Pith. sign in

REVIEW 5 major objections 7 minor 46 references

Attack Smarter: Attention-Driven Fine-Grained Webpage Fingerprinting Attacks

T0 review · 5 major / 7 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims an attention-guided model can fingerprint individual subpages inside multi-tab Tor traffic, reaching 50.54% mAP and 63.85% Recall@5 on a 1,000-class benchmark.

desk verdict A new and plausible application of attention-based augmentation to large-scale multi-tab webpage fingerprinting; results look strong, but missing code and repeated runs keep me from fully trusting the margins. read the letter →

arxiv 2506.20082 v1 pith:B3C644CH submitted 2025-06-25 cs.CR cs.LG

Yali Yuan , Weiyi Zou , Guang Cheng This is my paper
classification cs.CRcs.LG
keywords websitefingerprintingwebpageTortrafficanalysisattentionmechanismdataaugmentationmulti-labelclassificationmulti-tabbrowsingencrypted
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that website fingerprinting attacks survive the step from single homepages to large-scale, multi-tab browsing: one Tor trace that mixes several subpages from many sites can still be labeled with the correct set of pages. The proposed system, ADWPF, uses the CNN's own attention maps to decide which segments of the trace to amplify and which to hide during training, adds a Transformer encoder for global context, and finishes with a residual attention head that assigns labels position by position. On the 1,000-class Oscar-1000 benchmark, the paper reports a mean Average Precision of 50.54% and a Recall@5 of 63.85%, surpassing the strongest existing method by 13.49 and 10.08 percentage points respectively, with similar margins in the open-world setting. If this holds, a passive observer of Tor traffic learns not just which sites a user visits but which subpages they open, even when pages load before earlier ones finish.

What carries the argument

The load-bearing mechanism is the attention map of the final convolutional layer, a set of per-channel activation vectors over the trace that the model uses as a weak supervision signal for where the identifying content sits. After upsampling to the trace length, one map is randomly selected and thresholded to form two complementary binary operators: attention cropping keeps only positions above the threshold, and attention masking zeros out those positions while preserving the rest. These augmented sequences run through the shared ResNet-12 feature extractor, whose low-dimensional output feeds a four-layer multi-head self-attention encoder with learnable positional encoding, and the residual attention head combines global average pooling with class-specific position-weighted pooling to decide which labels are present. The mechanism's work is to convert page-level labels into positional knowledge about the trace, letting the model separate overlapping webpages without explicit segmentation.

What would settle it

Run the same training recipe with the attention map replaced by random binary masks of matched coverage; if Recall@5 and mAP do not fall materially, attention localization is not what drives the gains. A stronger check is to measure, on traces with known page boundaries, whether high-attention positions align with true page segments beyond chance.

Watch

Extended reading notes

Core claim

The central claim is that fine-grained webpage identification in mixed multi-tab traces can be solved end-to-end, with no prior knowledge of how many pages a trace contains and no sample-to-sample distance computation at inference time. ADWPF obtains attention maps from the final convolutional layer, thresholds them to crop salient segments into one augmented view and mask them out into another, and trains a shared CNN and Transformer encoder on original and augmented views so that both discriminative and previously ignored segments contribute features. The residual attention head then pools, for each class, a position-weighted sum of the encoded segments and adds a class-agnostic global average to form the prediction. This process yields the reported 50.54% mAP and 63.85% Recall@5 on 1,000 monitored webpage classes in the closed world, and 58.87% Recall@5 in the open world with 9,236 unmonitored sites; the intended significance is that subpage-level browsing habits are exposed to a passive Tor observer.

Load-bearing premise

Everything rests on the assumption that the attention map, trained only with page-level labels, points at the traffic segments that actually distinguish each webpage rather than at shared layout patterns or coincidental noise; if that localization fails, attention cropping and masking lose their advantage over random augmentation.

Editorial extensions

If this is right

  • A passive Tor observer can identify individual subpages inside a single multi-tab trace, so user behavior beyond homepage visits is at risk.
  • End-to-end prediction removes the need for explicit traffic segmentation or prior knowledge of the number of open pages, unlike earlier splitting-based and query-based methods.
  • Attention-guided augmentation adds about 5.63 mAP points over no augmentation on the 700-page ablation, while random augmentation costs 1.05 points, so how augmentation is targeted matters as much as whether it is applied.
  • Performance stays above 60% Recall@5 as the monitored set grows from 700 to 1,000 classes, suggesting the attack scales with the size of the monitored set.
  • In the open world with over 9,000 unmonitored sites, monitored subpages are still recovered at 58.87% Recall@5, implying the attack generalizes beyond clean closed-world conditions.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If attention localization is as reliable as the paper implies, the same maps could be reused for auxiliary tasks the paper does not attempt, such as estimating the number of open tabs or segmenting a trace by page, not just labelling it.
  • The ablation shows random augmentation actively hurts multi-tab fingerprinting (mAP drops by 1.05%); other WF pipelines that rely on random augmentation may therefore be leaving accuracy on the table, a claim the paper does not make.
  • The paper's experiments are all on undefended Tor traffic; whether ADWPF survives packet padding, traffic splitting, or adversarial perturbation defenses is left open.
  • Training takes roughly 12 hours on one GPU, so an implicit next step is a distilled or pruned variant that keeps most of the accuracy at a fraction of the cost.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 7 minor

Summary. The paper proposes ADWPF, an end-to-end model for large-scale multi-tab webpage fingerprinting (WPF) on Tor traffic. The model uses a 1D ResNet-12 backbone to extract features from direction sequences; during training, attention maps from the final convolutional layer are used to crop and mask salient traffic segments as a form of weakly supervised data augmentation. The resulting features are processed by a Transformer encoder, and a residual-attention head produces multi-label predictions that combine class-agnostic global pooling with class-specific position-weighted pooling. The authors evaluate on the Oscar-1000 and Oscar-1001 datasets in closed- and open-world settings, reporting state-of-the-art mAP of 50.54% and Recall@5 of 63.85% in the closed-world setting, and they conduct ablations on subset scales and tab counts.

Significance. If the reported results are reproduced, this would be a meaningful advance for fine-grained multi-tab WPF: the method is end-to-end, avoids the proxy/sample-based metric-learning overhead of Oscar, and appears to improve over strong baselines on a public benchmark. The paper also has the merit of addressing a realistic threat model (unknown number of pages, overlapping traffic) and honestly lists limitations (training overhead, lack of defenses, limited tab counts). The main empirical claims are, however, supported by a single run without error bars, and the comparison protocol deviates from the original baselines in ways that could affect the margins; the attention-based mechanism is not yet validated as the source of the gain.

major comments (5)
  1. [§5.2, §5.3.1, Table 3] The central state-of-the-art claim rests on a single 80/10/10 train/validation/test split with no repeated runs, confidence intervals, or significance tests. The headline margin of 13.49% mAP over ARES, and the smaller ablation gains in Table 6, could be within run-to-run variance. Please report mean and standard deviation over at least five independent seeds (or an equivalent resampling procedure) for the main comparisons and the ablations, and apply an appropriate significance test (e.g., paired bootstrap or Wilcoxon signed-rank) to support the claimed improvements.
  2. [§5.2, Table 3 footnote] The baseline adaptations may not be faithful to the original methods, and the comparison against the previous state of the art is incomplete. BAPM and TMWF are modified by averaging their prediction heads, and DF is converted to multi-label by replacing softmax with sigmoid and binary cross-entropy; these changes could disadvantage those baselines. More importantly, Oscar's mAP is omitted with the justification that the summed proxy/sample probabilities make mAP 'unsuitable,' but mAP can be computed from any score vector. This omission removes the natural previous SOTA from the mAP comparison and weakens the abstract's claim of surpassing 'the best existing method' by 13.49%. Please report Oscar's mAP computed from its summed scores, or provide a principled reason why it cannot be computed, and use the original evaluation protocols for the baselines where possible.
  3. [§4.4, Eqs. (2)-(5), Table 6] The attention-guided augmentation is not demonstrated to be the cause of the observed gains. The 'random augmentation' baseline uses a different corruption distribution (randomly cropping and masking directions) rather than random attention maps matched in mask length and position, so the ablation does not isolate the effect of attention-based selection. The paper never validates that the learned attention maps localize class-discriminative traffic segments; without such validation, the mechanism remains a plausible hypothesis rather than an established claim. Please add a control experiment using randomly selected attention maps or random masks matched to the attention-derived masks, and report an attention-localization diagnostic (e.g., overlap between high-attention regions and ground-truth page boundaries, or per-class activation consistency).
  4. [§5.3.4, Table 6] The ablation is conducted only on the 700-class subset and reports single-run results. The improvements from attention cropping (+1.87 mAP) and attention masking (+4.78 mAP) are not accompanied by variance estimates, and the claim that random augmentation hurts (−1.05 mAP) is based on one run. Please provide repeated-run statistics and, if feasible, extend the ablation to the full 1000-class dataset to confirm that the conclusions hold at the scale of the main claim.
  5. [§4.3, Table 2] The architecture description appears inconsistent with the stated output dimensions. With an input length of 10,000 and four max-pooling layers of size 9 (as listed in Table 2), the feature-map length cannot be 16 unless the pooling strides, paddings, and any downsampling are specified; the current description is not reproducible. Please clarify the exact layer configuration (strides, padding, and any intermediate downsampling) or correct the parameter table so that the stated feature shape M×C = 16×640 is derivable.
minor comments (7)
  1. [§4.2] The residual attention module is described as 'training-free,' but Eqs. (14)-(15) introduce learned parameters m_i; please correct this characterization.
  2. [§4.1] The label is described as a 'one-hot vector' in the multi-tab setting; since a trace can contain multiple webpage categories, the label is multi-hot, and the formulation Y_i ∈ {0,1}^{W_n} should be described accordingly.
  3. [§5.2] The sentence 'we additionally trim 1000 packets on both the left and right sides' is ambiguous: does 'trim' mean that the cropped region is extended by 1000 cells on each side (to avoid excessive information loss) or that 1000 cells are removed from the crop? Please clarify.
  4. [Table 8] The header row mixes AP@k, Recall@5, and mAP values across tab counts without clear column separators; please restructure the table so that each tab count has explicit metric sub-columns.
  5. [§5.3.5, Fig. 9] The visualization is qualitative and limited to two samples; please state the color conventions explicitly in the caption and avoid drawing general conclusions about the attention mechanism from this figure alone.
  6. [General] A reproducibility statement or release of code would substantially strengthen the paper, especially given the modified baselines and the absence of repeated runs.
  7. [General] There are minor typographical and punctuation errors (e.g., 'attacks„' in Section 2.1); a careful proofreading pass is recommended.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: held-out test evaluation and externally cited components ground the claimed results.

full rationale

ADWPF's central claim is an empirical performance comparison. The headline mAP/Recall@5 numbers in Tables 3 and 4 are computed on the held-out 10% test split of Oscar-1000/1001, independent of training data. No equation in Section 4 derives the reported accuracy from the attention map definition; the attention cropping and masking construction (Eqs. 2-5) is an architectural augmentation borrowed from Hu et al. (2019), and the residual attention head (Eqs. 14-17) is cited to Zhu and Wu (2021). Neither of these prior works is authored by the present authors, and neither is used as a self-citation or uniqueness theorem. The tuned scalars phi_c, phi_m, and lambda are hyperparameters selected during training/validation, not quantities fitted to the target metric and then renamed as predictions. The ablation study (Table 6) is an internal attribution analysis, not a derivation from first principles; its limitation is that the mechanism is not validated, which is a correctness or reproducibility concern, not circularity. Modifications to baseline protocols (sigmoid+BCE for DF, averaged heads for BAPM/TMWF) and the absence of repeated runs or confidence intervals are fairness and reproducibility concerns, not circular reductions. No load-bearing self-citation chain was found, and the paper is self-contained against external benchmarks. Therefore the circularity score is 0.

Assumptions & free parameters 6 free parameters · 5 assumptions · 1 invented entities

The central contribution is empirical: it combines WS-DAN-style attention augmentation, Transformer self-attention, and residual attention. All three are taken from prior work and applied to a new domain, so the paper adds no new axioms or entities. The listed free parameters are manually chosen hyperparameters that the results depend on; their values are not derived and no sensitivity analysis is given.

free parameters (6)
  • Attention cropping threshold phi_c = sampled uniformly in [0.4, 0.6]
    Controls which positions are kept during attention cropping; sampled randomly each iteration with no sensitivity analysis reported.
  • Attention masking threshold phi_m = sampled uniformly in [0.2, 0.5]
    Controls which positions are zeroed during attention masking; hand-chosen range, no ablation across the range.
  • Residual attention weight lambda = 0.3
    Balances class-agnostic and class-specific predictions in Eq. (17); set to a single value without reported sensitivity analysis.
  • Input sequence length L = 10000
    All traces are padded or truncated to length 10000; choice determines which tail packets are discarded.
  • Backbone filter counts and pool sizes = filters [64,160,320,640], pool sizes [9,9,9,9]
    Architecture hyperparameters inherited from ResNet-12 design; no ablation justifying these specific values for traffic data.
  • Transformer layers and heads = 4 layers, 8 heads
    Model capacity hyperparameters set by hand; no study of their effect on the reported results.
assumptions (5)
  • domain assumption Zero-padding and truncating every trace to a fixed length L=10000 preserves the information needed for webpage identification.
    Invoked in Section 4.3 when defining the input representation; trace length variation is collapsed by padding and truncation.
  • domain assumption Attention maps from the final CNN layer localize webpage-discriminative segments of the traffic.
    The augmentation pipeline in Section 4.4 (Eqs. 2-5) assumes activation values indicate informative positions; this is borrowed from image recognition without a traffic-specific validation.
  • domain assumption The multi-label binary label vector with independent labels is an adequate formulation for multi-tab traces.
    Section 4.1 defines each label independently; the model does not explicitly model page ordering or overlap beyond the residual attention pooling.
  • domain assumption The Oscar-1000 and Oscar-1001 datasets are representative of realistic multi-tab Tor browsing behavior.
    Section 5.1 relies on the dataset construction from Zhao et al. (2024), including 3-10 second intervals between pages and 1-5 pages per trace.
  • ad hoc to paper Hand-set augmentation thresholds and residual attention weight are adequate across all dataset scales and tab counts.
    Section 5.2 fixes phi_c, phi_m, and lambda without a systematic hyperparameter study, yet the main conclusions depend on these values.
invented entities (1)
  • None
    purpose: No new physical or conceptual entities are introduced.
    ADWPF uses existing neural network components (CNN, self-attention, residual attention). No new particles, forces, dimensions, or conserved quantities are postulated.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Attack Smarter: Attention-Driven Fine-Grained Webpage Fingerprinting Attacks." pith.science (2026). https://pith.science/paper/B3C644CH

@misc{pith2026250620082,
  author       = {Pith},
  title        = {Pith review of: Attack Smarter: Attention-Driven Fine-Grained Webpage Fingerprinting Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/B3C644CH}},
  note         = {Machine review of arXiv:2506.20082}
}
read the original abstract

Website Fingerprinting (WF) attacks aim to infer which websites a user is visiting by analyzing traffic patterns, thereby compromising user anonymity. Although this technique has been demonstrated to be effective in controlled experimental environments, it remains largely limited to small-scale scenarios, typically restricted to recognizing website homepages. In practical settings, however, users frequently access multiple subpages in rapid succession, often before previous content fully loads. WebPage Fingerprinting (WPF) generalizes the WF framework to large-scale environments by modeling subpages of the same site as distinct classes. These pages often share similar page elements, resulting in lower inter-class variance in traffic features. Furthermore, we consider multi-tab browsing scenarios, in which a single trace encompasses multiple categories of webpages. This leads to overlapping traffic segments, and similar features may appear in different positions within the traffic, thereby increasing the difficulty of classification. To address these challenges, we propose an attention-driven fine-grained WPF attack, named ADWPF. Specifically, during the training phase, we apply targeted augmentation to salient regions of the traffic based on attention maps, including attention cropping and attention masking. ADWPF then extracts low-dimensional features from both the original and augmented traffic and applies self-attention modules to capture the global contextual patterns of the trace. Finally, to handle the multi-tab scenario, we employ the residual attention to generate class-specific representations of webpages occurring at different temporal positions. Extensive experiments demonstrate that the proposed method consistently surpasses state-of-the-art baselines across datasets of different scales.

Figures

Figures reproduced from arXiv: 2506.20082 by the authors.

Figure 1
Figure 1. Threat model of multi-tab WPF attacks. Users may concurrently access webpages from both a monitored set and an unmonitored set. For monitored pages, the attacker’s objective is to perform fine-grained classification, accurately identifying individual subpage categories. In contrast, for unmonitored pages, the goal is to detect and classify them simply as unmonitored, without attempting to determine their exact categ… view at source ↗
Figure 2
Figure 2. The architecture of ADWPF consists of four main modules: Feature Extraction, Data Augmentation, Transformer Encoder, and Residual Attention. represented as a one-hot vector in this case. Given a dataset D = {(xi , Yi)} N i=1 of size N, each traffic instance xi ∈ R l is preprocessed to a fixed length L, and its corresponding label is represented as a binary vector Yi = [Yi,1, Yi,2, . . . , Yi,Wn ] ∈ {0, 1} Wn , where… view at source ↗
Figure 3
Figure 3. The architecture of 1D ResNet-12. For a trace xi = {d1, d2, ..., dL} of length L, each element di represents the direction of a packet, where +1 indicates an outgoing packet and -1 indicates an incoming packet. Since traces vary in length, zero-padding is applied to the end of each sequence to standardize them to a fixed length L, enabling batch processing by the feature extractor. To map the input sequence into a l… view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: The data augmentation process includes attention cropping and attention masking. original sequence length L using linear interpolation, yielding a ∗ ∈ R L×C ′ . One attention map a ∗ k ∈ R L is then randomly selected from a ∗ to guide the augmentation. For a ∗ k , the …
Figure 5
Figure 5. Figure 5: Multi-head self-attention captures relationships between different positions in a sequence from multiple perspec￾tives. Fig.5 illustrates the multi-head self-attention. The input feature map z ′ is first linearly pro￾jected into three matrices: the query Q ∈ R M×C , ke…
Figure 6
Figure 6. Figure 6: Comparison of model performance in terms of Recall@k and AP@k at different values of k in the closed-world setting. As shown in Fig.6, we increase the value of k to observe the model’s performance. ADWPF’s Recall@k consistently increases from 5 to 20 and remains signif…
Figure 7
Figure 7. Figure 7: Comparison of model performance in terms of Recall@k and AP@k at different values of k in the open-world setting. As shown in [PITH_FULL_IMAGE:figures/full_fig_p017_7.png]
Figure 8
Figure 8. Figure 8: Comparison of Recall@5 and AP@5 across different monitored webpage scales. We further evaluate the model’s performance under varying scales of monitored webpages, using datasets containing 700, 800, 900, and 1000 monitored pages, respectively. The construc￾tion of thes…
Figure 9
Figure 9. Figure 9: The results of applying attention cropping and attention masking to the original sample. To better understand how attention augmentation functions, we visualized two samples pro￾cessed by attention cropping and attention masking, as shown in Fig.9. The blue regions rep…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

46 extracted references · 31 canonical work pages

  1. [1]

    , author Bozorgi, A

    author Bahramali, A. , author Bozorgi, A. , author Houmansadr, A. , year 2023 . title Realistic website fingerprinting by augmenting network traces , in: booktitle Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security , pp. pages 1035--1049 . note https://doi.org/10.1145/3576915.3616639

    arXiv 2023

  2. [2]

    , author Lu, D

    author Bhat, S. , author Lu, D. , author Kwon, A. , author Devadas, S. , year 2018 . title Var-cnn: A data-efficient website fingerprinting attack based on deep learning . journal Proceedings on Privacy Enhancing Technologies volume 2019 , pages 292 -- 310 . note https://doi.org/10.2478/popets-2019-0070

    doi:10.2478/popets-2019-0070 2018

  3. [3]

    , author Mitseva, A

    author De la Cadena, W. , author Mitseva, A. , author Hiller, J. , author Pennekamp, J. , author Reuter, S. , author Filter, J. , author Engel, T. , author Wehrle, K. , author Panchenko, A. , year 2020 . title Trafficsliver: Fighting website fingerprinting attacks with traffic splitting , in: booktitle Proceedings of the 2020 ACM SIGSAC Conference on Comp...

    arXiv 2020

  4. [4]

    , author Sun, Y

    author Chen, T. , author Sun, Y. , year 2017 . title Task-guided and path-augmented heterogeneous network embedding for author identification , in: booktitle Proceedings of the tenth ACM international conference on web search and data mining , pp. pages 295--304

    work page 2017

  5. [5]

    , author Xu, M

    author Chen, T. , author Xu, M. , author Hui, X. , author Wu, H. , author Lin, L. , year 2019 . title Learning semantic-specific graph representation for multi-label image recognition , in: booktitle Proceedings of the IEEE/CVF international conference on computer vision , pp. pages 522--531

    work page 2019

  6. [6]

    , author Chen, T

    author Cui, W. , author Chen, T. , author Chan-Tin, E. , year 2020 . title More realistic website fingerprinting using deep learning , in: booktitle 2020 IEEE 40th International Conference on Distributed Computing Systems (ICDCS) , pp. pages 333--343 . note https://doi.org/10.1109/ICDCS47774.2020.00058

    arXiv 2020

  7. [7]

    , author Yin, Q

    author Deng, X. , author Yin, Q. , author Liu, Z. , author Zhao, X. , author Li, Q. , author Xu, M. , author Xu, K. , author Wu, J. , year 2023 . title Robust multi-tab website fingerprinting attacks in the wild , in: booktitle 2023 IEEE symposium on security and privacy (SP) , organization IEEE . pp. pages 1005--1022

    work page 2023

  8. [8]

    , author Chang, M.W

    author Devlin, J. , author Chang, M.W. , author Lee, K. , author Toutanova, K. , year 2019 . title Bert: Pre-training of deep bidirectional transformers for language understanding , in: booktitle Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 (long an...

    2019

Show all 46 references
  1. [9]

    , author Mathewson, N

    author Dingledine, R. , author Mathewson, N. , author Syverson, P.F. , et al., year 2004 . title Tor: The second-generation onion router. , in: booktitle USENIX security symposium , pp. pages 303--320 . note https://doi.org/10.21236/ada465464

    2004 doi

  2. [10]

    , author Beyer, L

    author Dosovitskiy, A. , author Beyer, L. , author Kolesnikov, A. , author Weissenborn, D. , author Zhai, X. , author Unterthiner, T. , author Dehghani, M. , author Minderer, M. , author Heigold, G. , author Gelly, S. , et al., year 2020 . title An image is worth 16x16 words: ...

    2020 arXiv

  3. [11]

    , author Zheng, H

    author Fu, J. , author Zheng, H. , author Mei, T. , year 2017 . title Look closer to see better: Recurrent attention convolutional neural network for fine-grained image recognition , in: booktitle Proceedings of the IEEE conference on computer vision and pattern recognition , ...

    2017

  4. [12]

    , author Wang, T

    author Gong, J. , author Wang, T. , year 2020 . title Zero-delay lightweight defenses against website fingerprinting , in: booktitle 29th USENIX Security Symposium (USENIX Security 20) , pp. pages 717--734

    2020

  5. [13]

    , author Xiong, G

    author Guan, Z. , author Xiong, G. , author Gou, G. , author Li, Z. , author Cui, M. , author Liu, C. , year 2021 . title Bapm: block attention profiling model for multi-tab website fingerprinting attacks on tor , in: booktitle Proceedings of the 37th Annual Computer Security ...

    2021

  6. [14]

    , author Danezis, G

    author Hayes, J. , author Danezis, G. , year 2016 . title k-fingerprinting: A robust scalable website fingerprinting technique , in: booktitle 25th USENIX Security Symposium (USENIX Security 16) , pp. pages 1187--1203

    2016

  7. [15]

    , author Zhang, X

    author He, K. , author Zhang, X. , author Ren, S. , author Sun, J. , year 2016 . title Deep residual learning for image recognition , in: booktitle Proceedings of the IEEE conference on computer vision and pattern recognition , pp. pages 770--778

    2016

  8. [16]

    , author Wendolsky, R

    author Herrmann, D. , author Wendolsky, R. , author Federrath, H. , year 2009 . title Website fingerprinting: attacking popular privacy enhancing technologies with the multinomial na \" ve-bayes classifier , in: booktitle Proceedings of the 2009 ACM workshop on Cloud computing...

    2009

  9. [17]

    , author Qi, H

    author Hu, T. , author Qi, H. , author Huang, Q. , author Lu, Y. , year 2019 . title See better before looking closer: Weakly supervised data augmentation network for fine-grained visual classification . journal arXiv preprint arXiv:1901.09891

    2019 arXiv

  10. [18]

    , author Lu, T

    author Jin, Z. , author Lu, T. , author Luo, S. , author Shang, J. , year 2023 . title Transformer-based model for multi-tab website fingerprinting attack , in: booktitle Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security , pp. pages 1050--10...

    2023

  11. [19]

    , author Afroz, S

    author Juarez, M. , author Afroz, S. , author Acar, G. , author Diaz, C. , author Greenstadt, R. , year 2014 . title A critical evaluation of website fingerprinting attacks , in: booktitle Proceedings of the 2014 ACM SIGSAC conference on computer and communications security , ...

    2014

  12. [20]

    , author Imani, M

    author Juarez, M. , author Imani, M. , author Perry, M. , author Diaz, C. , author Wright, M. , year 2016 . title Toward an efficient website fingerprinting defense , in: booktitle Computer Security--ESORICS 2016: 21st European Symposium on Research in Computer Security, Herak...

    2016

  13. [21]

    , author Shen, X

    author Lin, D. , author Shen, X. , author Lu, C. , author Jia, J. , year 2015 . title Deep lac: Deep localization, alignment and classification for fine-grained recognition , in: booktitle Proceedings of the IEEE conference on computer vision and pattern recognition , pp. page...

    2015

  14. [22]

    , author Gou, G

    author Lu, J. , author Gou, G. , author Su, M. , author Song, D. , author Liu, C. , author Yang, C. , author Guan, Y. , year 2021 . title Gap-wf: Graph attention pooling network for fine-grained ssl/tls website fingerprinting , in: booktitle 2021 International Joint Conference...

    2021

  15. [23]

    , author Bahramali, A

    author Nasr, M. , author Bahramali, A. , author Houmansadr, A. , year 2021 . title Defeating \ DNN-Based \ traffic analysis systems in \ Real-Time \ with blind adversarial perturbations , in: booktitle 30th USENIX Security Symposium (USENIX Security 21) , pp. pages 2705--2722

    2021

  16. [24]

    , author Lanze, F

    author Panchenko, A. , author Lanze, F. , author Pennekamp, J. , author Engel, T. , author Zinnen, A. , author Henze, M. , author Wehrle, K. , year 2016 . title Website fingerprinting at internet scale , in: booktitle Network and Distributed System Security Symposium . note ht...

    2016

  17. [25]

    , author Niessen, L

    author Panchenko, A. , author Niessen, L. , author Zinnen, A. , author Engel, T. , year 2011 . title Website fingerprinting in onion routing based anonymization networks , in: booktitle Proceedings of the 10th annual ACM workshop on Privacy in the electronic society , pp. page...

    2011

  18. [26]

    , author Sirinam, P

    author Rahman, M.S. , author Sirinam, P. , author Mathews, N. , author Gangadhara, K.G. , author Wright, M.K. , year 2019 . title Tik-tok: The utility of packet timing in website fingerprinting attacks . journal Proceedings on Privacy Enhancing Technologies volume 2020 , pages...

    2019 doi

  19. [27]

    , author Ben-Baruch, E

    author Ridnik, T. , author Ben-Baruch, E. , author Zamir, N. , author Noy, A. , author Friedman, I. , author Protter, M. , author Zelnik-Manor, L. , year 2021 . title Asymmetric loss for multi-label classification , in: booktitle Proceedings of the IEEE/CVF international confe...

    2021

  20. [28]

    , author Preuveneers, D

    author Rimmer, V. , author Preuveneers, D. , author Juarez, M. , author Van Goethem, T. , author Joosen, W. , year 2018 . title Automated website fingerprinting through deep learning , in: booktitle Proceedings of the 25nd Network and Distributed System Security Symposium (NDS...

    2018

  21. [29]

    , author Gao, Z

    author Shen, M. , author Gao, Z. , author Zhu, L. , author Xu, K. , year 2021 . title Efficient fine-grained website fingerprinting via encrypted traffic analysis with deep learning , in: booktitle 2021 IEEE/ACM 29th International Symposium on Quality of Service (IWQOS) , orga...

    2021

  22. [30]

    , author Liu, Y

    author Shen, M. , author Liu, Y. , author Chen, S. , author Zhu, L. , author Zhang, Y. , year 2019 . title Webpage fingerprinting using only packet length information , in: booktitle ICC 2019-2019 IEEE International Conference on Communications (ICC) , organization IEEE . pp. ...

    2019

  23. [31]

    , author Imani, M

    author Sirinam, P. , author Imani, M. , author Juarez, M. , author Wright, M. , year 2018 . title Deep fingerprinting: Undermining website fingerprinting defenses with deep learning , in: booktitle Proceedings of the 2018 ACM SIGSAC conference on computer and communications se...

    2018

  24. [32]

    , author Mathews, N

    author Sirinam, P. , author Mathews, N. , author Rahman, M.S. , author Wright, M. , year 2019 . title Triplet fingerprinting: More practical and portable website fingerprinting with n-shot learning , in: booktitle Proceedings of the 2019 ACM SIGSAC Conference on Computer and C...

    2019

  25. [33]

    , author Wang, Y

    author Tian, Y. , author Wang, Y. , author Krishnan, D. , author Tenenbaum, J.B. , author Isola, P. , year 2020 . title Rethinking few-shot image classification: a good embedding is all you need? , in: booktitle Computer Vision--ECCV 2020: 16th European Conference, Glasgow, UK...

    2020

  26. [34]

    , author Shazeer, N

    author Vaswani, A. , author Shazeer, N. , author Parmar, N. , author Uszkoreit, J. , author Jones, L. , author Gomez, A.N. , author Kaiser, . , author Polosukhin, I. , year 2017 . title Attention is all you need . journal Advances in neural information processing systems volume 30

    2017

  27. [35]

    , author Cai, X

    author Wang, T. , author Cai, X. , author Nithyanand, R. , author Johnson, R. , author Goldberg, I. , year 2014 . title Effective attacks and provable defenses for website fingerprinting , in: booktitle 23rd USENIX Security Symposium (USENIX Security 14) , pp. pages 143--157

    2014

  28. [36]

    , author Goldberg, I

    author Wang, T. , author Goldberg, I. , year 2013 . title Improved website fingerprinting on tor , in: booktitle Proceedings of the 12th ACM workshop on Workshop on privacy in the electronic society , pp. pages 201--212

    2013

  29. [37]

    , author Goldberg, I

    author Wang, T. , author Goldberg, I. , year 2016 . title On realistically attacking tor with website fingerprinting . journal Proceedings on Privacy Enhancing Technologies volume 2016 , pages 21 -- 36 . note https://doi.org/10.1515/popets-2016-0027

    2016 doi

  30. [38]

    , author Wang, S

    author Wang, Z. , author Wang, S. , author Zhang, P. , author Li, H. , author Zhong, W. , author Li, J. , year 2019 . title Weakly supervised fine-grained image classification via correlation-guided discriminative learning , in: booktitle Proceedings of the 27th ACM internatio...

    2019

  31. [39]

    , author Wang, T

    author Xu, Y. , author Wang, T. , author Li, Q. , author Gong, Q. , author Chen, Y. , author Jiang, Y. , year 2018 . title A multi-tab website fingerprinting attack , in: booktitle Proceedings of the 34th Annual Computer Security Applications Conference , pp. pages 327--341

    2018

  32. [40]

    , author Zhao, X

    author Yu, C. , author Zhao, X. , author Zheng, Q. , author Zhang, P. , author You, X. , year 2018 . title Hierarchical bilinear pooling for fine-grained visual recognition , in: booktitle Proceedings of the European conference on computer vision (ECCV) , pp. pages 574--589

    2018

  33. [41]

    , author Wu, L

    author Zhang, M.L. , author Wu, L. , year 2014 . title Lift: Multi-label learning with label-specific features . journal IEEE transactions on pattern analysis and machine intelligence volume 37 , pages 107--120

    2014

  34. [42]

    , author Donahue, J

    author Zhang, N. , author Donahue, J. , author Girshick, R. , author Darrell, T. , year 2014 . title Part-based r-cnns for fine-grained category detection , in: booktitle Computer Vision--ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedin...

    2014

  35. [43]

    , author Kang, C

    author Zhang, Z. , author Kang, C. , author Xiong, G. , author Li, Z. , year 2019 . title Deep forest with lrrs feature for fine-grained website fingerprinting with encrypted ssl/tls , in: booktitle Proceedings of the 28th ACM International Conference on Information and Knowle...

    2019

  36. [44]

    , author Deng, X

    author Zhao, X. , author Deng, X. , author Li, Q. , author Liu, Y. , author Liu, Z. , author Sun, K. , author Xu, K. , year 2024 . title Towards fine-grained webpage fingerprinting at scale , in: booktitle Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Commun...

    2024

  37. [45]

    , author Fu, J

    author Zheng, H. , author Fu, J. , author Zha, Z.J. , author Luo, J. , year 2019 . title Learning deep bilinear transformation for fine-grained image representation . journal Advances in Neural Information Processing Systems volume 32

    2019

  38. [46]

    , author Wu, J

    author Zhu, K. , author Wu, J. , year 2021 . title Residual attention: A simple but effective method for multi-label recognition , in: booktitle Proceedings of the IEEE/CVF international conference on computer vision , pp. pages 184--193

    2021

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.