ByteDefender: V8-Based Fingerprinting Mitigation

• ByteDefender is a mitigation system that analyzes V8 bytecode at the function level using a Transformer-based classifier to detect JavaScript fingerprinting.
• It integrates directly with V8 by disassembling bytecode into opcode sequences and applying a lightweight, compile-time signature matching for on-device enforcement.
• Empirical evaluation on top websites shows high accuracy and robust resistance to obfuscation with minimal page-load latency overhead, demonstrating practical deployment feasibility.

ByteDefender is a browser fingerprinting mitigation system that operates at the JavaScript function level by analyzing V8 bytecode rather than source code or URLs. It is presented as the first system leveraging V8 engine bytecode to detect fingerprinting operations specifically at the JavaScript function level, combining a Transformer-based classifier trained offline on bytecode sequences with a lightweight compile-time signature-matching mechanism for on-device enforcement. Its stated objectives are function-level precision, compile-time blocking before execution, and resilience to code obfuscation and URL-based evasion; its evaluation on the top 100k websites reports high detection accuracy, strong robustness under obfuscation, and an average page-load latency increase of 4% (Bahrami et al., 12 Sep 2025).

1. Threat model and problem setting

ByteDefender is motivated by the observation that browser fingerprinting silently collects device and browser characteristics such as canvas hashes, audio-processing quirks, font metrics, WebRTC SDP fields, and navigator properties in order to construct a quasi-unique, stateless identifier that survives cookie deletion and operates without user consent (Bahrami et al., 12 Sep 2025). The paper also notes that fingerprinting is not exclusively associated with tracking; it can be used for fraud detection or bot mitigation. The central concern, however, is pervasive cross-site tracking that evades URL-based filter lists, breaks sites if blocked wholesale, and sidesteps API-randomization defenses.

The adversarial model assumes injected JavaScript, whether inline or third-party, that invokes high-entropy browser APIs such as CanvasRenderingContext2D.toDataURL, AudioContext.startRendering, RTCPeerConnection.setLocalDescription, and navigator.userAgent in patterns that yield stable identifiers. It further assumes evasive transformations including CNAME aliasing, URL randomization, and heavy obfuscation through string encoding and control-flow flattening. Within this model, AST-based or URL-based defenses are described as ineffective under such transformations.

The design goals are correspondingly narrow and operational: block only the fingerprinting functions rather than whole scripts, enforce the policy on-device at compile time within the browser engine before untrusted code executes, and exploit V8 bytecode as an intermediate representation that preserves operational structure under source-level transformations. This suggests that ByteDefender is positioned not as a generic JavaScript malware detector, but as a targeted mitigation framework for fingerprinting behavior under realistic obfuscation pressure.

2. Integration with V8 and bytecode representation

ByteDefender is implemented by patching V8’s interpreter, Ignition, in DoFinalizeJobImpl() so that, for each SharedFunctionInfo, it emits the script URL, script ID, function name, and a disassembled bytecode sequence via BytecodeArray::Disassemble() (Bahrami et al., 12 Sep 2025). For a function such as gatherFingerprint, the extracted record consists of metadata and a bytecode sequence of mnemonic names, for example LdaGlobal, GetNamedProperty, CallProperty1, Star1, LdaGlobal, …, Return.

To keep signatures compact and obfuscation-agnostic, the system drops memory addresses, operand values, bytecode offsets, and comments, retaining only opcode names. This is a central representational decision: the classifier and the signature matcher both operate on opcode mnemonic sequences rather than richer disassembly output. A plausible implication is that the retained representation emphasizes execution structure over surface syntax, which is consistent with the paper’s claim of built-in resilience to code obfuscation.

Preprocessing includes truncating or padding sequences to a maximum length, exemplified as 1,024 opcodes, filtering out internal V8 or chrome-extension scripts, and mapping each opcode to a unique token index. The resulting representation is therefore a normalized token sequence over the V8 opcode vocabulary. Because ByteDefender works directly on bytecode generated by the engine, it bypasses dependence on URL semantics or source-level AST structure, which the paper identifies as common points of failure for prior defenses.

3. Transformer classifier and training corpus

The classifier takes bytecode tokens $b_1, \ldots, b_L$ and embeds them into vectors $x_1, \ldots, x_L$ of dimension $d = 256$ using learned token embeddings and sinusoidal positional encodings:

$$x_i = W_e \cdot \mathrm{one\_hot}(b_i) + W_p \cdot p_i$$

where $W_e \in \mathbb{R}^{d \times V}$ maps a vocabulary of opcodes to $d$-dimensional vectors, $p_i \in \mathbb{R}^d$ is the fixed sinusoidal encoding for position $i$, and $W_p$ is the identity or a learned diagonal matrix (Bahrami et al., 12 Sep 2025).

The sequence is processed by a single Transformer encoder layer with 4 attention heads, each of head dimension $256/4 = 64$, followed by a 512-unit feed-forward network, residual connections, and layer normalization. The output $x_1, \ldots, x_L$0 is globally average-pooled,

$x_1, \ldots, x_L$1

and passed through a two-layer MLP with ReLU and dropout 0.1 to a single sigmoid neuron:

$x_1, \ldots, x_L$2

Training uses binary cross-entropy,

$x_1, \ldots, x_L$3

The dataset was constructed by crawling 100 k top-sites, yielding 658 M function instances and, after filtering invalid URLs and anonymous or eval functions, approximately 407 M named functions. Ground truth labeling identified 4,690 fingerprinting functions through heuristic execution-trace patterns on high-entropy APIs, contrasted with approximately 405 M non-fingerprinting functions. The training set used all 4,670 fingerprinting functions and 93,400 non-fingerprinting functions at a 1:20 ratio, with a 90%/10% train/test split and no duplicate bytecode across splits. Optimization used Adam, batch size 128, and 16 epochs for the function-level model; the script-level model was fine-tuned similarly with batch size 8 or 16 for longer sequences. The discrepancy between 4,690 labeled fingerprinting functions and 4,670 training fingerprinting functions is reported in the paper as-is.

4. Signature derivation and compile-time enforcement

After offline training, ByteDefender derives a lightweight signature for each known fingerprinting function by hashing its opcode mnemonic sequence with a fast, non-cryptographic hash, exemplified as xxHash or FNV (Bahrami et al., 12 Sep 2025). These 64-bit hashes are compiled into a fixed lookup table inside V8. The mechanism is described by the following compile-time logic: $x_1, \ldots, x_L$5

The lookup is $x_1, \ldots, x_L$4 per function. Enforcement occurs immediately after Ignition bytecode generation but before execution or JIT, so the system blocks only the offending functions rather than the containing script. This compile-time placement is significant because it aligns with the stated goal of operating before any untrusted code executes while preserving legitimate script functionality.

The paper characterizes this combination of a learned detector and a fixed signature table as practical for on-device deployment. The learned model supplies the function set from which signatures are extracted, while runtime enforcement is reduced to constant-time matching over bytecode-derived hashes. This suggests a separation between expensive offline analysis and lightweight browser-resident policy application.

5. Empirical performance and robustness

On the held-out function-level test set of 93 k functions with a fingerprinting to non-fingerprinting ratio of approximately 1:20, the Transformer is reported to achieve 98.9% accuracy, 84.0% precision, 85.1% recall, ROC-AUC 93.3%, and PR-AUC 81.6% (Bahrami et al., 12 Sep 2025). Two alternative baselines are also reported: RandomForest+FastText with 94.8% accuracy, 94.8% precision, and 66.3% recall, and RandomForest+Word2Vec with 93.6% accuracy, 80.0% precision, and 60.0% recall. These results indicate that the ByteDefender classifier trades some of the very high precision of the best RandomForest baseline for substantially higher recall.

At the script level, where all function bytecode is concatenated and a script is labeled fingerprinting if any function is fingerprinting, the ByteDefender Transformer reaches 99.7% accuracy, 92.1% precision, and 96.9% recall. The AST-based baseline, described as one-hot parent-child node pairs plus a decision tree, achieves 97.5% accuracy, 85.0% precision, and 80.0% recall. The reported comparison is therefore strongest at the script level, where ByteDefender improves all three listed metrics relative to the AST-based baseline.

The robustness results are particularly central to the system’s claims. Without obfuscation augmentation, script-level recall collapses to 0.1% under JavaScript-Obfuscator and 2.8% under Google Closure. After augmenting training data with 47 k and 11 k re-obfuscated scripts, recall recovers to 92.1% and 78.0%, respectively. The paper interprets this as evidence that exposure to obfuscation styles during training yields strong generalization. More cautiously, this supports robustness against the specific obfuscation regimes used in evaluation.

Scalability is assessed over the top 100 k domains, from which 658 M functions were extracted. Transformer training used eight TPU v4 cores, and the model contains approximately 1 M weights occupying only a few megabytes at runtime. For runtime deployment, the signature lookup adds approximately 200 ms per page load while processing thousands of functions in parallel. In a separate overhead study on 1,000 diverse sites, median page-load overhead is reported as +158 ms, corresponding to 4% of a median baseline of approximately 3.9 s, with a 95th percentile overhead of +199 ms.

6. Limitations, scope, and future directions

The paper explicitly identifies several limitations of ByteDefender (Bahrami et al., 12 Sep 2025). First, ground-truth labeling relies on heuristics for known fingerprinting patterns, specifically Canvas, AudioContext, WebRTC, and font measurement, which may miss novel techniques or methods based on non-high-entropy APIs. This means that measured detection quality is partly bounded by the coverage of the heuristic label-generation process.

Second, anonymous and eval-loaded functions were excluded from label mapping. Although the deployed model examines their bytecode equally, the paper states that efficacy on purely anonymous code remains to be formally validated. This is an important boundary condition because dynamically generated or anonymous functions are common in heavily transformed JavaScript.

Third, ByteDefender is tied to V8’s instruction set. Extending it to SpiderMonkey or JavaScriptCore would require engineering new bytecode extractors and retraining. In addition, because V8’s bytecode format evolves, periodic retraining on new engine versions may be needed to maintain coverage. These constraints place ByteDefender within a specific browser-engine ecosystem rather than establishing an engine-agnostic method.

The future enhancements proposed in the paper are semi-supervised or anomaly-detection models for discovering previously unseen fingerprinting patterns without heuristic labels, cross-engine bytecode abstraction layers for broader browser support, and on-device online learning to adapt to emerging obfuscation strategies. These directions suggest an unresolved tension between the present system’s practicality and precision, on one hand, and the open-ended variability of future fingerprinting techniques, on the other. Within its stated scope, ByteDefender demonstrates that static, function-level analysis on V8 bytecode, combined with compile-time signature matching, can block browser fingerprinting with high accuracy, robust obfuscation resistance, minimal web-compatibility impact, and approximately 4% page-load overhead.