PaperlayerView exact revision on arXiv

Source-linked AI summary

Structural Decomposability of Encrypted Traffic Side-Channel Leakage

Guangjie Liu, Guang Cheng, Weiwei Liu

arXiv:2609.19036v1cs.CRcs.IT

TL;DR

Existing side-channel theories treat leakage holistically, without characterizing its internal structure. The paper decomposes leakage by traffic dimension and formalizes defenses as mechanism replacements; its empirical analysis finds the sufficient condition for a direction-only defense to sever timing leakage is unmet at the proxy level.

  • Problem

    Existing side-channel work leaves unclear how separate traffic dimensions contribute to total leakage and how their dependencies relate to single-dimension defense failures.

    Source: A. Attack Side: Multi-Dimensional… · p. 3, B. Defense Side: Limitations of… · p. 3

  • Method

    The paper combines mutual-information chain decomposition with SCM mechanism-replacement semantics and structural measures including coupling information and the Markov residual.

    Source: §VIII · p. 13

  • Results

    0.021 bits is the Markov residual under FRONT at proxy level, with a bootstrap 95% CI of [0.016, 0.027] excluding zero, so the sufficient condition is not met.

    Source: E. Empirical Summary · p. 12

  • Takeaways & Limitations

    The framework provides a computable, structured method for accounting for leakage and examining when a single-dimension defense is sufficient.

    Source: §VIII · p. 13

    The empirical account uses structural quantities rather than attack-accuracy curves as its primary output.

    Source: B. Defense Side: Limitations of… · p. 3

Abstract

from arXiv · show

Existing side-channel theories treat leakage as a holistic quantity $I(X;Y)$, without characterizing its internal structure. This paper studies the \emph{structural decomposability} of encrypted-traffic side-channel leakage. Via the structural causal model $X\!\to\!Y_{\mathrm{size}}\!\to\!Y_{\mathrm{dir}}\!\to\!Y_{\mathrm{time}}$ and the mutual-information chain rule, total leakage is decomposed into three sequential increments for packet size, direction, and timing. Defenses are formalized as mechanism replacement by a strategy variable~$D$; coupling information $C_{\mathrm{size,dir}}=I(Y_{\mathrm{size}};Y_{\mathrm{dir}}\!\mid\!X)$ measures inter-dimensional dependence, and the Markov residual gives a testable condition for a single-dimension defense to sever downstream leakage. Causal efficacy~$η_d$ quantifies per-unit-cost suppression, and a Fisher-geometric approximation $I(X;Y)\approx\frac{1}{2\ln 2}\mathrm{Tr}(GΣ_θ)$ holds under small perturbations. On the Wang dataset (95 websites), $Y_{\mathrm{dir}}$ dominates undefended leakage (0.637\,bits), while Tor's fixed 512-byte cells make $Y_{\mathrm{size}}$ degenerate; FRONT suppresses the direction term by 63\%, yet its Markov residual of 0.021\,bits (95\% CI $[0.016,0.027]$) shows it cannot sever timing leakage; $η_{\mathrm{dir}}=0.97$ vs. $η_{\mathrm{time}}\approx 0$ confirms FRONT's design intent. This yields a computable, structured leakage-accounting method for multi-dimensional joint defense design.

I. INTRODUCTION

The paper frames encrypted-traffic leakage as a structured set of size, direction, and timing contributions rather than a holistic quantity. It connects this accounting to causal defense analysis and to the observed use of multiple traffic dimensions in attacks.

I. INTRODUCTION

  • Existing theories treat leakage as a holistic quantity, leaving the contributions and statistical dependencies of size, direction, and timing uncharacterized.The paper identifies this structural gap as the motivation for decomposing total leakage.Source: §I · p. 1
  • The mutual-information chain rule decomposes total leakage exactly into size leakage, direction's increment given size, and timing's increment given size and direction.The three terms sum without omissions or double-counting.Source: §I · p. 1
  • The SCM maps defense choices to replacement of size, direction, or timing mechanisms, while information geometry approximates local mutual-information variation under small perturbations.The framework does not pursue causal effect identification via do-calculus.Source: §I · pp. 1–2
  • 0.637 bits of undefended leakage comes from direction; FRONT suppresses that term by 63%, but a 0.021-bit Markov residual leaves the sufficient condition for severing timing leakage unmet.The residual's bootstrap 95% CI is [0.016, 0.027]; causal efficacy is η_dir = 0.97 versus η_time ≈ 0.Source: §I · p. 2

A. Attack Side: Multi-Dimensional Feature Fusion and Long-Range Dependence

  • Attack studies exploit multiple dimensions and long-range observations, but lack a formal account of how their separate contributions combine into total leakage.This motivates chain decomposition and coupling information.Source: A. Attack Side: Multi-Dimensional… · p. 3

B. Defense Side: Limitations of Single-Dimension Defenses

Single-dimension defenses can leave conditional information in other traffic dimensions available to an adversary. The paper develops structural tools to account for leakage, formalize defense mechanisms, and distinguish traffic dimensions without assuming their statistical independence.

B. Defense Side: Limitations of Single-Dimension Defenses

  • Single-dimension defenses target one metadata feature, while adversaries may exploit conditional information in remaining dimensions, so overall leakage can persist.Prior evaluations found widespread failures, including Tamaraw against timing features and WTF-PAD against size and direction patterns.Source: B. Defense Side: Limitations of… · p. 3

C. Theoretical Tools: Causal Inference and Information Geometry

  • The paper formalizes leakage as chain-rule components and uses coupling information and a Markov residual to test whether a direction defense satisfies a sufficient condition for severing timing leakage.A residual significantly greater than zero indicates that the sufficient condition is not met.Source: C. Theoretical Tools: Causal Inference… · pp. 3–4
  • The framework aligns SCM mechanism-replacement semantics with information-geometric approximations of mutual, conditional mutual, and coupling information.Causal efficacy η_d reports leakage suppression per unit defense cost to guide trade-offs.Source: C. Theoretical Tools: Causal Inference… · pp. 3–4
  • The theory is limited to stationary memoryless defenses and does not claim global conclusions for memory-bearing or non-causal defense classes.The paper presents it as complementary to, not a replacement for, attack experiments.Source: C. Theoretical Tools: Causal Inference… · p. 4

III. CAUSAL DECOUPLING MODEL

  • The SCM uses mechanism-replacement semantics to specify defense targets; its decoupling describes modular structural equations, not statistical or conditional independence.The defense strategy variable changes mechanism parameters while the structural-equation form remains unchanged.Source: §III · p. 4

A. Multi-Dimensional Decomposition of Side-Channel Features

  • Size, direction, and timing are defined as non-overlapping feature dimensions; direction is usually most discriminative, while fixed-size Tor cells degenerate size features.Timing captures residual leakage from network conditions and computation latency.Source: A. Multi-Dimensional Decomposition of… · pp. 4–5

B. Structural Causal Model

The side-channel SCM represents causal dependencies among application semantics and observed traffic features. It uses a defense strategy variable to model mechanism replacement without imposing strong conditional-independence constraints.

B. Structural Causal Model

  • The SCM is a DAG over X, size, direction, and timing, with edges representing causal dependencies among those variables.Each edge corresponds to a structural equation.Source: B. Structural Causal Model · p. 5
  • The defense strategy variable D represents a chosen defense mechanism by replacing mechanism parameters, while leaving the structural-equation form unchanged.Different values of D correspond to mechanisms such as fixed-length padding, dummy packet injection, or random delay.Source: B. Structural Causal Model · p. 5
  • The graph deliberately avoids strong conditional-independence constraints because application semantics may affect observed dimensions through direct and indirect paths.Its role is to specify causal directionality and mechanism-replacement targets.Source: B. Structural Causal Model · p. 5

C. Defense Strategy Variable and Mechanism Replacement

The paper models defenses as replacements of selected mechanism parameters, while accounting for downstream effects in the causal chain. It also frames small defense-parameter changes as local changes in distributional separability.

C. Defense Strategy Variable and Mechanism Replacement

  • Defense strategy D constrains which mechanism parameters change: padding targets size, direction obfuscation targets direction, and delay targets timing.Dummy-packet injection can target direction alone or span multiple dimensions.Source: C. Defense Strategy Variable and… · p. 5
  • Mechanism replacement tracks which generation mechanisms change, rather than assuming only one dimension’s output changes as downstream effects propagate.The causal chain means an input change can propagate to downstream outputs.Source: C. Defense Strategy Variable and… · p. 5
  • The defense model allows packet-level metadata components to be correlated and defense-dependent, but excludes explicit history dependence such as buffer-queue state.Memory-bearing or non-causal defenses are left for future work.Source: C. Defense Strategy Variable and… · pp. 5–6

IV. INFORMATION GEOMETRY FRAMEWORK

  • For small defense-parameter changes, the Fisher information matrix locally characterizes how much distributional separability can change.Its eigenvalues in the parameter direction indicate the separability change produced by a mechanism replacement of the same magnitude.Source: §IV · p. 6

A. Statistical Manifold and Fisher Information Matrix

The section uses Fisher information to describe local distinguishability changes in traffic distributions and derives a local approximation to mutual information. The approximation depends on regularity and shared parametric-family conditions, while empirical mutual information is estimated directly.

A. Statistical Manifold and Fisher Information Matrix

  • Traffic parameters may describe packet-length distributions, inter-arrival rates, or defense settings such as padding rate and timing perturbation scale.These parameters describe points in the statistical manifold.Source: A. Statistical Manifold and Fisher… · p. 6
  • The Fisher information matrix defines a local metric: directions with larger v^T G(θ)v produce greater distributional change under small parameter shifts.Small-shift KL divergence is approximately proportional to the quadratic form in the shift direction.Source: A. Statistical Manifold and Fisher… · p. 6

B. Local Regularity and Geometric Approximation of Mutual Information

  • The KL divergence has a second-order Fisher-information approximation for small perturbations under local regularity conditions.The conditions include a three-times differentiable log-likelihood with bounded third derivatives and continuous Fisher information nearby.Source: B. Local Regularity and Geometric… · p. 6
  • The mutual-information approximation combines local Fisher sensitivity with the covariance of application parameters, under a shared regular family and nearby Fisher matrices.The trace form is used for interpretive comparison; empirical mutual-information quantities are estimated directly.Source: B. Local Regularity and Geometric… · pp. 6–7
  • For regularly parametrized marginal and conditional distributions, joint Fisher information decomposes into marginal information plus expected conditional information.The result extends iteratively to three variables under the stated factorization.Source: B. Local Regularity and Geometric… · p. 7

V. LEAKAGE DECOMPOSITION AND CAUSAL EFFICACY

The section combines the causal model with information geometry to frame leakage decomposition and causal efficacy. Its feature variables are extracted from raw metadata and need not be independent.

V. LEAKAGE DECOMPOSITION AND CAUSAL EFFICACY

  • The section combines the causal model and information geometry to establish a leakage-decomposition framework and discuss causal efficacy.Source: §V · p. 7
  • Size, direction, and timing are feature-map components of raw metadata, and the dimensions need not be mutually independent.Each represents a statistical description of a class of underlying metadata.Source: §V · p. 7
  • Feature extraction cannot increase information about application semantics, so leakage measured on the features is bounded by that in raw metadata.The chain decomposition itself depends only on the joint-distribution identity of the variables.Source: §V · p. 7

A. Chain Decomposition of Mutual Information

The section decomposes total leakage into ordered conditional increments and treats the ordering as an interpretable adversary upgrade path. It also uses coupling information and a testable Markov condition to assess whether a single-dimension defense can suppress downstream leakage.

A. Chain Decomposition of Mutual Information

  • The chain rule partitions total leakage into size, direction-given-size, and timing-given-size-and-direction increments, with the terms summing exactly to joint leakage.The identity holds for any joint distribution.Source: A. Chain Decomposition of Mutual… · p. 7
  • The size-to-direction-to-timing order represents successive adversary upgrades, and the defender’s task is to choose a truncation point with low cost.Any permutation gives a valid chain identity, but this ordering follows the paper’s causal chain for physical interpretability.Source: A. Chain Decomposition of Mutual… · p. 7

B. Coupling Information and Markov Residual

  • Coupling information measures dependence between size and direction given application semantics; positive coupling indicates conditional statistical dependence.The paper similarly defines timing’s dependence on size and direction given semantics.Source: B. Coupling Information and Markov… · p. 8
  • Coupling information signals possible need for joint defense, but is not sufficient to prove every single-dimension defense must fail.When a size defense leaves direction interactions unchanged, the direction residual generally cannot be driven to zero.Source: B. Coupling Information and Markov… · p. 8
  • A single-dimension size defense has a testable sufficient condition for eliminating direction residual leakage, assessed with plug-in mutual-information estimates and bootstrap intervals.Source: B. Coupling Information and Markov… · p. 8

C. Gaussian Illustrative Example

The Gaussian example assigns side-channel meanings to the model’s dimensions and illustrates how defenses can affect leakage and coupling. The geometric characterization aligns chain leakage with Fisher-information components and describes defense efficacy in that framework.

C. Gaussian Illustrative Example

  • Under Tor’s fixed 512-byte cells, I(X; Ysize) ≈ 0, so the size dimension degenerates.The example links this setting to negligible size variance and equal class means.Source: C. Gaussian Illustrative Example · p. 8
  • The conditional direction component models size–direction coupling and application-specific up/downstream asymmetry, with τ² representing interaction-pattern randomness.The example gives Gdir|size = 1/τ² and an approximate conditional leakage expression.Source: C. Gaussian Illustrative Example · p. 8
  • As τ increases, conditional noise reduces Csize,dir while leaving I(X; Ysize) unchanged; collapsing inter-class spread instead reduces size leakage while leaving coupling unchanged.The example presents these as two distinct defense limit mechanisms.Source: C. Gaussian Illustrative Example · p. 8

D. Geometric Characterization of Causal Efficacy

  • Dummy-packet injection can reduce Tr(GΣθ) by lowering Fisher sensitivity and compressing semantic parameter spread.The passage describes these as two geometric effects of dummy packet injection.Source: D. Geometric Characterization of… · p. 8
  • Under the local quadratic approximation, the mutual-information chain decomposition aligns term by term with the Fisher-information chain decomposition.The size, conditional direction, and conditional timing leakage terms correspond to their Fisher chain components multiplied by the global parameter covariance matrix.Source: D. Geometric Characterization of… · p. 9

VI. EMPIRICAL VALIDATION

The empirical validation tests the component ordering and defense alignment, checks Gaussian formulas against Monte Carlo estimates, and evaluates FRONT against a Markov sufficient condition. Its empirical chain order differs from the theoretical generation order because size degenerates in the Tor setting and direction is represented by two proxies.

VI. EMPIRICAL VALIDATION

  • The validation frames the FRONT test as checking whether the Markov sufficient condition holds and whether causal efficacy is quantifiable for injection-type defenses.The stated tests also include comparing suppression effects with defense design intent.Source: §VI · p. 9
  • The empirical tests target stable component magnitudes, alignment between defense suppression and design intent, Gaussian-formula agreement with Monte Carlo estimates, and FRONT’s Markov condition and causal efficacy.The stated component ordering is ˆYdir,1 term > ˆYdir,2 residual term > Markov residual.Source: §VI · p. 9
  • The empirical ordering is ˆYdir,1 ≺ ˆYtime ≺ ˆYdir,2, rather than the theoretical Ysize ≺ Ydir ≺ Ytime generation order.The empirical section omits degenerate size and splits direction into coarse-grained packet-count ratio and fine-grained reversal-rate proxies; this is an accounting order, not a claim about causal generation.Source: §VI · p. 9

A. Experimental Setup and Estimation Methods

The setup uses Tor website-fingerprinting datasets and low-dimensional proxies because the Wang data lack byte sizes and fixed-size cells degenerate the physical size dimension. Estimation uses discretized proxy variables, chain-closed plug-in mutual information, and resampling for uncertainty.

A. Experimental Setup and Estimation Methods

  • The datasets use 95-website Tor traffic, while the Wang data contain directions and timestamps but no byte sizes.The fixed 512-byte Tor cells make physical Ysize degenerate, so the study uses scalar proxies to demonstrate computability of the decomposition and coupling criteria.Source: A. Experimental Setup and Estimation… · pp. 9–10
  • The three proxies are incoming-packet fraction, mean inter-packet interval, and direction reversal rate; they are weak approximations, not equivalents, of the physical components.The two direction proxies represent overall asymmetry and local switching patterns and are treated jointly as a proxy for Ydir.Source: A. Experimental Setup and Estimation… · p. 10
  • The discrete plug-in estimator preserves chain identity at the estimation level and supports controllable bootstrap confidence intervals.Core quantities use 200 flow-level resamples and percentile 95% confidence intervals; increasing to 500 rounds changes CI width by less than 3%.Source: A. Experimental Setup and Estimation… · p. 10
  • Five quantile-equal-frequency bins per dimension form 125 joint symbols, with boundaries estimated from CW and held fixed across mechanisms.Boundaries depend on marginal quantiles rather than class labels; negative conditional-MI differences are zero-truncated, occurring in fewer than 1% of cases without affecting conclusions.Source: A. Experimental Setup and Estimation… · p. 10
  • Across 5 to 20 bins, the CW component ordering remains invariant, although numerical estimates rise with finer bins.A k=5-neighbor KSG estimate of I(X; ˆYdir,1) gives consistent ranking trends with the plug-in conclusions.Source: A. Experimental Setup and Estimation… · p. 10

B. Experiment I: Gaussian Illustrative Example Validation

The Gaussian example checks the approximation and illustrates separate limit mechanisms for size leakage and coupling. In real-traffic analyses, direction components dominate, FRONT mainly suppresses the coarse direction component, and its timing and other direction efficacy is near zero or negative.

Gaussian Illustrative Example Validation

  • The size-leakage approximation has +22% positive bias, while the Csize,dir formula error is −5%.The passage says the small-separation size approximation is a lower bound on true Gaussian-mixture MI at finite separation.Source: B. Experiment I: Gaussian Illustrative… · p. 10

Real Traffic Chain Decomposition and Causal Efficacy

Gaussian Illustrative Example Validation

  • As τ rises from 80 to 800, Csize,dir falls from 0.82 to 0.04 bits while I(X; Ysize) stays at approximately 0.23 bits.Separately, as inter-class spread collapses, size leakage falls toward zero while coupling remains at 0.83–0.84 bits.Source: B. Experiment I: Gaussian Illustrative… · pp. 10–11

Real Traffic Chain Decomposition and Causal Efficacy

  • Across three datasets, I(X; ˆYdir,1) > I(X; ˆYdir,2 | ·) > I(X; ˆYtime | ˆYdir,1), and this ordering holds from 5 to 20 bins.For 20-bin estimates, I(X; ˆYdir,1) is 1.139, 0.376, and 0.233 bits across the three datasets, compared with 0.637, 0.236, and 0.095 at 5 bins.Source: C. Experiments II–III: Real Traffic… · p. 11
  • 0.637 → 0.095 (−85.1%) for TrafficSliver’s direction term, while its Markov residual rises from 0.018 → 0.042.The reported bootstrap 95% CIs for the residual do not overlap: TrafficSliver [0.036, 0.049] and CW [0.015, 0.022].Source: C. Experiments II–III: Real Traffic… · p. 11
  • ηd is approximately 1.0 bits per relative packet-count overhead for ˆYdir,1 under FRONT, while timing and the second direction dimension have ηd near zero or negative.The passage states this is consistent with FRONT focusing dummy-packet injection on direction interaction patterns without intervening in timing scheduling.Source: C. Experiments II–III: Real Traffic… · p. 11, Table III · p. 11

D. Experiment IV: Coupling Information and Markov Residual

The proxy-level tests find a positive timing residual after FRONT, so the paper’s sufficient condition for severing downstream leakage is not satisfied. Across the empirical summary, direction dominates the chain components, while coupling reductions alone do not establish that the residual path is closed.

D. Experiment IV: Coupling Information and Markov Residual

  • The single-proxy and joint-direction-proxy tests assess the Markov chain at the proxy level, not for the true high-dimensional direction and timing variables.Conditioning on more direction-proxy information tests whether the residual reflects insufficient proxy coverage; failure of the sufficient condition is not a necessary-condition result.Source: D. Experiment IV: Coupling Information… · pp. 11–12
  • After FRONT, the Markov residual is 0.021 bits (95% CI [0.016, 0.027]) and the augmented residual is 0.017 bits (95% CI [0.013, 0.022]); both exclude zero.Both tests show the Markov condition does not hold at the proxy-variable level, and the augmented test indicates the residual is not caused solely by insufficient direction-proxy coverage.Source: D. Experiment IV: Coupling Information… · p. 12
  • TrafficSliver’s augmented residual is not reported because its split-path direction proxy is not comparable in meaning to the CW and FRONT proxies.The sub-path direction statistics reflect path-assignment logic rather than application semantics, so the joint conditional residual lacks a consistent interpretive basis for cross-scenario comparison.Source: D. Experiment IV: Coupling Information… · p. 12
  • C_dir,time drops from 0.042 to 0.014 bits after FRONT, but reduced coupling does not guarantee that the sufficient condition is satisfied.The confidence intervals do not overlap, supporting a reduction in direction–timing association.Source: D. Experiment IV: Coupling Information… · p. 12

E. Empirical Summary

  • Across three datasets, the direction chain component dominates, its spectral order persists from 5 to 20 bins, and defense suppression matches the replaced SCM mechanisms.The reported order is I(X; Y_dir,1) > I(X; Y_dir,2 | ·) > I(X; Y_time | Y_dir,1).Source: E. Empirical Summary · p. 12
  • The Gaussian checks report 5% C_size,dir formula error and a +22% lower-bound offset for I(X; Y_size), with inter-class spread collapse and coupling attenuation controlled independently.The experiments also validate how Tor’s fixed cells degenerate the size dimension and drive coupling toward zero.Source: E. Empirical Summary · p. 12

VII. DISCUSSION

The discussion delineates when mechanism-level causal interpretation and the Fisher-geometric approximation are appropriate. It concludes with a Tor/Wang validation and identifies open problems in generalizing the framework to other defenses and protocols.

A. Boundaries of Mechanism Separability

  • Causal interpretation of η_d as single-mechanism efficiency requires a defense to replace only dimension d’s mechanism while leaving other dimensions’ structural equations unchanged.Under joint interventions, η_d remains computable but describes a marginal observational effect rather than counterfactual leakage compression from a single-mechanism replacement.Source: A. Boundaries of Mechanism Separability · pp. 12–13
  • FRONT leaves the true timing mechanism unchanged, while its dummy packets alter the timing proxy through n_total, insufficient to produce proxy-level conditional independence.The proxy Y_time = t_end/(n_total − 1) depends explicitly on n_total, which FRONT changes.Source: A. Boundaries of Mechanism Separability · p. 12
  • Shared network resources can couple interventions: a token-bucket shaper jointly replaces size and timing mechanisms, while TrafficSliver affects timing and direction statistics.When dimensions share a physical scheduling resource, coupling is unavoidable; mechanism separability is more plausible when their generation processes depend on independent protocol layers.Source: A. Boundaries of Mechanism Separability · pp. 12–13

B. Valid Range of the Trace Approximation

  • The trace approximation overestimates leakage at large class separations and is better used to compare defense-perturbation directions at a fixed baseline.The paper uses direct mutual-information estimation as its primary empirical tool; the trace approximation is conceptual, with reference value in the timing dimension in the Tor/Wang scenario.Source: B. Valid Range of the Trace… · p. 13

VIII. CONCLUSION

  • The paper unifies chain decomposition, coupling measurement, and Fisher-geometric analysis into a computable framework for structured leakage accounting and joint-defense design.Its conclusion presents structured decomposition and testable criteria, not a universal theorem that every single-dimension defense must fail.Source: §VIII · p. 13
  • FRONT reduces the direction chain component from 0.637 to 0.236 bits (−62.9%), while the Markov residual changes only from 0.018 to 0.021 bits.The 95% CI [0.016, 0.027] for the 0.021-bit residual excludes zero, consistent with replacing the direction mechanism but not intervening on timing.Source: §VIII · p. 13
  • Generalization remains open: memory-bearing defenses need temporal SCM structure, and variable-length protocols may not preserve Tor’s size degeneration or direction dominance.The paper also identifies mapping real defense parameters to trace-formula parameters and defining suitable costs for splitting-type defenses as prerequisites for extensions.Source: §VIII · p. 14
Loading 2609.19036v1…