Burst features alone achieve 94.17% model-fingerprinting accuracy versus 95.67% for all 168 features; removing burst features drops accuracy by 9.33 percentage points, while removing packet-size or timing alone causes near-zero degradation. Information-theoretic analysis confirms burst-byte features leak 3.02 of the maximum 3.32 bits of model identity, versus only ~0.23 bits from aggregate volume/direction.

Prompt reformulation (wrapping prompts with semantics-preserving instructions) reduces model-fingerprinting accuracy from 93.2% to 69.5% (−23.7 pp), and temperature randomization reduces it by up to 18.2 pp, but accuracy remains far above the 10% random baseline in all tested conditions. Because the attacks exploit correlated signals across packet sizes, timing, burst rates, and response progression simultaneously, the paper concludes that defenses must reshape the entire traffic profile rather than mask any single feature family.

§V.C, §VI.A, Figure 9(a) evaluation

Using only encrypted packet metadata — packet sizes, directions, timing, and burst structure — a passive on-path observer achieves 97.7% balanced accuracy fingerprinting 10 LLMs, dropping only to 92.2% when the candidate set scales to 20 models. Two post-trained variants sharing the same Qwen3-14B backbone remain separable at 100% and 96.7% recall, showing that post-training-induced behavior changes the traffic fingerprint independently of architecture.

§V.A.2, Figure 9(b) detection

Multi-agent task fingerprinting achieves up to 90.7% balanced accuracy using all 247 features; observing encrypted traffic from a single agent yields 66.5% accuracy under graph topology and 78.0% under star topology, rising to 84.3% and 85.9% with up to four agents visible. Cross-topology accuracy drops from 83% to 52% but remains well above the 10% chance level, indicating that topology changes reduce but do not eliminate task leakage.

§V.B, Figure 8 detection

Using only LLM-to-user response packets (22 features), a classifier identifies the semantic category of a user's prompt — among six classes including code generation, mathematical reasoning, and adversarial requests — with 67.37% mean accuracy versus a 16.67% random baseline. Response-only accuracy exceeds full-traffic accuracy (65.10%), and packet-size and timing features contribute the most unique information (8.34 pp and 7.26 pp drop when each is removed); the leakage originates from generation behavior, not prompt length.

§V.A.3, Table II–III detection

Based on analysis of over 100,000 leaked Geedge Networks documents, InterSecLab (2025) found that Geedge supplied China-GFW-equivalent censorship and surveillance systems to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The systems include deep packet inspection, real-time mobile user monitoring, fine-grained traffic control, regionally customizable censorship rules, and — per WIRED's reporting — ML-based extraction of metadata from encrypted traffic to determine whether a flow is likely from a VPN or circumvention tool.

2026-anon-2026-27-vpn §8 (InterSecLab / WIRED section) dpiml-classifierfully-encrypted-detecttraffic-shape

Existing Provably Secure Steganography (PSS) schemes require access to the explicit output distribution of the generative model, a requirement that is impractical for black-box API deployments. This paper demonstrates that computational indistinguishability between normal and steganographic output can be achieved using only a seed-based model API, with no distribution access required.

2026-bai-provable-secure-steganography Abstract / §1 Introduction traffic-shapeml-classifier

The BiFEP datastream construction uses a 'wrapper' layer with authenticated DATA, DUMMY, and FIN frames over an independently keyed inner FEP per direction, revealing only a public sending schedule ΓX(t) and quantized closing epoch from the set Ecl — the exact private half-close time is hidden behind continued cover traffic. Empirical passive diagnostics on the Rust implementation show byte entropy of 7.999279–7.999749 bits/byte, maximum absolute byte correlation of 0.004668, and a random-forest ROC-AUC of 0.485 (95% CI [0.428, 0.542]) distinguishing DATA from ChaCha20 — not significantly better than chance.

2026-chen-closing-loop-bidirectional §IV; §VIII-D, Table IV fully-encrypted-detecttraffic-shapeml-classifier

Chameleon's many-to-many randomized traffic morphing blocks DAAE by eliminating the stable origin→defended-trace mapping that DAAE exploits. Under DAAE-based RF attacks on GTT23, Chameleon limits attack precision to 40.68% and F1-score to 35.19%, compared with 80.64%/70.30% for Palette and 89.82%/88.22% for Adaptive Tamaraw. The defense works by randomly mapping each webpage trace to one of multiple candidate traces, and allowing different webpages to share morphing targets, so no fixed per-class transformation exists for the autoencoder to learn.

2026-cui-chameleon-robust-defense §V-C, Table IV website-fingerprintml-classifiertraffic-shape

NATA (Non-invasive Active Traffic-correlation Analysis) injects low-frequency bandwidth waveforms (sinusoidal, square-wave, triangular) into Tor TCP connections at an upstream gateway without endpoint compromise, payload decryption, or Tor-browser modification. BM-Net, a selective state-space classifier trained on the exit-side observations, achieves a 99.65% binary detection F1 score distinguishing watermarked from natural traffic on a 20,000-trace real-world dataset.

2026-fan-activeflowmark-assessing-tor §IV, §VI.D, Table III flow-correlationtraffic-shapeml-classifier

BM-Net achieves a 99.65% binary detection F1 score for distinguishing bandwidth-watermarked Tor flows from natural traffic, outperforming all evaluated baselines (next best: TikTok at 75.96% F1). The accuracy gap stems from active perturbation imposing a deterministic low-frequency throughput constraint rather than relying on subtle natural metadata, making the detection task fundamentally easier than passive website fingerprinting.

2026-fan-activeflowmark-assessing-tor §VI-D, Table III–IV flow-correlationtraffic-shapeml-classifier