In open-world evaluation — where 213,099 traces from websites absent from training must be rejected — CipherSight achieves 97.64% AUROC, 88.54% AUPR, and 94.81% OSCR, exceeding the strongest baseline (RF at 93.04% AUROC, 72.03% AUPR, 87.61% OSCR) by 4.60, 16.51, and 7.20 percentage points respectively, demonstrating effective discrimination of monitored sites even amid a large pool of unseen traffic.

CipherSight achieves 95.41% top-1 accuracy across 2,008 website classes in closed-world evaluation, outperforming the strongest Tor-oriented baseline (VarCNN at 92.16%) by 3.25 percentage points and all HTTPS-native baselines by a wider margin, using only ciphertext-observable TLS record metadata without decrypting payloads.

Table 1, Closed-World Evaluation detection

CipherSight achieves 91.09% accuracy in Singapore and 90.59% in France when trained exclusively on US traffic, with only 0.50 pp variation between regions; the strongest regional baselines lag by 11.56 pp (Singapore) and 8.52 pp (France), and some baselines vary by up to 24.38 pp across regions, confirming that TLS-record-level fingerprinting is geographically transferable while packet-level methods are not.

Table 3, Geographic Drift detection

Under a 16-day temporal distribution shift (us0304→us0320), CipherSight retains 92.99% accuracy with only a −2.42 pp drop from its closed-world baseline, while the strongest prior baseline (H&W) falls to 79.96% (−6.49 pp) and Tor-oriented methods drop 18–25 pp, demonstrating that TLS-record-level representations generalize substantially better than packet-level ones over time.

Table 2, Temporal Drift detection

The authors find that more than 80% of TCP packet sequences are inconsistent across repeated captures of the same websites, making packet-level features inherently noisy and motivating TLS-record-level modeling; TLS records, which may span multiple TCP segments or share a segment, provide a more stable abstraction over transport-layer variability.

Introduction, Challenges (Challenge 1) evaluation

Compared with Adaptive Tamaraw on the DF dataset, Chameleon reduces adversarial-training-based WF attack accuracy by up to 36.74 percentage points while simultaneously lowering bandwidth overhead by 34.12% (130.60% vs. 198.23%) and time overhead by 60.38% (14.51% vs. 36.62%). In closed-world evaluation across DF, Var-CNN, RF, and NetCLR attacks, Chameleon holds all attack accuracies below 27% and reduces average SOTA attack accuracy by 76.52% relative to the undefended baseline.

2026-cui-chameleon-robust-defense §V-B, Table II, Abstract website-fingerprintml-classifier

Defense-aware autoencoder (DAAE) attacks can recover website fingerprinting accuracy against defenses that successfully resist adversarial training. On the GTT23 dataset, DAAE-based DF attacks achieve over 90% accuracy against RegulaTor and over 80% against Palette and Adaptive Tamaraw, despite those defenses reducing unaugmented DF attack accuracy from 93.2% to 2–35%. Adversarial training robustness and DAAE robustness are distinct and non-interchangeable properties.

2026-cui-chameleon-robust-defense §I, Figure 1 website-fingerprintml-classifier

Chameleon's many-to-many randomized traffic morphing blocks DAAE by eliminating the stable origin→defended-trace mapping that DAAE exploits. Under DAAE-based RF attacks on GTT23, Chameleon limits attack precision to 40.68% and F1-score to 35.19%, compared with 80.64%/70.30% for Palette and 89.82%/88.22% for Adaptive Tamaraw. The defense works by randomly mapping each webpage trace to one of multiple candidate traces, and allowing different webpages to share morphing targets, so no fixed per-class transformation exists for the autoencoder to learn.

2026-cui-chameleon-robust-defense §V-C, Table IV website-fingerprintml-classifiertraffic-shape

Chameleon's defense remains robust against randomization-aware attackers who augment training with up to K=20 independently randomized defended variants per trace. On the GTT23 dataset, even at K=20, DF, Var-CNN, RF, and NetCLR achieve only 17.50%, 18.82%, 31.06%, and 17.04% accuracy respectively — well below the 100-class closed-world ceiling — confirming that protection does not depend on limiting the attacker's exposure to defended traffic samples.

2026-cui-chameleon-robust-defense §V-E, Table VII website-fingerprintml-classifier

Increasing Nym's per-hop mixing delay (λM) counterintuitively worsens WF resistance: without cover traffic, raising λM to 100 ms raises Tik-Tok F1 from 0.91 (no mixing) to 0.98. Larger delays create a visible temporal gap between outgoing request bursts and incoming response bursts, making the Transposition feature set leak 95.5% classifier accuracy versus 88.5% with no delay at all.

2026-joll-s-website-fingerprinting-nym §5.2, Table 4, Table 5 website-fingerprintml-classifiertraffic-shape

In controlled Testnet conditions, the Tik-Tok deep-learning WF attack achieves F1=0.87 (closed-world) and F1=0.83 (open-world) against Nym's default configuration, compared to F1=0.94/0.91 on Tor. On the live Mainnet, real-world network jitter reduces attack effectiveness to F1=0.69/0.71, but this comes at 11.93× latency overhead and 8.97× bandwidth overhead — a side-effect of instability rather than designed protection. The Mainnet drop is attributable to geographic node spread and roughly 5% packet retransmissions rather than to designed obfuscation.

2026-joll-s-website-fingerprinting-nym §5.1, Table 2 website-fingerprintml-classifier