Defense-aware autoencoder (DAAE) attacks can recover website fingerprinting accuracy against defenses that successfully resist adversarial training. On the GTT23 dataset, DAAE-based DF attacks achieve over 90% accuracy against RegulaTor and over 80% against Palette and Adaptive Tamaraw, despite those defenses reducing unaugmented DF attack accuracy from 93.2% to 2–35%. Adversarial training robustness and DAAE robustness are distinct and non-interchangeable properties.

Compared with Adaptive Tamaraw on the DF dataset, Chameleon reduces adversarial-training-based WF attack accuracy by up to 36.74 percentage points while simultaneously lowering bandwidth overhead by 34.12% (130.60% vs. 198.23%) and time overhead by 60.38% (14.51% vs. 36.62%). In closed-world evaluation across DF, Var-CNN, RF, and NetCLR attacks, Chameleon holds all attack accuracies below 27% and reduces average SOTA attack accuracy by 76.52% relative to the undefended baseline.

§V-B, Table II, Abstract evaluation

Chameleon's many-to-many randomized traffic morphing blocks DAAE by eliminating the stable origin→defended-trace mapping that DAAE exploits. Under DAAE-based RF attacks on GTT23, Chameleon limits attack precision to 40.68% and F1-score to 35.19%, compared with 80.64%/70.30% for Palette and 89.82%/88.22% for Adaptive Tamaraw. The defense works by randomly mapping each webpage trace to one of multiple candidate traces, and allowing different webpages to share morphing targets, so no fixed per-class transformation exists for the autoencoder to learn.

§V-C, Table IV defense

Chameleon's radix-trie-based synchronization allows pluggable transport client and server endpoints to independently identify the same morphing trace using packet-direction prefixes without transmitting an explicit trace identifier. With a balanced-branch implementation and a candidate pool of at most 10 remaining traces, the selected trace is typically uniquely identified by a prefix of only 4–5 packet directions. Early-stage traffic (up to 60% of packets loaded) leaks minimal information: the Holmes partial-load WF attack achieves only 14.67% F1 against Chameleon at 60% load, a 74.5% reduction from the 57.61% baseline.

§IV-B, §V-D, Table V defense

Chameleon's defense remains robust against randomization-aware attackers who augment training with up to K=20 independently randomized defended variants per trace. On the GTT23 dataset, even at K=20, DF, Var-CNN, RF, and NetCLR achieve only 17.50%, 18.82%, 31.06%, and 17.04% accuracy respectively — well below the 100-class closed-world ceiling — confirming that protection does not depend on limiting the attacker's exposure to defended traffic samples.

§V-E, Table VII evaluation

Increasing Nym's per-hop mixing delay (λM) counterintuitively worsens WF resistance: without cover traffic, raising λM to 100 ms raises Tik-Tok F1 from 0.91 (no mixing) to 0.98. Larger delays create a visible temporal gap between outgoing request bursts and incoming response bursts, making the Transposition feature set leak 95.5% classifier accuracy versus 88.5% with no delay at all.

2026-joll-s-website-fingerprinting-nym §5.2, Table 4, Table 5 website-fingerprintml-classifiertraffic-shape

In controlled Testnet conditions, the Tik-Tok deep-learning WF attack achieves F1=0.87 (closed-world) and F1=0.83 (open-world) against Nym's default configuration, compared to F1=0.94/0.91 on Tor. On the live Mainnet, real-world network jitter reduces attack effectiveness to F1=0.69/0.71, but this comes at 11.93× latency overhead and 8.97× bandwidth overhead — a side-effect of instability rather than designed protection. The Mainnet drop is attributable to geographic node spread and roughly 5% packet retransmissions rather than to designed obfuscation.

2026-joll-s-website-fingerprinting-nym §5.1, Table 2 website-fingerprintml-classifier

Routing web traffic through Nym's constant-rate traffic stream (POISS-OFF) reduces Tik-Tok F1 to 0.06, with all feature-set leakage at ≤9.5% accuracy (Table 8), at the cost of latency overhead 7.32 and bandwidth overhead 8.06 (Table 7). Nym's 2,413-byte packet size means each cover packet incurs 4.7× the overhead of a Tor cover cell, making constant-rate defenses significantly more expensive in this architecture. This matches near-ideal Tamaraw protection on Tor, against WTF4Nym's F1 = 0.39 at 3.78x latency and 4.22x bandwidth.

2026-joll-s-website-fingerprinting-nym §6, Tables 7–8 website-fingerprintml-classifier

WTF4Nym, a burst-aware cover-traffic defense adapted to Nym's Poisson-rate architecture, reduces the Tik-Tok attack F1 score from 0.87 to 0.39 at moderate overhead (latency overhead 3.78×, bandwidth overhead 4.22×). This substantially outperforms directly applying WTF-PAD to Nym (F1=0.87), applying FRONT to Nym (F1=0.63), and the F1=0.65 achieved by FRONT on Tor at comparable overhead, by learning per-network burst distributions and injecting fake bursts that match those statistics. FRONT on Tor reaches F1 = 0.65 at 2.79x latency and 1.84x bandwidth, and under WTF4Nym the Time and N-gram feature leakage fall to 26.6% and 29.0% (Table 8).

2026-joll-s-website-fingerprinting-nym §6.2, Table 7 website-fingerprintml-classifier

Without chunk-based padding, an XGBoost classifier identifies the target website from covert data-chunk sizes with 91% accuracy (Tranco top-100). Chunking at 2 MB reduces accuracy to 12% at a 21.3% bandwidth overhead, while 16 MB chunks reduce accuracy to near random guessing at a 480.3% overhead. Chunks as small as 64 KB already reduce accuracy to 64%, demonstrating a monotonic fingerprinting–overhead tradeoff.

2026-kamali-huma §V-C, Figure 4 website-fingerprintml-classifier

Ephemeral defenses were integrated with a WireGuard fork and deployed as Mullvad VPN's 'DAITA' (Defense Against AI-guided Traffic Analysis) opt-in feature across Android, iOS, macOS, Linux, and Windows for over one year, serving a growing number of thousands of daily users. Individual defenses are derived deterministically from seeds in 43.6 ± 4.7 ms on a commodity laptop, making per-connection unique defenses practical at VPN scale.

2026-pulls-ephemeral-network-layer-fingerprinting §1, §7 ml-classifierwebsite-fingerprint