Websites generating only one or two observable non-Google DNS queries per visit have classification accuracy below 30% in DoHFuse's closed-world evaluation, compared to the model's overall 88.05% on 449 classes. Sites such as ftc.gov and ailawandorder.com fell near zero accuracy, revealing that extremely sparse DNS activity is a natural but uncontrolled defense against timing-based fingerprinting.

DoHFuse's dual-branch architecture outperforms all five baselines (KNN, Random Forest, FCNN+GRU, LSTM, Transformer) across 100-, 200-, and 449-class closed-world settings with standard deviations under 0.5 percentage points, while the vanilla Transformer's standard deviation exceeds 5 percentage points at 449 classes (mean 61.50%). This demonstrates that attention-based models without recurrence-scale adaptations are unsuitable for the burst–gap temporal dynamics of DoH/3, and that multi-scale gating (DMAG-LSTM) is the key architectural driver of robustness.

§V.C; Table II; Figure 6 evaluation

Under DoH/3, EDNS(0) padding and HTTP/3 framing collapse packet-length diversity: more than 99% of request packets fall within 233–350 bytes and more than 99% of response packets fall within 555–777 bytes. Direction-signed length-sequence classifiers (RF, LSTM, CNN) achieve only 67.39%, 8.95%, and 7.43% accuracy respectively on 449 classes — near or below random — confirming that size-based traffic analysis features lose nearly all discriminative power against DoH/3.

§IV.D; §V.B; Table I detection

DoHFuse achieves 88.05% accuracy (precision 88.56, recall 87.96, F1 87.83) fingerprinting 449 websites from DoH/3 traffic alone, demonstrating that EDNS(0) padding and QUIC/HTTP3 multiplexing are insufficient to prevent website fingerprinting. In the open-world setting, the model achieves AUPRC 0.975 with F1 0.951 (precision 0.906, recall 1.0), meaning every monitored site is detected while maintaining a low false-positive rate.

Abstract; §V.C; §V.E evaluation

Inter-arrival time sequences between client DoH/3 request packets retain site-specific temporal structure despite QUIC padding and stream multiplexing, exhibiting characteristic micro-burst and inter-burst gap patterns. Using timing features alone, LSTM achieves 83.75% ± 0.92% accuracy at 449 classes, and DoHFuse with its dual-branch DMAG-LSTM reaches 89.08% ± 0.49%, while length-only LSTM degrades to 8.95% under the same conditions.

§IV.D; §V.B; §V.C; Table II detection

Compared with Adaptive Tamaraw on the DF dataset, Chameleon reduces adversarial-training-based WF attack accuracy by up to 36.74 percentage points while simultaneously lowering bandwidth overhead by 34.12% (130.60% vs. 198.23%) and time overhead by 60.38% (14.51% vs. 36.62%). In closed-world evaluation across DF, Var-CNN, RF, and NetCLR attacks, Chameleon holds all attack accuracies below 27% and reduces average SOTA attack accuracy by 76.52% relative to the undefended baseline.

2026-cui-chameleon-robust-defense §V-B, Table II, Abstract website-fingerprintml-classifier

Defense-aware autoencoder (DAAE) attacks can recover website fingerprinting accuracy against defenses that successfully resist adversarial training. On the GTT23 dataset, DAAE-based DF attacks achieve over 90% accuracy against RegulaTor and over 80% against Palette and Adaptive Tamaraw, despite those defenses reducing unaugmented DF attack accuracy from 93.2% to 2–35%. Adversarial training robustness and DAAE robustness are distinct and non-interchangeable properties.

2026-cui-chameleon-robust-defense §I, Figure 1 website-fingerprintml-classifier

Chameleon's many-to-many randomized traffic morphing blocks DAAE by eliminating the stable origin→defended-trace mapping that DAAE exploits. Under DAAE-based RF attacks on GTT23, Chameleon limits attack precision to 40.68% and F1-score to 35.19%, compared with 80.64%/70.30% for Palette and 89.82%/88.22% for Adaptive Tamaraw. The defense works by randomly mapping each webpage trace to one of multiple candidate traces, and allowing different webpages to share morphing targets, so no fixed per-class transformation exists for the autoencoder to learn.

2026-cui-chameleon-robust-defense §V-C, Table IV website-fingerprintml-classifiertraffic-shape

Chameleon's defense remains robust against randomization-aware attackers who augment training with up to K=20 independently randomized defended variants per trace. On the GTT23 dataset, even at K=20, DF, Var-CNN, RF, and NetCLR achieve only 17.50%, 18.82%, 31.06%, and 17.04% accuracy respectively — well below the 100-class closed-world ceiling — confirming that protection does not depend on limiting the attacker's exposure to defended traffic samples.

2026-cui-chameleon-robust-defense §V-E, Table VII website-fingerprintml-classifier

Increasing Nym's per-hop mixing delay (λM) counterintuitively worsens WF resistance: without cover traffic, raising λM to 100 ms raises Tik-Tok F1 from 0.91 (no mixing) to 0.98. Larger delays create a visible temporal gap between outgoing request bursts and incoming response bursts, making the Transposition feature set leak 95.5% classifier accuracy versus 88.5% with no delay at all.

2026-joll-s-website-fingerprinting-nym §5.2, Table 4, Table 5 website-fingerprintml-classifiertraffic-shape

In controlled Testnet conditions, the Tik-Tok deep-learning WF attack achieves F1=0.87 (closed-world) and F1=0.83 (open-world) against Nym's default configuration, compared to F1=0.94/0.91 on Tor. On the live Mainnet, real-world network jitter reduces attack effectiveness to F1=0.69/0.71, but this comes at 11.93× latency overhead and 8.97× bandwidth overhead — a side-effect of instability rather than designed protection. The Mainnet drop is attributable to geographic node spread and roughly 5% packet retransmissions rather than to designed obfuscation.

2026-joll-s-website-fingerprinting-nym §5.1, Table 2 website-fingerprintml-classifier