From 4976aed3e5546b72aa1cb593cfe666ce72e5e087 Mon Sep 17 00:00:00 2001 From: leetcrypt Date: Mon, 20 Jul 2026 00:20:30 -0700 Subject: [PATCH] SS4: data-independent lead-paper draft (G4+RQ1+RQ2), written blind MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit docs/stage-07-paper-draft.md — Abstract skeleton, Intro (consent-gate novelty G4 + RQ1 bridge-leak / RQ2 funnelling motivation), Related Work, full Methods from the frozen prereg §2-§6, Limitations §7, References. Results/Discussion are HELD-BLIND placeholders (battery still running, zero confirmatory numbers seen); RQ2 subsections additionally gated on the pending posterior-construction ratification. Frozen prereg untouched; no RQ2 statistic computed. Co-Authored-By: Claude Opus 4.6 --- OVERSEER-STATUS.md | 2 + docs/stage-07-paper-draft.md | 350 +++++++++++++++++++++++++++++++++++ 2 files changed, 352 insertions(+) create mode 100644 docs/stage-07-paper-draft.md diff --git a/OVERSEER-STATUS.md b/OVERSEER-STATUS.md index 49d4474..af179b1 100644 --- a/OVERSEER-STATUS.md +++ b/OVERSEER-STATUS.md @@ -45,3 +45,5 @@ NEEDS-OPERATOR: How is the RQ2 per-circuit adversary sender-posterior constructe - 2026-07-20 OVERSEER RULED DIRECTION=A (fill the gap, reject B/C). DRAFTED docs/stage-05-rq2-posterior-clarification.md — PROPOSED (operator-ratification PENDING), blind pre-spec (battery still running, ZERO RQ2 numbers computed). Rule: adversary observes exit-bridge/house → uniform posterior over the observation-consistent anonymity set A_i → per-circuit H_i=MM(log2 m_i) [Serjantov2002 S=2^H, Diaz2002 d=H/log2 N]; makes RQ2-P1 (ΔH, two-sided) + RQ2-P3 (Spearman) computable OFFLINE from per_circuit_seeds + deterministic assemble(). Grounded in cited lit only; sign not presumed; frozen prereg untouched. - HARD HOLD honored: no RQ2 confirmatory statistic computed/inspected/reported until Andre ratifies. RQ1 loader ready; SS4 skeleton next (data-independent). Battery: 442→ /9000 circuits, RUNNING, healthy. - BATTERY MONITORING CAVEAT (for the loop): the SS2 launch wrapper reported a benign exit-1 (a trailing `echo > .current-ts` error) — the battery itself is VERIFIED HEALTHY and progressing (spot-checked 66→69 circuits/25s, docker hops cycling, python PID 2539198 alive under wrapper 2539195). Because that background task is now closed, COMPLETION WILL NOT AUTO-NOTIFY. Detect completion by: `output/sor-confirmatory/20260720T060132Z/confirmatory-data/battery-results.json` present AND hop0.pcap count == 9000 (currently ~69). Do NOT re-launch (would duplicate/waste progress). Resume SS3 analysis (post-blinding) only after completion + the RQ2 ruling. +- 2026-07-20 SS4 (data-independent draft) DONE + committed: docs/stage-07-paper-draft.md — lead paper (G4+RQ1+RQ2). Written BLIND (battery still running, zero confirmatory numbers seen): Abstract skeleton, Intro (G4 consent-gate novelty + RQ1 bridge-leak / RQ2 funnelling motivation), Related Work (onion/SOR [Egners2012], correlation [NasrBH18/OhYMH22], anonymity metrics [Serjantov2002/Diaz2002], social-trust G4 neighbours), full Methods from frozen prereg §2-§6 (design matrix, DVs, R=30×C=50, frozen detectors + §5 gate, Holm family=7 report-4), Limitations from §7, References. Results §5 + Discussion §6 = HELD-BLIND placeholders; RQ2 subsections additionally RATIFICATION-GATED (posterior proposal pending). No prereg edit; no RQ2 number. +- DRIVE STATE: SS1 ✅ SS2 firing ✅ SS3-RQ1 ✅ RQ2-proposal ✅ SS4-skeleton ✅. Battery: 492/9000, RUNNING healthy (PID 2539198). REMAINING GATES: SS3-RQ2 + RQ1-P2 pairing on Andre's RQ2 ratification; SS4 Results/Discussion + SS5 review on (a) battery completion (blinding) AND (b) RQ2 ratification. All data-independent overnight work now exhausted without fabricating or breaking blinding. diff --git a/docs/stage-07-paper-draft.md b/docs/stage-07-paper-draft.md new file mode 100644 index 0000000..fa514ac --- /dev/null +++ b/docs/stage-07-paper-draft.md @@ -0,0 +1,350 @@ +# Consent-Gated Federated Onion Routing: Linkability and Anonymity-Set Effects of an In-Band Accept/Reject Relay Model + +**Draft — SS4 lead paper (G4 + RQ1 + RQ2). DATA-INDEPENDENT SECTIONS ONLY.** + +> **Blinding status (prereg §2, binding).** This draft was written while the confirmatory +> battery was still running and **before any confirmatory intermediate result was inspected.** +> All Results / Discussion content is therefore held as empty placeholders and will be filled +> **once, after the full battery completes** and the raw outputs are sealed (stage-05 +> immutability). The frozen prereg +> (`sor-consent-prereg.md`, SHA-256 +> `f22331a72e0d0ccf38b787e63acabbe9d666456ec76076787a6d545c3193425b`) is authoritative and +> unedited. +> +> **RQ2 caveat (hard hold).** The RQ2 dependent variable — a *per-circuit adversary sender +> posterior* — has a construction gap the frozen prereg leaves open (see +> `docs/stage-05-rq2-posterior-clarification.md`, **PROPOSED, operator-ratification pending**). +> **No RQ2 confirmatory statistic is computed, inspected, or reported in this draft.** RQ2 +> methods text below is hedged accordingly; RQ2 result content stays empty until the posterior +> construction is ratified AND the battery completes. + +--- + +## Abstract *(skeleton — quantitative claims held until data + RQ2 ratification)* + +Onion-routing systems typically admit any relay that meets a directory's technical criteria; +they do not model **relay consent** — a host's in-band, per-circuit choice to carry a given +flow. We build and measure a **consent-gated, federated, nested-SSH relay data plane** in which +every hop must explicitly accept or reject each circuit through a signed in-band handshake +(Ed25519-authenticated, X25519 per-hop credentials), and in which relays are organized into +**houses** that federate either through a shared **bridge** or through a **directory**. Treating +this as a *measurement instrument* for a trust model's exposure (not a service that provides +anonymity), we ask two confirmatory questions on a lab grid of two phones and a laptop: **(RQ1)** +does a shared bridge introduce a measurable flow-linkability leak between a circuit's entry and +exit segments, and does cover padding remove it; **(RQ2)** does federating relays across houses +**grow or shrink** the anonymity set an adversary faces, and is any effect explained by +**bridge-concentration funnelling**. All detectors are frozen and calibrated on +known-linked/known-unlinked and equiprobable-sender fixtures before any confirmatory cell is run; +all inference is bootstrap-based with BCa 95% CIs, Holm–Bonferroni-corrected across the +confirmatory family. **[RESULTS — HELD BLIND.]** + +--- + +## 1. Introduction + +Anonymous-communication systems from onion routing [Reed1997; Dingledine2004] to its SSH-based +descendant SOR [Egners2012] share a membership model that is essentially *permissionless at the +relay*: a node participates if it meets directory or protocol criteria, and the routing layer +does not represent whether a host **consents** to carry a particular circuit. Yet in +social-trust and friend-to-friend designs — Freenet [Clarke2000], membership-concealing overlays +[Vasserman2009], and social-graph routers such as Pisces [Mittal2012] and X-Vine [Mittal2012b] — +*who is willing to relay for whom* is a first-class property. No existing system, to our +knowledge, makes **per-circuit relay consent an in-band, cryptographically-authenticated protocol +step** and then **measures the privacy consequences** of that gate. That gap — an +accept/reject relay model whose linkability and anonymity-set behaviour are empirically +characterised — is the novelty this work targets (**G4**). + +We do not propose consent-gating as a deployed anonymity service. We build it as a +**defensive-measurement instrument**: a controlled data plane whose knobs (bridge on/off, cover +padding, federation topology) let us *measure* how a consent gate reshapes an adversary's view. +Two consequences of the gate are non-obvious and testable: + +1. **A shared bridge is a linkability hazard (RQ1).** When federated houses route through one + shared bridge node, that node observes both the entry and exit segments of circuits crossing + it. Modern flow-correlation attacks link such segments at high accuracy from timing/volume + alone [NasrBH18; OhYMH22; RahmanSMGW20]. We ask whether our bridge exhibits a **measurable** + entry↔exit correlation leak, and whether **cover padding** closes it. + +2. **Consent-gating can funnel, not just spread (RQ2).** Federation intuitively enlarges the + candidate-sender set and thus anonymity [Serjantov2002; Diaz2002]. But a consent gate means + only *willing* relays carry traffic; if willingness concentrates on a few bridges, circuits + funnel through them and the effective anonymity set may **shrink**. We therefore treat the + sign of the federation effect as **unknown a priori** and report a shrink as prominently as a + growth. + +**Contributions.** (i) The design and instrument-grade implementation of a consent-gated, +federated, nested-SSH relay data plane with signed in-band accept/reject and per-hop X25519 +credentials (§3, §4). (ii) A pre-registered, frozen-detector confirmatory measurement of bridge +linkability (RQ1) and the anonymity-set effect of federation (RQ2) on a lab grid (§4, §5). +(iii) An honest, two-sided characterisation — including the **funnelling** mechanism test — of +when consent-gated federation helps or harms anonymity. **[Quantitative findings — HELD BLIND.]** + +**Scope.** Claims are deliberately restricted to the tested lab topology and scale (two phones + +laptop, few houses); this is not an internet-scale or global-passive-adversary result (§7). +The paired **churn-resilience** question (RQ3) and a QUIC/`ssh3` transport arm [Michel2023] are +pre-registered but held for a companion paper; this lead paper covers G4 + RQ1 + RQ2 only. + +--- + +## 2. Related work + +**Onion routing and SSH-based relays.** Mixes and onion routing originate with Chaum [Chaum1981] +and Reed–Syverson–Goldschlag [Reed1997], with Tor [Dingledine2004] as the dominant deployment. +SOR [Egners2012] is the **direct prior art**: it layers onion routing over stock SSH tunnels, +which is exactly our transport substrate. Nesting SSH inside SSH raises the well-known +TCP-over-TCP throughput/latency pathology [Honda2005], motivating our latency-aware measurement +and a (exploratory) QUIC-based `ssh3` transport [Michel2023]; UDP-based latency work on onion +services [AlAzad2023] is complementary. **None of these model per-circuit relay consent**, which +is the axis we add and measure. + +**Flow correlation / linkability (RQ1).** That an adversary seeing two segments of a flow can +link them is established: low-cost traffic analysis [MurdochD05], realistic-adversary correlation +on Tor [JohnsonWJSS13], and deep-learning correlators DeepCorr [NasrBH18] and DeepCoFFEA +[OhYMH22] achieve high linking accuracy; packet-timing (Tik-Tok [RahmanSMGW20]) and deep +fingerprinting [SirinamIJW18] show timing/volume suffice. We do **not** advance correlator +state-of-the-art; we adopt a **frozen, fixture-calibrated** correlator (calibration gate §5) and +use its AUC purely as an *instrument reading* of whether our bridge leaks — the contribution is +the consent-gate/bridge measurement, not the attack. + +**Anonymity metrics and Sybil/directory concerns (RQ2).** We quantify anonymity with the +information-theoretic set metrics of Serjantov–Danezis [Serjantov2002] (entropy of the adversary +posterior; effective set size S = 2^H) and Díaz et al. [Diaz2002] (normalized degree +d = H/log₂N). Federation across mutually-distrusting houses evokes decentralised-directory and +Sybil questions [Douceur2002; Winter2016] and statistical-disclosure exposure over repeated +circuits [Danezis2003]. Our **matched-N** design isolates the *topology* effect (federated vs. +single-house at equal total node count) rather than a node-count artifact. + +**Social-trust / consent-adjacent designs (G4 neighbours).** The closest neighbours treat +relaying willingness or social linkage as structural: Freenet's friend-to-friend mode +[Clarke2000], membership-concealing overlays [Vasserman2009], Drac's social low-volume comms +[Danezis2010], and social-graph routers Pisces [Mittal2012] / X-Vine [Mittal2012b] / STor +[Zhou2011]. These encode *trust in the graph*; **none makes consent an in-band, per-circuit, +signed accept/reject protocol step whose linkability and anonymity-set consequences are then +measured** — the specific gap G4 fills. + +--- + +## 3. System design (the instrument) + +The instrument is a nested-SSH relay data plane built into an existing zero-knowledge chat relay +(hack-house), entirely within an isolated worktree. It has seven components (roadmap R1–R7); the +subset load-bearing for this lead paper (RQ1 + RQ2, `static` selector, no model) is fully pinned +by the freeze. Key mechanisms: + +- **Consent handshake (R5).** Each hop receives a signed in-band consent *request* and must + **accept or reject** before it will carry the circuit. Requests are **Ed25519-signed** by the + originating persona and **verified before acceptance**; an unsigned or forged request is + rejected. Per-hop credentials are **X25519-sealed to the host's public key**, so a hop + credential decrypts *only* with that host's private key (no shared-symmetric secret). +- **Nested-SSH circuits (R4).** A circuit is a chain of SSH tunnels across grid hops; the entry + and exit **segments** are the observable units for RQ1. Every hop's traffic is captured to an + immutable per-hop pcap, written once and checksummed. +- **Federation / bridge (R6).** Relays are grouped into **houses**. Houses federate via a shared + **bridge** node or via a **directory**; a circuit's federation path is chosen under + split-knowledge topology constraints. The bridge is the shared observation point RQ1 probes and + the concentration point RQ2's funnelling test probes. +- **Determinism & provenance (R1–R3).** All stochastic behaviour derives from a single + `--sor-seed`; the seed, git SHA, and node-role→device mapping are echoed into an immutable + `manifest.json`, and every relay event is appended to a SHA-256-sealed `events.jsonl`. +- **Containment (binding).** Every forwarder runs in an **isolated engine only** + (`assert engine != local` or the run refuses). All traffic is self-generated to our own + fixtures, lab-only. No external target, no live-network relay. + +--- + +## 4. Methods (pre-registered; frozen) + +This study is a **confirmatory factorial controlled comparison**; the design, variables, seeds, +detectors, and analysis were frozen and hashed on 2026-07-19 before any confirmatory cell ran. + +### 4.1 Design matrix + +Cells are organised per RQ with the other factors held at their declared control: + +- **RQ1 (linkability):** bridge ∈ {off, on, on+padding} — 3 levels; topology held at + single-house, selector `static`. (bridge-off+padding is declared **N/A** — padding is defined + only for bridge-on.) +- **RQ2 (anonymity set):** topology ∈ {1-house-N, bridge-federated, directory-federated} at + **matched total node count N** — 3 levels; bridge held off, selector `static`. + +Full crossing is not run. Run order is randomised within each cell and the control arm is +interleaved before and after treatments so grid calibration drift is caught. All stochastic +elements are seed-controlled. + +### 4.2 Dependent variables + +- **RQ1 — correlation AUC.** Area under the ROC of the frozen flow-correlation detector scoring + (entry-segment, exit-segment) pairs as same/different circuit, measured from the real per-hop + pcaps. Unit of analysis: the **(entry, exit) pair**; 95% CI by **bootstrap over circuit + pairs**. +- **RQ2 — anonymity-set entropy H.** Shannon entropy of the **adversary's posterior over + candidate senders per circuit**; effective set size S = 2^H [Serjantov2002], normalized + d = H/log₂N [Diaz2002]; **Miller–Madow** finite-sample bias correction; 95% CI by **bootstrap + over circuits**. Unit of analysis: the **circuit**. **ΔH = H(federated) − H(single-house, + matched N).** + > *Construction caveat (hard hold).* The prereg pins this DV as a per-circuit posterior but + > does not give the posterior **construction rule**. A construction — uniform mass over the + > observation-consistent anonymity set, grounded only in [Serjantov2002; Diaz2002] — is + > **PROPOSED** in `docs/stage-05-rq2-posterior-clarification.md` and **awaits operator + > ratification**. Until ratified, **no RQ2 number is computed.** The construction is + > recomputable **offline** from the sealed per-circuit seeds (deterministic circuit assembly), + > so the running battery is not wasted regardless of the ratified rule. + +### 4.3 Sampling & power + +**R = 30** independent seeded runs per cell; each run builds **C = 50** circuits (≥ 1500 scored +pairs per cell for RQ1). The target is **precision, not a formal power analysis**: ≥ 1500 pairs +yields an expected bootstrap 95% CI half-width on AUC ≤ 0.03, enough to resolve the RQ1 floor +away from 0.5. One base seed **S0 = 20260719**; per-cell seed = `SHA256(S0 ‖ cell_id ‖ run_index)` +truncated to u64, echoed into every manifest. **Stopping rule:** all cells × R runs run to +completion — **no optional stopping, no interim looks**; an uninformative cell is reported +**inconclusive**, never extended to chase significance. + +### 4.4 Frozen detectors and the instrument-validation gate + +Detectors (correlator, entropy estimator, classifier) are written and **calibrated only on the +instrument-validation fixtures** — known-linked/known-unlinked control pairs and +equiprobable-sender synthetic sets — **before any confirmatory cell is run**; **no per-cell +tuning** is permitted. The battery ran only after all six boolean gate items passed green: +(1) 3-hop end-to-end delivery with per-hop pcap + checksum; (2) seeded reproducibility (same seed +→ identical circuit-build sequence); (3) correlator calibration (known-linked AUC ≈ 1, +known-unlinked ≈ 0.5); (4) entropy calibration (H = log₂N for N equiprobable senders); +(5) isolation (`assert engine != local` or refuse); (6) provenance integrity (replayed fixture → +schema-valid `events.jsonl` whose SHA-256 matches the manifest; append-only). + +### 4.5 Analysis plan + +Effect size + 95% CI for **every** comparison; p-values never reported alone. All inference is +bootstrap/permutation-based (10,000 resamples, **BCa** intervals; 3-seed spot-check to MC error). + +- **RQ1-P1 (leak).** Bridge-on correlation AUC, bootstrap 95% CI. **Confirmation gate = CI + excludes 0.5** (leak present); **null** if CI includes 0.5. Materiality is a *separate* label: + CI lower bound ≥ **0.60** ⇒ "material leak"; between 0.5 and 0.60 ⇒ "weak-but-real leak." +- **RQ1-P2 (padding efficacy).** ΔAUC = AUC(bridge-on, no-pad) − AUC(bridge-on, +pad); **paired** + bootstrap 95% CI. Padding effective iff ΔAUC CI **> 0**. +- **RQ2-P1 (federation effect, two-sided).** ΔH bootstrap 95% CI; **the sign is not presumed.** + **grow** if CI > 0; **honest shrink (reported with equal prominence)** if CI < 0; + **inconclusive** if it spans 0. *(Computation gated on RQ2 ratification.)* +- **RQ2-P3 (funnelling mechanism).** Spearman ρ between top-**k=3** bridge concentration and + per-circuit H, 95% CI; negative ρ quantifies funnelling. *(Computation gated on RQ2 + ratification.)* +- **Multiple comparisons.** Holm–Bonferroni over the frozen **family of 7** confirmatory tests + {RQ1-P1, RQ1-P2, RQ2-P1, RQ2-P3, RQ3-P1-perf, RQ3-P1-latency, RQ3-P2}; the 4 lead-paper tests + are reported at Holm-adjusted multipliers 7, 6, 5, 4 (conservative embedding — see + `docs/stage-05-holm-clarification.md`, ratified). EXPLORATORY results (QUIC transport; any + post-hoc contrast) are labelled and excluded from the confirmatory column. +- **Data exclusion (pre-data).** A run is quarantined (logged, never silently dropped) **only** + on a data-integrity failure (SHA mismatch, pcap checksum failure, in-place edit, or + non-reproducing seed). **No performance-based exclusions.** + +--- + +## 5. Results *(HELD BLIND — placeholders)* + +> Populated **once**, after the full battery completes and raw outputs are sealed. RQ2 subsections +> additionally gated on ratification of the posterior construction. No confirmatory number appears +> until then. + +### 5.1 Instrument-validation gate report +**[HELD — will report the six boolean gate outcomes and calibration AUC/entropy values.]** + +### 5.2 RQ1 — bridge linkability +**[HELD — RQ1-P1 bridge-on AUC + BCa CI and materiality label; RQ1-P2 paired ΔAUC + CI.]** + +### 5.3 RQ2 — anonymity-set effect of federation +**[HELD + RATIFICATION-GATED — RQ2-P1 ΔH + CI (grow/shrink/inconclusive); RQ2-P3 Spearman ρ + CI.]** + +### 5.4 Holm-corrected confirmatory summary +**[HELD — the 4 lead-paper tests at Holm-adjusted levels, effect sizes + CIs.]** + +--- + +## 6. Discussion *(HELD BLIND — placeholder)* + +**[HELD — interpretation of the confirmed/null/inconclusive outcomes; the honest-null story if +ΔH shrinks; what the funnelling ρ implies for consent-gated federation; padding efficacy.]** + +--- + +## 7. Limitations & threats to validity + +- **Scale / adversary model (External).** The grid is two phones + a laptop and few houses; this + is **not** internet-scale and **not** a global passive adversary. Claims are scoped to the + tested topology/scale; entropy CIs are wide at small node counts (accepted, node counts + reported). +- **Construct.** Self-generated fixture traffic is not real user traffic (inherent to lab + measurement; fixtures versioned/checksummed). A single correlator's AUC stands in for + "linkability" and plug-in H for "anonymity" — mitigated by fixture calibration (§4.4) and by + reporting S = 2^H and normalized d; a second entropy estimator (NSB) is reported EXPLORATORY as + a sensitivity check. +- **Internal.** Thermal/background load and device heterogeneity are mitigated by randomised + order, interleaved controls, per-session idle baselines, and a pinned node-role→device mapping. + Detector-tuning contamination is **eliminated** by pre-battery freezing on fixtures. +- **RQ2 construction dependency.** The RQ2 result depends on the ratified posterior construction + (§4.2 caveat); the construction is pre-specified blind, two-sided, and grounded only in cited + metrics — but it is a specification the frozen prereg did not pin, and is disclosed as such. +- **Dual-use (ethics).** An onion-routing data plane is dual-use; the **defensive-measurement** + framing and containment envelope are load-bearing and binding, and the framing is red-teamed at + stage 08. + +--- + +## 8. Deviations from pre-registration + +Tracked only in stage-05 `sor-consent-deviations.md` (none edit the frozen prereg). Two +clarifications recorded to date: the Holm family-size restatement +(`docs/stage-05-holm-clarification.md`, **ratified**) and the RQ2 posterior construction +(`docs/stage-05-rq2-posterior-clarification.md`, **PROPOSED — pending operator ratification**). + +--- + +## References + +- **[Chaum1981]** Chaum, D. L. (1981). Untraceable Electronic Mail, Return Addresses, and Digital + Pseudonyms. *CACM* 24(2), 84–90. https://doi.org/10.1145/358549.358563 +- **[Reed1997]** Reed, M. G., Syverson, P. F., & Goldschlag, D. M. (1997). Anonymous Connections + and Onion Routing. *IEEE S&P 1997*, 44–54. https://doi.org/10.1109/secpri.1997.601314 +- **[Dingledine2004]** Dingledine, R., Mathewson, N., & Syverson, P. (2004). Tor: The + Second-Generation Onion Router. *USENIX Security 2004*. +- **[Egners2012]** Egners, A., Gatzen, D., Panchenko, A., & Meyer, U. (2012). Introducing SOR: + SSH-based Onion Routing. *IEEE WAINA 2012*, 280–286. https://doi.org/10.1109/WAINA.2012.89 +- **[Honda2005]** Honda, O., et al. (2005). Understanding TCP over TCP. *SPIE 6011*. + https://doi.org/10.1117/12.630496 +- **[Michel2023]** Michel, F., & Bonaventure, O. (2023). Towards SSH3. arXiv:2312.08396. +- **[AlAzad2023]** Al Azad, M. W., et al. (2023). DarkHorse. *IEEE LCN 2023*. arXiv:2307.02429. +- **[MurdochD05]** Murdoch, S. J., & Danezis, G. (2005). Low-Cost Traffic Analysis of Tor. + *IEEE S&P 2005*, 183–195. https://doi.org/10.1109/SP.2005.12 +- **[JohnsonWJSS13]** Johnson, A., et al. (2013). Users Get Routed. *ACM CCS 2013*, 337–348. + https://doi.org/10.1145/2508859.2516651 +- **[NasrBH18]** Nasr, M., Bahramali, A., & Houmansadr, A. (2018). DeepCorr. *ACM CCS 2018*, + 1962–1976. https://doi.org/10.1145/3243734.3243824 +- **[OhYMH22]** Oh, S. E., et al. (2022). DeepCoFFEA. *IEEE S&P 2022*, 1915–1932. + https://doi.org/10.1109/SP46214.2022.9833801 +- **[RahmanSMGW20]** Rahman, M. S., et al. (2020). Tik-Tok. *PoPETs* 2020(3). + https://doi.org/10.2478/popets-2020-0043 +- **[SirinamIJW18]** Sirinam, P., et al. (2018). Deep Fingerprinting. *ACM CCS 2018*, 1928–1943. + https://doi.org/10.1145/3243734.3243768 +- **[Serjantov2002]** Serjantov, A., & Danezis, G. (2002). Towards an Information Theoretic Metric + for Anonymity. *PET 2002*, LNCS 2482, 41–53. https://doi.org/10.1007/3-540-36467-6_4 +- **[Diaz2002]** Díaz, C., et al. (2002). Towards Measuring Anonymity. *PET 2002*, LNCS 2482, + 54–68. https://doi.org/10.1007/3-540-36467-6_5 +- **[Douceur2002]** Douceur, J. R. (2002). The Sybil Attack. *IPTPS 2002*, LNCS 2429, 251–260. + https://doi.org/10.1007/3-540-45748-8_24 +- **[Danezis2003]** Danezis, G. (2003). Statistical Disclosure Attacks. *IFIP SEC 2003*. +- **[Winter2016]** Winter, P., et al. (2016). Identifying and Characterizing Sybils in the Tor + Network. *USENIX Security 2016*, 1169–1185. +- **[Clarke2000]** Clarke, I., et al. (2000/2001). Freenet. *Designing PETs*, LNCS 2009. + https://doi.org/10.1007/3-540-44702-4_4 +- **[Vasserman2009]** Vasserman, E. Y., et al. (2009). Membership-Concealing Overlay Networks. + *ACM CCS 2009*, 390–399. https://doi.org/10.1145/1653662.1653709 +- **[Danezis2010]** Danezis, G., et al. (2010). Drac. *PETS 2010*, LNCS 6205, 202–219. + https://doi.org/10.1007/978-3-642-14527-8_12 +- **[Mittal2012]** Mittal, P., Wright, M., & Borisov, N. (2012). Pisces. *NDSS 2013*. + arXiv:1208.6326. +- **[Mittal2012b]** Mittal, P., Caesar, M., & Borisov, N. (2012). X-Vine. *NDSS 2012*. + arXiv:1109.0971. +- **[Zhou2011]** Zhou, P., et al. (2011/2013). STor. arXiv:1110.5794. + +*(Full bibliography: `~/coding/sci-method/stages/01-literature/output/sor-consent-bibliography.md`. +Integrity flags carried forward: [Stutzbach2006] secondary-sourced; [Constantinides2026] recent +preprint — neither is load-bearing in this lead paper.)*