Curv-Tail achieves Tail-F1 scores of 85.70% and 46.30% on NUDT-Mobile (300 mobile-app classes) and DataCon-Website (100 encrypted proxy/VPN website classes) under natural long-tailed class frequencies, with only 0.84M parameters and 46.07M MACs per flow—using 98.48% fewer parameters and achieving 10.2× the batch inference throughput of MM4Flow at FP32 precision on an RTX 4090, with an amortized per-flow latency of 0.1359 ms at batch size 256.

Discrete packet-length tokenization is the single most influential component in Curv-Tail: replacing it with continuous length encoding reduces Tail-F1 by 11.04 percentage points on DataCon-Website (47.23% → 36.19%), a larger ablation gap than removing Lorentz geometry (−2.12 pp) or the length-retention auxiliary objective (−1.02 pp) combined.

§3.3, Table 3 detection

Classifier-level long-tail corrections applied to a fine-tuned and frozen ET-BERT encoder on NUDT-Mobile—including logit adjustment, effective-number reweighting, class-balanced retraining (cRT), and feature mixup—improve Tail-F1 by at most 0.08 percentage points over the base ET-BERT (82.79%); Curv-Tail's end-to-end joint representation learning outperforms the best correction by 2.83 points in Tail-F1 and 3.05 points in Macro-F1.

§3.2, Table 2 evaluation

On NUDT-Mobile, Curv-Tail achieves group-wise Macro-F1 of 96.98% on head classes (top 50% by training frequency), 92.84% on body classes, and 85.70% on tail classes, with per-group gains over the strongest baseline (MM4Flow) of 0.65, 1.12, and 4.97 percentage points respectively—demonstrating that architectural improvements disproportionately benefit rare-class detection and that tail-class accuracy is approaching head-class accuracy.

§3.2, Fig. 3 detection

Website fingerprinting over encrypted proxy/VPN tunnels on DataCon-Website reaches only 46.30% Tail-F1 for infrequent destination classes even with the best evaluated method—substantially below the 85.70% Tail-F1 achieved on mobile applications (NUDT-Mobile)—reflecting that rare encrypted website traffic classes remain significantly harder for ML classifiers regardless of model architecture improvements.

§3.2, Table 1 detection

Chameleon's many-to-many randomized traffic morphing blocks DAAE by eliminating the stable origin→defended-trace mapping that DAAE exploits. Under DAAE-based RF attacks on GTT23, Chameleon limits attack precision to 40.68% and F1-score to 35.19%, compared with 80.64%/70.30% for Palette and 89.82%/88.22% for Adaptive Tamaraw. The defense works by randomly mapping each webpage trace to one of multiple candidate traces, and allowing different webpages to share morphing targets, so no fixed per-class transformation exists for the autoencoder to learn.

2026-cui-chameleon-robust-defense §V-C, Table IV website-fingerprintml-classifiertraffic-shape

Increasing Nym's per-hop mixing delay (λM) counterintuitively worsens WF resistance: without cover traffic, raising λM to 100 ms raises Tik-Tok F1 from 0.91 (no mixing) to 0.98. Larger delays create a visible temporal gap between outgoing request bursts and incoming response bursts, making the Transposition feature set leak 95.5% classifier accuracy versus 88.5% with no delay at all.

2026-joll-s-website-fingerprinting-nym §5.2, Table 4, Table 5 website-fingerprintml-classifiertraffic-shape

With infinite training time, Laserbeak achieves 93.5%, 95.9%, and 95.9% accuracy against ephemeral padding, FRONT, and Interspace respectively, compared to 96.5% undefended — confirming that padding-only defenses provide no meaningful protection against a sufficiently trained deep-learning WF adversary. Only ephemeral blocking defenses retain measurable protection, reducing Laserbeak to 71.8% accuracy under infinite training versus 96.5% undefended.

2026-pulls-ephemeral-network-layer-fingerprinting §5.3, Table 2 ml-classifierwebsite-fingerprinttraffic-shape

Joint multi-task training with a combined loss L_joint = L_site + λ·L_pers shows that increasing λ from 0 to 2 raises mixed-site persona accuracy from approximately 45% to approximately 80% while website accuracy declines only from approximately 90% to approximately 75%, demonstrating a wide regime where an attacker can gain strong persona inference at modest cost to existing WFP capability.

2026-song-personafingerprint-measuring-persona §4.4, §5.7.2, Figure 5 website-fingerprintml-classifiertraffic-shape

Using only 1,000-packet windows of signed packet lengths and inter-arrival times (no payload, no URLs, no cookies), a passive adversary achieves approximately 84% accuracy at inferring behavioral persona in a mixed-site open-world setting spanning 10 modern websites and 15 canonical personas plus an open-world class. Per-site persona macro-F1 typically ranges from about 0.78 to 0.91 across representative platforms including Bilibili, eBay, Yahoo, Zhihu, and LinkedIn.

2026-song-personafingerprint-measuring-persona §5.3, §5.5, Abstract website-fingerprinttraffic-shapeml-classifier

Training WFP classifiers with LLM multi-agent simulated traces boosts cross-user accuracy to the 80% range (TikTok: 50.3%→84.9%, NetCLR: 53.6%→77.3%) compared to under 15% for models trained on scripted-only traffic. ClaudeOnly training outperforms ScriptedOnly baselines by approximately 3× on held-out human traces, using only 20% of the data volume, at a cost of roughly $10/GB versus $35/GB for human collection.

2026-song-redefining-website-fingerprinting §5.4 / Figure 6 website-fingerprintml-classifiertraffic-shape