FINDING · DETECTION

A persistent 'tail' of recurring candidates — not the early phase — dominates convergence cost and introduces high variance: three Vanguard stages at identical consensus weight 1200 converged at iterations 12, 142, and 251. In 13 of 36 stages, the intersection held ≥3 candidates at the penultimate iteration and collapsed to a singleton in one step, suggesting the tail is caused by persistent third-party guard/vanguard traffic rather than random noise.

From 2026-constantinides-cost-stability-deanonymizing — The Cost of Stability: Deanonymizing Onion Services Long-Lived Introduction Circuits · §4.2, Table 2 · 2026 · arXiv preprint

Implications

Persistent guard and vanguard reuse — Tor's own path-stability mechanisms — inadvertently create recurring traffic patterns that act as fixed beacons, enabling sequential deanonymization; circumvention designs that rotate relay assignments more frequently would disrupt this.
Adding cover traffic between observation windows (e.g., sending application-layer pings through unrelated circuits) would force false candidates to persist across more iterations, increasing attacker effort proportionally.