# The Shape of Traffic. What encrypted packets reveal when the destination is hidden *The Tor network hides destinations and contents, yet encrypted packet streams retain a temporal profile. A peer-reviewed USENIX Security ’26 study shows how target watchlist maintenance becomes radically cheaper via few-shot learning.* **Date**: August 20, 2026 | **Citation**: USENIX Security ’26 proceedings, 12–14 August 2026. Liu, Lin et al. (NUDT & Tsinghua University). --- ## Tor hides where you go. What can the rhythm of packets still reveal? Layered encryption conceals message payloads and obscures destination routing. Yet a passive observer monitoring the client’s local connection can still record burst lengths, packet directions, and inter-arrival timing. A newly peer-reviewed framework cuts the operational cost of maintaining a surveillance watchlist: onboarding an unseen website requires only 5 to 20 fresh visits, even when the user browses with multiple tabs simultaneously. ### Key Figures - **5–20**: traces needed to onboard a new monitored site (down from hundreds or thousands in older models) - **73.6%**: precision across 5 simultaneous tabs with just 5 shots (under controlled multi-tab evaluation) - **47.0%**: precision after 2 months of real web drift with 5 tabs (dropping below a coin toss) --- ## 1. What the attacker can and cannot observe To assess website fingerprinting realistically, one must begin with the observer’s position. In Tor’s threat model, a client routes encrypted traffic through a three-relay circuit. The attacker evaluated in the paper is strictly passive: positioned on the client-side link, such as a local Wi-Fi gateway, an ISP choke point, or the wire directly preceding the Tor entry guard. This observer never decrypts payloads, injects packets, modifies data, or introduces artificial delays. All Tor traffic is packaged into fixed 512-byte cells. Nevertheless, as a browser renders a modern webpage, it requests resources—HTML, stylesheets, images, scripts—in characteristic sequences, producing a distinctive temporal fingerprint of inbound and outbound bursts. ### Transit Visibility Breakdown - **Page Payload & Content** (HIDDEN): Fully end-to-end encrypted across three relays; opaque to the observer. - **Destination Server & IP** (HIDDEN): Obscured by Tor onion routing; the observer sees only the first guard relay. - **Direct User Identity** (HIDDEN): Not provided by packet metadata; requires fusion with external identifiers. - **Individual Packet Directions** (VISIBLE): Inbound (-1) vs outbound (+1) packet sequences logged per millisecond. - **Burst Cell Counts** (VISIBLE): Number of 512-byte cells transmitted before the next directional pause. - **Inter-Arrival Timings** (VISIBLE): Precise millisecond gaps between client requests and server responses. --- ## 2. The target watchlist maintenance bottleneck For years, practical website fingerprinting hit a steep logistical wall: target maintenance. Real websites continually change layouts, advertisements, and third-party assets. Moreover, actual users rarely browse in artificial single-tab isolation; they routinely keep three, four, or five tabs open at the same time. Conventional fingerprinting classifiers attempted to recognize the entire trace as a massive combinatoric mixture. Whenever an intelligence actor wanted to monitor a newly emerged whistleblower portal or exile media outlet, it had to harvest thousands of fresh traffic traces and retrain heavy neural networks from scratch. The MMF architecture reframes the problem entirely: instead of predicting the full combinatoric label, it asks independently whether features matching a monitored target are present inside the mixture. By applying metric-based few-shot learning, the observer can onboard a newly interesting site using as few as 5 to 20 recorded visits. ### Conventional Combinatoric Fingerprinting - Assumes 1 trace = 1 website or relies on rigid combination sets. - Requires hundreds or thousands of fresh traces per new website. - Demands full model retraining whenever the target watchlist updates. - Collapses rapidly when users open an unknown number of concurrent tabs. ### MMF Framework (USENIX Security ’26) - Treats multi-tab browsing as a composite mixture of independent signals. - Onboards newly monitored websites with only 5 to 20 recorded examples. - Bypasses heavy retraining by comparing metric feature embeddings. - Operates robustly even as the user’s tab count fluctuates in real time. --- ## 3. Comparative performance in open-world settings The authors evaluated MMF against leading academic baselines in both controlled conditions and realistic open-world environments containing thousands of unmonitored background sites. ### Precision at k (P@k) in 4-tab open-world testing under distribution shift - **MMF (New Framework)**: 62.36% — 3.51× higher precision than the closest baseline - **BAPM (2024 Baseline)**: 17.75% — Deteriorates sharply in multi-tab conditions - **TMWF (Baseline)**: 15.20% — Struggles with interleaved packet bursts - **ARES (Baseline)**: 13.43% — Low precision in multi-label decomposition - **FMWF (Baseline)**: 6.20% — Near-total loss of signal in open-world testing --- ## 4. Why 47% precision stops the 'superpower' narrative The most instructive finding in the paper is not peak lab accuracy, but the measurement of real-world drift. To replicate authentic surveillance constraints, the researchers collected traffic over approximately two months, allowing websites, CDNs, and network routes to shift naturally. Even when provided with 20 fresh traces per new website, MMF’s precision on the drift dataset dropped to 59.1% for 3 tabs, 54.5% for 4 tabs, and 47.0% for 5 tabs. When a user has 5 tabs active, the probability of a correct passive detection falls below a coin toss. This boundary demonstrates the inherent limits of passive traffic analysis: it is not omniscient, and it rapidly decays without continuous trace collection. The strategic shift is strictly economic: the operational burden of keeping a watchlist current dropped from thousands of traces to a few dozen. ### Drift Degradation Matrix - **3 concurrent tabs**: 59.15% — Moderate precision; burst interleaving is partially disentangled. - **4 concurrent tabs**: 54.50% — Substantial degradation; nearly half of all inferences are ambiguous. - **5 concurrent tabs**: 47.02% — Below 50%; complex traffic interleaving successfully obscures the target signature. --- ## 5. Institutions, attribution, and capability signals The paper is co-authored by researchers from China’s National University of Defense Technology (NUDT) and Tsinghua University. NUDT’s institutional structure places it directly subordinate to China’s Central Military Commission. This institutional affiliation serves as a clear capability signal regarding high-level state interest in traffic analysis and anonymity-network research. However, it does not demonstrate that this specific framework is currently deployed operationally by Chinese military or intelligence agencies. The authors deposited their source code and reproduction benchmarks openly on Zenodo in May 2026 and framed the research within privacy and defensive security boundaries, explicitly noting the risks of surveillance misuse against journalists and dissidents. > **Crucial Distinction: Detection vs Identification** > This framework detects statistical consistency with a target website; it does not directly identify an individual human being. Associating a detected traffic burst with a named person requires correlating the observation with subscriber records, gateway IP logs, device telemetry, or physical intelligence. --- *Source: USENIX Security ’26 proceedings, August 12–14, 2026. Reproduction code and artifacts archived on Zenodo (May 28, 2026).* *A research and visualization project by Marius Comper.*