2026-ling-one-prompt-censorship-evasion
One-Prompt Censorship Evasion via Generative Diffusion Models
canonical link → · arxiv: 2606.22717
2026-ling-one-prompt-censorship-evasion
canonical link → · arxiv: 2606.22717
findings extracted from this paper
Under maximum-sensitivity classifier settings, FlowPaint forces Random Forest to accept ~25% FPR across all four out-of-distribution protocols in order to maintain high TPR — blocking 1 in 4 legitimate flows, a level of collateral damage operationally unsustainable for state-level censors. Obfs4 and UPGen exhibit clean separation (TPR ≈ 1.00, FPR ≈ 0.00), imposing no such dilemma on the censor and thus offering no protection from the censor's perspective either.
FlowPaint evades all three GFW-style rule-based middlebox configurations — stateful TCP keyword reassembler (Censor A), heuristic header filter dropping flows with TCP data offset ≥ 9 (Censor B), and anti-replay validator caching (SEQ, payload_hash) pairs and injecting bidirectional RSTs on replay detection (Censor C). Geneva's duplicate-packet desynchronization strategy fails against Censor C because its malformed artifacts simultaneously satisfy the anti-replay blocking condition, while FlowPaint succeeds by recalculating checksums and injecting no extra packets.
FlowPaint achieves a steady-state goodput of 3.05 Gbps versus 10.7–10.85 Gbps for lightweight baselines (UPGen, Dummy) that provide near-zero evasion (TPR ≈ 1.00), with an initial TTFB of ~1.9 s dominated by fixed diffusion model inference cost that grows by only 1.28× as network RTT increases tenfold (20 ms to 200 ms). At 3.05 Gbps, FlowPaint exceeds 4K and 8K streaming bandwidth requirements (25 Mbps and 100 Mbps respectively) by two orders of magnitude, indicating that compute overhead is a manageable hardware-scaling constraint rather than a fundamental barrier.
Under a strict FPR ≤ 0.1% operational budget, FlowPaint achieves a TPR of 0.00 against Decision Tree and nPrintML classifiers across multiple out-of-distribution protocols (CurveZMQ, secio, SSH, TLS), while Obfs4 and UPGen remain near-fully detectable (TPR ≈ 1.00). Even against Deep Fingerprinting, FlowPaint reduces TPR to 0.80–0.92, compared to 1.00 for Obfs4 across all protocols tested.
Obfs4's payload randomization creates a high-entropy statistical profile that a Decision Tree detects with TPR ≈ 1.00 and FPR ≈ 0.00 across all four out-of-distribution protocols tested. UPGen's procedural protocol assembly similarly yields TPR ≈ 1.00 for most classifiers, confirming that both entropy randomization and rigid structural assembly leave artifacts detectable by even simple statistical classifiers operating under strict false-positive constraints.