PaperlayerView exact revision on arXiv

Source-linked AI summary

The Colossus with Feet of Clay: Debunking Encrypted Traffic Classifiers under PQC Evolution

Bingzhen Li, Lingjia Meng, Runhan Song, Chuanzhou Pan, Tongjun Pu, Ziqiang Ma, Yupeng Jiang, Lei Cui, Zhiyu Hao

arXiv:2608.22683v1cs.CR

TL;DR

PQC migration can reshape observable traffic while leaving website labels unchanged, making classifier reliability across cryptographic domains an evaluation challenge. This paper builds a paired Non-PQC/Hybrid-PQC benchmark and finds that matched-domain learnability does not ensure cross-domain reliability.

  • Problem

    Evaluating encrypted-traffic classifier reliability across cryptographic domains during PQC transition is a challenge because key-establishment changes can reshape observable traces without changing website labels.

    Source: §I · p. 1

  • Method

    The authors build a paired Non-PQC/Hybrid-PQC benchmark with controlled mixed test sets and evaluate five classifiers across matched-domain, cross-domain, and deployment-ratio settings.

    Source: §I · p. 2

  • Results

    CUMUL accuracy fell from 0.7731 in matched Non-PQC evaluation to 0.1919 under Hybrid-PQC transfer; across five classifiers, matched-domain learnability persisted but transfer reliability weakened.

    Source: §I · p. 2, §VII · p. 13

  • Takeaways & Limitations

    Classifier evaluations should treat protocol configuration as an explicit dimension and pair matched-domain accuracy with cross-domain tests; datasets should reflect contemporary cryptographic deployments.

    Source: §VII · p. 13

    Observed behavior may differ under other protocol stacks, cryptographic configurations, or attack settings not examined in this work.

    Source: §VII · p. 13

Abstract

from arXiv · show

Encrypted traffic classifiers often achieve high accuracy under matched training and testing conditions, implicitly assuming that deployment traffic follows the training distribution. TLS migration toward post-quantum cryptography (PQC) challenges this assumption because hybrid key establishment can reshape observable traffic without changing application labels. We frame this change as PQC-induced protocol drift and study its effects through closed-world HTTPS website fingerprinting using the deployed TLS~1.3 Hybrid-PQC group \texttt{\detokenize{X25519MLKEM768}}. We build a controlled, PQC-aware benchmark pairing Traditional (Non-PQC) and Hybrid-PQC traffic, then evaluate five representative classifiers and side-channel representations under matched-domain, cross-domain, and deployment-ratio settings. Collectively, the experiments show that PQC evolution does not remove learnable website information. Instead, it changes how that information appears in traffic, causing classifiers and feature combinations that perform well in-domain to lose reliability across cryptographic domains. By exposing the fragility of matched-domain evaluation, we offer strategic guidance, identify cross-domain robustness as a research priority, and recommend protocol-aware practices for dependable real-world encrypted traffic classification. The code is available at http://anonymous.4open.science/r/PQ-WF-Eval.

I. Introduction · II. Background and Related Work

The introduction frames PQC migration as protocol drift that reshapes classifier inputs despite stable website labels, and reports that matched-domain learnability does not guarantee cross-domain reliability.

I. Introduction

  • Matched-distribution evaluation and high in-domain accuracy do not establish classifier reliability as protocols evolve in closed-world HTTPS website fingerprinting.A passive adversary infers visited websites from packet lengths, directions, timing, and byte-level representations without decrypting TLS payloads.Source: §I · p. 1
  • PQC-induced protocol drift is a traffic-distribution shift caused by protocol evolution under otherwise fixed conditions, exemplified by migration from X25519 to X25519MLKEM768.The Hybrid-PQC group introduces larger key shares and expands handshake messages, potentially changing TCP segmentation, packet positions, and timing without changing the website label.Source: §I · p. 1
  • PQC changes observable representations despite stable task semantics, while coexisting Traditional, Hybrid-PQC, and future Pure-PQC configurations make cross-domain mismatch and deployment-ratio sensitivity important.Larger handshakes can alter packet-length sequences, burst boundaries, segmentation, and byte alignment, so matched-domain accuracy alone cannot characterize traffic mixtures that include configurations absent from training.Source: §I · p. 1
  • The PQC-aware benchmark pairs Non-PQC and Hybrid-PQC traffic for 195 websites, collecting 120 visits per website and configuration and testing six Hybrid-PQC deployment ratios.The study selected 200 high-ranked X25519MLKEM768-supporting websites from 2,060 Tranco-ranked sites, then retained 195 in the shared label set; visit-level partitions and a common closed-world task were used.Source: §I · p. 2
  • From Non-PQC to Hybrid-PQC, accuracy changes 0.7731→0.1919 (CUMUL), 0.9316→0.6255 (ET-BERT), and 1.0000→0.3582 (YaTC).Matched-domain accuracy remains comparable: ET-BERT achieves 0.9316 and 0.9332, while YaTC achieves 1.0000 and 0.9991. As the Hybrid-PQC deployment ratio rises, four classifiers decline monotonically, YaTC is non-monotonic, and none maintains its Non-PQC baseline across the full range.Source: §I · p. 2
  • The evaluation compares five representative classifiers across matched-domain learnability, bidirectional cross-domain transfer, deployment ratios, and side-channel feature contributions.With DF held fixed, packet length is the strongest individual feature, but its advantage diminishes as the Hybrid-PQC ratio rises; direction and timing add limited benefit, and no tested feature composition prevents cross-domain degradation.Source: §I · p. 2

A. Post-Quantum Key Establishment and Deployment in TLS · B. Encrypted Traffic Classifiers: Representations and Learning Paradigms · C. Distribution Drift in Encrypted Traffic Classification

These sections situate the study’s Hybrid-PQC TLS setting, survey traffic-classification representations, and frame protocol evolution as a source of distribution drift. They distinguish the evaluated hybrid transition from other PQC settings and motivate testing classifier reliability across cryptographic domains.

A. Post-Quantum Key Establishment and Deployment in TLS

B. Encrypted Traffic Classifiers: Representations and Learning Paradigms

  • Aggregate statistical methods use fixed flow-feature vectors and lightweight classifiers; CUMUL adds a sampled cumulative direction-coded packet-length curve,,,,.These methods are efficient and interpretable, but depend on manual feature design and dataset-specific tuning.Source: B. Encrypted Traffic Classifiers:… · p. 3
  • Sequence models preserve packet order and learn traffic structure, with DF modeling directional packet motifs and Tik-Tok adding timing information,,.Compared with fixed aggregate vectors, sequence inputs reduce manual aggregation but require choices about trace length, padding, truncation, and alignment.Source: B. Encrypted Traffic Classifiers:… · p. 3
  • Raw-byte inputs retain selected headers and encrypted payload bytes, while pre-training learns reusable representations; ET-BERT and YaTC illustrate this approach, –,,.Transfer quality still depends on the relationship between pre-training and downstream distributions, and byte-level preprocessing can introduce dataset-specific artifacts,.Source: B. Encrypted Traffic Classifiers:… · p. 3

C. Distribution Drift in Encrypted Traffic Classification

  • Distribution drift is a training–deployment traffic mismatch that can arise from time, network paths, clients, services, data pipelines, or protocol changes,, [53].Prior work reports degradation across collection environments, while comparatively less research isolates protocol-stack evolution as a drift source [49], [50].Source: C. Distribution Drift in Encrypted… · p. 3, Table I · p. 4
  • Protocol drift changes traffic generation through protocol evolution even when labels, clients, vantage points, and collection pipelines stay fixed; PQC migration is this study’s TLS example.The transition from X25519 to X25519MLKEM768 may alter handshake material, packet segmentation, timing, and byte-level classifier inputs –.Source: C. Distribution Drift in Encrypted… · pp. 3–4

III. PQC-Induced Protocol Drift in TLS 1.3 Traffic … 2) Hybrid-PQC Key Establishment:

Traditional TLS 1.3 key establishment uses ephemeral X25519, while the studied Hybrid-PQC mode combines X25519 with ML-KEM and supplies the concatenated secret to the TLS key schedule. The hybrid group changes handshake key-share sizes while retaining the standard TLS 1.3 handshake flow.

A. Comparison of TLS 1.3 Key-Establishment Modes

  • X25519 supplies the conventional shared secret that the TLS 1.3 key schedule uses to derive handshake and application traffic secrets and traffic keys.The endpoints derive the same secret from their ephemeral key shares; TLS incorporates it through HKDF-based extraction and expansion.Source: 1) Traditional (Non-PQC) Key… · p. 4

1) Traditional (Non-PQC) Key Establishment:

  • The Traditional baseline selects x25519, whose key share is 32 bytes, through TLS 1.3 supported_groups and key_share negotiation.The server returns the corresponding key share in ServerHello or can send a HelloRetryRequest if the client did not provide the selected group's share.Source: 1) Traditional (Non-PQC) Key… · p. 4
  • In traditional X25519 exchange, each endpoint computes the same shared secret from its private scalar and the peer’s key share.That shared secret is supplied to the TLS 1.3 key schedule.Source: 1) Traditional (Non-PQC) Key… · p. 4, Figure 1 · p. 4

2) Hybrid-PQC Key Establishment:

  • Hybrid key exchange represents a traditional key-exchange component and a post-quantum KEM component in one named group, designed to remain secure if either component remains secure.The concatenated component shared secret replaces the conventional (EC)DHE secret supplied to the TLS 1.3 key schedule.Source: 2) Hybrid-PQC Key Establishment · p. 5
  • X25519MLKEM768 is marked Recommended=Y; its client and server KeyShareEntries total 1216 and 1120 bytes, respectively.The client entry contains a 1184-byte ML-KEM-768 encapsulation key and a 32-byte X25519 share; the server entry contains a 1088-byte ciphertext and a 32-byte X25519 share.Source: 2) Hybrid-PQC Key Establishment · p. 5
  • In X25519MLKEM768, the client sends its ML-KEM public key and X25519 share; the server encapsulates to produce an ML-KEM ciphertext and secret, and returns that ciphertext with its X25519 share.Both endpoints derive the X25519 secret, concatenate the component secrets in the specified order, and supply the resulting 64-byte hybrid secret to the TLS 1.3 key schedule.Source: 2) Hybrid-PQC Key Establishment · p. 5, Figure 2 · p. 5
  • Pure-PQC key establishment removes the conventional (EC)DHE exchange and uses ML-KEM within the standard TLS 1.3 handshake flow.The mechanism and associated named groups are specified in draft-ietf-tls-mlkem-09.Source: 3) Pure-PQC Key Establishment · p. 5

3) Pure-PQC Key Establishment: · 4) Comparison of Key-Establishment Modes: · B. PQC-Induced Changes Across Four Feature Dimensions

Hybrid-PQC enlarges key-establishment payloads and changes observable traffic features, while Pure-PQC is included only in the protocol-level comparison, not the empirical evaluation.

3) Pure-PQC Key Establishment:

  • Pure-PQC MLKEM768 sends a client-generated encapsulation key in ClientHello; the server returns a ciphertext, and both derive a shared secret for the TLS 1.3 key schedule.The paper uses MLKEM768 for protocol-level comparison because it matches the KEM parameter set in X25519MLKEM768, but excludes Pure-PQC from empirical evaluation.Source: 3) Pure-PQC Key Establishment · p. 5

4) Comparison of Key-Establishment Modes:

  • Hybrid-PQC uses 1216-byte client and 1120-byte server KeyShareEntries, versus 32-byte entries for Traditional; Pure-PQC uses 1184-byte and 1088-byte entries.Pure-PQC entries are each 32 bytes smaller than Hybrid-PQC, but both PQC modes carry substantially larger key-establishment payloads than Traditional; these changes modify the observable side-channel surface.Source: 4) Comparison of Key-Establishment Modes · pp. 5–6, Table II · p. 6

B. PQC-Induced Changes Across Four Feature Dimensions

  • The traffic representation is a 4-tuple of packet lengths, directions, timestamps or inter-arrival times, and selected packet bytes.CUMUL, DF, and Tik-Tok primarily use combinations of length, direction, and timing; ET-BERT and YaTC consume byte-oriented representations, without plaintext application content.Source: B. PQC-Induced Changes Across Four… · p. 6
  • Expanded Hybrid-PQC key shares directly increase handshake packet lengths and byte volume, potentially shifting later packets and cumulative-byte curves when TLS records or TCP segments are crossed.These changes affect packet-length distributions and the CUMUL representation.Source: B. PQC-Induced Changes Across Four… · p. 6
  • Hybrid-PQC preserves ClientHello and ServerHello directions, but segmentation and packet filtering can change observed direction sequences, burst boundaries, and uplink–downlink patterns.The effect depends on whether preprocessing retains TCP segments and acknowledgments, and on the packet-filtering policy.Source: B. PQC-Induced Changes Across Four… · p. 6
  • Timing drift may result from additional transmission and cryptographic processing, but its magnitude depends on network conditions, implementation, hardware, and acceleration.More handshake bytes can require extra serialization and segments; added ML-KEM operations should not be assumed to exceed X25519's cost in every deployment.Source: B. PQC-Induced Changes Across Four… · p. 6
  • Hybrid-PQC changes key_share bytes and offsets, potentially shifting later-byte alignment so fixed or truncated windows capture different handshake and encrypted-record content.Pre-trained encoders may encounter familiar protocol fields at new offsets or omit content present in a Non-PQC window.Source: B. PQC-Induced Changes Across Four… · pp. 6–7
  • Hybrid-PQC directly changes packet lengths and byte representations, while its effects on directions and timing arise through segmentation, scheduling, and implementation-dependent processing.The resulting shift is in traffic representation, not in the semantics of encrypted application content.Source: B. PQC-Induced Changes Across Four… · p. 7

C. Hypotheses on Classifier Robustness under PQC-Induced Protocol Drift · IV. Building a PQC-Aware Encrypted Traffic Benchmark · A. Measuring TLS Key-Establishment Deployment

The paper hypothesizes that PQC-induced changes to packet lengths, direction, timing, and byte-level representations can undermine cross-domain classifier robustness. It measures TLS key-establishment deployment and uses the results to guide construction of a paired PQC-aware benchmark.

C. Hypotheses on Classifier Robustness under PQC-Induced Protocol Drift

  • Three hypotheses link protocol-level changes to cross-domain classifier robustness and provide the analytical basis for later research questions.They concern packet-length drift, directional and temporal drift, and robustness of pre-trained byte-level representations.Source: C. Hypotheses on Classifier Robustness… · p. 7
  • Hybrid-PQC expands handshake KEM payloads, changing early packet lengths, offsets, and cumulative profiles; classifiers relying on packet-length sequence L are hypothesized to degrade when trained on Non-PQC and tested on PQC traffic.The hypothesis also covers derived statistics such as cumulative curves and statistical moments.Source: C. Hypotheses on Classifier Robustness… · p. 7
  • Larger handshake messages and ML-KEM computation may alter packet direction and timing, so direction- or timing-based classifiers are hypothesized to degrade more on high-latency paths or resource-constrained endpoints.Additional TCP segments can shift packet and acknowledgment positions within the first N observations; computation and serialization overhead may change inter-arrival times and handshake completion time.Source: C. Hypotheses on Classifier Robustness… · p. 7
  • Pre-trained byte-level models ET-BERT and YaTC may preserve more cross-domain robustness than classifiers based on L, D, and T, but fixed windows and preprocessing may limit that advantage.Expanded handshakes or shifted TLS-record boundaries may change which bytes the models capture, and performance remains uncertain if their pre-training corpora omit Hybrid-PQC traffic.Source: C. Hypotheses on Classifier Robustness… · p. 7

IV. Building a PQC-Aware Encrypted Traffic Benchmark

  • The benchmark measures deployment across 2,060 websites, collects paired Non-PQC and Hybrid-PQC traffic for 195 common websites, and varies Hybrid-PQC proportions in test sets while holding labels and visit partitions fixed.These three stages connect observed deployment to paired traffic collection and deployment-ratio evaluation.Source: §IV · p. 7

A. Measuring TLS Key-Establishment Deployment

  • Deployment measurement records negotiated TLS versions and ServerHello key_share distributions for 2,060 Tranco-ranked websites, including both base-domain and www-prefixed SNIs.The method uses Algorithm 1 to extract the selected groups.Source: A. Measuring TLS Key-Establishment… · p. 7
  • 50.3% of 2,060 websites negotiated Hybrid-PQC TLS 1.3 key establishment, versus 38.6% Traditional TLS 1.3, 9.8% TLS 1.2, and 1.3% no reply.Hybrid-PQC was the largest measured category and supplied a sufficiently large candidate pool for paired traffic collection.Source: Figure 4 · p. 7, A. Measuring TLS Key-Establishment… · p. 8

B. Constructing Paired Non-PQC and Hybrid-PQC Traffic Datasets

The benchmark pairs Traditional (Non-PQC) and Hybrid-PQC traffic for websites supporting X25519MLKEM768, validating dataset membership by the negotiated TLS group. It uses balanced repeated visits and a shared 195-website label set.

B. Constructing Paired Non-PQC and Hybrid-PQC Traffic Datasets

  • The study selected the Top 200 websites supporting X25519MLKEM768 and retained 195 as the shared label set after four sites failed to yield valid captures under both configurations.The PQC Website Dataset contains Hybrid-PQC X25519MLKEM768 traffic, not Pure-PQC traffic.Source: B. Constructing Paired Non-PQC and… · p. 8
  • Firefox collected 120 complete page loads per website under each configuration, toggling security.tls.enable_kyber to capture Hybrid-PQC and Traditional (Non-PQC) traffic.Each packet trace represents one independent, isolated website visit.Source: B. Constructing Paired Non-PQC and… · p. 8
  • Handshake verification assigned samples by the ServerHello group: retained Hybrid-PQC captures negotiated X25519MLKEM768 (code point 4588), while Non-PQC captures negotiated X25519 (code point 29).Thus dataset membership depends on the negotiated group, not only the intended browser configuration.Source: B. Constructing Paired Non-PQC and… · p. 8
  • The benchmark extracts target-SNI TCP streams but splits data by complete website visit, keeping all streams from one visit in the same partition.This prevents related traffic from crossing training, validation, and test partitions.Source: B. Constructing Paired Non-PQC and… · p. 8

C. Constructing Deployment-Ratio Test Sets

The section constructs six test settings to model gradual Hybrid-PQC deployment, varying the proportion of Hybrid-PQC traffic while holding the label space and visit-level partitioning fixed.

C. Constructing Deployment-Ratio Test Sets

  • Six deployment-ratio settings combine Non-PQC and Hybrid-PQC endpoint tests with four Mixed test sets, with α denoting the Hybrid-PQC sample proportion.The endpoint settings are 0% and 100% Hybrid-PQC; the four intermediate values define the Mixed sets.Source: C. Constructing Deployment-Ratio Test… · p. 8
  • Applying the same α to each website keeps cryptographic composition uniform across all 195 labels, while fixed labels and visit-level partitions isolate test-domain composition effects.This prevents class-dependent deployment skew from confounding classifier performance.Source: C. Constructing Deployment-Ratio Test… · p. 8
  • The test sets support the deployment-ratio and feature-control experiments in RQ3 and RQ4.Source: C. Constructing Deployment-Ratio Test… · p. 9

V. Evaluation · A. Threat Model and Evaluation Scope · B. Experimental Setup

The evaluation examines classifier reliability under PQC-induced protocol drift across matched-domain, cross-domain, deployment-ratio, and feature-controlled settings. It uses a controlled closed-world HTTPS website-fingerprinting scope to isolate the effects of the Non-PQC to Hybrid-PQC transition.

V. Evaluation

  • The evaluation tests classifier reliability under PQC-induced protocol drift across matched-domain, cross-domain, deployment-ratio, and feature-controlled settings.This evaluation builds on the PQC-aware encrypted traffic benchmark developed in Section IV.Source: §V · p. 9

A. Threat Model and Evaluation Scope

  • A passive adversary near the client observes encrypted packet traces from complete, isolated HTTPS visits and seeks to infer domains among 195 Tranco websites in a closed-world setting.The adversary cannot decrypt, modify, or inject traffic.Source: A. Threat Model and Evaluation Scope · p. 9
  • Holding the label space and browsing procedure fixed isolates the effect of the transition from Non-PQC to Hybrid-PQC key establishment on classifier reliability.Source: A. Threat Model and Evaluation Scope · p. 9
  • The five classifiers retain their native feature representations and preprocessing workflows, using only information available in passively observed packets.The evaluation excludes out-of-band DNS and decrypted TLS-handshake or application-layer information, including certificates, HTTP Host headers, and URLs.Source: A. Threat Model and Evaluation Scope · p. 9
  • The scope excludes Tor and VPN tunneling, active attacks such as probing or traffic injection, and open-world evaluation, assessing controlled protocol-drift reliability rather than unconstrained attack effectiveness.Source: A. Threat Model and Evaluation Scope · p. 9

B. Experimental Setup

  • The setup selects five representative encrypted-traffic classifiers: one aggregate statistical method, two packet-sequence models, and two pre-trained byte-level models.Table III organizes the classifiers into three groups consistent with the taxonomy in Section II.Source: 1) Evaluated Classifiers · p. 9

1) Evaluated Classifiers: … Research Questions

The evaluation compares five classifiers across Non-PQC and Hybrid-PQC traffic while preserving their native representations and using shared visit-level data partitions. Four research questions examine matched-domain learnability, cross-domain transfer, deployment-ratio sensitivity, and side-channel feature contributions.

1) Evaluated Classifiers:

  • Five classifiers compare packet-length, direction, timing, and byte-level representations across Non-PQC and Hybrid-PQC traffic.CUMUL, DF, and Tik-Tok use statistical or packet-sequence inputs; ET-BERT and YaTC use anonymized byte-oriented inputs. The comparison does not presume pre-training provides cross-domain robustness.Source: 1) Evaluated Classifiers · p. 9
  • CUMUL, DF, Tik-Tok, ET-BERT, and YaTC are sensitive to different traffic changes, including volume, packet positions, timing, and byte offsets.CUMUL captures volume and cumulative transfer profiles; DF learns local patterns in direction-coded sequences; Tik-Tok models inter-arrival time with packet sequences. ET-BERT and YaTC use byte-oriented inputs that may be sensitive to shifted offsets and fixed observation windows.Source: 1) Evaluated Classifiers · p. 9
  • All five classifiers use the same closed-world task over 195 websites, with 120 complete visits per website and cryptographic domain.Complete website visits, which may contain multiple TCP streams, are partitioned identically per website at an 80:10:10 train-validation-test ratio.Source: 2) Evaluation Controls · p. 9

2) Evaluation Controls:

  • The evaluation preserves each model’s native preprocessing and compares classifiers primarily with their own matched-domain baselines.RQ4 varies only DF’s input representation while holding its architecture and training procedure fixed; accuracy, precision, recall, and F1 are reported for every setting.Source: 2) Evaluation Controls · pp. 9–10

Research Questions

  • RQ1 asks how Hybrid-PQC key establishment affects fingerprinting performance when training and testing use the same cryptographic domain.Source: Research Questions · p. 10
  • RQ2 asks how well classifiers transfer bidirectionally between Non-PQC and Hybrid-PQC traffic domains.Source: Research Questions · p. 10
  • RQ3 asks how classifier performance changes as Hybrid-PQC traffic increases across deployment-ratio settings.Source: Research Questions · p. 10
  • RQ4 asks how packet length, direction, and timing affect fingerprinting performance individually and jointly under PQC-induced protocol drift.Source: Research Questions · p. 10

C. RQ1: Matched-Domain Learnability · D. RQ2: Bidirectional Cross-Domain Transfer

In matched-domain tests, all five classifiers retain comparable website-fingerprinting performance on Non-PQC and Hybrid-PQC traffic; across domains, performance falls and transfer is direction-dependent. The results show that Hybrid-PQC traffic remains learnable, but matched-domain accuracy does not ensure cross-domain reliability.

C. RQ1: Matched-Domain Learnability

  • RQ1 trains, validates, and tests five classifiers separately on the Non-PQC and PQC datasets; the latter contains Hybrid-PQC traffic negotiated with X25519MLKEM768.The matched-domain design tests website fingerprinting within each cryptographic domain without the distribution mismatch examined in RQ2.Source: C. RQ1: Matched-Domain Learnability · p. 10
  • Within their native preprocessing pipelines, YaTC remains near perfect, while ET-BERT records 0.9316 and 0.9332 accuracy and 0.9138 and 0.9157 F1 in N-N and P-P, respectively.YaTC’s accuracy and F1 each decrease from 1.0000 to 0.9991; the N-N and P-P results remain close across all four metrics and classifiers.Source: C. RQ1: Matched-Domain Learnability · p. 10, Table IV · p. 10
  • All five classifiers achieve comparable N-N and P-P performance, so Hybrid-PQC key establishment produces no consistent loss of matched-domain learnability.The evaluation retains 195 website labels, visit-level partitions, and model configurations across the two domains.Source: C. RQ1: Matched-Domain Learnability · p. 10, Table IV · p. 10

D. RQ2: Bidirectional Cross-Domain Transfer

  • RQ2 tests transfer without retraining in both directions, using 80 training, 10 validation, and 10 held-out visits per website with the RQ1 labels, partitions, and configurations.N-P trains on Non-PQC and tests on Hybrid-PQC traffic; P-N reverses the domains.Source: D. RQ2: Bidirectional Cross-Domain… · p. 10
  • All five classifiers degrade outside their training domain; only YaTC approaches its matched-domain baseline in P-N, while degrading substantially in N-P.The results establish asymmetric cross-domain transfer but do not identify the mechanism underlying YaTC’s P-N behavior.Source: Table V · p. 11, D. RQ2: Bidirectional Cross-Domain… · p. 11
  • In N-P, ET-BERT retains the highest accuracy at 0.6255, while CUMUL, DF, Tik-Tok, and YaTC fall to 0.1919, 0.3728, 0.3873, and 0.3582 accuracy, respectively.These values are below their corresponding N-N accuracies; YaTC’s N-P F1 score is 0.2835 and ET-BERT’s is 0.5476.Source: D. RQ2: Bidirectional Cross-Domain… · p. 11, Table V · p. 11
  • In P-N, YaTC reaches 0.9709 accuracy and 0.9634 F1, while CUMUL, DF, Tik-Tok, and ET-BERT record accuracies of 0.2778, 0.4923, 0.4256, and 0.6043, respectively.Four classifiers perform better in P-N than N-P; ET-BERT is the exception, and only YaTC approaches matched-domain performance in this direction.Source: D. RQ2: Bidirectional Cross-Domain… · p. 11, Table V · p. 11

E. RQ3: Deployment-Ratio Sensitivity · F. RQ4: Side-Channel Feature Contributions

As the Hybrid-PQC share rises, classifiers trained on Non-PQC traffic lose accuracy, and their deployment-ratio trajectories differ. Packet length is the strongest individual side channel, but no tested representation or feature combination prevents degradation under PQC-induced drift.

E. RQ3: Deployment-Ratio Sensitivity

  • CUMUL accuracy falls from 0.7731 to 0.1919, while DF falls from 0.5855 to 0.3728 and Tik-Tok from 0.5679 to 0.3873.All three decline monotonically as the test distribution moves away from the Non-PQC training domain.Source: E. RQ3: Deployment-Ratio Sensitivity · p. 11
  • Across all five classifiers, increasing the Hybrid-PQC share generally reduces accuracy, and none preserves its Non-PQC baseline across the full deployment range.The tests retain the same 195 website labels and partitions while varying Hybrid-PQC traffic from 0% to 100%.Source: Figure 5 · p. 11, E. RQ3: Deployment-Ratio Sensitivity · p. 11
  • YaTC follows a non-monotonic trajectory, whereas ET-BERT declines monotonically and leads at N-M2, N-M4, N-M6, and N-P.YaTC rises from 0.6166 at N-M4 to 0.7252 at N-M8 before falling to 0.3582 at N-P; ET-BERT falls from 0.9316 under N-N to 0.6255 under N-P, and YaTC exceeds it at N-M8.Source: E. RQ3: Deployment-Ratio Sensitivity · p. 11

F. RQ4: Side-Channel Feature Contributions

  • All five DF input representations decline from N-N to N-P; changing feature composition alters accuracy but does not prevent degradation under drift.The controlled comparison varies direction, length, and timing inputs while holding the DF architecture, training procedure, and data partitions constant.Source: Figure 6 · p. 12, F. RQ4: Side-Channel Feature… · p. 12
  • Packet length is the strongest individual feature at every deployment ratio, but its accuracy advantage over direction narrows from 0.2089 under N-N to 0.0582 under N-P.Under N-P, length achieves 0.4310 accuracy, compared with 0.3728 for direction and 0.3766 for timing.Source: F. RQ4: Side-Channel Feature… · p. 12
  • At N-N, DL and DLT achieve 0.8026 and 0.7983 accuracy, only slightly above length alone at 0.7944; from N-M4 onward, length outperforms both combinations.At N-M2, DL, DLT, and L achieve 0.7272, 0.7241, and 0.7205, respectively.Source: F. RQ4: Side-Channel Feature… · p. 12
  • DLT never surpasses DL, and feature fusion alone does not provide cross-domain robustness.Adding timing to direction and length provides no benefit in any evaluated setting; neither direction nor timing compensates for drift-related loss.Source: F. RQ4: Side-Channel Feature… · p. 12

VI. Discussion … VII. Conclusion

PQC-induced protocol drift changes how learnable website information appears in traffic rather than eliminating it, making cross-domain robustness a central reliability and evaluation concern.

A. Beyond Hybrid Key Establishment: Post-Quantum Authentication

  • This evaluation isolates Hybrid-PQC key establishment with X25519MLKEM768; broader PQC authentication could add kilobyte-scale signatures and certificate chains that reshape packetization and handshake timing.Pure-PQC key establishment appears only as a protocol-level comparison in Section III.Source: A. Beyond Hybrid Key Establishment:… · p. 12
  • Because TLS-record and TCP-segmentation thresholds can reposition packets, post-quantum authentication may reinforce or mask key-establishment drift; varying KEM and authentication independently could disentangle them.The proposed factorial evaluation would help reveal whether classifiers learn application-level invariants or migration-specific artifacts.Source: A. Beyond Hybrid Key Establishment:… · p. 12

B. Practical Trade-offs of LLM-Based Traffic Classifiers

  • ET-BERT and YaTC show that model scale cannot ensure cross-domain robustness: richer byte-level context may also intensify protocol-specific shortcuts despite high matched-domain accuracy.The relevant question is whether representations remain stable across cryptographic environments, not whether they improve matched-domain accuracy.Source: B. Practical Trade-offs of LLM-Based… · p. 12
  • Fair classifier comparisons should treat tokenization, pre-training, truncation, and adaptation data as model components, and report bidirectional transfer, recovery costs, throughput, latency, and memory.Larger models are practically meaningful only when they improve the robustness-cost trade-off rather than merely recovering matched-domain accuracy.Source: B. Practical Trade-offs of LLM-Based… · p. 13

C. PQC-Induced Protocol Drift as Incidental Obfuscation

  • Hybrid-PQC remains distinguishable after in-domain training, so apparent obfuscation reflects model staleness; packet length dominates, while direction and timing add limited benefit in evaluated configurations.Deterministic cryptographic expansion is unlikely to provide durable obfuscation once its patterns enter an attacker’s training data.Source: C. PQC-Induced Protocol Drift as… · p. 13, §VII · p. 13
  • PQC-induced drift may impose adaptation costs when perturbations are hard to relearn, but this closed-world X25519MLKEM768 study cannot establish that effect beyond evaluated stacks or attacks.Drift-inspired defenses should be tested against adaptive traffic recollection and model retraining, not only fixed legacy classifiers.Source: C. PQC-Induced Protocol Drift as… · p. 13

VII. Conclusion

  • Hybrid-PQC traffic retains learnable website identity, while Non-PQC-trained classifiers degrade under Hybrid-PQC testing and generally worsen as Hybrid-PQC share rises in mixed tests.Individual models also show asymmetric transfer, so strong in-domain performance does not predict stability across cryptographic environments.Source: §VII · p. 13
  • Classifier evaluations should expose protocol configurations and contemporary deployments explicitly, pairing matched-domain accuracy with cross-domain tests across evolving environments.The observed behavior may differ under protocol stacks, cryptographic configurations, or attack settings not examined in this work.Source: §VII · p. 13
Loading 2608.22683v1…