Sweeping the moving-average detector threshold multiplier k shows that different adversary thresholds produce substantially different certified KL divergence lower bounds; more conservative thresholds (larger k) reduce FPR but can yield significantly larger KL lower bounds even as TPR also changes. The framework audits the HCS against a suite of statistical tests by reporting the maximum lower bound across the family.

Maude-HCS formalizes undetectability as (M, d)-HCS undetectability: a deployment satisfies the property if for all adversary strategies A and all initial environment states E₀, the divergence measure M between the HCS and ordinary trace distributions is at most d. Using the data-processing inequality for KL divergence, certified lower bounds on DKL(Q_t ∥ P_t) are derived from Monte Carlo estimates of detector TPR and FPR, enabling falsification of claimed privacy parameters under specified modeling assumptions.

§3, §3.1 defense

Increasing goodput in a tunneling-based HCS generally increases statistical distinguishability between HCS and ordinary traffic: as Alice's mean inter-post wait time decreases, the certified KL divergence lower bound rises across all tested scenarios (0% and 2.5–5% link loss), though the magnitude depends heavily on background traffic volume and packet loss rate.

§5.2 evaluation

In the DNS+Mastodon steganographic HCS case study, model-predicted latency distribution for 1,600B Iodine file transfers shows strong semantic alignment with testbed measurements: KL(EXP ∥ SMC) = 0.0007 and KL(SMC ∥ EXP) = 0.0007, with experimental mean 3.822s (σ=1.191, n=300) versus model mean 3.796s (σ=1.166, n=13,080).

§5.3 evaluation

Performance tuning alone — adjusting mean inter-post wait time with a fixed detector threshold — can shift the HCS between high-detectability and low-detectability operating regimes. Even with no change to the adversary's classifier or the protocol's structural properties, wait-time variation moves the certified KL divergence lower bound across operating points that span qualitatively different detection risk levels.

§5.2 defense

Based on analysis of over 100,000 leaked Geedge Networks documents, InterSecLab (2025) found that Geedge supplied China-GFW-equivalent censorship and surveillance systems to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The systems include deep packet inspection, real-time mobile user monitoring, fine-grained traffic control, regionally customizable censorship rules, and — per WIRED's reporting — ML-based extraction of metadata from encrypted traffic to determine whether a flow is likely from a VPN or circumvention tool.

2026-anon-2026-27-vpn §8 (InterSecLab / WIRED section) dpiml-classifierfully-encrypted-detecttraffic-shape

Existing Provably Secure Steganography (PSS) schemes require access to the explicit output distribution of the generative model, a requirement that is impractical for black-box API deployments. This paper demonstrates that computational indistinguishability between normal and steganographic output can be achieved using only a seed-based model API, with no distribution access required.

2026-bai-provable-secure-steganography Abstract / §1 Introduction traffic-shapeml-classifier

Chameleon's many-to-many randomized traffic morphing blocks DAAE by eliminating the stable origin→defended-trace mapping that DAAE exploits. Under DAAE-based RF attacks on GTT23, Chameleon limits attack precision to 40.68% and F1-score to 35.19%, compared with 80.64%/70.30% for Palette and 89.82%/88.22% for Adaptive Tamaraw. The defense works by randomly mapping each webpage trace to one of multiple candidate traces, and allowing different webpages to share morphing targets, so no fixed per-class transformation exists for the autoencoder to learn.

2026-cui-chameleon-robust-defense §V-C, Table IV website-fingerprintml-classifiertraffic-shape

NATA (Non-invasive Active Traffic-correlation Analysis) injects low-frequency bandwidth waveforms (sinusoidal, square-wave, triangular) into Tor TCP connections at an upstream gateway without endpoint compromise, payload decryption, or Tor-browser modification. BM-Net, a selective state-space classifier trained on the exit-side observations, achieves a 99.65% binary detection F1 score distinguishing watermarked from natural traffic on a 20,000-trace real-world dataset.

2026-fan-activeflowmark-assessing-tor §IV, §VI.D, Table III flow-correlationtraffic-shapeml-classifier

BM-Net achieves a 99.65% binary detection F1 score for distinguishing bandwidth-watermarked Tor flows from natural traffic, outperforming all evaluated baselines (next best: TikTok at 75.96% F1). The accuracy gap stems from active perturbation imposing a deterministic low-frequency throughput constraint rather than relying on subtle natural metadata, making the detection task fundamentally easier than passive website fingerprinting.

2026-fan-activeflowmark-assessing-tor §VI-D, Table III–IV flow-correlationtraffic-shapeml-classifier

BM-Net achieves a 99.65% binary detection F1 score distinguishing watermarked from natural Tor flows, and a 97.5% macro-F1 score for fine-grained modulation classification across sinusoidal, square-wave, and triangular patterns. The fine-grained test set contains 201 held-out samples collected from ten clients across five geographic regions (Europe, North America, Australia, Southeast Asia, East Asia), with training traces including traffic collected under WTF-PAD and Walkie-Talkie defenses.

2026-fan-activeflowmark-assessing-tor §VI-D, Table III, Table V flow-correlationml-classifiertraffic-shape