Scylla, a modified Sphinx mix format, applies OAEP (an all-or-nothing transform) to the concatenated recipient address and message before splitting into fragments, so the final hop cannot recover the recipient or message without all fragments. Scylla adds only 39 bytes of header overhead over Sphinx and ~247 µs per fragment of computation time—negligible compared to Nym's default 15 ms per-hop mixing delay.

The Fragging attack exploits message fragmentation in Nym to break sender-recipient unlinkability without any external side information. In a Shadow network simulator testbed, benign fragment sets complete in an average of 308 ms, while sets with at least one dropped fragment show completion times of ~2000 ms due to Nym's retransmission timeout—a timing signal that remains distinguishable at per-hop mixing delays of up to 500 ms.

§4.1, Figure 2 detection

Three conditions are jointly necessary and sufficient for a Fragging attack: (C1) the adversary can drop packets while knowing their sender—met by a malicious gateway/entry node in both Nym and Tor; (C2) the adversary can detect a missing fragment—met by Nym's explicit fragment-set identifiers and by Tor's encryption-state desynchronization on cell drop; and (C3) the adversary can learn the recipient from the surviving fragments—met in both systems because other fragments of the set arrive intact.

§4.3 detection

Fragging-like attacks on Tor allow an adversary controlling the entry node to encode at least a 1-bit confirmation signal by dropping a single stream cell and observing circuit teardown (caused by encryption-state desynchronization between client and exit relay). If the adversary knows the expected cell count, they can select which cell to drop and thereby encode log(n) bits of information to the exit relay.

§4.2 detection

Scylla's AONT-based fragmentation closes the C3 condition for Fragging (fragment-drop as a tagging mechanism) but does not close the retransmission timing side-channel in Nym: per-fragment acknowledgments still allow a malicious recipient to measure fragment-set completion time and distinguish dropped-fragment senders. Full mitigation requires replacing per-fragment acknowledgments with per-message acknowledgments that retransmit all fragments under a fresh identifier only after the complete message is confirmed received.

§5.5 defense

A three-stage detection pipeline exploiting the "dual-role" behavioral fingerprint of single-IP circumvention relays achieved 23.2% recall (96/414 ground-truth relays) with a 0.18% false-positive rate against 97,651 benign TLS servers, for an overall accuracy of 99.5%. The ground-truth set covered OpenVPN, WireGuard, and SOCKS relays identified in a 17 TB single-day backbone trace (WIDE Project, April 9, 2025).

2026-almutairi-server §3.4, Table 1 traffic-shapedpiflow-correlation

NATA (Non-invasive Active Traffic-correlation Analysis) injects low-frequency bandwidth waveforms (sinusoidal, square-wave, triangular) into Tor TCP connections at an upstream gateway without endpoint compromise, payload decryption, or Tor-browser modification. BM-Net, a selective state-space classifier trained on the exit-side observations, achieves a 99.65% binary detection F1 score distinguishing watermarked from natural traffic on a 20,000-trace real-world dataset.

2026-fan-activeflowmark-assessing-tor §IV, §VI.D, Table III flow-correlationtraffic-shapeml-classifier

BM-Net achieves a 99.65% binary detection F1 score for distinguishing bandwidth-watermarked Tor flows from natural traffic, outperforming all evaluated baselines (next best: TikTok at 75.96% F1). The accuracy gap stems from active perturbation imposing a deterministic low-frequency throughput constraint rather than relying on subtle natural metadata, making the detection task fundamentally easier than passive website fingerprinting.

2026-fan-activeflowmark-assessing-tor §VI-D, Table III–IV flow-correlationtraffic-shapeml-classifier

BM-Net achieves a 99.65% binary detection F1 score distinguishing watermarked from natural Tor flows, and a 97.5% macro-F1 score for fine-grained modulation classification across sinusoidal, square-wave, and triangular patterns. The fine-grained test set contains 201 held-out samples collected from ten clients across five geographic regions (Europe, North America, Australia, Southeast Asia, East Asia), with training traces including traffic collected under WTF-PAD and Walkie-Talkie defenses.

2026-fan-activeflowmark-assessing-tor §VI-D, Table III, Table V flow-correlationml-classifiertraffic-shape

Active bandwidth perturbation has an inherent detectability–stability trade-off: overly aggressive low-rate phases cause Tor SENDME-based flow control stalls, retransmissions, timeouts, or circuit replacement before sufficient correlation evidence is collected. The paper selects a 30-second modulation period and an empirically determined minimum shaping rate; the usable shaping range varies with relay load, path length, TCP congestion control behavior, and Tor multiplexing.

2026-fan-activeflowmark-assessing-tor §VII-A flow-correlationtraffic-shape

BM-Net achieves a 97.5% macro-F1 score for fine-grained classification of three modulation geometries (sinusoidal, square-wave, triangular) from noisy exit-side Tor observations using only 201 labeled test samples collected across cross-continental Tor paths. Residual errors concentrate between natural traffic and square-wave modulation, as abrupt low-rate transitions are partially smoothed by Tor multiplexing and network jitter. Per-class F1 is 95.7% for square-wave, the hardest class, versus 99.0% each for sinusoidal and triangular.

2026-fan-activeflowmark-assessing-tor §VI-D, Table V flow-correlationml-classifiertraffic-shape