally easier than passive website fingerprinting.

2026-fan-activeflowmark-assessing-tor §VI-D, Table III–IV flow-correlationtraffic-shapeml-classifier

BM-Net achieves a 99.65% binary detection F1 score distinguishing watermarked from natural Tor flows, and a 97.5% macro-F1 score for fine-grained modulation classification across sinusoidal, square-wave, and triangular patterns. The fine-grained test set contains 201 held-out samples collected from ten clients across five geographic regions (Europe, North America, Australia, Southeast Asia, East Asia), with training traces including traffic collected under WTF-PAD and Walkie-Talkie defenses.

2026-fan-activeflowmark-assessing-tor §VI-D, Table III, Table V flow-correlationml-classifiertraffic-shape

Active bandwidth perturbation has an inherent detectability–stability trade-off: overly aggressive low-rate phases cause Tor SENDME-based flow control stalls, retransmissions, timeouts, or circuit replacement before sufficient correlation evidence is collected. The paper selects a 30-second modulation period and an empirically determined minimum shaping rate; the usable shaping range varies with relay load, path length, TCP congestion control behavior, and Tor multiplexing.

2026-fan-activeflowmark-assessing-tor §VII-A flow-correlationtraffic-shape