Pith. sign in

REVIEW 4 major objections 4 minor 59 references

Towards Robust Multi-tab Website Fingerprinting

T0 review · 4 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read ARES shows that multi-tab Tor browsing can be de-anonymized without knowing the number of open tabs, using local-pattern fingerprints from short traffic segments.

desk verdict Solid attack with a large dataset, but the headline claim about working without knowing the tab count is not actually tested. read the letter →

arxiv 2501.12622 v1 pith:ZAVDMKV4 submitted 2025-01-22 cs.CR cs.AI

Xinhao Deng , Xiyuan Zhao , Qilei Yin , Zhuotao Liu , Qi Li , Mingwei Xu , Ke Xu , Jianping Wu This is my paper · ORCID
classification cs.CRcs.AI
keywords websitefingerprintingmulti-tabbrowsingToranonymitymulti-labelclassificationTransformertrafficanalysisWFdefensesdeeplearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper's central claim is that a website fingerprinting attacker does not need to know how many tabs a Tor user has open: the multi-tab identification problem can be reformulated as a multi-label classification in which each monitored site gets its own binary "was this site visited?" classifier. Each classifier is a Transformer-based model (Trans-WF) that cuts the mixed, defended traffic into short time segments, extracts packet- and burst-level aggregation features from each segment, profiles them with convolutional layers, and correlates the resulting local patterns with a top-m self-attention mechanism. The authors argue and demonstrate experimentally that short segments of obfuscated multi-tab traffic still carry enough site-specific local information to fingerprint websites, even when the global page-level pattern is destroyed by tab mixing and by defenses such as WTF-PAD. In their evaluations, ARES reaches a MAP@k above 0.9 across tab settings, and in the closed-world 5-tab case reaches P@5 = 0.869 and MAP@5 = 0.909, compared with 0.500 and 0.586 for the strongest baseline TMWF. If correct, this closes a major gap between single-tab WF attacks and real browsing behavior, making multi-tab Tor browsing a viable target for de-anonymization.

What carries the argument

The load-bearing object is Trans-WF, the per-site classifier inside ARES. It works in three stages. A multi-level traffic aggregation module splits the session into fixed-length segments (20 ms by default) and, for each segment, extracts eight directional features: packet count, average inter-packet interval, burst count, and average burst size for incoming and outgoing traffic. A local profiling module passes these features through stacked one-dimensional convolutional blocks, exploiting translation invariance so that a site's local pattern can be recognized wherever it appears. A website identification module then applies multi-head top-m attention, a variant of Transformer self-attention that keeps only the m largest attention weights per row and replaces the rest with a small constant, so that correlations among the target site's local patterns are kept while contributions from noise segments are suppressed. This chain is what turns the paper's premise—that local patterns survive obfuscation—into a working fingerprint.

What would settle it

A concrete falsifying observation would be: on multi-tab Tor traces where several sites load from the same CDN and a defense applies stronger padding than WTF-PAD's default, the mutual information between ARES's eight segment-level features and the website label approaches zero, and simultaneously ARES's MAP@2 drops to chance.

Watch

Extended reading notes

Core claim

The paper asserts a discovery about where website identity survives in encrypted traffic: although multi-tab mixing and padding defenses destroy the holistic traffic pattern of a single page, the page's identity still leaves local traces in short, fixed-duration segments of the session. ARES is designed around that premise. It treats each monitored website independently, converting the multi-tab attack into a one-vs-all multi-label problem whose output is a set of visited sites rather than a single label, thereby removing any need to know the number of tabs in advance. On the authors' large multi-month Tor datasets, this formulation yields closed-world AUC above 0.988 even with five tabs, MAP@5 of 0.909, and open-world MAP@5 of 0.914; under the WTF-PAD defense it keeps MAP@2 at 0.893, which is an average MAP@2 improvement of 89.73% over the baselines. The paper concludes that robust multi-tab website fingerprinting is achievable under realistic conditions, including unknown tab counts and active defenses.

Load-bearing premise

A multi-tab Tor session, even after defenses add padding, contains enough website-specific patterns in short, fixed-length pieces of traffic for a model to tell which websites are present.

Editorial extensions

If this is right

  • An eavesdropper can enumerate which sites were open in a Tor session without knowing, in advance, how many tabs were open; the model outputs a label set, not a single site.
  • The attack keeps working as the number of tabs grows from 2 through 5, with closed-world MAP@5 at 0.909, whereas prior multi-tab attacks degrade toward 0.586.
  • Padding defenses such as Random, WTF-PAD, Front, and even the delay-heavy RegulaTor do not neutralize the attack; under WTF-PAD, ARES keeps P@2 = 0.846 and MAP@2 = 0.893.
  • The model generalizes across mismatched training and testing tab counts better than baselines, so it remains usable when the real tab count changes after deployment.
  • In the open world, non-monitored websites can be rejected while monitored sites are still found, with MAP@5 = 0.914.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because ARES trains one Trans-WF per monitored website, the cost grows linearly with the monitoring list; at the scale of tens of thousands of sites the one-vs-all architecture would need label-tree or shared-embedding tricks, a direction the paper leaves open.
  • The paper's own suggested countermeasure—regularizing the HTML elements of a page that are most correlated with each other—could be tested directly: if a defense erases the correlation among a site's local segments, top-m attention should lose its target and ARES should degrade.
  • The evaluation relies on the authors' own collected traces; a natural external check is to run ARES on traces gathered from a different Tor network population, with different relays and page versions, to see whether the local-pattern premise survives distribution shift.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes ARES, a website fingerprinting (WF) framework for multi-tab Tor browsing sessions, formulated as a multi-label classification problem. ARES trains one Trans-WF binary classifier per monitored website; each classifier divides traffic into fixed-time segments, extracts packet- and burst-level aggregation features, profiles local patterns with CNNs, and applies a top-m multi-head self-attention layer. The framework fuses per-classifier probabilities and outputs a label set based on a pre-determined threshold. The authors evaluate ARES on over 500,000 multi-tab traces collected over several months, comparing with seven baselines in closed-world, open-world, defense, dynamic, and mismatched-training settings, and report that ARES achieves the best AUC, P@K, and MAP@K values in nearly all settings.

Significance. If the claimed results hold, ARES would be a substantial step for multi-tab WF: the dataset is large and more realistic than many prior efforts (multiple Tor versions, subpages, varied vantage points), the code is released, and the architecture is described in enough detail to be reproduced. The ablation study and parameter analysis are also useful. However, the headline claim that ARES removes the attacker's prior knowledge of the number of tabs is not actually evaluated: all closed-world metrics select K equal to the true tab count, and the dynamic-setting metric is confounded by a label-count ceiling. The evidence as presented supports a weaker claim about ranking quality conditioned on knowing K; it does not yet support the threshold-based label-set prediction advertised in Sections I and IV. The baseline modifications also make the comparison less straightforward. With additional experiments, the central claim may be defensible, so the significance is conditional on those experiments.

major comments (4)
  1. [Sections I, IV-A, V-A, V-B; Table II] The paper's central advertised contribution is that ARES can identify the set of visited websites without prior knowledge of the number of open tabs, via a threshold applied to the fused classifier outputs (Section IV-A). Yet the closed-world evaluation does not test this capability. In Table II, every metric uses K equal to the true tab count of the setting (P@2 for 2-tab, ..., P@5 for 5-tab), so the evaluation is given the exact information the attack claims to avoid. The Precision/Recall metrics defined in Section V-A for label-set prediction are never reported, and no threshold-selection procedure is described. I ask the authors to add an experiment that directly evaluates label-set prediction, e.g., report Precision, Recall, and F1 at the chosen threshold (or a threshold-independent metric such as coverage@K with a fixed K across all tab counts), and to separate the ranking ability of ARES from its ability to determine how many tabs were open.
  2. [Table V (Dynamic multi-tab columns)] The dynamic multi-tab evaluation fixes K=5 for all instances while the number of true labels ranges from 2 to 5. For an instance with two true labels, the maximum achievable P@5 is 2/5=0.4 and the maximum achievable MAP@5 is approximately 0.713 even under perfect ranking, because P@3, P@4, and P@5 are capped at 2/3, 0.5, and 0.4 respectively. Consequently, the raw MAP@5 values in Table V are not comparable across instances, and the reported ARES value of 0.707 is likely near the ceiling for the two-tab subset. The 'average improvements' over baselines are therefore not meaningful as stated. I ask the authors to either stratify the dynamic-setting results by the true number of tabs, or use a metric that normalizes for the number of true labels, such as average precision over the true labels or recall@K reported separately for each subgroup.
  3. [Section V-A (Baselines)] The single-tab baselines are modified before comparison: the loss is replaced with binary cross-entropy, a sigmoid output layer is added, and the adaptive pooling layer in RF is replaced with a linear layer. These modifications are not validated against the original implementations or shown to be optimal for the adapted task. Because the paper's core claim is that ARES outperforms all existing attacks, the fairness of the baseline adaptation is load-bearing. I ask the authors to report the hyperparameter search performed for each baseline, or to compare against the original code/checkpoints where available, and to discuss the impact of each architectural modification on baseline performance.
  4. [Tables II-VI] All reported metrics are single-point values without confidence intervals, standard deviations, or the number of independent training runs. Given the stochastic nature of deep learning and the large number of comparisons, the reader cannot assess whether the reported improvements are statistically significant. I ask the authors to train each model with multiple seeds and report means and confidence intervals for the main tables, or at least for the headline comparisons in Tables II, IV, and V.
minor comments (4)
  1. [Figure 6] The axis label in the figure contains a typo: 'stting' should be 'setting'.
  2. [Section IV-D] The text uses 'donate' where 'denote' is intended, and 'irreverent packets' should be 'irrelevant packets'.
  3. [Section V-A] The implementation is cited as reference [33], but [33] is a prior paper on early-stage website fingerprinting rather than the ARES code repository; the footnote link to GitHub is separate and should be cited consistently.
  4. [Throughout] The model name is typeset with a space ('T rans-WF') throughout the manuscript; this should be corrected to a consistent form such as 'Trans-WF'.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: ARES is an empirical system whose results are benchmarked independently; the unvalidated label-set/no-prior-tab-count claim is an evaluation gap, not a circular reduction.

full rationale

ARES is an empirical website-fingerprinting system; its claimed contribution is a multi-label, one-vs-all framework with a Transformer-based classifier, and it is evaluated on independently collected datasets against seven external baselines. No equation in the paper defines the model's output in terms of the quantity being predicted: the Trans-WF architecture composes standard CNN feature extraction, top-m attention (adapted from KVT [39]), and traffic aggregation features (extended from RF/Holmes [32], [33]), and the ablations in Tables VII-VIII test each component's contribution. The same-group references [1], [32], [33] provide dataset-construction details and prior feature designs, but the ARES results are not derived from them, and the paper releases code and data, so the citations are ordinary prior work rather than load-bearing self-citation. The one substantive concern, raised by the skeptic, is that the headline capability of 'outputs the complete label set for all monitored websites based on a pre-determined threshold' (Sec. IV-A) is never directly evaluated: the closed-world results use P@K/MAP@K with K equal to the true tab count, the dynamic-table results fix K=5 without normalizing for instances with fewer than five true labels, and the Precision/Recall definitions in Sec. V-A are never instantiated with an actual threshold. This is a real validity gap in the evidence supporting an advertised capability, but it is not circularity: K is not an input to the trained model, and the reported ranking metrics are not used to construct the claimed thresholded label set. No step in the paper reduces to its own inputs by construction, so the circularity score is 0.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

ARES introduces no new physical entities, forces, or conserved quantities. The framework and Trans-WF model are software artifacts. The load-bearing assumptions are domain-level expectations about the structure of encrypted traffic, plus several architectural hyperparameters chosen by the authors.

free parameters (5)
  • Segment time interval t = 20 ms
    Chosen for traffic division; parameter analysis shows MAP@2 varies only from 0.871 to 0.903 for t between 10 and 50 ms (Section V-G).
  • Input dimension d = 8000
    Controls the number of aggregation features; performance degrades at d=2000 (MAP@2=0.852) and saturates for larger d (Figure 8b).
  • Top-m value m = 20
    Number of attention weights retained; tuning over m=5..25 changes MAP@2 by only 0.83% (Section V-G).
  • Number of attention layers n = 4
    Depth of the top-m attention stack; tuning over n=1..5 changes MAP@2 by 1.78% (Section V-G).
  • Label-set threshold = not specified
    ARES outputs the complete label set based on a 'pre-determined threshold' (Section IV-A), but the threshold value is never reported in the paper.
assumptions (4)
  • domain assumption Sub-segments of obfuscated traffic contain sufficient local patterns to fingerprint individual websites
    Section IV-A states this as the key observation behind Trans-WF, and Section IV-B repeats it as the motivation for the multi-level traffic aggregation module.
  • domain assumption CNN translation invariance enables extraction of local patterns at arbitrary positions in the segmented traffic
    Section IV-C justifies the local profiling module with the claim that CNN invariantly profiles shifted inputs, but this property is not demonstrated on traffic data.
  • domain assumption Top-m attention filters noise because the monitored website's local features are less correlated with noise than with itself
    Section IV-D asserts this heuristic to justify the top-m selection, and it is not proven or validated against alternative noise models.
  • domain assumption The automated data collection pipeline produces traffic representative of real Tor multi-tab browsing
    Section V-A describes Selenium-based automated browsing and ResNet-based filtering of failed loads, but does not compare against organic user traffic or independent measurements.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Towards Robust Multi-tab Website Fingerprinting." pith.science (2026). https://pith.science/paper/ZAVDMKV4

@misc{pith2026250112622,
  author       = {Pith},
  title        = {Pith review of: Towards Robust Multi-tab Website Fingerprinting},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZAVDMKV4}},
  note         = {Machine review of arXiv:2501.12622}
}
read the original abstract

Website fingerprinting enables an eavesdropper to determine which websites a user is visiting over an encrypted connection. State-of-the-art website fingerprinting (WF) attacks have demonstrated effectiveness even against Tor-protected network traffic. However, existing WF attacks have critical limitations on accurately identifying websites in multi-tab browsing sessions, where the holistic pattern of individual websites is no longer preserved, and the number of tabs opened by a client is unknown a priori. In this paper, we propose ARES, a novel WF framework natively designed for multi-tab WF attacks. ARES formulates the multi-tab attack as a multi-label classification problem and solves it using the novel Transformer-based models. Specifically, ARES extracts local patterns based on multi-level traffic aggregation features and utilizes the improved self-attention mechanism to analyze the correlations between these local patterns, effectively identifying websites. We implement a prototype of ARES and extensively evaluate its effectiveness using our large-scale datasets collected over multiple months. The experimental results illustrate that ARES achieves optimal performance in several realistic scenarios. Further, ARES remains robust even against various WF defenses.

Figures

Figures reproduced from arXiv: 2501.12622 by the authors.

Figure 1
Figure 1. The threat model of ARES. Users open multiple tabs to visit different websites, and the middle nodes of the Tor network may be a defense proxy. B. Multi-Class and Multi-Label Classification In machine learning, the Multi-Class classification means that the total number of class labels is greater than two [27] (otherwise, it is a Binary classification). For example, an adversary has a monitoring set with 100 differen… view at source ↗
Figure 2
Figure 2. The overview of ARES. all monitored websites. The Trans-WF model consists of three modules designed to robustly identify obfuscated traffic of the specific website, including multi-level traffic aggregation, local profiling, and website identification. Multi-level Traffic Aggregation. The multi-level traffic ag￾gregation module extracts features containing local website information from obfuscated traffic. Although … view at source ↗
Figure 3
Figure 3. Dividing obfuscated traffic and extracting multi-level [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Profiling the traffic pattern generated from each [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: The multi-head top-m attention method correlates local [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Precision-recall curves of multi-tab WF attacks in the closed-world scenario. [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: Comparison of AUC of monitored websites AUCM and non-monitored websites AUCN with different tab settings in the open-world scenario. Remark. The experimental results in the open-world scenarios demonstrate that ARES is able to accurately identify the monitored websites…
Figure 8
Figure 8. Figure 8: Evaluation of ARES with different parameter settings. TABLE VII: Ablation analysis of multi-level traffic aggrega￾tion module, local analysis module, and website identification module in ARES. Traffic Local Website MAP@2 aggregation profiling identification ✗ ✔ ✔ 0.828…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

59 extracted references · 50 canonical work pages

  1. [1]

    Robust multi-tab website fingerprinting attacks in the wild,

    X. Deng, Q. Yin, Z. Liu, X. Zhao, Q. Li, M. Xu, K. Xu, and J. Wu, “Robust multi-tab website fingerprinting attacks in the wild,” in 2023 IEEE Symposium on Security and Privacy (SP) , 2023

    work page 2023

  2. [2]

    Understanding tor usage with privacy-preserving measurement,

    A. Mani, T. Wilson-Brown, R. Jansen, A. Johnson, and M. Sherr, “Understanding tor usage with privacy-preserving measurement,” in Proceedings of the Internet Measurement Conference 2018 , 2018, pp. 175–187

    work page 2018

  3. [3]

    Tor: The second- generation onion router,

    R. Dingledine, N. Mathewson, and P. Syverson, “Tor: The second- generation onion router,” Naval Research Lab Washington DC, Tech. Rep., 2004

    2004

  4. [4]

    Effective attacks and provable defenses for website fingerprinting,

    T. Wang, X. Cai, R. Nithyanand, R. Johnson, and I. Goldberg, “Effective attacks and provable defenses for website fingerprinting,” in 23rd USENIX Security Symposium , 2014, pp. 143–157

    work page 2014

  5. [6]

    k-fingerprinting: A robust scalable website fingerprinting technique,

    J. Hayes and G. Danezis, “k-fingerprinting: A robust scalable website fingerprinting technique,” in 25th USENIX Security Symposium , 2016, pp. 1187–1203

    work page 2016

  6. [7]

    Fingerprinting attack on tor anonymity using deep learning,

    K. Abe and S. Goto, “Fingerprinting attack on tor anonymity using deep learning,” Proceedings of the Asia-Pacific Advanced Network , vol. 42, pp. 15–20, 2016

    work page 2016

  7. [8]

    Automated website fingerprinting through deep learning,

    V . Rimmer, D. Preuveneers, M. Juarez, T. Van Goethem, and W. Joosen, “Automated website fingerprinting through deep learning,” in NDSS, 2018

    work page 2018

  8. [9]

    Deep fingerprinting: Undermining website fingerprinting defenses with deep learning,

    P. Sirinam, M. Imani, M. Juarez, and M. Wright, “Deep fingerprinting: Undermining website fingerprinting defenses with deep learning,” in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, 2018, pp. 1928–1943

    work page 2018

Show all 59 references
  1. [10]

    A critical evaluation of website fingerprinting attacks,

    M. Juarez, S. Afroz, G. Acar, C. Diaz, and R. Greenstadt, “A critical evaluation of website fingerprinting attacks,” in Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security , 2014, pp. 263–274

    2014

  2. [11]

    On Realistically Attacking Tor with Website Fingerprinting,

    T. Wang and I. Goldberg, “On Realistically Attacking Tor with Website Fingerprinting,” Proceedings on Privacy Enhancing Technologies , vol. 2016, no. 4, pp. 21–36, 2016

    2016

  3. [12]

    A multi- tab website fingerprinting attack,

    Y . Xu, T. Wang, Q. Li, Q. Gong, Y . Chen, and Y . Jiang, “A multi- tab website fingerprinting attack,” in Proceedings of the 34th Annual Computer Security Applications Conference , 2018, pp. 327–341

    2018

  4. [13]

    What tcp/ip protocol headers can tell us about the web,

    F. D. Smith, F. H. Campos, K. Jeffay, and D. Ott, “What tcp/ip protocol headers can tell us about the web,” in Proceedings of the 2001 ACM SIGMETRICS international conference on Measurement and modeling of computer systems , 2001, pp. 245–256

    2001

  5. [14]

    Re- visiting assumptions for website fingerprinting attacks,

    W. Cui, T. Chen, C. Fields, J. Chen, A. Sierra, and E. Chan-Tin, “Re- visiting assumptions for website fingerprinting attacks,” in Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security, 2019, pp. 328–339

    2019

  6. [15]

    An automated multi-tab website fingerprinting attack,

    Q. Yin, Z. Liu, Q. Li, T. Wang, Q. Wang, C. Shen, and Y . Xu, “An automated multi-tab website fingerprinting attack,” IEEE Transactions on Dependable and Secure Computing , vol. 19, no. 6, pp. 3656–3670, 2022

    2022

  7. [16]

    Bapm: Block attention profiling model for multi-tab website fingerprinting attacks on tor,

    Z. Guan, G. Xiong, G. Gou, Z. Li, M. Cui, and C. Liu, “Bapm: Block attention profiling model for multi-tab website fingerprinting attacks on tor,” in Annual Computer Security Applications Conference , 2021, pp. 248–259

    2021

  8. [17]

    Transformer-based model for multi- tab website fingerprinting attack,

    Z. Jin, T. Lu, S. Luo, and J. Shang, “Transformer-based model for multi- tab website fingerprinting attack,” in Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security , 2023, pp. 1050–1064

    2023

  9. [18]

    Wtf- pad: toward an efficient website fingerprinting defense for tor,

    M. Ju ´arez, M. Imani, M. Perry, C. Dıaz, and M. Wright, “Wtf- pad: toward an efficient website fingerprinting defense for tor,” CoRR, abs/1512.00524, 2015

    2015 arXiv

  10. [19]

    Zero-delay lightweight defenses against website fingerprinting,

    J. Gong and T. Wang, “Zero-delay lightweight defenses against website fingerprinting,” in 29th USENIX Security Symposium , 2020, pp. 717– 734

    2020

  11. [20]

    Website fingerprinting: attacking popular privacy enhancing technologies with the multinomial na¨ıve-bayes classifier,

    D. Herrmann, R. Wendolsky, and H. Federrath, “Website fingerprinting: attacking popular privacy enhancing technologies with the multinomial na¨ıve-bayes classifier,” in Proceedings of the 2009 ACM workshop on Cloud computing security , 2009, pp. 31–42

    2009

  12. [21]

    Triplet fingerprinting: More practical and portable website fingerprinting with n-shot learning,

    P. Sirinam, N. Mathews, M. S. Rahman, and M. Wright, “Triplet fingerprinting: More practical and portable website fingerprinting with n-shot learning,” in Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security , 2019, pp. 1131–1148

    2019

  13. [22]

    Defeating dnn-based traffic analysis systems in real-time with blind adversarial perturbations,

    M. Nasr, A. Bahramali, and A. Houmansadr, “Defeating dnn-based traffic analysis systems in real-time with blind adversarial perturbations,” in 30th USENIX Security Symposium , 2021

    2021

  14. [23]

    Website finger- printing in onion routing based anonymization networks,

    A. Panchenko, L. Niessen, A. Zinnen, and T. Engel, “Website finger- printing in onion routing based anonymization networks,” inProceedings of the 10th annual ACM workshop on Privacy in the electronic society , 2011, pp. 103–114

    2011

  15. [24]

    Regulator: A straightforward website fingerprinting defense,

    J. K. Holland and N. Hopper, “Regulator: A straightforward website fingerprinting defense,” Proceedings on Privacy Enhancing Technolo- gies, 2022

    2022

  16. [25]

    A systematic approach to developing and evaluating website fingerprinting defenses,

    X. Cai, R. Nithyanand, T. Wang, R. Johnson, and I. Goldberg, “A systematic approach to developing and evaluating website fingerprinting defenses,” in Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security , 2014, pp. 227–238

    2014

  17. [26]

    Peek-a-boo, i still see you: Why efficient traffic analysis countermeasures fail,

    K. P. Dyer, S. E. Coull, T. Ristenpart, and T. Shrimpton, “Peek-a-boo, i still see you: Why efficient traffic analysis countermeasures fail,” in2012 IEEE symposium on security and privacy . IEEE, 2012, pp. 332–346

    2012

  18. [27]

    Probability estimates for multi- class classification by pairwise coupling,

    T.-F. Wu, C.-J. Lin, and R. C. Weng, “Probability estimates for multi- class classification by pairwise coupling,” Journal of Machine Learning Research, vol. 5, no. Aug, pp. 975–1005, 2004

    2004

  19. [28]

    Collective multi-label classification,

    N. Ghamrawi and A. McCallum, “Collective multi-label classification,” in Proceedings of the 14th ACM international conference on Information and knowledge management , 2005, pp. 195–200

    2005

  20. [29]

    Multi-label classification: An overview,

    G. Tsoumakas and I. Katakis, “Multi-label classification: An overview,” International Journal of Data Warehousing and Mining (IJDWM), vol. 3, no. 3, pp. 1–13, 2007

    2007

  21. [30]

    High precision open-world website fingerprinting,

    T. Wang, “High precision open-world website fingerprinting,” in 2020 IEEE Symposium on Security and Privacy (SP) . IEEE, 2020, pp. 152– 167

    2020

  22. [31]

    Attention is all you need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,” in Advances in neural information processing systems , 2017, pp. 5998–6008

    2017

  23. [32]

    Subverting website fingerprinting defenses with robust traffic representation,

    M. Shen, K. Ji, Z. Gao, Q. Li, L. Zhu, and K. Xu, “Subverting website fingerprinting defenses with robust traffic representation,” in 32nd USENIX Security Symposium (USENIX Security 23) , 2023, pp. 607–624

    2023

  24. [33]

    Robust and reliable early-stage web- site fingerprinting attacks via spatial-temporal distribution analysis,

    X. Deng, Q. Li, and K. Xu, “Robust and reliable early-stage web- site fingerprinting attacks via spatial-temporal distribution analysis,” in Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security, 2024

    2024

  25. [34]

    On translation invariance in cnns: Convolutional layers can exploit absolute spatial location,

    O. S. Kayhan and J. C. v. Gemert, “On translation invariance in cnns: Convolutional layers can exploit absolute spatial location,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020, pp. 14 274–14 285

    2020

  26. [35]

    Tik-tok: The utility of packet timing in website finger- printing attacks,

    M. S. Rahman, P. Sirinam, N. Mathews, K. G. Gangadhara, and M. Wright, “Tik-tok: The utility of packet timing in website finger- printing attacks,” Proceedings on Privacy Enhancing Technologies , vol. 3, pp. 5–24, 2020

    2020

  27. [36]

    Transformer in transformer,

    K. Han, A. Xiao, E. Wu, J. Guo, C. Xu, and Y . Wang, “Transformer in transformer,” arXiv preprint arXiv:2103.00112 , 2021

    2021 arXiv

  28. [37]

    Pyramid vision transformer: A versatile backbone for dense prediction without convolutions,

    W. Wang, E. Xie, X. Li, D.-P. Fan, K. Song, D. Liang, T. Lu, P. Luo, and L. Shao, “Pyramid vision transformer: A versatile backbone for dense prediction without convolutions,” arXiv preprint arXiv:2102.12122 , 2021

    2021 arXiv

  29. [38]

    Swin transformer: Hierarchical vision transformer using shifted windows,

    Z. Liu, Y . Lin, Y . Cao, H. Hu, Y . Wei, Z. Zhang, S. Lin, and B. Guo, “Swin transformer: Hierarchical vision transformer using shifted windows,” arXiv preprint arXiv:2103.14030 , 2021

    2021 arXiv

  30. [39]

    Kvt: k-nn attention for boosting vision transformers,

    P. Wang, X. Wang, F. Wang, M. Lin, S. Chang, W. Xie, H. Li, and R. Jin, “Kvt: k-nn attention for boosting vision transformers,” arXiv preprint arXiv:2106.00515, 2021

    2021 arXiv

  31. [40]

    Deep networks with stochastic depth,

    G. Huang, Y . Sun, Z. Liu, D. Sedra, and K. Q. Weinberger, “Deep networks with stochastic depth,” in European conference on computer vision. Springer, 2016, pp. 646–661

    2016

  32. [41]

    Multi-label ocular disease classification with a dense correlation deep neural network,

    J. He, C. Li, J. Ye, Y . Qiao, and L. Gu, “Multi-label ocular disease classification with a dense correlation deep neural network,” Biomedical Signal Processing and Control , vol. 63, p. 102167, 2021

    2021

  33. [42]

    Selenium: a browser automation framework and ecosystem

    “Selenium: a browser automation framework and ecosystem.” 2021. [Online]. Available: https://github.com/SeleniumHQ/selenium

    2021

  34. [43]

    [Online]

    (2023) Circuit-level padding. [Online]. Available: https://spec.torproject. org/padding-spec/circuit-level-padding.html

    2023

  35. [44]

    Surakav: Generating realistic traces for a strong website fingerprinting defense,

    J. Gong, W. Zhang, C. Zhang, and T. Wang, “Surakav: Generating realistic traces for a strong website fingerprinting defense,” in2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 2022, pp. 1558–1573

    2022

  36. [45]

    Real- time website fingerprinting defense via traffic cluster anonymization,

    M. Shen, K. Ji, J. Wu, Q. Li, X. Kong, K. Xu, and L. Zhu, “Real- time website fingerprinting defense via traffic cluster anonymization,” in 2024 IEEE Symposium on Security and Privacy (SP) . IEEE Computer Society, 2024, pp. 263–263. 14

    2024

  37. [46]

    Var-cnn: A data-efficient website fingerprinting attack based on deep learning,

    S. Bhat, D. Lu, A. Kwon, and S. Devadas, “Var-cnn: A data-efficient website fingerprinting attack based on deep learning,” Proceedings on Privacy Enhancing Technologies, 2019

    2019

  38. [47]

    Realistic website fingerprinting by augmenting network traces,

    A. Bahramali, A. Bozorgi, and A. Houmansadr, “Realistic website fingerprinting by augmenting network traces,” in Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, 2023, pp. 1035–1049

    2023

  39. [48]

    Auc: a statistically consistent and more discriminating measure than accuracy,

    C. X. Ling, J. Huang, H. Zhang et al. , “Auc: a statistically consistent and more discriminating measure than accuracy,” in Ijcai, vol. 3, 2003, pp. 519–524

    2003

  40. [49]

    Deep learning for extreme multi-label text classification,

    J. Liu, W.-C. Chang, Y . Wu, and Y . Yang, “Deep learning for extreme multi-label text classification,” in Proceedings of the 40th international ACM SIGIR conference on research and development in information retrieval, 2017, pp. 115–124

    2017

  41. [50]

    Website fingerprinting at internet scale

    A. Panchenko, F. Lanze, J. Pennekamp, T. Engel, A. Zinnen, M. Henze, and K. Wehrle, “Website fingerprinting at internet scale.” inNDSS, 2016

    2016

  42. [51]

    The emerging trends of multi- label learning,

    W. Liu, H. Wang, X. Shen, and I. Tsang, “The emerging trends of multi- label learning,” IEEE Transactions on Pattern Analysis and Machine Intelligence, 2021

    2021

  43. [52]

    Ml-forest: A multi-label tree ensemble method for multi-label classification,

    Q. Wu, M. Tan, H. Song, J. Chen, and M. K. Ng, “Ml-forest: A multi-label tree ensemble method for multi-label classification,” IEEE transactions on knowledge and data engineering , vol. 28, no. 10, pp. 2665–2680, 2016

    2016

  44. [53]

    Attentionxml: Label tree-based attention-aware deep model for high- performance extreme multi-label text classification,

    R. You, Z. Zhang, Z. Wang, S. Dai, H. Mamitsuka, and S. Zhu, “Attentionxml: Label tree-based attention-aware deep model for high- performance extreme multi-label text classification,” arXiv preprint arXiv:1811.01727, 2018

    2018 arXiv

  45. [54]

    Turbotransformers: an efficient gpu serving system for transformer models,

    J. Fang, Y . Yu, C. Zhao, and J. Zhou, “Turbotransformers: an efficient gpu serving system for transformer models,” in Proceedings of the 26th ACM SIGPLAN Symposium on Principles and Practice of Parallel Programming, 2021, pp. 389–402

    2021

  46. [55]

    LightSeq: A high performance inference library for transformers,

    X. Wang, Y . Xiong, Y . Wei, M. Wang, and L. Li, “LightSeq: A high performance inference library for transformers,” in Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies: Industry Paper...

    2021

  47. [56]

    p1-fp: Extraction, classification, and prediction of website fingerprints with deep learning,

    S. E. Oh, S. Sunkam, and N. Hopper, “p1-fp: Extraction, classification, and prediction of website fingerprints with deep learning,” Proceedings on Privacy Enhancing Technologies , vol. 2019, no. 3, 2019

    2019

  48. [57]

    Laserbeak: Evolving website fingerprinting attacks with attention and multi-channel feature representation,

    N. Mathews, J. K. Holland, N. Hopper, and M. Wright, “Laserbeak: Evolving website fingerprinting attacks with attention and multi-channel feature representation,” IEEE Transactions on Information Forensics and Security, 2024

    2024

  49. [58]

    Stop, don’t click here anymore: boosting website fingerprinting by considering sets of subpages,

    A. Mitseva and A. Panchenko, “Stop, don’t click here anymore: boosting website fingerprinting by considering sets of subpages,” in 33rd USENIX Security Symposium (USENIX Security 24) , 2024, pp. 4139–4156

    2024

  50. [59]

    A novel Website Fingerprinting at- tack against multi-tab browsing behavior,

    X. Gu, M. Yang, and J. Luo, “A novel Website Fingerprinting at- tack against multi-tab browsing behavior,” in Computer Supported Cooperative Work in Design (CSCWD), 2015 IEEE 19th International Conference on. IEEE, 2015, pp. 234–239

    2015

  51. [60]

    Towards fine-grained webpage fingerprinting at scale,

    X. Zhao, X. Deng, Q. Li, Y . Liu, Z. Liu, K. Sun, and K. Xu, “Towards fine-grained webpage fingerprinting at scale,” in Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security , 2024

    2024

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.