Tor exhibits the highest service separability among the four evaluated anonymity networks, achieving a Macro-F1 of 0.7165 and a cumulative normalized behavioral leakage of 3.9461 under combined structural–rhythmic classification. FreeNet exhibits the lowest combined leakage (0.8744) and the lowest intra-network Macro-F1 (0.4510). The primary leakage drivers in Tor are directional byte-exchange asymmetry (S_byte_directional_dominance, normalized MI = 0.258) and byte tempo (R_byte_tempo, normalized MI = 0.198).

Behavioral leakage is concentrated in a small subset of flow-level descriptors rather than uniformly distributed across the feature space. Globally, S_payload_per_packet (normalized MI = 0.173) and R_silence_density (normalized MI = 0.132) are the dominant leakage sources. No descriptor dominates across all networks: I2P leaks primarily through S_forward_packet_share (MI = 0.069) and R_burst_frequency_proxy (MI = 0.056), while FreeNet and ZeroNet rely on R_packet_tempo (MI = 0.066 and 0.101 respectively).

§4.2, Table 2, Figure 3 detection

A leave-one-network-out evaluation shows that behavioral classifiers trained on three anonymity networks (Tor, I2P, FreeNet, ZeroNet) fail to generalize to the held-out network, with all Macro-F1 scores remaining below 0.1822 regardless of whether structural, rhythmic, or combined descriptors are used. The highest individual result (Rhythmic, Tor held out: 0.1822) is still far below intra-network performance. This demonstrates that behavioral leakage signatures are architecture-specific rather than universal.

§4.1, Table 1 detection

Structural vs. rhythmic dominance is network-dependent: Tor traffic leakage is structurally dominated (S_byte_directional_dominance NMI = 0.258 vs. R_byte_tempo 0.198; dominance index DRF positive), while FreeNet and ZeroNet show rhythmic dominance with R_packet_tempo ranking as the strongest descriptor (NMI = 0.066 and 0.101). I2P shows near-balanced dominance. The Service Variability Index further reveals that video has consistent cross-network separability, whereas chat and email vary considerably across anonymity-network pairs.

§4.2, §4.4, Table 2 detection

Combining structural and rhythmic descriptors into a unified S+R representation consistently yields the highest within-network Macro-F1 across all four anonymity networks, providing evidence of complementary information in the two behavioral channels. However, the same fusion does not improve cross-network transferability: S+R performs similarly to or slightly worse than the best individual channel under leave-one-network-out evaluation (e.g., Tor held-out: Combined 0.1175 vs. Rhythmic 0.1822). This asymmetry indicates that structural–rhythmic interactions encode network-architecture-specific rather than universally transferable behavioral information.

§4.1, §4.3, Table 1 evaluation

Based on analysis of over 100,000 leaked Geedge Networks documents, InterSecLab (2025) found that Geedge supplied China-GFW-equivalent censorship and surveillance systems to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The systems include deep packet inspection, real-time mobile user monitoring, fine-grained traffic control, regionally customizable censorship rules, and — per WIRED's reporting — ML-based extraction of metadata from encrypted traffic to determine whether a flow is likely from a VPN or circumvention tool.

2026-anon-2026-27-vpn §8 (InterSecLab / WIRED section) dpiml-classifierfully-encrypted-detecttraffic-shape

Existing Provably Secure Steganography (PSS) schemes require access to the explicit output distribution of the generative model, a requirement that is impractical for black-box API deployments. This paper demonstrates that computational indistinguishability between normal and steganographic output can be achieved using only a seed-based model API, with no distribution access required.

2026-bai-provable-secure-steganography Abstract / §1 Introduction traffic-shapeml-classifier

Chameleon's many-to-many randomized traffic morphing blocks DAAE by eliminating the stable origin→defended-trace mapping that DAAE exploits. Under DAAE-based RF attacks on GTT23, Chameleon limits attack precision to 40.68% and F1-score to 35.19%, compared with 80.64%/70.30% for Palette and 89.82%/88.22% for Adaptive Tamaraw. The defense works by randomly mapping each webpage trace to one of multiple candidate traces, and allowing different webpages to share morphing targets, so no fixed per-class transformation exists for the autoencoder to learn.

2026-cui-chameleon-robust-defense §V-C, Table IV website-fingerprintml-classifiertraffic-shape

NATA (Non-invasive Active Traffic-correlation Analysis) injects low-frequency bandwidth waveforms (sinusoidal, square-wave, triangular) into Tor TCP connections at an upstream gateway without endpoint compromise, payload decryption, or Tor-browser modification. BM-Net, a selective state-space classifier trained on the exit-side observations, achieves a 99.65% binary detection F1 score distinguishing watermarked from natural traffic on a 20,000-trace real-world dataset.

2026-fan-activeflowmark-assessing-tor §IV, §VI.D, Table III flow-correlationtraffic-shapeml-classifier

BM-Net achieves a 99.65% binary detection F1 score for distinguishing bandwidth-watermarked Tor flows from natural traffic, outperforming all evaluated baselines (next best: TikTok at 75.96% F1). The accuracy gap stems from active perturbation imposing a deterministic low-frequency throughput constraint rather than relying on subtle natural metadata, making the detection task fundamentally easier than passive website fingerprinting.

2026-fan-activeflowmark-assessing-tor §VI-D, Table III–IV flow-correlationtraffic-shapeml-classifier

BM-Net achieves a 99.65% binary detection F1 score distinguishing watermarked from natural Tor flows, and a 97.5% macro-F1 score for fine-grained modulation classification across sinusoidal, square-wave, and triangular patterns. The fine-grained test set contains 201 held-out samples collected from ten clients across five geographic regions (Europe, North America, Australia, Southeast Asia, East Asia), with training traces including traffic collected under WTF-PAD and Walkie-Talkie defenses.

2026-fan-activeflowmark-assessing-tor §VI-D, Table III, Table V flow-correlationml-classifiertraffic-shape