Chameleon's radix-trie-based synchronization allows pluggable transport client and server endpoints to independently identify the same morphing trace using packet-direction prefixes without transmitting an explicit trace identifier. With a balanced-branch implementation and a candidate pool of at most 10 remaining traces, the selected trace is typically uniquely identified by a prefix of only 4–5 packet directions. Early-stage traffic (up to 60% of packets loaded) leaks minimal information: the Holmes partial-load WF attack achieves only 14.67% F1 against Chameleon at 60% load, a 74.5% reduction from the 57.61% baseline.

Compared with Adaptive Tamaraw on the DF dataset, Chameleon reduces adversarial-training-based WF attack accuracy by up to 36.74 percentage points while simultaneously lowering bandwidth overhead by 34.12% (130.60% vs. 198.23%) and time overhead by 60.38% (14.51% vs. 36.62%). In closed-world evaluation across DF, Var-CNN, RF, and NetCLR attacks, Chameleon holds all attack accuracies below 27% and reduces average SOTA attack accuracy by 76.52% relative to the undefended baseline.

§V-B, Table II, Abstract evaluation

Defense-aware autoencoder (DAAE) attacks can recover website fingerprinting accuracy against defenses that successfully resist adversarial training. On the GTT23 dataset, DAAE-based DF attacks achieve over 90% accuracy against RegulaTor and over 80% against Palette and Adaptive Tamaraw, despite those defenses reducing unaugmented DF attack accuracy from 93.2% to 2–35%. Adversarial training robustness and DAAE robustness are distinct and non-interchangeable properties.

§I, Figure 1 detection

Chameleon's many-to-many randomized traffic morphing blocks DAAE by eliminating the stable origin→defended-trace mapping that DAAE exploits. Under DAAE-based RF attacks on GTT23, Chameleon limits attack precision to 40.68% and F1-score to 35.19%, compared with 80.64%/70.30% for Palette and 89.82%/88.22% for Adaptive Tamaraw. The defense works by randomly mapping each webpage trace to one of multiple candidate traces, and allowing different webpages to share morphing targets, so no fixed per-class transformation exists for the autoencoder to learn.

§V-C, Table IV defense

Chameleon's defense remains robust against randomization-aware attackers who augment training with up to K=20 independently randomized defended variants per trace. On the GTT23 dataset, even at K=20, DF, Var-CNN, RF, and NetCLR achieve only 17.50%, 18.82%, 31.06%, and 17.04% accuracy respectively — well below the 100-class closed-world ceiling — confirming that protection does not depend on limiting the attacker's exposure to defended traffic samples.

§V-E, Table VII evaluation

IP-based fingerprints are operationally stable: approximately 60% of domains exhibit no IP changes across the three-month measurement period for both IPv4 and IPv6. Among churning domains, per-domain churn behavior is comparable across protocols—about 28% of churning IPv4 domains rotate within one hour on average vs 35% for IPv6. Fingerprint databases of ≈100 KB per site (50–60 GB for 520K sites) can be maintained with only periodic DNS re-resolution at negligible overhead for adversaries already collecting NetFlow data.

2026-ahmad-more-space-less §6.4, §5.3.2 website-fingerprinttraffic-shape

IP-based website fingerprinting achieves 93–94% top-1 accuracy on dual-stack incomplete websites (those with any IPv4-only third-party dependencies) using both IPv4 and IPv6 fingerprints across 228K sites. For dual-stack complete sites (all resources reachable over IPv6), accuracy drops to 56% over IPv4 and 45% over IPv6. The discriminating signal comes almost entirely from secondary resource IPs: using only the primary domain's IP yields 5–8% accuracy regardless of protocol.

2026-ahmad-more-space-less §6.1, Table 1 website-fingerprinttraffic-shape

Incoming traffic is the dominant website fingerprinting leakage vector in Nym because the network requester does not apply Poisson-rate cover traffic by default. The Features In feature set achieves 72.1% random-forest accuracy on Nym Testnet — exceeding Tor's 70.2% — while outgoing Features Out leaks only 43.9% (vs. 65.0% for Tor). The combined Features In/Out (70.0%) provides no additional information beyond Features In alone, confirming the inbound channel is the bottleneck. Enabling Poisson-rate cover traffic on the network requester side (lambda_QR = 10-20 ms) lowers the Tik-Tok F1 score from 0.87 to 0.75-0.64 but raises latency overhead to 7.32-12.66x (Table 4, configs 10-11).

2026-joll-s-website-fingerprinting-nym §5.1, Table 3 website-fingerprinttraffic-shape

Increasing Nym's per-hop mixing delay (λM) counterintuitively worsens WF resistance: without cover traffic, raising λM to 100 ms raises Tik-Tok F1 from 0.91 (no mixing) to 0.98. Larger delays create a visible temporal gap between outgoing request bursts and incoming response bursts, making the Transposition feature set leak 95.5% classifier accuracy versus 88.5% with no delay at all.

2026-joll-s-website-fingerprinting-nym §5.2, Table 4, Table 5 website-fingerprintml-classifiertraffic-shape

With infinite training time, Laserbeak achieves 93.5%, 95.9%, and 95.9% accuracy against ephemeral padding, FRONT, and Interspace respectively, compared to 96.5% undefended — confirming that padding-only defenses provide no meaningful protection against a sufficiently trained deep-learning WF adversary. Only ephemeral blocking defenses retain measurable protection, reducing Laserbeak to 71.8% accuracy under infinite training versus 96.5% undefended.

2026-pulls-ephemeral-network-layer-fingerprinting §5.3, Table 2 ml-classifierwebsite-fingerprinttraffic-shape

The authors find that more than 80% of TCP packet sequences are inconsistent across repeated captures of the same websites, making packet-level features inherently noisy and motivating TLS-record-level modeling; TLS records, which may span multiple TCP segments or share a segment, provide a more stable abstraction over transport-layer variability.

2026-song-ciphersight-robust-website Introduction, Challenges (Challenge 1) website-fingerprinttraffic-shape