{"id":"b6d65122-16fc-43b1-b068-31789289a537","arxiv_id":"2412.11487","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"WFCAT is a CNN-based Tor website fingerprinting attack using inter-arrival-time histograms and channel-wise attention, reaching 59% closed-world accuracy against the Surakav defense.","lead":"This paper presents a website fingerprinting attack called WFCAT that uses histograms of packet timing to identify which website a Tor user visits, even when defenses pad or delay traffic. In tests it beat all six prior attacks on defended traces and reached 59% accuracy against the Surakav defense, compared with 31% for the best prior method.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The headline Surakav accuracy may be inflated by selecting hyperparameters (G=9) on the Surakav test set, contradicting §V-B's claim of undefended tuning; a fixed-configuration rerun is needed.","rationale":"The reader's verdict is CONDITIONAL, citing artifact absence, potential inefficiency of the Surakav implementation, and tuning on the Surakav dataset. My stress-test read found a more specific and more actionable flaw: the reported 59% Surakav accuracy is potentially a selected maximum over hyperparameters chosen on the same dataset. The paper's Section V-B says hyperparameters were tuned on the undefended dataset and that G=4 was optimal, but Table II reports final G=9, and Section V-H explicitly justifies G=9 by peaking accuracy on Surakav. This is an internal inconsistency that makes the exact headline number unreliable. The qualitative conclusion that WFCAT beats RF and Tik-Tok on Surakav is likely robust because the margins are large, but the 'over 59%' figure cannot be taken at face value. A fixed-configuration rerun with G=4 would settle whether the margin is real. I therefore keep the reader's CONDITIONAL verdict: the paper should be accepted only if the code and data are released and the fixed-configuration result confirms the headline. The reader's formal weakest_assumption (Surakav implementation representativeness) is a legitimate external-validity concern, but the hyperparameter-selection issue is more immediate and is supported by explicit contradicting statements in the manuscript.","tokens_in":24846,"tokens_out":7140,"duration_ms":63018,"concrete_test":"Re-run the closed-world Surakav experiment with G fixed to 4 (the value §V-B claims was optimal on the undefended validation set) and K=4, keeping all other hyperparameters as in Table II, and report the resulting accuracy; then compare to the 59.12% in Table III. If the fixed-configuration accuracy is materially lower (e.g., 55% or below), the headline margin over RF and Tik-Tok shrinks and the reported 59% is attributable to test-set selection. The decisive check is whether the accuracy at the pre-specified G=4 configuration still exceeds the 30.92% of RF and the 15.04% of Tik-Tok by the claimed margins.","verdict_should_be":"UNCHANGED","load_bearing_attack":"WFCAT's central claim is the 59.12% closed-world accuracy against Surakav (Table III). The final model's hyperparameters are not fixed independently of this result. Section V-B states that hyperparameters were tuned on the undefended dataset and that 'G = 4 provides optimal performance,' yet Table II lists the final G as 9. Section V-H then reports experiments on the Surakav dataset showing accuracy peaking at 59% when G=9, and explicitly says 'Based on these results, we set G = 9 as the default value.' Thus the reported headline number was obtained after selecting at least the bin count G (and confirming K) on the same Surakav test distribution. This is a form of test-set selection: the 59% figure is a maximum over searched configurations rather than the accuracy of a pre-specified model. Since the claimed advantage over RF (30.92%) and Tik-Tok (15.04%) is large, even a few points of optimism does not overturn the qualitative conclusion, but the exact margin and the 'over 59%' claim are not reliable as stated. The issue is compounded by the absence of released code/data, so the reader cannot determine which G was actually used in the main experiments. If G=4 was used (as §V-B claims), the text's later justification is wrong; if G=9 was used, the tuning protocol is inconsistent. Either way, the headline number requires independent verification with a pre-registered hyperparameter choice.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes WFCAT, a website fingerprinting attack on Tor that represents a trace as an inter-arrival-time (IAT) histogram over fixed time slots and classifies it with a CNN comprising Inception blocks and channel-wise attention (SEBlock). The authors report state-of-the-art closed-world accuracy against defended traces, notably 59.12% against Surakav versus 30.92% for RF and 15.04% for Tik-Tok, and they also present open-world results, bandwidth-mismatch robustness, sample-efficiency curves, and training-time comparisons. The contribution is primarily empirical: the representation and architecture are described in detail, but no code, data, or error bars are provided.","tokens_in":25182,"tokens_out":4767,"duration_ms":44830,"significance":"If the headline results survive independent verification, this is a meaningful advance for the WF attack literature: the paper identifies timing information as a persistent leakage source under strong reshaping defenses, and the proposed IAT histogram plus multi-scale attention CNN is a plausible mechanism for exploiting it. The evaluation is broad, covering seven defenses, closed- and open-world settings, bandwidth shifts, varying training set sizes, and an ablation study. However, the absence of released code/data/error bars, the unresolved G=4 versus G=9 conflict, and the use of a defense implementation from the authors' own group mean that the quantitative claims are not yet established at the reported precision. The paper contains no formal proofs; its contribution is empirical, which makes the reproducibility and evaluation-protocol concerns directly load-bearing. I would therefore treat the contribution as significant but conditional on a re-evaluation with a pre-specified configuration.","major_comments":[{"comment":"The manuscript contains a direct contradiction on the default bin count G. Section V-B states that hyperparameters were tuned on the undefended dataset using the validation set and that 'G = 4 provides optimal performance', while Table II lists the final G as 9, and Section V-H reports experiments on the Surakav dataset showing accuracy peaking at 59% when G=9 and explicitly stating 'Based on these results, we set G = 9 as the default value.' Since Table III, the headline closed-world result, was presumably produced with G=9, the final configuration appears to have been selected using the Surakav test distribution, which is inconsistent with the tuning protocol claimed in V-B. The 59.12% figure is therefore a post-selection maximum rather than the accuracy of a pre-specified model. Please state explicitly which G was used for Table III, re-run the main comparisons with a configuration fixed before any Surakav evaluation (including the G=4 configuration from V-B), and report results for both configurations with confidence intervals.","section":"V-B, V-H, Table II"},{"comment":"The Surakav dataset is collected with the authors' own implementation of the defense: Section V-A states that 'Due to the absence of accurate simulation code for Surakav', the authors 'collected another dataset defended by Surakav using Gong's implementation on WFDefProxy'. Since the authors include the original Surakav and WFDefProxy authors, the attacker and the defender are evaluated within the same group's framework. This creates an insider-advantage risk: if this implementation differs from the Surakav defense as originally specified or as deployed, the reported 59.12% accuracy may not transfer to other Surakav instances. To support the central claim, the paper should provide the exact Surakav parameters and configuration used, validate the collected traces against the original Surakav paper's trace statistics, and ideally compare against an independent implementation. Releasing the collected traces and a description of the WFDefProxy Surakav module would allow the community to assess representativeness.","section":"V-A"},{"comment":"The evaluation methodology is underspecified regarding the relationship between the 8:1:1 split and the claimed 10-fold cross-validation. Section V-A says the dataset is divided into training, validation, and test sets with an 8:1:1 ratio and also that 10-fold cross-validation is conducted for each experiment with combined results. These are not the same protocol, and it is unclear whether hyperparameters were tuned once on a fixed validation set or per fold, and whether the reported accuracies are averages across folds or pooled over all test folds. This matters directly for the G=9 selection in V-H, because that section appears to evaluate on the Surakav test set. Please specify the exact protocol, including how the validation set was used during ASHA tuning and whether the final G and K were chosen before any test-set evaluation.","section":"V-A, Table III"},{"comment":"No confidence intervals or variance estimates are reported for any of the closed- or open-world numbers, despite the claim of 10-fold cross-validation. Given that the headline margin over RF on Surakav is 28.20 percentage points, even a few points of optimism would not overturn the qualitative conclusion, but the exact margin and the 'over 59%' claim are not reliable as stated. Please report the standard deviation or 95% confidence interval for each accuracy figure, and make the code and processed traces available so that the reader can reproduce the reported numbers for at least the Surakav and undefended configurations.","section":"V-A, Table III"}],"minor_comments":[{"comment":"The abstract says the improvement over RF and Tik-Tok is 'over 28% and 48%', but Table III shows differences of 28.20 and 44.08 percentage points; the '48%' should be '44%' or the sentence should be reworded.","section":"Abstract"},{"comment":"The narrative alternates between 'TikTok' and 'Tik-Tok'; please use the consistent name used in the reference list and other sections.","section":"V-C"},{"comment":"The sentence 'However, our defense and other attacks have not compromised Tamaraw' should read 'our attack' rather than 'our defense', since WFCAT is an attack.","section":"V-C"},{"comment":"There is a typo: 'We have rent two servers' should be 'We have rented two servers'.","section":"V-A"},{"comment":"The figure example shows G=3 bins, while the final configuration in Table II and Section V-H uses G=9; either caption the figure as an illustrative example with G=3 or update the figure to show the default setting.","section":"Figure 2"},{"comment":"The two subfigures in Figure 8 lack clear axis labels and titles; the left panel varies G and the right panel varies K, but this is only apparent from the caption. Please add titles and axis labels.","section":"Figure 8"}],"recommendation":"major_revision","confidential_remarks":"The authorship and provenance of the Surakav evaluation deserve the editor's attention: the paper evaluates WFCAT against Surakav using a dataset collected with the authors' own WFDefProxy implementation, and the author list includes the original Surakav authors. This is not improper in itself, but it raises the bar for independent verification. I would suggest inviting a re-evaluation by an independent group, or at minimum requiring the release of the Surakav traces and the exact defense parameters. Additionally, the G=4/G=9 contradiction should be checked against any code submitted during revision, because it directly affects the validity of the headline number."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: WFCAT has a genuinely new input representation—an IAT histogram binned per time slot and direction—and the Inception-plus-SEBlock backbone is a reasonable adaptation of vision components to WF. The evaluation is broad: seven defenses, closed and open world, data efficiency, bandwidth mismatch, training time. That is real work. But the headline number against Surakav is less solid than the abstract suggests. The paper contradicts itself on the bin count: §V-B says they tuned on the undefended dataset and G=4 is optimal, Table II lists G=9 as final, and §V-H says they ran experiments on Surakav and then set G=9 because it peaked at 59%. So the 59% is a maximum over a hyperparameter search on the same Surakav test distribution. That is test-set selection, not a pre-specified attack. The margin over RF (31%) and Tik-Tok (15%) is large enough that the qualitative conclusion probably survives, but the exact \"over 59%\" figure is optimistic and the claim as stated is not reliable.\n\nThere is also no code, no data, no error bars, despite saying 10-fold cross-validation. Surakav was implemented with the authors' own WFDefProxy framework, and two of the authors are also Surakav authors. That alone would not worry me, but combined with the tuning issue it raises the burden for independent verification.\n\nWhat is good: the ablation is clean, showing both the IAT feature and the new backbone contribute, with the gain growing under stronger defenses. The open-world numbers, the data-efficiency curves, and the bandwidth-mismatch experiment are useful. The paper also correctly reports that Tamaraw holds up, which is consistent with prior provable-security arguments.\n\nBottom line: this is a serious empirical paper with a real evaluation flaw in the central claim. The qualitative finding—timing histograms leak under Surakav and RegulaTor—should be taken seriously. Give it a serious referee, and require code/data release and a fixed-configuration rerun, or at least a clear statement of which G was actually used and where each hyperparameter was chosen. If the results replicate with a pre-registered configuration, it would overturn the view that Surakav is a strong reshaping defense.","headline":"A genuinely new timing feature and a broad empirical study, but the headline Surakav number was selected by tuning G on the Surakav data—the qualitative finding likely stands, the exact 59% does not.","tokens_in":25700,"tokens_out":2476,"would_cite":false,"duration_ms":22709,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that a website fingerprinting attack built on an inter-arrival time histogram and channel-wise attention can identify Tor pages through strong defenses, reaching 59% accuracy against Surakav in closed-world tests.","keywords":["website fingerprinting","Tor anonymity","traffic analysis","inter-arrival time histogram","channel-wise attention","convolutional neural network","defended traffic classification","timing features"],"falsifier":"Train WFCAT on traces from one set of Tor circuits and test it on traces for the same pages collected through different circuits and a different time window, using an independent implementation of Surakav (or the defense authors' original code) rather than the authors' reimplementation. If closed-world accuracy on these traces falls to the pre-WFCAT level (around 31% or below), the claimed 59% figure would not generalize beyond the specific collection setting.","tokens_in":24673,"feed_emoji":"🕵️","tokens_out":8960,"duration_ms":75350,"temperature":0.7,"pith_summary":"The paper aims to show that website fingerprinting attacks on Tor can be made much stronger against modern defenses by treating packet timing as a first-class feature. It claims that existing attacks either discard fine timing detail or use raw timestamps that defenses perturb, and that a middle-granularity representation called the inter-arrival time (IAT) histogram retains enough timing structure to break defenses that delay or pad packets. On top of this representation, the paper builds a CNN, WFCAT, whose multi-scale kernels and channel-wise attention learn which timing patterns matter. If the claims hold, a local passive observer can deanonymize Tor users even when the traffic has passed through defenses such as Surakav, which was previously considered strong.","feed_headline":"Attack on Tor beats Surakav defense with 59% accuracy","feed_subtitle":"Binned packet inter-arrival times plus attention let an attacker read pages through padding and delay defenses.","key_machinery":"The load-bearing object is the inter-arrival time (IAT) histogram, an intermediate-granularity trace representation. Given a Tor trace as an ordered sequence of cells with timestamps $t_i$ and directions $d_i$, each cell gets an inter-arrival time $\\delta_i = t_i - t_{i-1}$, and the loading timeline is cut into slots of length $s$. In each slot, incoming and outgoing cells are counted separately into $G$ bins whose edges are evenly spaced on a logarithmic scale, yielding a tensor $\\tilde{X}$ of shape $G\\times2\\times L$. The accompanying WFCAT backbone uses an Inception2d block—kernels of width 2 and heights $2k+1$ for $k=0,\\dots,K-1$—to look at the in/out correlation at multiple scales, a squeeze-and-excitation block that learns a weight per feature channel through a two-layer fully connected net and sigmoid, and Inception1d blocks after reshaping; global average pooling produces the final logits. The representation is what preserves timing information that TAM-style counts discard, and the attention is what lets the model emphasise the IAT bins that survive defense noise.","core_discovery":"The paper's central claim is that packet timing leaks through defenses that are supposed to hide traffic shape, and that the leak can be harvested with the right representation and architecture. Existing attacks either use raw timestamps, which defense delays jitter, or coarse packet-count matrices (TAM), which lose the spacing between cells inside each time slot. WFCAT replaces these with an inter-arrival time (IAT) histogram: for each fixed time slot it bins the intervals between consecutive cells on a logarithmic scale, separately for outgoing and incoming cells, producing a $G \\times 2 \\times L$ tensor. A CNN with multi-scale Inception kernels and a squeeze-and-excitation channel-attention block then learns which IAT bins and time slots are informative. In closed-world tests on 100 monitored pages, WFCAT reaches 94.47% accuracy on undefended traces and 59.12% on Surakav-defended traces, compared with 30.92% for the RF attack and 15.04% for Tik-Tok; it also leads in open-world precision-recall against all tested defenses except the deterministic Tamaraw defense. The paper concludes that timing-sensitive defenses—padding and delaying mechanisms whose activation depends on page characteristics—inadvertently leave a recoverable fingerprint.","pith_inferences":["A natural next benchmark for WF defenses would be to report accuracy against an IAT-histogram attack in addition to TAM and direction-sequence attacks; the paper's ablations suggest defenses tuned to defeat one representation may not defeat the other.","The channel-attention weights could be inspected to identify which IAT bins and time slots carry the signal for a given defense, potentially revealing the exact delay or padding trigger that leaks information; this is a testable hypothesis the paper does not pursue.","Because WFCAT exploits timing regularity, defenses that randomize their delay schedules per page load or per circuit, rather than making delays page-dependent, may be more robust; constructing such a defense and measuring WFCAT's accuracy would be a concrete extension.","The IAT histogram representation is generic enough that it could be applied to other encrypted-traffic classification tasks, such as application or service identification, with the same attention mechanism; the paper only evaluates it for website fingerprinting."],"forward_implications":["If the headline result holds, the Surakav defense is not providing the security margin prior work assumed: a passive observer can identify a monitored page from defended traffic 59% of the time in a 100-page closed world.","Timing-sensitive defenses such as RegulaTor and Surakav leak page identity in their delay and padding schedules; defenses should be re-evaluated with IAT-based attacks rather than only direction-sequence or TAM attacks.","Traffic-splitting defenses like TrafficSliver remain vulnerable (over 50% closed-world accuracy and 0.59 recall), so splitting alone should not be treated as sufficient protection.","Noise-injection-only defenses such as FRONT and WTF-PAD cost bandwidth but give little protection: WFCAT stays near 93% closed-world accuracy against both.","Attackers can get strong accuracy from few labeled traces (20–30 per class on defended datasets), which makes the attack more realistic when pages change frequently."],"supporting_citations":[{"why":"Introduces the TAM representation that WFCAT is designed to improve on, and provides the strongest baseline (RF) whose closed-world accuracy WFCAT exceeds by 28 percentage points on Surakav.","marker":"[52]"},{"why":"Shows timing-with-direction input helps against defenses, and serves as the prior timing baseline that WFCAT surpasses by 44 points on Surakav.","marker":"[48]"},{"why":"Defines the Surakav defense that is the paper's headline target; the defended dataset is collected from an implementation of this defense.","marker":"[15]"},{"why":"Supplies the live-Tor collection pipeline used to build the undefended and Surakav-defended datasets.","marker":"[16]"},{"why":"Defines RegulaTor, a timing-sensitive defense that WFCAT exploits; the experiments measure WFCAT against its defended traces.","marker":"[22]"},{"why":"Defines WTF-PAD, a noise-injection defense whose near-ineffectiveness in the paper's tests supports the claim that timing survives padding.","marker":"[27]"},{"why":"Defines FRONT, the noise-injection defense where WFCAT's intermediate-granularity representation yields a large accuracy gain over RF.","marker":"[14]"},{"why":"Introduces the squeeze-and-excitation channel attention mechanism used as the paper's key architectural innovation.","marker":"[23]"},{"why":"Introduces the Inception multi-scale kernel idea that the WFCAT blocks adapt for timing features.","marker":"[56]"}],"fun_headline_variants":["Timing leak breaks Tor padding defense: 59% accuracy","WFCAT: channel attention on packet timings beats Surakav","IAT histograms + attention crack Tor's Surakav defense","Timing attention attack on Tor tops Surakav defense","Packet timing histogram attack defeats Surakav at 59%"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack's reported 59% accuracy against Surakav assumes the authors' own implementation of Surakav produces traces representative of the defense, and that the attacker can train on traces drawn from the same defense and network distribution as the victim's traffic; if either condition fails, the reported accuracy does not transfer.","fun_headline_variants_meta":{"raw":{"variants":["Timing leak breaks Tor padding defense: 59% accuracy","WFCAT: channel attention on packet timings beats Surakav","IAT histograms + attention crack Tor's Surakav defense","Timing attention attack on Tor tops Surakav defense","Packet timing histogram attack defeats Surakav at 59%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000211,"raw_usage":{"total_tokens":1469,"prompt_tokens":1058,"completion_tokens":411,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":674,"completion_tokens_details":{"reasoning_tokens":337}},"tokens_in":674,"tokens_out":411,"duration_ms":4347,"temperature":1.0,"reasoning_tokens":337,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T14:52:15.115481+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train WFCAT on traces from one set of Tor circuits and test it on traces for the same pages collected through different circuits and a different time window, using an independent implementation of Surakav (or the defense authors' original code) rather than the authors' reimplementation. If closed-world accuracy on these traces falls to the pre-WFCAT level (around 31% or below), the claimed 59% figure would not generalize beyond the specific collection setting.","supporting_citations":[{"cited_title":"Subverting Website Fingerprinting Defenses with Robust Traffic Rep- resentation","cited_arxiv_id":null,"evidence_quote":"Introduces the TAM representation that WFCAT is designed to improve on, and provides the strongest baseline (RF) whose closed-world accuracy WFCAT exceeds by 28 percentage points on Surakav."},{"cited_title":"Tik-Tok: The Utility of Packet Timing in Website Fingerprinting Attacks","cited_arxiv_id":null,"evidence_quote":"Shows timing-with-direction input helps against defenses, and serves as the prior timing baseline that WFCAT surpasses by 44 points on Surakav."},{"cited_title":"Surakav: Generating Realistic Traces for a Strong Website Fingerprinting Defense","cited_arxiv_id":null,"evidence_quote":"Defines the Surakav defense that is the paper's headline target; the defended dataset is collected from an implementation of this defense."},{"cited_title":"WFDefProxy: Real World Implementation and Evaluation of Website Fingerprinting Defenses","cited_arxiv_id":null,"evidence_quote":"Supplies the live-Tor collection pipeline used to build the undefended and Surakav-defended datasets."},{"cited_title":"Holland and Nicholas Hopper","cited_arxiv_id":null,"evidence_quote":"Defines RegulaTor, a timing-sensitive defense that WFCAT exploits; the experiments measure WFCAT against its defended traces."},{"cited_title":"Toward an Efficient Website Fingerprinting Defense","cited_arxiv_id":null,"evidence_quote":"Defines WTF-PAD, a noise-injection defense whose near-ineffectiveness in the paper's tests supports the claim that timing survives padding."},{"cited_title":"Zero-delay Lightweight Defenses against Website Fingerprinting","cited_arxiv_id":null,"evidence_quote":"Defines FRONT, the noise-injection defense where WFCAT's intermediate-granularity representation yields a large accuracy gain over RF."},{"cited_title":"Squeeze-and-Excitation Networks","cited_arxiv_id":null,"evidence_quote":"Introduces the squeeze-and-excitation channel attention mechanism used as the paper's key architectural innovation."},{"cited_title":"Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich","cited_arxiv_id":null,"evidence_quote":"Introduces the Inception multi-scale kernel idea that the WFCAT blocks adapt for timing features."}],"review_version":1}