Website fingerprinting over encrypted proxy/VPN tunnels on DataCon-Website reaches only 46.30% Tail-F1 for infrequent destination classes even with the best evaluated method—substantially below the 85.70% Tail-F1 achieved on mobile applications (NUDT-Mobile)—reflecting that rare encrypted website traffic classes remain significantly harder for ML classifiers regardless of model architecture improvements.

Curv-Tail achieves Tail-F1 scores of 85.70% and 46.30% on NUDT-Mobile (300 mobile-app classes) and DataCon-Website (100 encrypted proxy/VPN website classes) under natural long-tailed class frequencies, with only 0.84M parameters and 46.07M MACs per flow—using 98.48% fewer parameters and achieving 10.2× the batch inference throughput of MM4Flow at FP32 precision on an RTX 4090, with an amortized per-flow latency of 0.1359 ms at batch size 256.

§3.2, §3.4, Table 1, Fig. 4(a) evaluation

Discrete packet-length tokenization is the single most influential component in Curv-Tail: replacing it with continuous length encoding reduces Tail-F1 by 11.04 percentage points on DataCon-Website (47.23% → 36.19%), a larger ablation gap than removing Lorentz geometry (−2.12 pp) or the length-retention auxiliary objective (−1.02 pp) combined.

§3.3, Table 3 detection

Classifier-level long-tail corrections applied to a fine-tuned and frozen ET-BERT encoder on NUDT-Mobile—including logit adjustment, effective-number reweighting, class-balanced retraining (cRT), and feature mixup—improve Tail-F1 by at most 0.08 percentage points over the base ET-BERT (82.79%); Curv-Tail's end-to-end joint representation learning outperforms the best correction by 2.83 points in Tail-F1 and 3.05 points in Macro-F1.

§3.2, Table 2 evaluation

On NUDT-Mobile, Curv-Tail achieves group-wise Macro-F1 of 96.98% on head classes (top 50% by training frequency), 92.84% on body classes, and 85.70% on tail classes, with per-group gains over the strongest baseline (MM4Flow) of 0.65, 1.12, and 4.97 percentage points respectively—demonstrating that architectural improvements disproportionately benefit rare-class detection and that tail-class accuracy is approaching head-class accuracy.

§3.2, Fig. 3 detection

Compared with Adaptive Tamaraw on the DF dataset, Chameleon reduces adversarial-training-based WF attack accuracy by up to 36.74 percentage points while simultaneously lowering bandwidth overhead by 34.12% (130.60% vs. 198.23%) and time overhead by 60.38% (14.51% vs. 36.62%). In closed-world evaluation across DF, Var-CNN, RF, and NetCLR attacks, Chameleon holds all attack accuracies below 27% and reduces average SOTA attack accuracy by 76.52% relative to the undefended baseline.

2026-cui-chameleon-robust-defense §V-B, Table II, Abstract website-fingerprintml-classifier

Defense-aware autoencoder (DAAE) attacks can recover website fingerprinting accuracy against defenses that successfully resist adversarial training. On the GTT23 dataset, DAAE-based DF attacks achieve over 90% accuracy against RegulaTor and over 80% against Palette and Adaptive Tamaraw, despite those defenses reducing unaugmented DF attack accuracy from 93.2% to 2–35%. Adversarial training robustness and DAAE robustness are distinct and non-interchangeable properties.

2026-cui-chameleon-robust-defense §I, Figure 1 website-fingerprintml-classifier

Chameleon's many-to-many randomized traffic morphing blocks DAAE by eliminating the stable origin→defended-trace mapping that DAAE exploits. Under DAAE-based RF attacks on GTT23, Chameleon limits attack precision to 40.68% and F1-score to 35.19%, compared with 80.64%/70.30% for Palette and 89.82%/88.22% for Adaptive Tamaraw. The defense works by randomly mapping each webpage trace to one of multiple candidate traces, and allowing different webpages to share morphing targets, so no fixed per-class transformation exists for the autoencoder to learn.

2026-cui-chameleon-robust-defense §V-C, Table IV website-fingerprintml-classifiertraffic-shape

Chameleon's defense remains robust against randomization-aware attackers who augment training with up to K=20 independently randomized defended variants per trace. On the GTT23 dataset, even at K=20, DF, Var-CNN, RF, and NetCLR achieve only 17.50%, 18.82%, 31.06%, and 17.04% accuracy respectively — well below the 100-class closed-world ceiling — confirming that protection does not depend on limiting the attacker's exposure to defended traffic samples.

2026-cui-chameleon-robust-defense §V-E, Table VII website-fingerprintml-classifier

Increasing Nym's per-hop mixing delay (λM) counterintuitively worsens WF resistance: without cover traffic, raising λM to 100 ms raises Tik-Tok F1 from 0.91 (no mixing) to 0.98. Larger delays create a visible temporal gap between outgoing request bursts and incoming response bursts, making the Transposition feature set leak 95.5% classifier accuracy versus 88.5% with no delay at all.

2026-joll-s-website-fingerprinting-nym §5.2, Table 4, Table 5 website-fingerprintml-classifiertraffic-shape

In controlled Testnet conditions, the Tik-Tok deep-learning WF attack achieves F1=0.87 (closed-world) and F1=0.83 (open-world) against Nym's default configuration, compared to F1=0.94/0.91 on Tor. On the live Mainnet, real-world network jitter reduces attack effectiveness to F1=0.69/0.71, but this comes at 11.93× latency overhead and 8.97× bandwidth overhead — a side-effect of instability rather than designed protection. The Mainnet drop is attributable to geographic node spread and roughly 5% packet retransmissions rather than to designed obfuscation.

2026-joll-s-website-fingerprinting-nym §5.1, Table 2 website-fingerprintml-classifier