Redefining Website Fingerprinting Attacks with Multi-Agent LLMs

Cross-user generalization (LeaveOneUser) causes 30–40% accuracy drops across all nine state-of-the-art WFP models in closed-world settings: Var-CNN falls from 75.6% to 46.8%, DF from 78.2% to 48.7%, and TikTok/NetCLR from over 80% to approximately 50% in the 10-site task. Models lose recall faster than precision, indicating overfitting to frequent behavioral patterns of seen users rather than site-invariant features.

§5.3–5.4 / Table 1 / Figure 6 evaluation website-fingerprintml-classifier generic

In the boundless (boundary-free, session-unsegmented) setting with Human+Claude training, TrafficSliver reduces WFNet accuracy from 0.760 to 0.592, Cluster Anonymization (Palette) to 0.647, and Zero-delay (FRONT) to 0.706 at 2000 training samples. All three defenses assume clean session or page-load boundaries and are less effective against an attacker classifying arbitrary 5,000-packet continuous segments.

§5.7 / Table 2 evaluation website-fingerprintml-classifier generic

Training WFP classifiers with LLM multi-agent simulated traces boosts cross-user accuracy to the 80% range (TikTok: 50.3%→84.9%, NetCLR: 53.6%→77.3%) compared to under 15% for models trained on scripted-only traffic. ClaudeOnly training outperforms ScriptedOnly baselines by approximately 3× on held-out human traces, using only 20% of the data volume, at a cost of roughly $10/GB versus $35/GB for human collection.

§5.4 / Figure 6 detection website-fingerprintml-classifiertraffic-shape generic

In open-world evaluation against 40 unseen background websites, models trained with Human+Claude traces suffer only 2–3% accuracy degradation versus 5–8% for Human-only training. This demonstrates that LLM-augmented data provides behavioral regularization that reduces false positives on background traffic, sustaining closed-world accuracy under realistic adversarial conditions.

§5.5 / Figure 7 evaluation website-fingerprintml-classifier generic

WFP models trained and tested on scripted browser traffic achieve near-perfect accuracy (NetCLR: 98.9%, TF: 98.3%, Var-CNN: 98.9%), but accuracy collapses to below 10% — with F1-scores near zero (TF: 0.034, Var-CNN: 0.022, ARES: 0.025) — when trained on scripted traffic and tested on real human traffic (CrossDomain). This structural mismatch means scripted datasets overestimate the real-world WFP threat by more than 80 percentage points.

§5.3 / Table 1 evaluation website-fingerprintml-classifiertraffic-shape generic