The website fingerprinting task identifies 50 monitored HTTPS websites from Chromium visit Traces using inter-packet intervals and direction-encoded IP-packet lengths (up to 512 packet events and 128 bursts per trace), distinguishing monitored sites from visits to 100 unknown domains. Summary statistics over the complete trace supplement the truncated event sequence.

TrafficInstruct evaluates majority-class, random-forest, ET-BERT, an unadapted 27B language model (Qwen3.8-27B), and task-specific LoRA adapters (trained 10 epochs, batch 32, lr 2×10⁻⁵, max 512 tokens) on a shared frozen base across ten traffic classification tasks including VPN detection, Tor behavior detection, and website fingerprinting; task-specific adaptation improves Macro-F1 over the unadapted 27B baseline on all tasks.

§V-A, Abstract evaluation

The malicious DNS-over-HTTPS detection task classifies iodine, dns2tcp, and dnscat2 tunnel traffic across 12 scripted behaviors (heartbeats, polling, staged uploads, bidirectional sessions, large transfers) using 166 statistical features per bidirectional flow extracted by a fixed feature extractor without a configured packet-count threshold (13 packets is a reported observed minimum, not an admission gate).

§III-A (task 3) detection

The Tor behavior detection collection configured all Tor clients to use Snowflake bridges, meaning the dataset's 'Tor' label class captures Snowflake-tunneled Tor traffic. A classifier trained on these flows would associate the Snowflake WebRTC signaling and DTLS/SRTP profile with the Tor-Normal classification boundary.

§III-A (task 7) detection

TrafficInstruct's encrypted VPN and Tor behavior detection tasks use flow-level features (packet lengths, directions, relative times, header fields) while explicitly omitting SNI, domain names, endpoint identifiers, and raw payloads. This demonstrates that VPN and Tor traffic can be classified into 18 and 12 activity categories respectively using statistical features alone, without application-layer identifiers.

§IV-A, §IV-D detection

Chameleon's many-to-many randomized traffic morphing blocks DAAE by eliminating the stable origin→defended-trace mapping that DAAE exploits. Under DAAE-based RF attacks on GTT23, Chameleon limits attack precision to 40.68% and F1-score to 35.19%, compared with 80.64%/70.30% for Palette and 89.82%/88.22% for Adaptive Tamaraw. The defense works by randomly mapping each webpage trace to one of multiple candidate traces, and allowing different webpages to share morphing targets, so no fixed per-class transformation exists for the autoencoder to learn.

2026-cui-chameleon-robust-defense §V-C, Table IV website-fingerprintml-classifiertraffic-shape

Increasing Nym's per-hop mixing delay (λM) counterintuitively worsens WF resistance: without cover traffic, raising λM to 100 ms raises Tik-Tok F1 from 0.91 (no mixing) to 0.98. Larger delays create a visible temporal gap between outgoing request bursts and incoming response bursts, making the Transposition feature set leak 95.5% classifier accuracy versus 88.5% with no delay at all.

2026-joll-s-website-fingerprinting-nym §5.2, Table 4, Table 5 website-fingerprintml-classifiertraffic-shape

With infinite training time, Laserbeak achieves 93.5%, 95.9%, and 95.9% accuracy against ephemeral padding, FRONT, and Interspace respectively, compared to 96.5% undefended — confirming that padding-only defenses provide no meaningful protection against a sufficiently trained deep-learning WF adversary. Only ephemeral blocking defenses retain measurable protection, reducing Laserbeak to 71.8% accuracy under infinite training versus 96.5% undefended.

2026-pulls-ephemeral-network-layer-fingerprinting §5.3, Table 2 ml-classifierwebsite-fingerprinttraffic-shape

Joint multi-task training with a combined loss L_joint = L_site + λ·L_pers shows that increasing λ from 0 to 2 raises mixed-site persona accuracy from approximately 45% to approximately 80% while website accuracy declines only from approximately 90% to approximately 75%, demonstrating a wide regime where an attacker can gain strong persona inference at modest cost to existing WFP capability.

2026-song-personafingerprint-measuring-persona §4.4, §5.7.2, Figure 5 website-fingerprintml-classifiertraffic-shape

Using only 1,000-packet windows of signed packet lengths and inter-arrival times (no payload, no URLs, no cookies), a passive adversary achieves approximately 84% accuracy at inferring behavioral persona in a mixed-site open-world setting spanning 10 modern websites and 15 canonical personas plus an open-world class. Per-site persona macro-F1 typically ranges from about 0.78 to 0.91 across representative platforms including Bilibili, eBay, Yahoo, Zhihu, and LinkedIn.

2026-song-personafingerprint-measuring-persona §5.3, §5.5, Abstract website-fingerprinttraffic-shapeml-classifier

Training WFP classifiers with LLM multi-agent simulated traces boosts cross-user accuracy to the 80% range (TikTok: 50.3%→84.9%, NetCLR: 53.6%→77.3%) compared to under 15% for models trained on scripted-only traffic. ClaudeOnly training outperforms ScriptedOnly baselines by approximately 3× on held-out human traces, using only 20% of the data volume, at a cost of roughly $10/GB versus $35/GB for human collection.

2026-song-redefining-website-fingerprinting §5.4 / Figure 6 website-fingerprintml-classifiertraffic-shape