Across five independent trials, injecting speedBonus and capacityBonus values of 9999 into I2P peer profiles deterministically promoted adversary nodes into the victim's eligible selection set (Fv) with perfect consistency (σ = 0), and the adversary was chosen for 1.38× more tunnel build requests than matched controls (10.76 ± 0.20 vs 7.80 ± 1.84 lifetime agreed-to tunnels).

Advertising a 16 MB/s bandwidth class did not raise attackers' measured peak throughput above controls under light testbed load (0.127 ± 0.000 KBps vs 0.210 ± 0.072 KBps, ρ = 0.60), showing that the behavioral lever (earned performance) is ineffective at low traffic volumes and that direct bonus injection is the operative attack component in I2P reputation manipulation.

§5.3, Fig. 11, Fig. 12 evaluation

The paper identifies a statistical anomaly defense against I2P reputation injection: an injected bonus value (e.g., 9999) sits orders of magnitude above any legitimate measured value for the same peer, so a router comparing stored bonus fields against the distribution of its own observed measurements for that peer could flag and discard outlier values while leaving legitimately earned reputations intact.

§8 defense

A 50-router I2P deployment spanning five geographic locations stabilizes in approximately 25 minutes and consumes roughly 21 GB RAM (417 MB per router, measured via live systemd cgroups), with a single-host ceiling of approximately 90 routers and a static-profiling estimate (257 MB) that was 62% lower than the live measurement.

§3, §4, Table 2, §7 evaluation

Selection stage success does not imply delivery stage success: adversary nodes selected 1.38× more often were also rejected 3.45× more often than controls (265.8 ± 21.2 vs 77.0 ± 16.5 lifetime rejections), demonstrating that compromising the selection criterion is a necessary but not sufficient condition for traffic interception.

§5.3, Fig. 10, Fig. 12 evaluation

Stage 1 of the detection pipeline uses a lightweight heuristic: restrict analysis to IP addresses in "VPS-dense ASNs," which censors already target for resource-intensive inspection of fully-encrypted traffic. This pre-filter dramatically reduces the search space before applying the more expensive dual-role behavioral analysis. The evaluation was conducted without Stages 1 and 3 due to dataset limitations, meaning the reported 23% recall and 0.18% FPR are conservative lower bounds on the full pipeline's performance.

2026-almutairi-server §2.1, §2.2, §3.4 fully-encrypted-detectdpiml-classifier

Based on analysis of over 100,000 leaked Geedge Networks documents, InterSecLab (2025) found that Geedge supplied China-GFW-equivalent censorship and surveillance systems to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The systems include deep packet inspection, real-time mobile user monitoring, fine-grained traffic control, regionally customizable censorship rules, and — per WIRED's reporting — ML-based extraction of metadata from encrypted traffic to determine whether a flow is likely from a VPN or circumvention tool.

2026-anon-2026-27-vpn §8 (InterSecLab / WIRED section) dpiml-classifierfully-encrypted-detecttraffic-shape

China's CAC Phase 2 'Clearance·Rectify AI Application Chaos' campaign (reported 2026-09-02) removed 5.61 million pieces of content, processed 49,000+ accounts, and actioned 2,400+ websites and apps. Enforcement extended beyond post-publication removal to include AI-generated content labeling mandates, corpus auditing in generative AI products, and app-store developer vetting with retrospective re-testing of live apps.

2026-anon-gpt-6-astra §China CAC enforcement ml-classifierkeyword-filtering

Existing Provably Secure Steganography (PSS) schemes require access to the explicit output distribution of the generative model, a requirement that is impractical for black-box API deployments. This paper demonstrates that computational indistinguishability between normal and steganographic output can be achieved using only a seed-based model API, with no distribution access required.

2026-bai-provable-secure-steganography Abstract / §1 Introduction traffic-shapeml-classifier

The BiFEP datastream construction uses a 'wrapper' layer with authenticated DATA, DUMMY, and FIN frames over an independently keyed inner FEP per direction, revealing only a public sending schedule ΓX(t) and quantized closing epoch from the set Ecl — the exact private half-close time is hidden behind continued cover traffic. Empirical passive diagnostics on the Rust implementation show byte entropy of 7.999279–7.999749 bits/byte, maximum absolute byte correlation of 0.004668, and a random-forest ROC-AUC of 0.485 (95% CI [0.428, 0.542]) distinguishing DATA from ChaCha20 — not significantly better than chance.

2026-chen-closing-loop-bidirectional §IV; §VIII-D, Table IV fully-encrypted-detecttraffic-shapeml-classifier

Compared with Adaptive Tamaraw on the DF dataset, Chameleon reduces adversarial-training-based WF attack accuracy by up to 36.74 percentage points while simultaneously lowering bandwidth overhead by 34.12% (130.60% vs. 198.23%) and time overhead by 60.38% (14.51% vs. 36.62%). In closed-world evaluation across DF, Var-CNN, RF, and NetCLR attacks, Chameleon holds all attack accuracies below 27% and reduces average SOTA attack accuracy by 76.52% relative to the undefended baseline.

2026-cui-chameleon-robust-defense §V-B, Table II, Abstract website-fingerprintml-classifier