DEMUX: Boundary-Aware Multi-Scale Traffic Demixing for Multi-Tab Website Fingerprinting

2026-04-16

AI Summary

This work addresses the significant performance degradation in website fingerprinting caused by severe traffic interleaving under multi-label concurrent scenarios. To this end, the paper proposes DEMUX, a novel framework that simultaneously fulfills three critical structural requirements: boundary signal integrity, multi-scale local modeling, and temporal correlation of dispersed fragments. DEMUX achieves precise traffic demixing and accurate website identification through boundary-preserving aggregation, multi-scale parallel convolutions, and a two-stage Transformer equipped with rotary position encoding. Designed as a plug-and-play preprocessing module, DEMUX substantially enhances the performance of existing methods. Experimental results demonstrate state-of-the-art performance across multiple complex settings, achieving a precision@5 of 0.943 and mean average precision@5 of 0.961 in a 5-label closed-world scenario—improvements of 9.2 and 6.2 percentage points, respectively, over the strongest baseline.

Technology Category

• Machine Learning: Multimodal Learning
• Computer Vision: Multi-modal Vision
• Natural Language Processing: Language Grounding & Multi-modal NLP

Application Category

• Web Mining and Content Analysis: Large pretrained models with web data
• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Responsible Web: Human-perceived consequences of algorithmic deployment on the web

Abstract

Website fingerprinting (WF) attacks infer the websites visited by users from encrypted traffic in anonymous networks such as Tor. Existing deep learning methods achieve high accuracy under the single-tab assumption but degrade substantially when users open multiple tabs concurrently, producing interleaved traffic that transforms WF into an implicit demixing problem. We identify three structural requirements for effective multi-tab demixing, namely signal integrity at segment boundaries, multi-scale local modeling, and relative temporal association of dispersed fragments, and show that no prior method satisfies all three simultaneously. We propose DEMUX, a designed framework that addresses these requirements through three tightly coupled components. A Boundary Preserving Aggregation Module employs overlapping window partitioning with joint packet-level and burst-level feature extraction. A Multi-Scale Parallel CNN captures heterogeneous temporal patterns via parallel branches. A two-stage Transformer encoder with Rotary Positional Embedding enables robust cross-window fragment association. The Boundary Preserving Aggregation Module additionally serves as a plug-and-play preprocessor that consistently improves existing baselines without architectural modification. Extensive experiments across closed-world, open-world, defense-augmented, dynamic-tab, and cross-configuration settings demonstrate that DEMUX achieves state-of-the-art performance. In the challenging closed-world 5-tab setting, DEMUX attains a P@5 of 0.943 and MAP@5 of 0.961, outperforming the strongest baseline by 9.2 and 6.2 percentage points respectively, confirming its strong robustness in complex multi-tab demixing scenarios.

Problem

• website fingerprinting
• multi-tab
• traffic demixing
• encrypted traffic
• anonymous networks

Innovation

• Website Fingerprinting
• Multi-Tab Demixing
• Boundary-Aware Aggregation
• Multi-Scale CNN
• Rotary Positional Embedding