Performance tuning alone — adjusting mean inter-post wait time with a fixed detector threshold — can shift the HCS between high-detectability and low-detectability operating regimes. Even with no change to the adversary's classifier or the protocol's structural properties, wait-time variation moves the certified KL divergence lower bound across operating points that span qualitatively different detection risk levels.

Sweeping the moving-average detector threshold multiplier k shows that different adversary thresholds produce substantially different certified KL divergence lower bounds; more conservative thresholds (larger k) reduce FPR but can yield significantly larger KL lower bounds even as TPR also changes. The framework audits the HCS against a suite of statistical tests by reporting the maximum lower bound across the family.

§5.2 evaluation

Maude-HCS formalizes undetectability as (M, d)-HCS undetectability: a deployment satisfies the property if for all adversary strategies A and all initial environment states E₀, the divergence measure M between the HCS and ordinary trace distributions is at most d. Using the data-processing inequality for KL divergence, certified lower bounds on DKL(Q_t ∥ P_t) are derived from Monte Carlo estimates of detector TPR and FPR, enabling falsification of claimed privacy parameters under specified modeling assumptions.

§3, §3.1 defense

Increasing goodput in a tunneling-based HCS generally increases statistical distinguishability between HCS and ordinary traffic: as Alice's mean inter-post wait time decreases, the certified KL divergence lower bound rises across all tested scenarios (0% and 2.5–5% link loss), though the magnitude depends heavily on background traffic volume and packet loss rate.

§5.2 evaluation

In the DNS+Mastodon steganographic HCS case study, model-predicted latency distribution for 1,600B Iodine file transfers shows strong semantic alignment with testbed measurements: KL(EXP ∥ SMC) = 0.0007 and KL(SMC ∥ EXP) = 0.0007, with experimental mean 3.822s (σ=1.191, n=300) versus model mean 3.796s (σ=1.166, n=13,080).

§5.3 evaluation

TSG's Context-Based Detector (CBD) evaluates circumvention tool signatures across JA3/JA4 TLS fingerprints, SSL certificate issuer fields, UDP payload length, first-packet byte patterns, server IP ranges, and FQDN matches, often combining multiple conditions with logical AND. Of 29 VPN and circumvention tool signatures logged in the VPN Signature File Update Log (March–November 2024), 21 carry risk level 5 (the maximum), indicating aggressive prioritization of blocking major tools including ExpressVPN, NordVPN, Tor Browser, and Psiphon.

2026-ablove-technical-analysis-geedge §4.1, §4.1.2, Table 3, Table 4 dpitls-fingerprinttraffic-shapeip-blockingsni-blocking

IP-based fingerprints are operationally stable: approximately 60% of domains exhibit no IP changes across the three-month measurement period for both IPv4 and IPv6. Among churning domains, per-domain churn behavior is comparable across protocols—about 28% of churning IPv4 domains rotate within one hour on average vs 35% for IPv6. Fingerprint databases of ≈100 KB per site (50–60 GB for 520K sites) can be maintained with only periodic DNS re-resolution at negligible overhead for adversaries already collecting NetFlow data.

2026-ahmad-more-space-less §6.4, §5.3.2 website-fingerprinttraffic-shape

IP-based website fingerprinting achieves 93–94% top-1 accuracy on dual-stack incomplete websites (those with any IPv4-only third-party dependencies) using both IPv4 and IPv6 fingerprints across 228K sites. For dual-stack complete sites (all resources reachable over IPv6), accuracy drops to 56% over IPv4 and 45% over IPv6. The discriminating signal comes almost entirely from secondary resource IPs: using only the primary domain's IP yields 5–8% accuracy regardless of protocol.

2026-ahmad-more-space-less §6.1, Table 1 website-fingerprinttraffic-shape

A three-stage detection pipeline exploiting the "dual-role" behavioral fingerprint of single-IP circumvention relays achieved 23.2% recall (96/414 ground-truth relays) with a 0.18% false-positive rate against 97,651 benign TLS servers, for an overall accuracy of 99.5%. The ground-truth set covered OpenVPN, WireGuard, and SOCKS relays identified in a 17 TB single-day backbone trace (WIDE Project, April 9, 2025).

2026-almutairi-server §3.4, Table 1 traffic-shapedpiflow-correlation

The paper identifies a fundamental architectural vulnerability in single-IP circumvention designs: a relay must generate new observable flows (via DNS or TLS SNI) to reach end services after receiving client connections, creating a detectable server-and-client behavioral contrast. A relay accessing user-facing domains (news, social media) scores high on a Relay Suspicion Score (w=0.9) versus infrastructure domains (w=0.1). The paper argues this host-level signal is censorship-invariant and cannot be concealed by link obfuscation.

2026-almutairi-server §2.4, §4 traffic-shapedpisni-blocking

Based on analysis of over 100,000 leaked Geedge Networks documents, InterSecLab (2025) found that Geedge supplied China-GFW-equivalent censorship and surveillance systems to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The systems include deep packet inspection, real-time mobile user monitoring, fine-grained traffic control, regionally customizable censorship rules, and — per WIRED's reporting — ML-based extraction of metadata from encrypted traffic to determine whether a flow is likely from a VPN or circumvention tool.

2026-anon-2026-27-vpn §8 (InterSecLab / WIRED section) dpiml-classifierfully-encrypted-detecttraffic-shape