In controlled Testnet conditions, the Tik-Tok deep-learning WF attack achieves F1=0.87 (closed-world) and F1=0.83 (open-world) against Nym's default configuration, compared to F1=0.94/0.91 on Tor. On the live Mainnet, real-world network jitter reduces attack effectiveness to F1=0.69/0.71, but this comes at 11.93× latency overhead and 8.97× bandwidth overhead — a side-effect of instability rather than designed protection. The Mainnet drop is attributable to geographic node spread and roughly 5% packet retransmissions rather than to designed obfuscation.

Incoming traffic is the dominant website fingerprinting leakage vector in Nym because the network requester does not apply Poisson-rate cover traffic by default. The Features In feature set achieves 72.1% random-forest accuracy on Nym Testnet — exceeding Tor's 70.2% — while outgoing Features Out leaks only 43.9% (vs. 65.0% for Tor). The combined Features In/Out (70.0%) provides no additional information beyond Features In alone, confirming the inbound channel is the bottleneck. Enabling Poisson-rate cover traffic on the network requester side (lambda_QR = 10-20 ms) lowers the Tik-Tok F1 score from 0.87 to 0.75-0.64 but raises latency overhead to 7.32-12.66x (Table 4, configs 10-11).

§5.1, Table 3 detection

Increasing Nym's per-hop mixing delay (λM) counterintuitively worsens WF resistance: without cover traffic, raising λM to 100 ms raises Tik-Tok F1 from 0.91 (no mixing) to 0.98. Larger delays create a visible temporal gap between outgoing request bursts and incoming response bursts, making the Transposition feature set leak 95.5% classifier accuracy versus 88.5% with no delay at all.

§5.2, Table 4, Table 5 evaluation

Routing web traffic through Nym's constant-rate traffic stream (POISS-OFF) reduces Tik-Tok F1 to 0.06, with all feature-set leakage at ≤9.5% accuracy (Table 8), at the cost of latency overhead 7.32 and bandwidth overhead 8.06 (Table 7). Nym's 2,413-byte packet size means each cover packet incurs 4.7× the overhead of a Tor cover cell, making constant-rate defenses significantly more expensive in this architecture. This matches near-ideal Tamaraw protection on Tor, against WTF4Nym's F1 = 0.39 at 3.78x latency and 4.22x bandwidth.

§6, Tables 7–8 defense

WTF4Nym, a burst-aware cover-traffic defense adapted to Nym's Poisson-rate architecture, reduces the Tik-Tok attack F1 score from 0.87 to 0.39 at moderate overhead (latency overhead 3.78×, bandwidth overhead 4.22×). This substantially outperforms directly applying WTF-PAD to Nym (F1=0.87), applying FRONT to Nym (F1=0.63), and the F1=0.65 achieved by FRONT on Tor at comparable overhead, by learning per-network burst distributions and injecting fake bursts that match those statistics. FRONT on Tor reaches F1 = 0.65 at 2.79x latency and 1.84x bandwidth, and under WTF4Nym the Time and N-gram feature leakage fall to 26.6% and 29.0% (Table 8).

§6.2, Table 7 defense

Without chunk-based padding, an XGBoost classifier identifies the target website from covert data-chunk sizes with 91% accuracy (Tranco top-100). Chunking at 2 MB reduces accuracy to 12% at a 21.3% bandwidth overhead, while 16 MB chunks reduce accuracy to near random guessing at a 480.3% overhead. Chunks as small as 64 KB already reduce accuracy to 64%, demonstrating a monotonic fingerprinting–overhead tradeoff.

2026-kamali-huma §V-C, Figure 4 website-fingerprintml-classifier

Ephemeral defenses were integrated with a WireGuard fork and deployed as Mullvad VPN's 'DAITA' (Defense Against AI-guided Traffic Analysis) opt-in feature across Android, iOS, macOS, Linux, and Windows for over one year, serving a growing number of thousands of daily users. Individual defenses are derived deterministically from seeds in 43.6 ± 4.7 ms on a commodity laptop, making per-connection unique defenses practical at VPN scale.

2026-pulls-ephemeral-network-layer-fingerprinting §1, §7 ml-classifierwebsite-fingerprint

Ephemeral blocking defenses reduce DF accuracy from 89.0% (undefended) to 10.2% and RF from 90.1% to 14.7% with standard 30-epoch training, at 97.5% bandwidth and 68.4% delay overhead; under infinite training, DF rises to only 29.2% and RF to 24.3%, still far below undefended baselines of 92.7% and 94.7%. Defenses are tunable at deployment time by adjusting Maybenot framework-wide limits, enabling overhead-vs-protection trade-offs without redeployment.

2026-pulls-ephemeral-network-layer-fingerprinting §5.2, §5.3, Table 1, Table 2 ml-classifierwebsite-fingerprint

The ephemeral property — using a unique seed-derived defense per connection — prevents attackers from training classifiers on the exact deployed defense variant. Stacked combinations with height H=5 from N=1,000 base defenses yield 6.88×10^25 unique defenses (polynomial growth O(N^{2H})). Attacks trained on ephemeral defenses also generalize significantly better across other randomized defense families than attacks trained on static defenses.

2026-pulls-ephemeral-network-layer-fingerprinting §3.3, §5.4 ml-classifierwebsite-fingerprint

With infinite training time, Laserbeak achieves 93.5%, 95.9%, and 95.9% accuracy against ephemeral padding, FRONT, and Interspace respectively, compared to 96.5% undefended — confirming that padding-only defenses provide no meaningful protection against a sufficiently trained deep-learning WF adversary. Only ephemeral blocking defenses retain measurable protection, reducing Laserbeak to 71.8% accuracy under infinite training versus 96.5% undefended.

2026-pulls-ephemeral-network-layer-fingerprinting §5.3, Table 2 ml-classifierwebsite-fingerprinttraffic-shape

Joint multi-task training with a combined loss L_joint = L_site + λ·L_pers shows that increasing λ from 0 to 2 raises mixed-site persona accuracy from approximately 45% to approximately 80% while website accuracy declines only from approximately 90% to approximately 75%, demonstrating a wide regime where an attacker can gain strong persona inference at modest cost to existing WFP capability.

2026-song-personafingerprint-measuring-persona §4.4, §5.7.2, Figure 5 website-fingerprintml-classifiertraffic-shape