Pith. sign in

REVIEW 3 major objections 6 minor 52 references

Quantifying Mix Network Privacy Erosion with Generative Models

T0 review · 3 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that a transformer model trained from scratch on link-id sequences of mixnet traffic can estimate sender-message unlinkability, revealing cumulative privacy erosion that entropy and likelihood-difference metrics…

desk verdict A genuinely new measurement approach for cumulative mixnet privacy erosion, but the headline comparison against entropy and likelihood difference is apples-to-oranges and needs fixing. read the letter →

arxiv 2506.08918 v1 pith:X22V42J3 submitted 2025-06-10 cs.CR

Vasilios Mavroudis , Tariq Elahi This is my paper
classification cs.CR
keywords mixnetworkstrafficanalysisprivacyestimationtransformersunlinkabilitygenerativemodelsentropymetriclikelihooddifference
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

LLMix is a transformer trained from scratch to predict the next link id in observed mixnet traffic, and the paper uses it as an empirical estimator of sender-message unlinkability. The central claim is that this model captures cumulative leakage across multiple mixing rounds, something the standard entropy and likelihood-difference metrics average away. Evaluations show that mixing strategies with the same mean latency can differ in privacy, that privacy loss grows with the number of captured messages, and that larger models give sharper estimates. The paper positions the method as design-agnostic: any privacy goal formalized as a game can be translated into a classification task on traffic sequences.

What carries the argument

The load-bearing object is the traffic-sequence encoding combined with the transformer. Each event is replaced by the integer id of the network link it traversed; messages are indistinguishable, so link id and relative order are the only observable metadata. The paper argues this sequence is lossless for a passive adversary and forms a language with a small vocabulary and no lexical ambiguity, so a transformer trained to predict the next link id learns the mixing rules. The formal privacy game for sender-message unlinkability is translated into a binary classification task, and the model's classification token representation is passed through a linear classifier; accuracy above the random 0.5 baseline is the privacy-loss estimate.

What would settle it

Train LLMix on traces where each event also carries its inter-arrival time as an additional token, or compare the order-only model against a timing-aware baseline on the same mixnet configurations; if accuracy rises, the order-only encoding under-reports leakage and the reported privacy-loss values are lower bounds rather than exact estimates.

Watch

Extended reading notes

Core claim

The paper's central discovery is that a generative model trained on the language of mixnet link-id sequences, LLMix, can serve as a privacy estimator for sender-message unlinkability under a global passive adversary. Working under the anytrust assumption, the authors simulate threshold, pool, and Poisson mixing nodes, encode observed traffic as sequences of link ids, and train a Longformer-based transformer to predict the next event. The trained model then solves the one-of-two sender-identification task: given a recipient and two candidate senders, guess which one is the persistent contact. The results show that privacy loss accumulates with the number of observed messages, that configurations with equal mean latency are not equally private, and that entropy and likelihood-difference measures aggregate away this cumulative leakage. The authors interpret the estimates as a best case for the defender because the traffic model assumes uniform sending rates.

Load-bearing premise

The load-bearing premise is that a sequence of link ids in relative order contains all the information a passive adversary can collect; if timing or other discarded metadata matters for de-anonymization, the privacy-loss estimates are systematically optimistic.

Editorial extensions

If this is right

  • Configurations that impose the same average latency can offer different privacy: for example, a threshold of 70 with a 14 percent pool and a threshold of 100 without a pool give similar privacy, while a threshold of 80 with a 13 percent pool gives more privacy at lower latency.
  • Privacy loss increases with the number of messages the adversary captures: in the reported results accuracy rises from 0.583 when the real sender sends one message to 0.958 when about 20.7 messages are observed.
  • Entropy and likelihood-difference metrics fail to capture this cumulative leakage: their values across observation windows are mostly not statistically significantly different, while LLMix's advantage differences are.
  • Larger transformer variants with longer observation windows are more sample-efficient and more accurate, so progress in language models should translate directly into better privacy estimates.
  • The method is design-agnostic with respect to the mixing strategy, so operators can benchmark the privacy of any strategy through the same task-to-model pipeline.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The order-only encoding drops timestamps, so if inter-arrival timing patterns carry mixing information, LLMix's estimates are an optimistic lower bound on leakage rather than a neutral measurement; feeding timestamps to the model as additional tokens would test this directly.
  • The defender-favourable assumptions, uniform sending rates and a passive adversary, mean real-world deployments with skewed traffic or active adversaries would likely show higher leakage than the reported numbers.
  • The same task-to-model pipeline could be applied to other privacy notions in the formal hierarchy, such as sender anonymity or relationship anonymity, by swapping the classification task.
  • The scaling result suggests a testable prediction: as future transformers improve long-sequence modeling, model-based privacy estimates for the same mixnet configuration will rise, and designers should re-baseline their parameter choices.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper introduces LLMix, a transformer-based generative model trained from scratch on an encoding of mixnet traffic as link-id sequences, and uses it to estimate sender-message unlinkability under a global passive adversary. The authors define a one-of-two sender identification task, generate synthetic traces for Poisson, threshold, and pool mixing strategies, and report that (i) configurations with similar average latency can have different measured privacy, (ii) classifier accuracy increases with the number of observed messages, (iii) entropy and likelihood-difference metrics appear flatter as the observation window grows, which is interpreted as under-reporting cumulative leakage, and (iv) a larger model achieves higher accuracy, taken as evidence of scaling benefits. The paper also formalizes the task following the privacy-game framework of Kuhn et al. and describes a curriculum-learning approach for training multiple configurations.

Significance. If its central comparative claim were properly supported, the paper would offer a useful design-agnostic tool for mixnet privacy evaluation that can leverage advances in language models. The held-out evaluation on synthetic traces is a legitimate internal measure of how learnable the task is under the simulator's assumptions, and the authors' commitment to open-source their models and scripts is a concrete strength. However, the comparison with entropy and likelihood difference as presented is not a valid test of cumulative leakage, and the claimed 'lossless' encoding omits observable timing information. The core methodology is promising, but the headline conclusions require either additional experiments or a more careful statement of what is actually measured.

major comments (3)
  1. [Section 7.4, Table 1, Eq. (2)] The comparison in Table 1 and Section 7.4 is apples-to-oranges. The likelihood difference ε is defined per message as |log(p0/p1)|, and the entropy column is per-message entropy of the anonymity set. The LLMix accuracy, by contrast, is a cumulative decision based on the full multi-message sequence. For an adversary who observes multiple messages from the same sender to the same recipient, the correct classical metrics are the entropy of the posterior over senders given the full transcript and the cumulative log-likelihood ratio (the sum of per-message LLRs). These cumulative quantities grow with the number of observed messages, so the flat ε and entropy columns in Table 1 are an expected artifact of the per-message evaluation protocol, not evidence that classical metrics cannot capture cumulative leakage. The paper's central claim that entropy and log-likelihood under-report cumulative privacy erosion is therefore unsupported by the current comparison. Please compute cumulative classical baselines (e.g., by summing log-likelihood ratios over the observed sequences or evaluating posterior entropy on the full transcript) before drawing that conclusion.
  2. [Section 4.1] The statement that the sequence encoding 'retains all the information that a passive adversary can collect by eavesdropping the network links' is not justified. The encoding records only the relative order of link ids and discards event timestamps. A global passive adversary can observe exact arrival and departure times; under Poisson mixing, inter-arrival times and message ages in buffers can carry information about the mixing process. Discarding timestamps may therefore make the LLMix estimates systematically optimistic about the defender's privacy. The paper's framing of the results as a 'best case (for the defender)' is thus a hidden modeling commitment rather than a measured upper bound. Either include timing information in the encoding (e.g., as inter-arrival tokens) or explicitly acknowledge and justify the timing-oblivious adversary model, ideally with an experiment showing that a timing-aware baseline does not achieve higher accuracy.
  3. [Section 7.3, Table 1] The masked evaluation used to assess different observation lengths is not a valid proxy. For each 4096-event test sample, a random contiguous region of size 256–2048 is selected and the remainder is padded with zero tokens. The model was trained on dense 4096-token sequences, so these padded inputs are out-of-distribution; long runs of zeros do not correspond to 'no observed activity' in the same way as the natural gaps seen in training. This could confound the observed accuracy trend. The correct procedure is to generate or truncate traces to the target length so that the model sees naturally bounded observations. Additionally, the 'larger model' comparison is confounded: the larger model uses a different attention window, a longer training sequence length (4096 vs 2048), and a different batch size. The paper's claim that 'larger models exhibit greater sample efficiency' is not actually tested, because no data-ablation or learning-curve comparison is reported. Please either provide such evidence or soften the claim to say that the larger model achieves higher accuracy under the settings tested.
minor comments (6)
  1. [Section 2.1] There is a typo in 'cyrptographically processed' — should be 'cryptographically processed'.
  2. [Section 7.2, Figure 3] The figure caption for Figure 3 says 'Privacy-loss estimation' but the text indicates the y-axis is accuracy (0.5 = random, 1.0 = perfect). Please make the axis label and caption consistent, and add error bars or confidence intervals to the plotted points.
  3. [Section 7.4] The paper states that mean differences are 'statistically significant (p-value 0.05)' but does not name the statistical test used, nor whether any multiple-comparison correction was applied across the adjacent rows. Please specify the test and the correction procedure.
  4. [Section 7.2] The statement that threshold-mix latency is 'approximately n/2' assumes a message arrival rate of 1 message per second; with 100 users each sending one message per 100 seconds the global rate is indeed 1/sec, but this assumption should be stated explicitly when deriving latency values.
  5. [Table 1] The entropy column shows slightly lower values for longer sequences (5.859 for 256 down to 5.824 for 4096), which is counterintuitive if entropy is computed per message. The text's explanation ('only 1 and 2 leaky messages') is unclear, since the entropy metric is per message rather than per sequence. Please clarify how the entropy values were averaged and why they vary with sequence length.
  6. [References] Reference [15] (Nym Network) has a formatting error: 'Ilya, , and Aggelos Kiayias' contains an empty author field. Please correct the author list.

Circularity Check

1 steps flagged · score 6.0 of 10

Core LLMix measurement is self-contained, but the claimed demonstration that entropy and likelihood-difference under-report cumulative leakage reduces to their per-message definitions.

  1. self definitional [Section 1; Section 7.4 (Comparison with other metrics), especially Table 1]
    "However, by definition they do not combine observations from multiple mixing rounds and thus do not estimate the cumulative leakage over time (only the average) ... Given a message, its likelihood difference is calculated as: ε = |log(p0/p1)| ... Each metric should capture the additional privacy loss as the number of messages increases. However as seen in the table, the difference ... is not statistically significant and thus the likelihood difference ε fails to capture the extent of the leakage."

    The paper's own wording concedes that entropy and likelihood-difference do not combine observations 'by definition.' Yet Section 7.4 / Table 1 presents this definitional limitation as an empirical result: LLMix's cumulative accuracy grows with sequence length while per-message ε and entropy stay flat. Since ε is defined as |log(p0/p1)| for a single message and entropy is defined for the distribution 'of a given message,' averaging these per-message quantities over longer sequences cannot by construction accumulate evidence. A proper classical baseline would combine per-message likelihood ratios (e.g., sum of log-likelihood ratios) or compute the posterior entropy over the full transcript.

full rationale

The core LLMix pipeline is self-contained: the model is trained from scratch on link-id sequences and evaluated on held-out test sequences from the same simulator; its classification accuracy is an explicitly operationalized adversarial advantage (Section 3.1), not a fitted parameter renamed as a prediction. The encoding assumption (Section 4.1) is a modeling choice, not a circular reduction. Self-citations (e.g., Loopix for ε and the anytrust assumption) are standard external results and are not load-bearing in the derivation. The one genuine circular step is the comparison in Section 7.4/Table 1: the paper states that entropy and likelihood-difference fail by definition to combine observations, then uses constant per-message values of these metrics across longer observation windows to empirically 'demonstrate' that failure. Because ε and entropy are defined per message, their flatness is entailed by construction, and no cumulative classical baseline is computed. The LLMix privacy estimates, and the latency-vs-privacy findings, do not depend on this circular comparison and provide independent content.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The central claims rest on the simulator's traffic model, the lossless-encoding assumption, and the identification of classification accuracy with privacy loss. The model's internal parameters are learned, not hand-fitted constants, so no free parameters are listed beyond the experimental configuration choices, which are inputs rather than fitted values.

assumptions (4)
  • domain assumption The link-id sequence encoding is a lossless representation of all information available to the global passive adversary, including the meaningful absence of timing information.
    Section 4.1 asserts the sequence 'retains all the information that a passive adversary can collect'. The encoding maps each event to a link id and preserves only order, not timestamps. This is load-bearing because any timing leakage not represented will not be discovered by the model.
  • domain assumption The simulated user model (uniform per-user rates, two-party contacts, no dummy traffic, no active attacks) is a faithful enough foundation for privacy comparisons.
    Section 5.2 sets identical sending rates for all active users and no reciprocity, explicitly favoring the defender and framing results as upper bounds on privacy. The comparison across strategies is still conditional on this synthetic workload.
  • domain assumption Averaging the classifier's accuracy on the 'one of two' task measures the SML sender-message unlinkability notion.
    Section 3.1 translates the Kuhn et al. formal notion into a binary classification problem; the paper states other notions can be adapted, but all experiments use this one task as the sole privacy estimator.
  • standard math Transformer models trained on synthetic traces from the testbed generalize to held-out synthetic traces from the same testbed.
    Universal approximation and transfer properties of transformers are assumed from the ML literature; the paper's test accuracy is on samples from the same simulator distribution.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Quantifying Mix Network Privacy Erosion with Generative Models." pith.science (2026). https://pith.science/paper/X22V42J3

@misc{pith2026250608918,
  author       = {Pith},
  title        = {Pith review of: Quantifying Mix Network Privacy Erosion with Generative Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/X22V42J3}},
  note         = {Machine review of arXiv:2506.08918}
}
read the original abstract

Modern mix networks improve over Tor and provide stronger privacy guarantees by robustly obfuscating metadata. As long as a message is routed through at least one honest mixnode, the privacy of the users involved is safeguarded. However, the complexity of the mixing mechanisms makes it difficult to estimate the cumulative privacy erosion occurring over time. This work uses a generative model trained on mixnet traffic to estimate the loss of privacy when users communicate persistently over a period of time. We train our large-language model from scratch on our specialized network traffic ``language'' and then use it to measure the sender-message unlinkability in various settings (e.g. mixing strategies, security parameters, observation window). Our findings reveal notable differences in privacy levels among mix strategies, even when they have similar mean latencies. In comparison, we demonstrate the limitations of traditional privacy metrics, such as entropy and log-likelihood, in fully capturing an adversary's potential to synthesize information from multiple observations. Finally, we show that larger models exhibit greater sample efficiency and superior capabilities implying that further advancements in transformers will consequently enhance the accuracy of model-based privacy estimates.

Figures

Figures reproduced from arXiv: 2506.08918 by the authors.

Figure 1
Figure 1. Intercepted mixnet traffic can be efficiently represented as a sequence. Messages [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 2
Figure 2. A sender indistinguishability game: 1) the adversary picks two potential senders [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Privacy-loss estimation for different types of mixing strategies. The estimation [PITH_FULL_IMAGE:figures/full_fig_p012_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Mean latency and standard deviation (in seconds) for various configurations [PITH_FULL_IMAGE:figures/full_fig_p014_4.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

52 extracted references · 43 canonical work pages

  1. [2]

    Mixflow: Assessing mixnets anonymity with contrastive architectures and semantic network information.IACR Cryptol

    ReyhaneAttarian,EsfandiarMohammadi,TaoWang,andEmadHeydariBeni. Mixflow: Assessing mixnets anonymity with contrastive architectures and semantic network information.IACR Cryptol. ePrint Arch., page 199, 2023

    work page 2023

  2. [1]

    MCMix: Anonymous Messaging via Secure Multiparty Computation

    Nikolaos Alexopoulos, Aggelos Kiayias, Riivo Talviste, and Thomas Zacharias. MCMix: Anonymous Messaging via Secure Multiparty Computation. InProceedings of the 26th USENIX Conference on Security Symposium. USENIX Association, 2017. 18 V. Mavroudis and T. Elahi

    work page 2017

  3. [3]

    Neural Machine Translation by Jointly Learning to Align and Translate

    Dzmitry Bahdanau, Kyunghyun Cho, and Yoshua Bengio. Neural Machine Translation by Jointly Learning to Align and Translate. In Yoshua Bengio and Yann LeCun, editors, 3rd International Conference on Learning Representations, ICLR 2015, 2015

    work page 2015

  4. [4]

    Longformer: The long-document transformer.arXiv preprint arXiv:2004.05150, 2020

    Iz Beltagy, Matthew E Peters, and Arman Cohan. Longformer: The long-document transformer.arXiv preprint arXiv:2004.05150, 2020

    arXiv 2004

  5. [5]

    Var-cnn: A data-efficient website fingerprinting attack based on deep learning.Proceedings on Privacy Enhancing Technologies, 2019(4):292–310, 2019

    Sanjit Bhat, David Lu, Albert Kwon, and Srinivas Devadas. Var-cnn: A data-efficient website fingerprinting attack based on deep learning.Proceedings on Privacy Enhancing Technologies, 2019(4):292–310, 2019

    work page 2019

  6. [6]

    Language Models are Few-Shot Learners

    Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert-Voss, Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel Ziegler, Jeffrey Wu, Clemens Winter, Chris Hesse, Mark Chen, Eric Sigler, Mateusz Litwin, Scott Gr...

    work page 2020

  7. [7]

    David L. Chaum. Untraceable Electronic Mail, Return Addresses, and Digital Pseudonyms.Communications of the ACM, 24, 1981

    work page 1981

  8. [8]

    Untraceable electronic mail, return addresses, and digital pseudonyms

    David L Chaum. Untraceable electronic mail, return addresses, and digital pseudonyms. Communications of the ACM, 24(2):84–90, 1981

    work page 1981

Show all 52 references
  1. [9]

    Asoni, Barrera, OSC, David, George Danezis, and Adrain Perrig

    Chen Chen, Daniele E. Asoni, Barrera, OSC, David, George Danezis, and Adrain Perrig. HORNET: High-Speed Onion Routing at the Network Layer. InProceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security. Association for Computing Machinery, 2015

    2015

  2. [10]

    Thetrafficanalysisofcontinuous-timemixes

    GeorgeDanezis. Thetrafficanalysisofcontinuous-timemixes. InInternational Workshop on Privacy Enhancing Technologies, pages 35–50. Springer, 2004

    2004

  3. [11]

    Traffic Analysis of the HTTP Protocol over TLS, 2009

    George Danezis. Traffic Analysis of the HTTP Protocol over TLS, 2009

    2009

  4. [12]

    Sphinx: A compact and provably secure mix format

    George Danezis and Ian Goldberg. Sphinx: A compact and provably secure mix format. In2009 30th IEEE Symposium on Security and Privacy, pages 269–282. IEEE, 2009

    2009

  5. [13]

    Flashattention: Fast andmemory-efficientexactattentionwithio-awareness.Advances in Neural Information Processing Systems, 35:16344–16359, 2022

    Tri Dao, Dan Fu, Stefano Ermon, Atri Rudra, and Christopher Ré. Flashattention: Fast andmemory-efficientexactattentionwithio-awareness.Advances in Neural Information Processing Systems, 35:16344–16359, 2022

    2022

  6. [14]

    BERT: Pre- training of deep bidirectional transformers for language understanding.arXiv preprint arXiv:1810.04805, 2018

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. BERT: Pre- training of deep bidirectional transformers for language understanding.arXiv preprint arXiv:1810.04805, 2018

    2018 arXiv

  7. [15]

    The Nym Network: The Next Generation of Privacy Infrastructure.White Paper, Version 1.0, 2021

    Claudia Diaz, Harry Halpin, Ilya, , and Aggelos Kiayias. The Nym Network: The Next Generation of Privacy Infrastructure.White Paper, Version 1.0, 2021

    2021

  8. [16]

    Taxonomy of Mixes and Dummy Traffic

    Claudia Diaz and Bart Preneel. Taxonomy of Mixes and Dummy Traffic. InInformation Security Management, Education and Privacy, 2004

    2004

  9. [17]

    Comparison Between Two Practical Mix Designs

    Claudia Díaz, Len Sassaman, and Evelyne Dewitte. Comparison Between Two Practical Mix Designs. InComputer Security – ESORICS 2004, 2004

    2004

  10. [18]

    Anonymity loves company: Usability and the network effect

    Roger Dingledine and Nick Mathewson. Anonymity loves company: Usability and the network effect. InWEIS. Citeseer, 2006

    2006

  11. [19]

    I know what you saw last minute—encrypted http adaptive video streaming title classification.IEEE trans- actions on information forensics and security, 12(12):3039–3049, 2017

    Ran Dubin, Amit Dvir, Ofir Pele, and Ofer Hadar. I know what you saw last minute—encrypted http adaptive video streaming title classification.IEEE trans- actions on information forensics and security, 12(12):3039–3049, 2017

    2017

  12. [20]

    The Norwegian Internet Voting Protocol

    Kristian Gjøsteen. The Norwegian Internet Voting Protocol. InE-Voting and Identity, 2012. Combining Leaked Information from Mixing Nodes 19

    2012

  13. [21]

    Mixnet optimization methods.Proceedings on Privacy Enhancing Technologies, 1:22, 2022

    Iness Ben Guirat and Claudia Diaz. Mixnet optimization methods.Proceedings on Privacy Enhancing Technologies, 1:22, 2022

    2022

  14. [22]

    k-fingerprinting: A robust scalable website finger- printing technique

    Jamie Hayes, George Danezis, et al. k-fingerprinting: A robust scalable website finger- printing technique. InUSENIX security symposium, pages 1187–1203, 2016

    2016

  15. [23]

    https://hoprnet.org/Book_Of_Hopr_2021.01_v1

    HOPR.The Book of HOPR, 2021. https://hoprnet.org/Book_Of_Hopr_2021.01_v1. pdf

    2021

  16. [24]

    On Privacy Notions in Anonymous Communication.Proceedings on Privacy Enhancing Technologies, 2019

    Christiane Kuhn, Martin Beck, Stefan Schiffner, Eduard Jorswieck, and Thorsten Strufe. On Privacy Notions in Anonymous Communication.Proceedings on Privacy Enhancing Technologies, 2019

    2019

  17. [25]

    Karaoke:Distributedprivatemessaging immune to passive traffic analysis

    DavidLazar,YossiGilad,andNickolaiZeldovich. Karaoke:Distributedprivatemessaging immune to passive traffic analysis. In13th USENIX Symposium on Operating Systems Design and Implementation (OSDI 18), pages 711–725, 2018

    2018

  18. [26]

    Stopping silent sneaks: Defending against malicious mixes with topological engineering.arXiv preprint arXiv:2206.00592, 2022

    Xinshu Ma, Florentin Rochet, and Tariq Elahi. Stopping silent sneaks: Defending against malicious mixes with topological engineering.arXiv preprint arXiv:2206.00592, 2022

    2022 arXiv

  19. [27]

    An empirical model of large-batch training.arXiv preprint arXiv:1812.06162, 2018

    Sam McCandlish, Jared Kaplan, Dario Amodei, and OpenAI Dota Team. An empirical model of large-batch training.arXiv preprint arXiv:1812.06162, 2018

    2018 arXiv

  20. [28]

    Distributed Representations of Words and Phrases and their Compositionality

    Tomas Mikolov, Ilya Sutskever, Kai Chen, Greg S Corrado, and Jeff Dean. Distributed Representations of Words and Phrases and their Compositionality. InAdvances in Neural Information Processing Systems. Curran Associates, Inc., 2013

    2013

  21. [29]

    I know why you went to the clinic: Risks and realization of https traffic analysis

    Brad Miller, Ling Huang, Anthony D Joseph, and J Doug Tygar. I know why you went to the clinic: Risks and realization of https traffic analysis. InInternational Symposium on Privacy Enhancing Technologies Symposium. Springer, 2014

    2014

  22. [30]

    GPT-4 technical report.CoRR, abs/2303.08774, 2023

    OpenAI. GPT-4 technical report.CoRR, abs/2303.08774, 2023

    2023 arXiv

  23. [31]

    Do dummies pay off? limits of dummy traffic protection in anonymous communications

    Simon Oya, Carmela Troncoso, and Fernando Pérez-González. Do dummies pay off? limits of dummy traffic protection in anonymous communications. In Emiliano De Cristofaro and Steven J. Murdoch, editors,Privacy Enhancing Technologies, pages 204–223, Cham, 2014. Springer Internatio...

    2014

  24. [32]

    Understanding the effects of real-world behavior in statistical disclosure attacks

    Simon Oya, Carmela Troncoso, and Fernando Perez-Gonzalez. Understanding the effects of real-world behavior in statistical disclosure attacks. In2014 IEEE International Workshop on Information Forensics and Security (WIFS), pages 72–77, 2014

    2014

  25. [33]

    Meet the family of statisticaldisclosureattacks

    Simon Oya, Carmela Troncoso, and Fernando Pérez-González. Meet the family of statisticaldisclosureattacks. In2013 IEEE Global Conference on Signal and Information Processing, pages 233–236, 2013

    2013

  26. [34]

    Website fingerprinting at internet scale

    Andriy Panchenko, Fabian Lanze, Jan Pennekamp, Thomas Engel, Andreas Zinnen, Martin Henze, and Klaus Wehrle. Website fingerprinting at internet scale. InNDSS, 2016

    2016

  27. [35]

    GloVe: Global Vectors for Word Representation

    Jeffrey Pennington, Richard Socher, and Christopher Manning. GloVe: Global Vectors for Word Representation. InProceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP), 2014

    2014

  28. [36]

    Peters, Mark Neumann, Mohit Iyyer, Matt Gardner, Christopher Clark, Kenton Lee, and Luke Zettlemoyer

    Matthew E. Peters, Mark Neumann, Mohit Iyyer, Matt Gardner, Christopher Clark, Kenton Lee, and Luke Zettlemoyer. Deep Contextualized Word Representations. In Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Huma...

    2018

  29. [37]

    Piotrowska

    Ania M. Piotrowska. Studying the anonymity trilemma with a discrete-event mix network simulator. InProceedings of the 20th Workshop on Workshop on Privacy in the Electronic Society, WPES ’21, page 39–44, New York, NY, USA, 2021. Association for Computing Machinery

    2021

  30. [38]

    Piotrowska

    Ania M. Piotrowska. Studying the Anonymity Trilemma with a Discrete-Event Mix Network Simulator. InProceedings of the 20th Workshop on Workshop on Privacy in the Electronic Society, 2021. 20 V. Mavroudis and T. Elahi

    2021

  31. [39]

    The loopix anonymity system

    Ania M Piotrowska, Jamie Hayes, Tariq Elahi, Sebastian Meiser, and George Danezis. The loopix anonymity system. In26th USENIX Security Symposium (USENIX Security 17), pages 1199–1216, 2017

    2017

  32. [40]

    Fernando Pérez-González, Carmela Troncoso, and Simon Oya. A least squares approach to the static traffic analysis of high-latency anonymous communication systems.IEEE Transactions on Information Forensics and Security, 9(9):1341–1355, 2014

    2014

  33. [41]

    Rae, Sebastian Borgeaud, Trevor Cai, Jeff Stanway, Lorrayne Bennett, Demis Hassabis, Koray Kavukcuoglu, and Geoffrey Irving

    Jack W. Rae, Sebastian Borgeaud, Trevor Cai, Jeff Stanway, Lorrayne Bennett, Demis Hassabis, Koray Kavukcuoglu, and Geoffrey Irving. Scaling language models: Methods, analysis & insights from training gopher.CoRR, abs/2112.11446, 2021

    2021 arXiv

  34. [42]

    Towards an Information Theoretic Metric for Anonymity

    Andrei Serjantov and George Danezis. Towards an Information Theoretic Metric for Anonymity. InPrivacy Enhancing Technologies, 2003

    2003

  35. [43]

    From a Trickle to a Flood: Active Attacks on Several Mix Types

    Andrei Serjantov, Roger Dingledine, and Paul Syverson. From a Trickle to a Flood: Active Attacks on Several Mix Types. InInformation Hiding, 2003

    2003

  36. [44]

    Deep fingerprinting: Undermining website fingerprinting defenses with deep learning

    Payap Sirinam, Mohsen Imani, Marc Juarez, and Matthew Wright. Deep fingerprinting: Undermining website fingerprinting defenses with deep learning. InProceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pages 1928–1943, 2018

    2018

  37. [45]

    Word Representations: A Simple and General Method for Semi-Supervised Learning

    Joseph Turian, Lev-Arie Ratinov, and Yoshua Bengio. Word Representations: A Simple and General Method for Semi-Supervised Learning. InProceedings of the 48th Annual Meeting of the Association for Computational Linguistics, 2010

    2010

  38. [46]

    Vuvuzela: Scalable private messaging resistant to traffic analysis

    Jelle Van Den Hooff, David Lazar, Matei Zaharia, and Nickolai Zeldovich. Vuvuzela: Scalable private messaging resistant to traffic analysis. InProceedings of the 25th Symposium on Operating Systems Principles, pages 137–152, 2015

    2015

  39. [47]

    Attention is all you need.Advances in neural information processing systems, 30, 2017

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need.Advances in neural information processing systems, 30, 2017

    2017

  40. [48]

    Effective attacks and provable defenses for website fingerprinting

    Tao Wang, Xiang Cai, Rishab Nithyanand, Rob Johnson, and Ian Goldberg. Effective attacks and provable defenses for website fingerprinting. InUsenix Conference on Security Symposium, pages 143–157, 2014

    2014

  41. [49]

    Hug- gingface’s transformers: State-of-the-art natural language processing.arXiv preprint arXiv:1910.03771, 2019

    Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, et al. Hug- gingface’s transformers: State-of-the-art natural language processing.arXiv preprint arXiv:1910.03771, 2019

    1910 arXiv

  42. [50]

    Scalable anonymous group communication in the anytrust model

    David Isaac Wolinsky, Henry Corrigan-Gibbs, Bryan Ford, and Aaron Johnson. Scalable anonymous group communication in the anytrust model. InEuropean Workshop on System Security (EuroSec), volume 4, 2012

    2012

  43. [51]

    Harnessing the power of llms in practice: A survey on chatgpt and beyond

    Jingfeng Yang, Hongye Jin, Ruixiang Tang, Xiaotian Han, Qizhang Feng, Haoming Jiang, Bing Yin, and Xia Hu. Harnessing the power of llms in practice: A survey on chatgpt and beyond. 2023

    2023

  44. [52]

    A Survey of Large Language Models, 2023

    Wayne Xin Zhao, Kun Zhou, Junyi Li, Tianyi Tang, Xiaolei Wang, Yupeng Hou, Yingqian Min, Beichen Zhang, Junjie Zhang, Zican Dong, Yifan Du, Chen Yang, Yushuo Chen, Zhipeng Chen, Jinhao Jiang, Ruiyang Ren, Yifan Li, Xinyu Tang, Zikang Liu, Peiyu Liu, Jian-Yun Nie, and Ji-Rong W...

    2023

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.