Even with perfectly equalized cycle sizes, a persistent intra-response timing side channel survives in Dodge: timing characteristics of individual packets within server responses cannot be controlled client-side, causing vRF accuracy to remain slightly above random guessing in all tested scenarios. This residual leak is consistent and observable regardless of anonymity set size or media configuration.

Dodge-mimic reduces vRF deep-learning classifier accuracy to 10.6–15.6% for k=10 anonymity sets, matching the theoretical k-anonymity bound of (100/k)%=10%. The heuristic Walls Have Ears attack also fails: WHE-seg peaks at ≤8.5% and WHE-cyk at 9.7%, confirming that equalized cycle sizes leak no per-video information.

§5.2, Table 2 defense

In live deployment with k=10 anonymity sets, video+audio+ABR, Dodge-mimic causes zero playback stalls in approximately 68% of sessions; for the remaining 32%, the mean initial stall time is 1.6 seconds — an extension of normal startup delay rather than mid-playback interruption — and all cycles complete roughly 20 seconds before playback ends even with large trailing cycles.

§5.3, §5.3.3 evaluation

Small random per-session perturbations (±bytes per range) to Dodge-mimic extended manifests fully compensate for HPACK header compression in HTTP/2, yielding vRF accuracy of 10.5–14.2% for k=10 — indistinguishable from HTTP/1.1 results and near the theoretical bound. Because HTTP/3-QUIC uses analogous QPACK compression, the approach generalizes to the dominant future transport.

§5.4, Table 3 defense

With 32 worker threads, Dodge-mimic anonymity-set bandwidth overhead (as percentage of undefended video content) ranges from 21.0%±0.8 at k=2 to 73.1%±2.8 at k=10 and 107.4%±1.5 at k=20; beyond k=10–16 threads, additional parallelism yields diminishing returns and can increase overhead due to thread-boundary fragmentation of the optimal search space.

§5.1, Table 1 evaluation

IP-based fingerprints are operationally stable: approximately 60% of domains exhibit no IP changes across the three-month measurement period for both IPv4 and IPv6. Among churning domains, per-domain churn behavior is comparable across protocols—about 28% of churning IPv4 domains rotate within one hour on average vs 35% for IPv6. Fingerprint databases of ≈100 KB per site (50–60 GB for 520K sites) can be maintained with only periodic DNS re-resolution at negligible overhead for adversaries already collecting NetFlow data.

2026-ahmad-more-space-less §6.4, §5.3.2 website-fingerprinttraffic-shape

IP-based website fingerprinting achieves 93–94% top-1 accuracy on dual-stack incomplete websites (those with any IPv4-only third-party dependencies) using both IPv4 and IPv6 fingerprints across 228K sites. For dual-stack complete sites (all resources reachable over IPv6), accuracy drops to 56% over IPv4 and 45% over IPv6. The discriminating signal comes almost entirely from secondary resource IPs: using only the primary domain's IP yields 5–8% accuracy regardless of protocol.

2026-ahmad-more-space-less §6.1, Table 1 website-fingerprinttraffic-shape

Incoming traffic is the dominant website fingerprinting leakage vector in Nym because the network requester does not apply Poisson-rate cover traffic by default. The Features In feature set achieves 72.1% random-forest accuracy on Nym Testnet — exceeding Tor's 70.2% — while outgoing Features Out leaks only 43.9% (vs. 65.0% for Tor). The combined Features In/Out (70.0%) provides no additional information beyond Features In alone, confirming the inbound channel is the bottleneck. Enabling Poisson-rate cover traffic on the network requester side (lambda_QR = 10-20 ms) lowers the Tik-Tok F1 score from 0.87 to 0.75-0.64 but raises latency overhead to 7.32-12.66x (Table 4, configs 10-11).

2026-joll-s-website-fingerprinting-nym §5.1, Table 3 website-fingerprinttraffic-shape

Increasing Nym's per-hop mixing delay (λM) counterintuitively worsens WF resistance: without cover traffic, raising λM to 100 ms raises Tik-Tok F1 from 0.91 (no mixing) to 0.98. Larger delays create a visible temporal gap between outgoing request bursts and incoming response bursts, making the Transposition feature set leak 95.5% classifier accuracy versus 88.5% with no delay at all.

2026-joll-s-website-fingerprinting-nym §5.2, Table 4, Table 5 website-fingerprintml-classifiertraffic-shape

With infinite training time, Laserbeak achieves 93.5%, 95.9%, and 95.9% accuracy against ephemeral padding, FRONT, and Interspace respectively, compared to 96.5% undefended — confirming that padding-only defenses provide no meaningful protection against a sufficiently trained deep-learning WF adversary. Only ephemeral blocking defenses retain measurable protection, reducing Laserbeak to 71.8% accuracy under infinite training versus 96.5% undefended.

2026-pulls-ephemeral-network-layer-fingerprinting §5.3, Table 2 ml-classifierwebsite-fingerprinttraffic-shape

Joint multi-task training with a combined loss L_joint = L_site + λ·L_pers shows that increasing λ from 0 to 2 raises mixed-site persona accuracy from approximately 45% to approximately 80% while website accuracy declines only from approximately 90% to approximately 75%, demonstrating a wide regime where an attacker can gain strong persona inference at modest cost to existing WFP capability.

2026-song-personafingerprint-measuring-persona §4.4, §5.7.2, Figure 5 website-fingerprintml-classifiertraffic-shape