Adaptive Tamaraw: Cluster-Based WF Defense

• Adaptive Tamaraw is a cluster-based website fingerprinting defense that adapts padding parameters per anonymity set to maintain rigorous security guarantees.
• It employs a two-phase operation that starts with global conservative padding and switches to tailored, lighter padding based on early traffic classification.
• Empirical evaluations demonstrate a tunable privacy-efficiency trade-off, achieving overhead reductions up to 99% while keeping attacker accuracy bounded.

Searching arXiv for the Adaptive Tamaraw paper and closely related website fingerprinting defense work. Adaptive Tamaraw is a cluster-based website fingerprinting defense that modifies classic Tamaraw by assigning padding parameters on a per-cluster basis while retaining its original information-theoretic guarantee. The scheme combines regularization-style traffic shaping with supersequence-style grouping: it begins with global, conservative padding, uses early time-series classification to identify a suitable anonymity set for the trace in progress, and then switches to lighter, set-specific parameters for the remainder of the connection. Its stated objective is to preserve provable security while substantially reducing bandwidth and time overhead, especially relative to classic Tamaraw’s uniform, fixed-parameter design (Khajavi et al., 1 Sep 2025).

1. Problem setting and design objective

Adaptive Tamaraw is situated in the website fingerprinting (WF) defense literature as a response to a specific limitation of classic Tamaraw. In the formulation summarized in "Lightening the Load: A Cluster-Based Framework for A Lower-Overhead, Provable Website Fingerprinting Defense" (Khajavi et al., 1 Sep 2025), classic Tamaraw is a regularization-based defense that shapes all packet flows with uniform, fixed parameters such as packet rate and cell count rounding. This yields strong information-theoretic security, but it also ignores intra- and inter-website traffic variability, so padding must accommodate the largest or most bursty patterns across all websites.

The central design goal is therefore not merely adaptation, but adaptation without reducing secrecy guarantees. The paper frames this as a unification of two defense families: the effectiveness of regularization-based defenses and the provable security of supersequence-style grouping. The resulting mechanism is explicitly tunable. By varying the anonymity-set parameter $k$, operators can trade privacy for efficiency: in the high-privacy mode, the bound on any attacker’s accuracy is pushed below $30\%$, whereas in efficiency-centred settings total overhead is reduced by $99\%$ compared with classic Tamaraw (Khajavi et al., 1 Sep 2025).

A key conceptual point is that the adaptation target is not a single website profile. Instead, the defense maps a trace to an anonymity set constructed to be both $k$-anonymous and $l$-diverse. This prevents the adaptive phase from degenerating into per-website specialization and is central to the privacy argument.

2. Pattern extraction and anonymity-set construction

The scheme begins from the observation that webpages do not produce a single canonical trace. The paper emphasizes intra-webpage variability arising from dynamic content, ads, and personalization, and argues that webpage-level aggregation is therefore inefficient (Khajavi et al., 1 Sep 2025). Adaptive Tamaraw addresses this with a two-stage clustering pipeline.

First, each trace is converted into a Traffic Aggregation Matrix (TAM), a two-dimensional time series representing inbound and outbound packets per time slot. Traces are then clustered within each page using a modified CAST algorithm with local scaling for affinity. The affinity between traces $F_x$ and $F_y$ is defined as

$$A(F_x, F_y) = \exp\left(-\frac{d^2(F_x, F_y)}{\sigma_x \sigma_y}\right).$$

The paper further states that cleaning and post-processing are applied to ensure cluster quality and to limit cluster count.

Second, the resulting traffic patterns are clustered across webpages into anonymity sets. These sets satisfy two explicit privacy properties: $k$-anonymity, meaning at least $k$ patterns per set, and $30\%$0-diversity, meaning at least $30\%$1 different webpages represented in each set. The clustering criterion is not purely geometric similarity. Instead, the distance between a partial set and a candidate pattern is defined through the expected attacker’s success rate after Tamaraw regularization. In the notation used in the paper, for an anonymity set $30\%$2,

$30\%$3

This construction links grouping directly to post-defense distinguishability. The intended effect is that traces within a set become both less distinguishable after padding and more heterogeneous in origin.

3. Online adaptation and switching logic

Adaptive Tamaraw operates in two phases during a connection. It starts with strong global Tamaraw padding, which protects the early part of the traffic when the visited site is still unknown. It then attempts to classify the trace prefix into an anonymity set as early as possible, after which it switches to lighter, set-specific padding parameters for the remainder of the connection (Khajavi et al., 1 Sep 2025).

The early classification mechanism is adapted from the ECDIRE framework. The classifier pipeline described in the paper uses Holmes, a deep spatial-temporal CNN, to predict the likely website; a per-site k-fingerprinting model then selects the intra-site pattern; and the resulting pair maps to a unique anonymity set. This is not described as unrestricted online switching. Rather, the earliest switching time is precomputed for each anonymity set as $30\%$4, and switching occurs only when classifier confidence is sufficient. The paper presents this as a safe-switching mechanism designed to avoid excessive switching and possible timing side-channels.

Once the anonymity set has been selected, padding parameters are no longer globally conservative. They are optimized for that set, which is the main source of the overhead reduction. A common misunderstanding would be to treat this as a heuristic relaxation of Tamaraw’s protection. The design as stated in the paper does not frame the lighter padding as an ad hoc efficiency shortcut; it frames it as a constrained adaptation inside a cluster construction that is itself chosen to retain a formal security bound.

4. Formalism and security guarantee

The paper’s security analysis is stated in terms of weighted pre-images. For a defended trace $30\%$5, the weighted pre-image size is

$30\%$6

where $30\%$7 is the set of all original traces that map to $30\%$8, and $30\%$9 is the subset whose source is webpage $99\%$0 (Khajavi et al., 1 Sep 2025). Under this definition, the attacker’s best strategy is to guess the most common website in the pre-image.

The defense notion is weighted $99\%$1-non-injectivity. In the pointwise form, the guarantee is $99\%$2, which implies an optimal attacker success rate of at most $99\%$3. The paper then explicitly shifts to a non-uniform setting, where the bound is on the average attack success rate over the defended trace distribution rather than on the absolute worst case. This distinction is important: the guarantee is average-case over defended traces, not a universal worst-case indistinguishability claim.

The central theorem states that Adaptive Tamaraw is non-uniformly weighted $99\%$4-non-injective, so the attacker’s average success probability satisfies

$99\%$5

The proof outline in the summary proceeds by noting that, after switching, all traces in an anonymity set $99\%$6 are shaped identically except for their total padded length. Within each set and length bucket, traces are indistinguishable, and the strongest attacker succeeds by choosing the most common label in that bucket. The global bound is then obtained by averaging these success rates over sets and lengths (Khajavi et al., 1 Sep 2025).

The role of the anonymity parameters is also formalized. Increasing $99\%$7 enlarges anonymity sets and lowers the attacker’s success bound, while $99\%$8-diversity prevents trivial sets such as those containing only one webpage. This clarifies why privacy and efficiency move in opposite directions when $99\%$9 is tuned.

5. Privacy–efficiency trade-off and measured behavior

The reported empirical behavior is organized around a tunable privacy–efficiency trade-off. Small $k$0 yields more aggressive overhead reduction but a looser accuracy bound for the attacker. Large $k$1 yields higher privacy but less overhead reduction, because the padding must hide more patterns (Khajavi et al., 1 Sep 2025).

For the overhead comparison with classic Tamaraw, the paper reports the following values. At bucket length $k$2, Tamaraw incurs $k$3 overhead, while Adaptive Tamaraw reports $k$4 for $k$5, $k$6 for $k$7, and $k$8 for $k$9. At $l$0, the corresponding values are $l$1, $l$2, $l$3, and $l$4. At $l$5, they are $l$6, $l$7, $l$8, and $l$9. The paper highlights the $F_x$0, $F_x$1 case as a setting in which Adaptive Tamaraw cuts total overhead by $F_x$2 relative to classic Tamaraw. It also states that most traces see lower overhead, some see up to $F_x$3 saving, the average effect is positive, and a small fraction experience slight regressions.

For privacy bounds, the paper reports that with $F_x$4 and $F_x$5, attacker accuracy is bounded at approximately $F_x$6. With $F_x$7 and $F_x$8, the bound tightens to below $F_x$9. Intermediate settings are described as interpolating smoothly. The abstract-level summary compresses this into two endpoints: high-privacy configurations can push the accuracy bound below $F_y$0, whereas efficiency-centred configurations maximize overhead reduction (Khajavi et al., 1 Sep 2025).

The paper also compares theoretical bounds with empirical attack accuracies. For four padding settings, the reported pairs are: bound $F_y$1 with kFP $F_y$2, Tik-Tok $F_y$3, RF $F_y$4, LASERBEAK $F_y$5; bound $F_y$6 with kFP $F_y$7, Tik-Tok $F_y$8, RF $F_y$9, LASERBEAK $$A(F_x, F_y) = \exp\left(-\frac{d^2(F_x, F_y)}{\sigma_x \sigma_y}\right).$$0; bound $$A(F_x, F_y) = \exp\left(-\frac{d^2(F_x, F_y)}{\sigma_x \sigma_y}\right).$$1 with kFP $$A(F_x, F_y) = \exp\left(-\frac{d^2(F_x, F_y)}{\sigma_x \sigma_y}\right).$$2, Tik-Tok $$A(F_x, F_y) = \exp\left(-\frac{d^2(F_x, F_y)}{\sigma_x \sigma_y}\right).$$3, RF $$A(F_x, F_y) = \exp\left(-\frac{d^2(F_x, F_y)}{\sigma_x \sigma_y}\right).$$4, LASERBEAK $$A(F_x, F_y) = \exp\left(-\frac{d^2(F_x, F_y)}{\sigma_x \sigma_y}\right).$$5; and bound $$A(F_x, F_y) = \exp\left(-\frac{d^2(F_x, F_y)}{\sigma_x \sigma_y}\right).$$6 with kFP $$A(F_x, F_y) = \exp\left(-\frac{d^2(F_x, F_y)}{\sigma_x \sigma_y}\right).$$7, Tik-Tok $$A(F_x, F_y) = \exp\left(-\frac{d^2(F_x, F_y)}{\sigma_x \sigma_y}\right).$$8, RF $$A(F_x, F_y) = \exp\left(-\frac{d^2(F_x, F_y)}{\sigma_x \sigma_y}\right).$$9, LASERBEAK $k$0. The reported conclusion is that empirical results always remain at or below the theoretical bound. One explicit example states that with $k$1 and $k$2, the worst-case bound is $k$3, while actual RF accuracy is $k$4 and LASERBEAK accuracy is $k$5.

6. Generalization, interpretation, and relation to prior defense styles

The paper presents Adaptive Tamaraw as a hybrid of two established design styles. From regularization-based defenses it inherits fixed-parameter shaping within each chosen regime; from supersequence-style approaches it inherits grouping and a proof strategy based on trace coalescence within anonymity sets (Khajavi et al., 1 Sep 2025). This suggests that its main novelty is not only the switch itself, but the way switching is constrained by a cluster construction that remains analyzable.

A second interpretive point concerns generalization. The paper states that Adaptive Tamaraw remains effective even when defending webpages not present at training time. In that out-of-training setting, the maximum attacker-accuracy bound is reported as $k$6, and overhead improvements still occur, although somewhat diminished. This is significant because the defense is built from learned pattern structure and early classification, yet is not described as restricted to a fixed closed list of protected pages.

Finally, the most important limitation stated in the formalism is the non-uniform nature of the guarantee. The bound is on average attack success over the defended-trace distribution, not an absolute worst-case guarantee for every possible defended trace. A plausible implication is that Adaptive Tamaraw should be understood as preserving a provable security statement of the form actually analyzed in the paper, rather than as eliminating all variation-dependent risk. Within that stated scope, the contribution is a defense that adapts padding in real time, groups traffic into $k$7-diverse anonymity sets, and retains a theorem-backed upper bound on average attacker success while reducing overhead relative to classic Tamaraw (Khajavi et al., 1 Sep 2025).