Pith. sign in

REVIEW 3 major objections 4 minor 32 references

Rate-Distortion Function for Encrypted Traffic Side-Channel Defense

T0 review · 3 major / 4 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A new rate-distortion function pins down the exact tradeoff between traffic-defense cost and leakage rate, and three published defenses are measurably above it.

desk verdict Solid rate-distortion core, but the empirical suboptimality claims hinge on an unproven one-sentence extension from memoryless to memory-based defenses. read the letter →

arxiv 2607.17889 v1 pith:MNNW4RJD submitted 2026-07-20 cs.CR

Guangjie Liu , Guang Cheng , Weiwei Liu , Yutong Wang This is my paper
classification cs.CR MSC 94A3494A1749Q22
keywords side-channelrate-distortionencryptedtrafficwebsitefingerprintingWassersteindistanceoptimaltransportexponentialtiltingprivacyleakagedefensecost
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Encrypted traffic defenses have been tuned empirically, with no provable answer to how much leakage remains for a given cost budget. This paper defines the side-channel rate-distortion function R_sc(D): the minimum per-packet mutual information a defender can achieve when the average Wasserstein-1 distance between original and defended feature distributions is at most D. Within the memoryless, per-packet defense class, the paper proves this function is the exact Pareto frontier — no defense in the class can leak less for the same cost, and the curve is attained by a defense of exponential-tilting form. Applied to three published defenses on real website-fingerprinting traces, all three sit strictly above the curve, with measured suboptimality gaps of 0.028, 0.034, and 0.124 bits. The result matters because it converts a heuristic tuning problem into a computable benchmark.

What carries the argument

The central object is the side-channel rate-distortion function R_sc(D), a dual of classical rate-distortion: instead of minimizing description rate subject to distortion, it minimizes leakage rate (mutual information between semantic labels X and defended observations Y) subject to a defense-cost constraint. The cost is the average Wasserstein-1 distance between each class's original feature distribution P_x and its defended distribution Q_x; W1 is chosen because the W1 ball is convex and Kantorovich–Rubinstein duality ties the cost to Lipschitz statistics. The argument is carried by a convex program whose KKT conditions yield the exponential-tilting (Boltzmann) form of the optimal defense,

What would settle it

Construct any stationary memoryless defense on the same dataset whose measured (cost, leakage) point falls strictly below the computed R_sc(D) curve; that would refute Pareto optimality. A more direct check is to measure the actual latency and bandwidth overhead of a defense whose W1 cost is known: if the W1 cost is not monotonically related to real QoS cost, the curve's interpretation as a QoS budget breaks.

Watch

Extended reading notes

Core claim

The paper's central discovery is that the leakage-versus-cost tradeoff in encrypted traffic defense has a provable, computable characterization. Defining the defense class Θiid of stationary memoryless per-packet defenses and measuring cost by the average W1 distance D(θ) = Σ_x p(x) W1(Q_x, P_x), the authors define R_sc(D) = min I(X;Y) over Q_x with D(θ) ≤ D. They prove R_sc(D) is decreasing, convex, continuous, starts at I(X;Z) for D=0, and reaches zero at a finite critical cost D_max; for binary equal-prior tasks D_max = ½W1(P0,P1). The optimal defense has the Boltzmann form Q_x*(y) ∝ \bar Q*(y) exp(−λ*φ_x*(y)), where φ_x* is the Kantorovich potential of the W1 ball and λ* is the marginal

Load-bearing premise

W1 distance between quantized per-packet feature histograms faithfully represents the real cost of a defense — a proxy the paper never validates against actual latency or bandwidth measurements.

Editorial extensions

If this is right

  • Any stationary memoryless defense that spends cost D in W1 units leaks at least R_sc(D) bits per packet; the bound is tight and achieved by an exponential-tilting defense.
  • The direction of perturbation matters: optimal defenses push each class's histogram along the Kantorovich potential, whereas fixed-policy padding wastes budget on the wrong directions.
  • The critical cost D_max = ½W1(P0,P1) for binary equal-prior tasks gives a target: fully merging the two feature distributions costs exactly half their W1 separation.
  • Published defenses are quantifiably suboptimal: Front at 0.028 bits, WTF-PAD at 0.034 bits, and TrafficSliver at 0.124 bits above the curve, with cost utilization 89%, 84%, and 46%.
  • The curve provides a benchmark: any proposed defense can now be scored by its gap below the theoretical frontier.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The W1 distance between quantized delay histograms is used as a proxy for QoS; if true latency or bandwidth overhead diverges from W1, the reported cost utilizations and the 'QoS budget' framing would need recalibration. The paper acknowledges an engineering gap without quantifying it.
  • The claimed extension to memory-based defenses via I(X;Y|κ) ≥ R_sc(D) is asserted with a 'Jensen argument' but not proved; a rigorous multi-letter treatment could either confirm the bound or reveal that adaptive causal defenses can do better.
  • Because the optimal defense is given in closed form as an exponential tilt of the mixture distribution, it could be instantiated directly on empirical histograms; comparing such a constructor against existing defenses would test the bound's practical tightness.
  • The same rate-distortion template applies to other side channels — packet lengths, directions, flow timing — wherever a metric on feature space and a semantic label source are available.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper defines a side-channel rate-distortion function R_sc(D) = min_{Σ_x p_X(x) W1(Q_x,P_x) ≤ D} I(X;Y) for a stationary memoryless defense class Θ_iid, proves basic properties (monotonicity, convexity, continuity, endpoints), derives an exponential-tilting optimal defense via KKT conditions, claims an exact Pareto frontier within Θ_iid, gives a Kantorovich–Rubinstein formula for D_max in the binary equal-prior case, and applies the curve to three real-world website-fingerprinting defenses to report suboptimality gaps (Front 0.028 bits, WTF-PAD 0.034 bits, TrafficSliver 0.124 bits).

Significance. The theoretical core is clean and largely self-contained: the optimization program is convex, the Slater argument is valid, and the KKT derivation is algebraically transparent. If the cost model is accepted, the paper provides a computable lower bound that does not rely on fitted constants, and the empirical evaluation on a public dataset yields falsifiable predictions (all three evaluated defenses lie above the curve). The claimed Pareto frontier and the exponential-tilting structure are genuine contributions. However, the applied significance depends on two unproven bridges: the extension of the lower bound from Θ_iid to the actual evaluated defenses (which are not memoryless), and the interpretation of the Wasserstein-1 transport cost as a QoS metric. Both are load-bearing for the headline empirical claims. The manuscript is publishable in principle, but the current version overstates what is established.

major comments (3)
  1. [§6, 'Scope of R_sc(D)'] The empirical suboptimality claims in Table 1 and Fig. 2 are made for defenses that are not in Θ_iid. As described in §5.1, Front and WTF-PAD use adaptive causal burst-state injection, and TrafficSliver uses flow-level splitting. The only bridge is the single sentence: 'a Jensen argument shows (1/n)I(X^n;Y^n) → I(X;Y|κ) ≥ R_sc(D) asymptotically under per-packet marginal cost.' This omitted argument requires (i) stationarity/ergodicity assumptions to define the limit, (ii) a precise per-realization cost condition for each κ, and (iii) a Jensen step that applies R_sc to each conditional channel. It also does not cover adaptive policies whose state depends on past observations rather than on a random key κ. The paper's own remark that tighter bounds for 'adaptive causal defenses' are open implies WTF-PAD and Front are not covered. Because Theorem 3(ii) is confined to Θ_iid, the non-negativi
  2. [§3.2, Definition 3] The paper calls D(θ) a 'QoS cost budget' and reports cost utilization ratios (Table 1: Front 89.2%, WTF-PAD 83.6%, TrafficSliver 46.4%). However, D(θ) is an average Wasserstein-1 distance between packet-delay histograms — a purely distributional quantity. No mapping to latency, bandwidth overhead, or any other QoS metric is provided or cited. Without such a validation, the quantitative 'QoS' claims are not meaningful: a 0.034-bit gap at 84% of the transport budget could correspond to a very different real-world overhead for different defenses. Please either compare W1 costs with measured overheads, or consistently describe D as a feature-space transport cost and remove the QoS interpretation from the abstract and headline claims.
  3. [§4.3, Proposition 1 and §5.1] Equation (5) states D_max = (1/2)W1(P0,P1) as an equality, but the proof establishes the upper bound only 'if a W1-geodesic midpoint Q_{1/2} exists.' No argument is given that such a midpoint exists for the empirical feature space Z (50 delay bins with an unspecified metric d). If the metric space is not geodesically convex, D_max can be strictly larger than (1/2)W1(P0,P1), and the cost utilizations bD/D_max in Table 1 and Fig. 2 would be overstated. The empirical D_max should either be computed by direct convex optimization over Q, or the formula should be presented as a lower bound and the ratios recomputed.
minor comments (4)
  1. [§5.1] The metric d on Z is never specified beyond 'Z is finite with metric d' in Definition 2. The experimental section only says 'quantize to L=50 uniform histogram bins.' Please state the exact metric (e.g., normalized absolute delay difference) and whether it satisfies the geodesic-midpoint condition needed for Proposition 1.
  2. [Theorem 2] The KKT derivation uses a subgradient φ_x of W1(·,P_x). Since W1 is piecewise linear, φ_x need not be unique. The exponential-tilting form (4) depends on the selected subgradient; please state whether the SLSQP implementation accounts for this non-uniqueness and how the Kantorovich potential is chosen.
  3. [Theorem 3] Theorem 3(ii) is definitional (R_sc is the infimum over the class). Consider presenting it as a corollary of Definition 5 and reserving 'Pareto frontier' terminology for the substantive content of Theorems 1 and 2.
  4. [§5.1] The top-5 class pairs are selected on undefended data by W1 distance, so the reported bootstrap CIs are conditional on this selection. This selection bias should be acknowledged explicitly in the discussion.

Circularity Check

1 steps flagged · score 4.0 of 10

The lower-bound half of the 'exact Pareto frontier' is a restatement of the defining minimization; independent content appears in the KKT/exponential-tilting theorem and the Dmax formula. The §6 Jensen bridge is an omitted proof, but that is a rigor gap, not circularity.

  1. self definitional [§4.3, Theorem 3(ii), with Definition 5 (Eq. 2)]
    "Theorem 3 (Exact Pareto frontier within Θiid)... (ii) (Unimprovability) For any θ∈Θiid with D(θ)≤D, we have R(θ)≥R_sc(D)... R_sc(D) is defined as the infimum of R(θ) over all θ∈Θiid with D(θ)≤D. By definition, R(θ)≥R_sc(D) for every such θ."

    Definition 5 defines R_sc(D) as exactly this minimization, so Theorem 3(ii) restates the defining inequality rather than deriving a new bound. Consequently, the non-negativity of the measured gaps Δ_gap = R_hat − R_sc(D_hat) is guaranteed by construction and is not an independent empirical finding; only the strict positivity of the gaps is empirical. The 'exact Pareto frontier' lower bound is thus an unpacking of the definition, though Theorem 2 and Proposition 1 provide separate content.

full rationale

The core optimization defining R_sc(D) is self-contained: no fitted constants enter the derivation of the curve; it is a finite-dimensional convex program solved from empirical histograms. Theorem 1's monotonicity/convexity/continuity, Theorem 2's KKT/exponential-tilting form, and Proposition 1's Dmax formula follow from that definition plus convex analysis and Kantorovich–Rubinstein duality, not from the defense outcomes. The only self-citation [16] (same first/third authors) is motivational (inevitability of leakage) and is not load-bearing for R_sc. The self-definitional aspect is Theorem 3(ii), which makes the lower-bound part of the 'Pareto frontier' a restatement of Definition 5, so the claim that real defenses are 'above the curve' is partly arithmetic; however, the actual gap sizes are measured data and the KKT/Dmax results are independent. Separately, §6 asserts without proof that a 'Jensen argument' extends R_sc to memory-based defenses, while also admitting adaptive causal defenses are open; WTF-PAD and Front are adaptive/causal and TrafficSliver uses shared randomness, so Table 1's external validity rests on an omitted proof. That is a rigor gap, not circularity, and is weighed as a limitation.

Assumptions & free parameters 4 free parameters · 8 assumptions · 0 invented entities

The theory rests on standard convex-analytic facts (I(X;Y) convex in the channel, W1 convex in its first argument, Kantorovich–Rubinstein duality) plus three modeling idealizations: an i.i.d. per-symbol source, the Θiid outcome-distribution class (defender may pick arbitrary per-class Q_x), and W1-in-feature-space as the cost of defense. The empirical gaps additionally depend on arbitrary choices — L=50 bins, an unstated metric, top-5 pair selection, equal priors — that are not sensitivity-tested. No invented entities: R_sc(D) is a derived mathematical object, not a postulated mechanism.

free parameters (4)
  • L = 50 (delay histogram bins) = 50
    Feature quantization level chosen by hand in §5.1; the measured gaps (0.028–0.124 bits) and the curve itself depend on it; no sensitivity analysis.
  • metric d on Z (empirical)
    Definition 2 requires a metric d: Z×Z→[0,1], but the experiments never state d (implied: normalized absolute delay difference); the W1 costs D̂ and D_max = (1/2)W1(P0,P1) depend on it.
  • class-pair selection (top-5 by W1) = 5 pairs, W1 ∈ [0.039, 0.042]
    §5.1 selects the five most separable of 4465 pairs; the reported gap magnitudes are conditional on this selection.
  • equal prior pX = (1/2, 1/2) = 0.5 / 0.5
    Assumed for the binary-pair benchmark so D_max = (1/2)W1(P0,P1) applies (§4.3, §5.1); real WF priors are unequal.
assumptions (8)
  • domain assumption Source X is i.i.d. with min p(x) > 0 (Def. 1)
    Site traffic is modeled as a stationary memoryless label sequence; real traces have burst/object-level structure. Entered at §3.1.
  • ad hoc to paper Defense class Θiid = arbitrary per-class output distributions {Q_x}, each realizable independently (Def. 2)
    The Pareto frontier is exact only over outcome distributions; a real defender does not know x and is mechanism-constrained (padding only, causality, TCP), so the optimum may not be implementable. §3.1, §6.
  • domain assumption W1 in feature space is the defense cost and stands in for QoS (Def. 3)
    The abstract frames D as a 'QoS cost budget'; no validation that W1 on delay histograms tracks bandwidth/latency. §3.2.
  • domain assumption Z finite with metric d (Def. 2)
    Finite support is required for compactness, LP duality, and the endpoint arguments; real delays are continuous and binning is an approximation.
  • standard math I(X;Y) is convex in the test channel at fixed pX [7]
    Used in Theorem 1(ii) convexity proof and in the claim that the program is convex.
  • standard math Kantorovich–Rubinstein duality W1(Q,P) = sup_{1-Lipschitz h} |E_Q h − E_P h| [27]
    Used for the D_max identity (Prop. 1) and for the subgradient φ* in Theorem 2.
  • domain assumption W1-geodesic midpoint Q_1/2 exists (Prop. 1)
    The equality D_max = (1/2)W1(P0,P1) is conditional on this; it holds for the delay-grid metric but not for every finite metric space.
  • ad hoc to paper Jensen argument: (1/n)I(X^n;Y^n) → I(X;Y|κ) ≥ R_sc(D) for memory-based defenses (§6)
    Asserted without proof; this is the only bridge from Θiid to real (memory-based) defenses and is open for the multi-letter case.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Rate-Distortion Function for Encrypted Traffic Side-Channel Defense." pith.science (2026). https://pith.science/paper/MNNW4RJD

@misc{pith2026260717889,
  author       = {Pith},
  title        = {Pith review of: Rate-Distortion Function for Encrypted Traffic Side-Channel Defense},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MNNW4RJD}},
  note         = {Machine review of arXiv:2607.17889}
}
abstract

Parameter selection for encrypted traffic defense has long relied on empirical tuning, yet the fundamental question -- \emph{given a QoS cost budget $D$, how low can the leakage rate go under sustained observation?} -- lacks a provable, computable baseline. Taking the semantic label sequence $X^n$ as the source, the defended feature sequence $Y^n$ as the observation, and Wasserstein-1 distance as the defense cost, we define the \emph{side-channel rate-distortion function} $R^{\mathrm{sc}}(D)$ within the stationary memoryless defense class $\Theta_{\mathrm{iid}}$ and provide its complete characterization. We prove that $R^{\mathrm{sc}}(D)$ is monotone decreasing, convex, and continuous, with exact endpoints; the optimal defense has an exponential-tilting (Boltzmann) structure governed by KKT conditions; and the curve constitutes the exact Pareto frontier within $\Theta_{\mathrm{iid}}$. For binary equal-prior tasks, $D_{\max} = \tfrac{1}{2}W_1(P_0,P_1)$ via Kantorovich--Rubinstein duality. On real-world website-fingerprinting defenses, the framework locates Front ($\Delta_{\mathrm{gap}}{=}0.028$\,bits), WTF-PAD ($0.034$\,bits), and TrafficSliver ($0.124$\,bits) above the theoretical curve, quantifying their suboptimality gaps.

Figures

Figures reproduced from arXiv: 2607.17889 by the authors.

Figure 1
Figure 1. Side-channel rate-distortion curve Rsc(D): the exact Pareto frontier within Θiid. Any defense in the class operates at or above the curve. For the W1 term, since W1(·, Px) is a convex piecewise-linear function (LP value), we select a subgradient ϕ ∗ x (the optimal Kantorovich dual potential). The sta￾tionarity condition ∇Qx(y)L = 0 becomes: px [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗
Figure 2
Figure 2. Cost utilization vs. suboptimality gap for three defenses across five class [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

32 extracted references

  1. [1]

    Prentice-Hall, Englewood Cliffs, NJ (1971)

    Berger, T.: Rate Distortion Theory: A Mathematical Basis for Data Compression. Prentice-Hall, Englewood Cliffs, NJ (1971)

    1971

  2. [2]

    IEEE Transactions on Information Theory18(4), 460–473 (1972)

    Blahut, R.E.: Computation of channel capacity and rate-distortion functions. IEEE Transactions on Information Theory18(4), 460–473 (1972)

    1972

  3. [3]

    In: Proceedings of the 2020 ACM SIGSAC Confer- ence on Computer and Communications Security

    De la Cadena, W., Mitseva, A., Hiller, J., Pennekamp, J., Reuter, S., Filter, J., Engel, T., Wehrle, K., Panchenko, A.: TrafficSliver: Fighting website fingerprinting attacks with traffic splitting. In: Proceedings of the 2020 ACM SIGSAC Confer- ence on Computer and Communications Security. pp. 1971–1985. ACM (2020). https://doi.org/10.1145/3372297.3423351

    arXiv 2020

  4. [4]

    In: Proceed- ings of the 2014 ACM SIGSAC Conference on Computer and Communications Security

    Cai, X., Nithyanand, R., Wang, T., Johnson, R., Goldberg, I.: A systematic ap- proach to developing and evaluating website fingerprinting defenses. In: Proceed- ings of the 2014 ACM SIGSAC Conference on Computer and Communications Security. pp. 227–238. ACM (2014)

    2014

  5. [5]

    Information and Computation206(2-4), 378–401 (2008)

    Chatzikokolakis, K., Palamidessi, C., Panangaden, P.: Anonymity protocols as noisy channels. Information and Computation206(2-4), 378–401 (2008)

    2008

  6. [6]

    Proceedings on Privacy Enhancing Technologies2017(4), 215–231 (2017)

    Cherubin, G.: Bayes, not naïve: Security bounds on website fingerprinting defenses. Proceedings on Privacy Enhancing Technologies2017(4), 215–231 (2017)

    2017

  7. [7]

    Wiley, Hoboken, NJ, 2nd edn

    Cover, T.M., Thomas, J.A.: Elements of Information Theory. Wiley, Hoboken, NJ, 2nd edn. (2006)

    2006

  8. [8]

    Deng, X., Li, Q., Xu, K.: Robust and reliable early-stage website fingerprinting attacksviaspatial-temporaldistributionanalysis.In:Proceedingsofthe2024ACM SIGSAC Conference on Computer and Communications Security. pp. 423–436. ACM (2024). https://doi.org/10.1145/3658644.3670272

    arXiv 2024

Show all 32 references
  1. [9]

    In: Advances in Cryptology – EU- ROCRYPT 2006

    Dwork, C., Kenthapadi, K., McSherry, F., Mironov, I., Naor, M.: Our data, our- selves: Privacy via distributed noise generation. In: Advances in Cryptology – EU- ROCRYPT 2006. pp. 486–503. Springer (2006)

    2006

  2. [10]

    In: Proceedings of the 2012 IEEE Symposium on Security and Privacy

    Dyer, K.P., Coull, S.E., Ristenpart, T., Shrimpton, T.: Peek-a-boo, I still see you: Why efficient traffic analysis countermeasures fail. In: Proceedings of the 2012 IEEE Symposium on Security and Privacy. pp. 332–346. IEEE (2012)

    2012

  3. [11]

    Wiley, New York, NY (1968)

    Gallager, R.G.: Information Theory and Reliable Communication. Wiley, New York, NY (1968)

    1968

  4. [12]

    In: Proceedings of the 29th USENIX Security Symposium

    Gong, J., Wang, T.: Zero-delay lightweight defenses against website fingerprinting. In: Proceedings of the 29th USENIX Security Symposium. pp. 717–734. USENIX Association (2020)

    2020

  5. [13]

    In: Proceedings of the 25th USENIX Security Symposium

    Hayes, J., Danezis, G.: k-fingerprinting: A robust scalable website fingerprinting technique. In: Proceedings of the 25th USENIX Security Symposium. pp. 1187–

  6. [14]

    Juarez, M., Imani, M., Perry, M., Diaz, C., Wright, M.: Toward an efficient website fingerprintingdefense.In:ComputerSecurity–ESORICS2016.pp.27–46.Springer (2016)

    2016

  7. [15]

    In: Proceedings of the ACM Web Conference 2022

    Lin, X., Xiong, G., Gou, G., Li, Z., Shi, J., Yu, J.: ET-BERT: A contextualized datagram representation with pre-training transformers for encrypted traffic clas- sification. In: Proceedings of the ACM Web Conference 2022. pp. 633–642. ACM (2022) 12 G. Liu et al

    2022

  8. [16]

    arXiv preprint arXiv:2602.14055 (2026),https://arxiv.org/abs/2602

    Liu, G., Chen, G., Liu, W.: The inevitability of side-channel leakage in encrypted traffic. arXiv preprint arXiv:2602.14055 (2026),https://arxiv.org/abs/2602. 14055

    2026

  9. [17]

    In: Proceedings of the 44th IEEE Symposium on Security and Privacy

    Mathews,N.,Holland,J.K.,Oh,S.E.,Rahman,M.S.,Hopper,N.,Wright,M.:SoK: A critical evaluation of efficient website fingerprinting defenses. In: Proceedings of the 44th IEEE Symposium on Security and Privacy. pp. 969–986. IEEE (2023)

    2023

  10. [18]

    https://doi.org/10.1109/TON.2025.3532094

    Mei, H., Cheng, G., Yuan, Y.: High precision and efficient anonymous traffic classi- ficationinthereal-world.IEEETransactionsonNetworking33(3),966–981(2025). https://doi.org/10.1109/TON.2025.3532094

    2025

  11. [19]

    IEEE Trans- actions on Information Theory53(6), 2254–2261 (2007)

    Merhav, N., Shamai, S.: Information rates subject to state masking. IEEE Trans- actions on Information Theory53(6), 2254–2261 (2007)

    2007

  12. [20]

    In: Proceedings of the 33rd USENIX Security Symposium

    Sabzi, A., Vora, R., Goswami, S., Seltzer, M., Lécuyer, M., Mehta, A.: NetShaper: A differentially private network side-channel mitigation system. In: Proceedings of the 33rd USENIX Security Symposium. pp. 3385–3402. USENIX Association (2024)

    2024

  13. [21]

    In: Privacy Enhancing Technologies: 2nd International Workshop, PET 2002

    Serjantov, A., Danezis, G.: Towards an information theoretic metric for anonymity. In: Privacy Enhancing Technologies: 2nd International Workshop, PET 2002. Lec- ture Notes in Computer Science, vol. 2482, pp. 41–53. Springer (2003)

    2002

  14. [22]

    IRE International Convention Record7(4), 142–163 (1959)

    Shannon, C.E.: Coding theorems for a discrete source with a fidelity criterion. IRE International Convention Record7(4), 142–163 (1959)

    1959

  15. [23]

    In: Proceedings of the 2024 IEEE Symposium on Security and Privacy (SP)

    Shen, M., Ji, K., Wu, J., Li, Q., Kong, X., Xu, K., Zhu, L.: Real-time website fingerprinting defense via traffic cluster anonymization. In: Proceedings of the 2024 IEEE Symposium on Security and Privacy (SP). pp. 3238–3256. IEEE (2024)

    2024

  16. [24]

    IEEE Transactions on Information Forensics and Security16, 2367–2380 (2021)

    Shen, M., Zhang, J., Zhu, L., Xu, K., Du, X., Liu, Y.: Accurate decentralized ap- plication identification via encrypted traffic analysis using graph neural networks. IEEE Transactions on Information Forensics and Security16, 2367–2380 (2021)

    2021

  17. [25]

    Proceedings on Privacy Enhancing Technologies2023(4), 79–95 (2023)

    Siby, S., Barman, L., Wood, C.A., Fayed, M., Sullivan, N., Troncoso, C.: Evaluat- ing practical QUIC website fingerprinting defenses for the masses. Proceedings on Privacy Enhancing Technologies2023(4), 79–95 (2023)

    2023

  18. [26]

    In: Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security

    Sirinam, P., Imani, M., Juarez, M., Wright, M.: Deep fingerprinting: Undermining website fingerprinting defenses with deep learning. In: Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security. pp. 1928–

    2018

  19. [27]

    Villani, C.: Optimal Transport: Old and New, Grundlehren der math- ematischen Wissenschaften, vol. 338. Springer, Berlin, Heidelberg (2009). https://doi.org/10.1007/978-3-540-71050-9

    2009 doi

  20. [28]

    In: Proceed- ings of the 23rd USENIX Security Symposium

    Wang, T., Cai, X., Nithyanand, R., Johnson, R., Goldberg, I.: Effec- tive attacks and provable defenses for website fingerprinting. In: Proceed- ings of the 23rd USENIX Security Symposium. pp. 143–157. USENIX Association (2014),https://www.usenix.org/conference/usenixsecurity1...

    2014

  21. [29]

    In: Proceedings of the 26th USENIX Security Symposium

    Wang, T., Goldberg, I.: Walkie-talkie: An efficient defense against passive website fingerprinting attacks. In: Proceedings of the 26th USENIX Security Symposium. pp. 1375–1390. USENIX Association (2017)

    2017

  22. [30]

    IEEE Trans- actions on Information Theory43(3), 827–835 (1997)

    Yamamoto, H.: Rate-distortion theory for the Shannon cipher system. IEEE Trans- actions on Information Theory43(3), 827–835 (1997)

    1997

  23. [31]

    In: Proceedings of the 38th AAAI Conference on Artificial Intelligence

    Yang, C., Qi, J., Zhou, A.: Wasserstein differential privacy. In: Proceedings of the 38th AAAI Conference on Artificial Intelligence. pp. 14928–14936. AAAI Press (2024)

    2024

  24. [1203]

    USENIX Association (2016)

    2016

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.