Reality Check for Tor Website Fingerprinting in the Open World

• URL: http://arxiv.org/abs/2603.07412v1
• Date: Sun, 08 Mar 2026 01:48:24 GMT
• Title: Reality Check for Tor Website Fingerprinting in the Open World
• Abstract summary: Website fingerprinting (WF) attacks on Tor can infer user destinations from encrypted traffic metadata.<n>We re-examine WF from a guard-relay vantage point using a novel, privacy-preserving methodology.<n>We show that WF remains highly effective against real Tor open-world traffic.
• Score: 2.2075770535310126
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Website fingerprinting (WF) attacks on Tor can infer user destinations from encrypted traffic metadata. However, their real-world effectiveness remains debated due to laboratory settings that fail to capture network fluctuations, evaluate noise, and create a representative open world. In this work, we re-examine WF from a guard-relay vantage point using a novel, privacy-preserving methodology that builds an open-world background from real, unlabeled Tor traffic paired with synthetic monitored traces. Using this methodology, we collect a large-scale dataset of over 800,000 traces. We then benchmark state-of-the-art WF attacks under a cross-network setting and show that WF remains highly effective against real Tor open-world traffic: the best-performing attack achieves 0.956 precision and 0.922 recall at a 9% base rate. We further present results that demonstrate robustness to small training sets, network jitter, and concept drift. Moreover, we show that timing-independent classifiers are significantly more robust to network variability than others. Finally, we provide the first systematic study of Tor's Conflux traffic-splitting, where we show that a guard node with a latency advantage can maintain high attack effectiveness even when traffic is split.

Related papers

• PrismWF: A Multi-Granularity Patch-Based Transformer for Robust Website Fingerprinting Attack [45.608550871415]
  Tor is a low-latency anonymous communication network that protects user privacy by encrypting website traffic.<n>Recent website fingerprinting (WF) attacks have shown that encrypted traffic can still leak users' visited websites by exploiting statistical features such as packet size, direction, and inter-arrival time.<n>We propose PrismWF, a multi-granularity patch-based Transformer for multi-tab WF attack.
  arXiv  Detail & Related papers  (2026-03-22T08:17:03Z)
• ZORRO: Zero-Knowledge Robustness and Privacy for Split Learning (Full Version) [58.595691399741646]
  Split Learning (SL) is a distributed learning approach that enables resource-constrained clients to collaboratively train deep neural networks (DNNs)<n>This setup enables SL to leverage server capacities without sharing data, making it highly effective in resource-constrained environments dealing with sensitive data.<n>We present ZORRO, a private, verifiable, and robust SL defense scheme.
  arXiv  Detail & Related papers  (2025-09-11T18:44:09Z)
• WFCAT: Augmenting Website Fingerprinting with Channel-wise Attention on Timing Features [16.443437518731383]
  Website Fingerprinting aims to deanonymize users on the Tor network by analyzing encrypted network traffic.<n>Recent deep-learning-based attacks show high accuracy on undefended traces.<n>But they struggle against modern defenses that use tactics like injecting dummy packets and delaying real packets.
  arXiv  Detail & Related papers  (2024-12-16T07:04:44Z)
• Red Pill and Blue Pill: Controllable Website Fingerprinting Defense via Dynamic Backdoor Learning [93.44927301021688]
  Website fingerprint (WF) attacks covertly monitor user communications to identify the web pages they visit.<n>Existing WF defenses attempt to reduce the attacker's accuracy by disrupting unique traffic patterns.<n>We introduce Controllable Website Fingerprint Defense (CWFD), a novel defense perspective based on backdoor learning.
  arXiv  Detail & Related papers  (2024-12-16T06:12:56Z)
• Lazy Layers to Make Fine-Tuned Diffusion Models More Traceable [70.77600345240867]
  A novel arbitrary-in-arbitrary-out (AIAO) strategy makes watermarks resilient to fine-tuning-based removal. Unlike the existing methods of designing a backdoor for the input/output space of diffusion models, in our method, we propose to embed the backdoor into the feature space of sampled subpaths. Our empirical studies on the MS-COCO, AFHQ, LSUN, CUB-200, and DreamBooth datasets confirm the robustness of AIAO.
  arXiv  Detail & Related papers  (2024-05-01T12:03:39Z)
• A Measurement of Genuine Tor Traces for Realistic Website Fingerprinting [5.4482836906033585]
  Website fingerprinting (WF) is a dangerous attack on web privacy because it enables an adversary to predict the website a user is visiting. We present GTT23, the first WF dataset of genuine Tor traces, which we obtain through a large-scale measurement of the Tor network.
  arXiv  Detail & Related papers  (2024-04-11T16:24:49Z)
• Towards a Near-real-time Protocol Tunneling Detector based on Machine Learning Techniques [0.0]
  We present a protocol tunneling detector prototype which inspects, in near real time, a company's network traffic using machine learning techniques. The detector monitors unencrypted network flows and extracts features to detect possible occurring attacks and anomalies. Results show 97.1% overall accuracy and an F1-score equals to 95.6%.
  arXiv  Detail & Related papers  (2023-09-22T09:08:43Z)
• Realistic Website Fingerprinting By Augmenting Network Trace [17.590363320978415]
  Website Fingerprinting (WF) is considered a major threat to the anonymity of Tor users. We show that augmenting network traces can enhance the performance of WF classifiers in unobserved network conditions.
  arXiv  Detail & Related papers  (2023-09-18T20:57:52Z)
• Efficient and Low Overhead Website Fingerprinting Attacks and Defenses based on TCP/IP Traffic [16.6602652644935]
  Website fingerprinting attacks based on machine learning and deep learning tend to use the most typical features to achieve a satisfactory performance of attacking rate. To defend against such attacks, random packet defense (RPD) with a high cost of excessive network overhead is usually applied. We propose a filter-assisted attack against RPD, which can filter out the injected noises using the statistical characteristics of TCP/IP traffic. We further improve the list-based defense by a traffic splitting mechanism, which can combat the mentioned attacks as well as save a considerable amount of network overhead.
  arXiv  Detail & Related papers  (2023-02-27T13:45:15Z)
• FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learning [66.56240101249803]
  We study how hardening benign clients can affect the global model (and the malicious clients) We propose a trigger reverse engineering based defense and show that our method can achieve improvement with guarantee robustness. Our results on eight competing SOTA defense methods show the empirical superiority of our method on both single-shot and continuous FL backdoor attacks.
  arXiv  Detail & Related papers  (2022-10-23T22:24:03Z)
• Temporally-Transferable Perturbations: Efficient, One-Shot Adversarial Attacks for Online Visual Object Trackers [81.90113217334424]
  We propose a framework to generate a single temporally transferable adversarial perturbation from the object template image only. This perturbation can then be added to every search image, which comes at virtually no cost, and still, successfully fool the tracker.
  arXiv  Detail & Related papers  (2020-12-30T15:05:53Z)
• Cooling-Shrinking Attack: Blinding the Tracker with Imperceptible Noises [87.53808756910452]
  A cooling-shrinking attack method is proposed to deceive state-of-the-art SiameseRPN-based trackers. Our method has good transferability and is able to deceive other top-performance trackers such as DaSiamRPN, DaSiamRPN-UpdateNet, and DiMP.
  arXiv  Detail & Related papers  (2020-03-21T07:13:40Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.