FlowAtom is a new method for multi‑label website fingerprinting that aggregates evidence from encrypted traffic flows into shared prototypes called Atoms. It pre‑trains a flow encoder on unlabeled traffic, then combines Atom responses across flows within each observation window to produce a fixed‑dimensional, permutation‑invariant representation for predicting which monitored websites were visited. In closed‑world tests on Direct HTTPS, Trojan, and VMess traffic, FlowAtom achieves micro‑F1 scores of 97.82%, 94.43%, and 93.92% respectively, and consistently outperforms baseline approaches in open‑world scenarios involving monitored visits.
arXiv:2608. 13905v1 Announce Type: cross Abstract: HTTPS website fingerprinting (WF) aims to identify visited websites from metadata observable in encrypted traffic.
arXiv:2608. 08245v1 Announce Type: cross Abstract: LLM applications deployed at scale face a fundamental challenge: privacy constraints prevent direct inspection of user interactions, making it difficult to obtain any representative evaluation dataset or to track the ongoing evolution of production traffic.
The paper audits 14 encrypted traffic classification benchmarks to investigate how flow labels are generated. It finds two common labeling strategies—coarse inheritance, which may mislabel flows, and overstrict filtering, which may discard useful flows—leading to inconsistencies between benchmark labels and actual traffic records. The study also quantifies the impact of these labeling practices on classifier accuracy, showing that inherited labels limit balanced accuracy to 0.56–0.76, while filtering can raise macro accuracy from 0.44 to 0.65.
The paper introduces a method to detect which web scrapers feed data to large language models (LLMs) by deploying dynamic websites that issue unique canary tokens to each scraper. By querying LLMs for information about these sites, the authors can identify when an LLM consistently outputs the unique tokens, indicating exposure to a specific scraper. Experiments on 22 production LLM systems show the technique reliably uncovers both known and undisclosed scrapers, offering a tool for third parties to monitor and control unwanted web scraping.
RiskChainBench is a new benchmark that pairs 3,600 synthetic token‑text restoration inputs with 600 human‑labeled local web environments to evaluate how well models can recover obfuscated platform messages and then investigate the associated websites. The benchmark measures both message restoration accuracy and the subsequent web‑investigation decision, using a fixed multimodal evidence judge to assess faithfulness, sufficiency, completeness, and consistency. Across ten models, performance varies widely, with entry recovery ranging from 35.2% to 95.2% and web decision accuracy from 26.3% to 62.8%, highlighting execution failures as the main bottleneck.
Platform abuse campaigns conceal redirection instructions with emojis, homophones, character decomposition, and redundant symbols, then route users through disguised links to services associated with...
arXiv:2607. 15267v1 Announce Type: new Abstract: Poisoning pretraining data can introduce harmful behaviors to LMs that are difficult to detect and mitigate.
arXiv:2607. 28019v1 Announce Type: new Abstract: User foundation models have demonstrated strong results in e-commerce and social recommendation, but most industrial deployments assume environments where user identity is stable and persistent.
arXiv:2604. 06367v2 Announce Type: replace-cross Abstract: Web agents automate browser tasks, ranging from simple form completion to complex workflows like ordering groceries.
The paper evaluates the common assumption that combining flow statistics and TLS handshake fingerprints improves encrypted command-and-control detection. Using 17,577 TLS flows from 62 real Cobalt Strike captures, the authors show that data leakage and preprocessing choices inflate performance metrics, revealing that the true benefit of multi-view fusion is minimal (0.022 F1). They also uncover that many captures contain only benign traffic and that class imbalance is an artifact of analysis rather than a real feature of the task.
The paper presents a simple detector for model extraction attacks on large language model APIs. It frames detection as a benign‑calibrated traffic‑window distribution test, embedding queries into a semantic space and using maximum mean discrepancy (MMD) to compare against historical benign traffic. Evaluated on fourteen attacker‑normal query pairs across four extraction scenarios, MMD achieves near‑perfect true‑positive rates while maintaining a 0.3% false‑positive rate, outperforming several existing baselines.
arXiv:2605. 11504v2 Announce Type: replace Abstract: Recent advances in Large Language Models (LLMs) have enabled agentic systems for complex, multi-step tasks; cybersecurity is emerging as a prominent application.