An arXiv preprint reports that, under Chameleon, website-fingerprinting attack accuracy was below 27% across the evaluated DF closed-world tests. Website fingerprinting here means trying to identify which website was visited from encrypted Tor traffic. The paper reports an average accuracy 76.52% lower on DF, while the lowest reported DS-19 accuracy was 6.40%.
The work is a systems evaluation rather than a study of human participants. It tests traffic from public datasets and a real-world Tor pluggable-transport bridge under several attack models and comparison defenses.
A defense built around many possible traffic shapes
Chameleon does not give each site one fixed disguise. It selects diverse candidate traces that are ambiguous across website classes, then randomly maps each webpage trace to multiple candidates that can be shared across webpages.
At the PT endpoints, candidate traces are synchronized using packet-direction prefixes—the sequence of packet departures in each direction—organized in a radix-trie structure. Trace mutation is included to handle directional mismatches and buffering overhead during morphing.
The tests used several large traffic collections
The DF dataset contained 95 retained closed-world sites with 1,000 traces per site, plus 40,716 open-world sites with one instance per site. DS-19 contained 100 monitored sites visited 100 times and 10,000 unmonitored websites.
GTT23 contained approximately 14 million visits from more than 1.1 million domains. Its derived evaluation sets used 100 closed-world domains with 2,000 instances each and 10,000 open-world domains.
Lower attack scores came with extra traffic
The reported cost varied by dataset. On DF, Chameleon added 130.60% in bandwidth overhead and 14.51% in time overhead. On DS-19, the corresponding figures were 72.48% and 9.97%.
In the DF open-world evaluation, Chameleon’s F1 score—a measure combining precision and recall—ranged from 14.89% to 26.16% across DF, Var-CNN, RF and NetCLR attacks. False-positive rates ranged from 5.65% to 11.77%.
On GTT23, a defense-aware autoencoder and random-forest attack produced an F1 score of 35.19% against Chameleon, compared with 88.22% for Adaptive Tamaraw.
The defense was also tested under changing conditions
In an early-stage Holmes test, Chameleon’s F1 score ranged from 8.06% to 14.67% as loaded traffic rose from 20% to 60%. At 60% loaded traffic, the paper reports a 74.5% reduction compared with NoDef.
When the randomization-aware evaluation used 20 defended variants, reported attack accuracy was 17.50% for DF, 18.82% for Var-CNN, 31.06% for RF and 17.04% for NetCLR.
The reported configurations show a clear security-overhead trade-off. The lightweight version carried 130.60% bandwidth overhead and 14.51% time overhead. The heavy version carried 260.46% bandwidth overhead and 48.50% latency overhead, while its reported attack accuracies ranged from 9.73% to 12.94%.
A bridge test produced a similar pattern
In the real-world pluggable-transport bridge evaluation, Chameleon had 91.47% bandwidth overhead and 16.25% time overhead. Attack accuracies ranged from 6.51% to 17.45% across the four reported attacks.
These figures measure performance against the tested attacks and traffic traces, not anonymity or privacy directly for Tor users. The supplied analysis treats attack accuracy, F1 and information-leakage measures as surrogate outcomes.
The evaluation used selected datasets, defenses, attack models and one real-world PT configuration. It reported no confidence intervals, inferential tests or other variability estimates, so the results do not establish universal security or a direct user-level privacy benefit.
The document is an arXiv version 1 preprint dated 20 August 2026. The authors present Chameleon as a security-overhead trade-off within the tested settings, not as proof that all defense-induced leakage is removed or that long-term operational reliability has been established.
Paper data and sources
Original title: Chameleon: Robust Defense Against Tor Website Fingerprinting via Many-to-Many Traffic Morphing
Authors: Yuwen Cui, Kai Wei, Kehan Shen et al.
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-20
DOI: Not available
Original paper · Full text