The authors find that more than 80% of TCP packet sequences are inconsistent across repeated captures of the same websites, making packet-level features inherently noisy and motivating TLS-record-level modeling; TLS records, which may span multiple TCP segments or share a segment, provide a more stable abstraction over transport-layer variability.

CipherSight achieves 95.41% top-1 accuracy across 2,008 website classes in closed-world evaluation, outperforming the strongest Tor-oriented baseline (VarCNN at 92.16%) by 3.25 percentage points and all HTTPS-native baselines by a wider margin, using only ciphertext-observable TLS record metadata without decrypting payloads.

Table 1, Closed-World Evaluation detection

CipherSight achieves 91.09% accuracy in Singapore and 90.59% in France when trained exclusively on US traffic, with only 0.50 pp variation between regions; the strongest regional baselines lag by 11.56 pp (Singapore) and 8.52 pp (France), and some baselines vary by up to 24.38 pp across regions, confirming that TLS-record-level fingerprinting is geographically transferable while packet-level methods are not.

Table 3, Geographic Drift detection

In open-world evaluation — where 213,099 traces from websites absent from training must be rejected — CipherSight achieves 97.64% AUROC, 88.54% AUPR, and 94.81% OSCR, exceeding the strongest baseline (RF at 93.04% AUROC, 72.03% AUPR, 87.61% OSCR) by 4.60, 16.51, and 7.20 percentage points respectively, demonstrating effective discrimination of monitored sites even amid a large pool of unseen traffic.

Table 5, Open-World Evaluation detection

Under a 16-day temporal distribution shift (us0304→us0320), CipherSight retains 92.99% accuracy with only a −2.42 pp drop from its closed-world baseline, while the strongest prior baseline (H&W) falls to 79.96% (−6.49 pp) and Tor-oriented methods drop 18–25 pp, demonstrating that TLS-record-level representations generalize substantially better than packet-level ones over time.

Table 2, Temporal Drift detection

IP-based fingerprints are operationally stable: approximately 60% of domains exhibit no IP changes across the three-month measurement period for both IPv4 and IPv6. Among churning domains, per-domain churn behavior is comparable across protocols—about 28% of churning IPv4 domains rotate within one hour on average vs 35% for IPv6. Fingerprint databases of ≈100 KB per site (50–60 GB for 520K sites) can be maintained with only periodic DNS re-resolution at negligible overhead for adversaries already collecting NetFlow data.

2026-ahmad-more-space-less §6.4, §5.3.2 website-fingerprinttraffic-shape

IP-based website fingerprinting achieves 93–94% top-1 accuracy on dual-stack incomplete websites (those with any IPv4-only third-party dependencies) using both IPv4 and IPv6 fingerprints across 228K sites. For dual-stack complete sites (all resources reachable over IPv6), accuracy drops to 56% over IPv4 and 45% over IPv6. The discriminating signal comes almost entirely from secondary resource IPs: using only the primary domain's IP yields 5–8% accuracy regardless of protocol.

2026-ahmad-more-space-less §6.1, Table 1 website-fingerprinttraffic-shape

Chameleon's many-to-many randomized traffic morphing blocks DAAE by eliminating the stable origin→defended-trace mapping that DAAE exploits. Under DAAE-based RF attacks on GTT23, Chameleon limits attack precision to 40.68% and F1-score to 35.19%, compared with 80.64%/70.30% for Palette and 89.82%/88.22% for Adaptive Tamaraw. The defense works by randomly mapping each webpage trace to one of multiple candidate traces, and allowing different webpages to share morphing targets, so no fixed per-class transformation exists for the autoencoder to learn.

2026-cui-chameleon-robust-defense §V-C, Table IV website-fingerprintml-classifiertraffic-shape

Chameleon's radix-trie-based synchronization allows pluggable transport client and server endpoints to independently identify the same morphing trace using packet-direction prefixes without transmitting an explicit trace identifier. With a balanced-branch implementation and a candidate pool of at most 10 remaining traces, the selected trace is typically uniquely identified by a prefix of only 4–5 packet directions. Early-stage traffic (up to 60% of packets loaded) leaks minimal information: the Holmes partial-load WF attack achieves only 14.67% F1 against Chameleon at 60% load, a 74.5% reduction from the 57.61% baseline.

2026-cui-chameleon-robust-defense §IV-B, §V-D, Table V website-fingerprinttraffic-shape

Incoming traffic is the dominant website fingerprinting leakage vector in Nym because the network requester does not apply Poisson-rate cover traffic by default. The Features In feature set achieves 72.1% random-forest accuracy on Nym Testnet — exceeding Tor's 70.2% — while outgoing Features Out leaks only 43.9% (vs. 65.0% for Tor). The combined Features In/Out (70.0%) provides no additional information beyond Features In alone, confirming the inbound channel is the bottleneck. Enabling Poisson-rate cover traffic on the network requester side (lambda_QR = 10-20 ms) lowers the Tik-Tok F1 score from 0.87 to 0.75-0.64 but raises latency overhead to 7.32-12.66x (Table 4, configs 10-11).

2026-joll-s-website-fingerprinting-nym §5.1, Table 3 website-fingerprinttraffic-shape

Increasing Nym's per-hop mixing delay (λM) counterintuitively worsens WF resistance: without cover traffic, raising λM to 100 ms raises Tik-Tok F1 from 0.91 (no mixing) to 0.98. Larger delays create a visible temporal gap between outgoing request bursts and incoming response bursts, making the Transposition feature set leak 95.5% classifier accuracy versus 88.5% with no delay at all.

2026-joll-s-website-fingerprinting-nym §5.2, Table 4, Table 5 website-fingerprintml-classifiertraffic-shape