SS4: data-independent lead-paper draft (G4+RQ1+RQ2), written blind

docs/stage-07-paper-draft.md — Abstract skeleton, Intro (consent-gate novelty G4 + RQ1 bridge-leak / RQ2 funnelling motivation), Related Work, full Methods from the frozen prereg §2-§6, Limitations §7, References. Results/Discussion are HELD-BLIND placeholders (battery still running, zero confirmatory numbers seen); RQ2 subsections additionally gated on the pending posterior-construction ratification. Frozen prereg untouched; no RQ2 statistic computed. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-07-20 00:20:30 -07:00
parent a254267e1a
commit 4976aed3e5
2 changed files with 352 additions and 0 deletions
@@ -45,3 +45,5 @@ NEEDS-OPERATOR: How is the RQ2 per-circuit adversary sender-posterior constructe
 - 2026-07-20 OVERSEER RULED DIRECTION=A (fill the gap, reject B/C). DRAFTED docs/stage-05-rq2-posterior-clarification.md — PROPOSED (operator-ratification PENDING), blind pre-spec (battery still running, ZERO RQ2 numbers computed). Rule: adversary observes exit-bridge/house → uniform posterior over the observation-consistent anonymity set A_i → per-circuit H_i=MM(log2 m_i) [Serjantov2002 S=2^H, Diaz2002 d=H/log2 N]; makes RQ2-P1 (ΔH, two-sided) + RQ2-P3 (Spearman) computable OFFLINE from per_circuit_seeds + deterministic assemble(). Grounded in cited lit only; sign not presumed; frozen prereg untouched.
 - HARD HOLD honored: no RQ2 confirmatory statistic computed/inspected/reported until Andre ratifies. RQ1 loader ready; SS4 skeleton next (data-independent). Battery: 442→ /9000 circuits, RUNNING, healthy.
 - BATTERY MONITORING CAVEAT (for the loop): the SS2 launch wrapper reported a benign exit-1 (a trailing `echo > .current-ts` error) — the battery itself is VERIFIED HEALTHY and progressing (spot-checked 66→69 circuits/25s, docker hops cycling, python PID 2539198 alive under wrapper 2539195). Because that background task is now closed, COMPLETION WILL NOT AUTO-NOTIFY. Detect completion by: `output/sor-confirmatory/20260720T060132Z/confirmatory-data/battery-results.json` present AND hop0.pcap count == 9000 (currently ~69). Do NOT re-launch (would duplicate/waste progress). Resume SS3 analysis (post-blinding) only after completion + the RQ2 ruling.
 - 2026-07-20 SS4 (data-independent draft) DONE + committed: docs/stage-07-paper-draft.md — lead paper (G4+RQ1+RQ2). Written BLIND (battery still running, zero confirmatory numbers seen): Abstract skeleton, Intro (G4 consent-gate novelty + RQ1 bridge-leak / RQ2 funnelling motivation), Related Work (onion/SOR [Egners2012], correlation [NasrBH18/OhYMH22], anonymity metrics [Serjantov2002/Diaz2002], social-trust G4 neighbours), full Methods from frozen prereg §2-§6 (design matrix, DVs, R=30×C=50, frozen detectors + §5 gate, Holm family=7 report-4), Limitations from §7, References. Results §5 + Discussion §6 = HELD-BLIND placeholders; RQ2 subsections additionally RATIFICATION-GATED (posterior proposal pending). No prereg edit; no RQ2 number.
 - DRIVE STATE: SS1 ✅ SS2 firing ✅ SS3-RQ1 ✅ RQ2-proposal ✅ SS4-skeleton ✅. Battery: 492/9000, RUNNING healthy (PID 2539198). REMAINING GATES: SS3-RQ2 + RQ1-P2 pairing on Andre's RQ2 ratification; SS4 Results/Discussion + SS5 review on (a) battery completion (blinding) AND (b) RQ2 ratification. All data-independent overnight work now exhausted without fabricating or breaking blinding.
@@ -0,0 +1,350 @@
 # Consent-Gated Federated Onion Routing: Linkability and Anonymity-Set Effects of an In-Band Accept/Reject Relay Model
 **Draft — SS4 lead paper (G4 + RQ1 + RQ2). DATA-INDEPENDENT SECTIONS ONLY.**
 > **Blinding status (prereg §2, binding).** This draft was written while the confirmatory
 > battery was still running and **before any confirmatory intermediate result was inspected.**
 > All Results / Discussion content is therefore held as empty placeholders and will be filled
 > **once, after the full battery completes** and the raw outputs are sealed (stage-05
 > immutability). The frozen prereg
 > (`sor-consent-prereg.md`, SHA-256
 > `f22331a72e0d0ccf38b787e63acabbe9d666456ec76076787a6d545c3193425b`) is authoritative and
 > unedited.
 >
 > **RQ2 caveat (hard hold).** The RQ2 dependent variable — a *per-circuit adversary sender
 > posterior* — has a construction gap the frozen prereg leaves open (see
 > `docs/stage-05-rq2-posterior-clarification.md`, **PROPOSED, operator-ratification pending**).
 > **No RQ2 confirmatory statistic is computed, inspected, or reported in this draft.** RQ2
 > methods text below is hedged accordingly; RQ2 result content stays empty until the posterior
 > construction is ratified AND the battery completes.
 ---
 ## Abstract *(skeleton — quantitative claims held until data + RQ2 ratification)*
 Onion-routing systems typically admit any relay that meets a directory's technical criteria;
 they do not model **relay consent** — a host's in-band, per-circuit choice to carry a given
 flow. We build and measure a **consent-gated, federated, nested-SSH relay data plane** in which
 every hop must explicitly accept or reject each circuit through a signed in-band handshake
 (Ed25519-authenticated, X25519 per-hop credentials), and in which relays are organized into
 **houses** that federate either through a shared **bridge** or through a **directory**. Treating
 this as a *measurement instrument* for a trust model's exposure (not a service that provides
 anonymity), we ask two confirmatory questions on a lab grid of two phones and a laptop: **(RQ1)**
 does a shared bridge introduce a measurable flow-linkability leak between a circuit's entry and
 exit segments, and does cover padding remove it; **(RQ2)** does federating relays across houses
 **grow or shrink** the anonymity set an adversary faces, and is any effect explained by
 **bridge-concentration funnelling**. All detectors are frozen and calibrated on
 known-linked/known-unlinked and equiprobable-sender fixtures before any confirmatory cell is run;
 all inference is bootstrap-based with BCa 95% CIs, Holm–Bonferroni-corrected across the
 confirmatory family. **[RESULTS — HELD BLIND.]**
 ---
 ## 1. Introduction
 Anonymous-communication systems from onion routing [Reed1997; Dingledine2004] to its SSH-based
 descendant SOR [Egners2012] share a membership model that is essentially *permissionless at the
 relay*: a node participates if it meets directory or protocol criteria, and the routing layer
 does not represent whether a host **consents** to carry a particular circuit. Yet in
 social-trust and friend-to-friend designs — Freenet [Clarke2000], membership-concealing overlays
 [Vasserman2009], and social-graph routers such as Pisces [Mittal2012] and X-Vine [Mittal2012b] —
 *who is willing to relay for whom* is a first-class property. No existing system, to our
 knowledge, makes **per-circuit relay consent an in-band, cryptographically-authenticated protocol
 step** and then **measures the privacy consequences** of that gate. That gap — an
 accept/reject relay model whose linkability and anonymity-set behaviour are empirically
 characterised — is the novelty this work targets (**G4**).
 We do not propose consent-gating as a deployed anonymity service. We build it as a
 **defensive-measurement instrument**: a controlled data plane whose knobs (bridge on/off, cover
 padding, federation topology) let us *measure* how a consent gate reshapes an adversary's view.
 Two consequences of the gate are non-obvious and testable:
 1. **A shared bridge is a linkability hazard (RQ1).** When federated houses route through one
   shared bridge node, that node observes both the entry and exit segments of circuits crossing
   it. Modern flow-correlation attacks link such segments at high accuracy from timing/volume
   alone [NasrBH18; OhYMH22; RahmanSMGW20]. We ask whether our bridge exhibits a **measurable**
   entry↔exit correlation leak, and whether **cover padding** closes it.
 2. **Consent-gating can funnel, not just spread (RQ2).** Federation intuitively enlarges the
   candidate-sender set and thus anonymity [Serjantov2002; Diaz2002]. But a consent gate means
   only *willing* relays carry traffic; if willingness concentrates on a few bridges, circuits
   funnel through them and the effective anonymity set may **shrink**. We therefore treat the
   sign of the federation effect as **unknown a priori** and report a shrink as prominently as a
   growth.
 **Contributions.** (i) The design and instrument-grade implementation of a consent-gated,
 federated, nested-SSH relay data plane with signed in-band accept/reject and per-hop X25519
 credentials (§3, §4). (ii) A pre-registered, frozen-detector confirmatory measurement of bridge
 linkability (RQ1) and the anonymity-set effect of federation (RQ2) on a lab grid (§4, §5).
 (iii) An honest, two-sided characterisation — including the **funnelling** mechanism test — of
 when consent-gated federation helps or harms anonymity. **[Quantitative findings — HELD BLIND.]**
 **Scope.** Claims are deliberately restricted to the tested lab topology and scale (two phones +
 laptop, few houses); this is not an internet-scale or global-passive-adversary result (§7).
 The paired **churn-resilience** question (RQ3) and a QUIC/`ssh3` transport arm [Michel2023] are
 pre-registered but held for a companion paper; this lead paper covers G4 + RQ1 + RQ2 only.
 ---
 ## 2. Related work
 **Onion routing and SSH-based relays.** Mixes and onion routing originate with Chaum [Chaum1981]
 and Reed–Syverson–Goldschlag [Reed1997], with Tor [Dingledine2004] as the dominant deployment.
 SOR [Egners2012] is the **direct prior art**: it layers onion routing over stock SSH tunnels,
 which is exactly our transport substrate. Nesting SSH inside SSH raises the well-known
 TCP-over-TCP throughput/latency pathology [Honda2005], motivating our latency-aware measurement
 and a (exploratory) QUIC-based `ssh3` transport [Michel2023]; UDP-based latency work on onion
 services [AlAzad2023] is complementary. **None of these model per-circuit relay consent**, which
 is the axis we add and measure.
 **Flow correlation / linkability (RQ1).** That an adversary seeing two segments of a flow can
 link them is established: low-cost traffic analysis [MurdochD05], realistic-adversary correlation
 on Tor [JohnsonWJSS13], and deep-learning correlators DeepCorr [NasrBH18] and DeepCoFFEA
 [OhYMH22] achieve high linking accuracy; packet-timing (Tik-Tok [RahmanSMGW20]) and deep
 fingerprinting [SirinamIJW18] show timing/volume suffice. We do **not** advance correlator
 state-of-the-art; we adopt a **frozen, fixture-calibrated** correlator (calibration gate §5) and
 use its AUC purely as an *instrument reading* of whether our bridge leaks — the contribution is
 the consent-gate/bridge measurement, not the attack.
 **Anonymity metrics and Sybil/directory concerns (RQ2).** We quantify anonymity with the
 information-theoretic set metrics of Serjantov–Danezis [Serjantov2002] (entropy of the adversary
 posterior; effective set size S = 2^H) and Díaz et al. [Diaz2002] (normalized degree
 d = H/log₂N). Federation across mutually-distrusting houses evokes decentralised-directory and
 Sybil questions [Douceur2002; Winter2016] and statistical-disclosure exposure over repeated
 circuits [Danezis2003]. Our **matched-N** design isolates the *topology* effect (federated vs.
 single-house at equal total node count) rather than a node-count artifact.
 **Social-trust / consent-adjacent designs (G4 neighbours).** The closest neighbours treat
 relaying willingness or social linkage as structural: Freenet's friend-to-friend mode
 [Clarke2000], membership-concealing overlays [Vasserman2009], Drac's social low-volume comms
 [Danezis2010], and social-graph routers Pisces [Mittal2012] / X-Vine [Mittal2012b] / STor
 [Zhou2011]. These encode *trust in the graph*; **none makes consent an in-band, per-circuit,
 signed accept/reject protocol step whose linkability and anonymity-set consequences are then
 measured** — the specific gap G4 fills.
 ---
 ## 3. System design (the instrument)
 The instrument is a nested-SSH relay data plane built into an existing zero-knowledge chat relay
 (hack-house), entirely within an isolated worktree. It has seven components (roadmap R1–R7); the
 subset load-bearing for this lead paper (RQ1 + RQ2, `static` selector, no model) is fully pinned
 by the freeze. Key mechanisms:
 - **Consent handshake (R5).** Each hop receives a signed in-band consent *request* and must
  **accept or reject** before it will carry the circuit. Requests are **Ed25519-signed** by the
  originating persona and **verified before acceptance**; an unsigned or forged request is
  rejected. Per-hop credentials are **X25519-sealed to the host's public key**, so a hop
  credential decrypts *only* with that host's private key (no shared-symmetric secret).
 - **Nested-SSH circuits (R4).** A circuit is a chain of SSH tunnels across grid hops; the entry
  and exit **segments** are the observable units for RQ1. Every hop's traffic is captured to an
  immutable per-hop pcap, written once and checksummed.
 - **Federation / bridge (R6).** Relays are grouped into **houses**. Houses federate via a shared
  **bridge** node or via a **directory**; a circuit's federation path is chosen under
  split-knowledge topology constraints. The bridge is the shared observation point RQ1 probes and
  the concentration point RQ2's funnelling test probes.
 - **Determinism & provenance (R1–R3).** All stochastic behaviour derives from a single
  `--sor-seed`; the seed, git SHA, and node-role→device mapping are echoed into an immutable
  `manifest.json`, and every relay event is appended to a SHA-256-sealed `events.jsonl`.
 - **Containment (binding).** Every forwarder runs in an **isolated engine only**
  (`assert engine != local` or the run refuses). All traffic is self-generated to our own
  fixtures, lab-only. No external target, no live-network relay.
 ---
 ## 4. Methods (pre-registered; frozen)
 This study is a **confirmatory factorial controlled comparison**; the design, variables, seeds,
 detectors, and analysis were frozen and hashed on 2026-07-19 before any confirmatory cell ran.
 ### 4.1 Design matrix
 Cells are organised per RQ with the other factors held at their declared control:
 - **RQ1 (linkability):** bridge ∈ {off, on, on+padding} — 3 levels; topology held at
  single-house, selector `static`. (bridge-off+padding is declared **N/A** — padding is defined
  only for bridge-on.)
 - **RQ2 (anonymity set):** topology ∈ {1-house-N, bridge-federated, directory-federated} at
  **matched total node count N** — 3 levels; bridge held off, selector `static`.
 Full crossing is not run. Run order is randomised within each cell and the control arm is
 interleaved before and after treatments so grid calibration drift is caught. All stochastic
 elements are seed-controlled.
 ### 4.2 Dependent variables
 - **RQ1 — correlation AUC.** Area under the ROC of the frozen flow-correlation detector scoring
  (entry-segment, exit-segment) pairs as same/different circuit, measured from the real per-hop
  pcaps. Unit of analysis: the **(entry, exit) pair**; 95% CI by **bootstrap over circuit
  pairs**.
 - **RQ2 — anonymity-set entropy H.** Shannon entropy of the **adversary's posterior over
  candidate senders per circuit**; effective set size S = 2^H [Serjantov2002], normalized
  d = H/log₂N [Diaz2002]; **Miller–Madow** finite-sample bias correction; 95% CI by **bootstrap
  over circuits**. Unit of analysis: the **circuit**. **ΔH = H(federated) − H(single-house,
  matched N).**
  > *Construction caveat (hard hold).* The prereg pins this DV as a per-circuit posterior but
  > does not give the posterior **construction rule**. A construction — uniform mass over the
  > observation-consistent anonymity set, grounded only in [Serjantov2002; Diaz2002] — is
  > **PROPOSED** in `docs/stage-05-rq2-posterior-clarification.md` and **awaits operator
  > ratification**. Until ratified, **no RQ2 number is computed.** The construction is
  > recomputable **offline** from the sealed per-circuit seeds (deterministic circuit assembly),
  > so the running battery is not wasted regardless of the ratified rule.
 ### 4.3 Sampling & power
 **R = 30** independent seeded runs per cell; each run builds **C = 50** circuits (≥ 1500 scored
 pairs per cell for RQ1). The target is **precision, not a formal power analysis**: ≥ 1500 pairs
 yields an expected bootstrap 95% CI half-width on AUC ≤ 0.03, enough to resolve the RQ1 floor
 away from 0.5. One base seed **S0 = 20260719**; per-cell seed = `SHA256(S0 ‖ cell_id ‖ run_index)`
 truncated to u64, echoed into every manifest. **Stopping rule:** all cells × R runs run to
 completion — **no optional stopping, no interim looks**; an uninformative cell is reported
 **inconclusive**, never extended to chase significance.
 ### 4.4 Frozen detectors and the instrument-validation gate
 Detectors (correlator, entropy estimator, classifier) are written and **calibrated only on the
 instrument-validation fixtures** — known-linked/known-unlinked control pairs and
 equiprobable-sender synthetic sets — **before any confirmatory cell is run**; **no per-cell
 tuning** is permitted. The battery ran only after all six boolean gate items passed green:
 (1) 3-hop end-to-end delivery with per-hop pcap + checksum; (2) seeded reproducibility (same seed
 → identical circuit-build sequence); (3) correlator calibration (known-linked AUC ≈ 1,
 known-unlinked ≈ 0.5); (4) entropy calibration (H = log₂N for N equiprobable senders);
 (5) isolation (`assert engine != local` or refuse); (6) provenance integrity (replayed fixture →
 schema-valid `events.jsonl` whose SHA-256 matches the manifest; append-only).
 ### 4.5 Analysis plan
 Effect size + 95% CI for **every** comparison; p-values never reported alone. All inference is
 bootstrap/permutation-based (10,000 resamples, **BCa** intervals; 3-seed spot-check to MC error).
 - **RQ1-P1 (leak).** Bridge-on correlation AUC, bootstrap 95% CI. **Confirmation gate = CI
  excludes 0.5** (leak present); **null** if CI includes 0.5. Materiality is a *separate* label:
  CI lower bound ≥ **0.60** ⇒ "material leak"; between 0.5 and 0.60 ⇒ "weak-but-real leak."
 - **RQ1-P2 (padding efficacy).** ΔAUC = AUC(bridge-on, no-pad) − AUC(bridge-on, +pad); **paired**
  bootstrap 95% CI. Padding effective iff ΔAUC CI **> 0**.
 - **RQ2-P1 (federation effect, two-sided).** ΔH bootstrap 95% CI; **the sign is not presumed.**
  **grow** if CI > 0; **honest shrink (reported with equal prominence)** if CI < 0;
  **inconclusive** if it spans 0. *(Computation gated on RQ2 ratification.)*
 - **RQ2-P3 (funnelling mechanism).** Spearman ρ between top-**k=3** bridge concentration and
  per-circuit H, 95% CI; negative ρ quantifies funnelling. *(Computation gated on RQ2
  ratification.)*
 - **Multiple comparisons.** Holm–Bonferroni over the frozen **family of 7** confirmatory tests
  {RQ1-P1, RQ1-P2, RQ2-P1, RQ2-P3, RQ3-P1-perf, RQ3-P1-latency, RQ3-P2}; the 4 lead-paper tests
  are reported at Holm-adjusted multipliers 7, 6, 5, 4 (conservative embedding — see
  `docs/stage-05-holm-clarification.md`, ratified). EXPLORATORY results (QUIC transport; any
  post-hoc contrast) are labelled and excluded from the confirmatory column.
 - **Data exclusion (pre-data).** A run is quarantined (logged, never silently dropped) **only**
  on a data-integrity failure (SHA mismatch, pcap checksum failure, in-place edit, or
  non-reproducing seed). **No performance-based exclusions.**
 ---
 ## 5. Results *(HELD BLIND — placeholders)*
 > Populated **once**, after the full battery completes and raw outputs are sealed. RQ2 subsections
 > additionally gated on ratification of the posterior construction. No confirmatory number appears
 > until then.
 ### 5.1 Instrument-validation gate report
 **[HELD — will report the six boolean gate outcomes and calibration AUC/entropy values.]**
 ### 5.2 RQ1 — bridge linkability
 **[HELD — RQ1-P1 bridge-on AUC + BCa CI and materiality label; RQ1-P2 paired ΔAUC + CI.]**
 ### 5.3 RQ2 — anonymity-set effect of federation
 **[HELD + RATIFICATION-GATED — RQ2-P1 ΔH + CI (grow/shrink/inconclusive); RQ2-P3 Spearman ρ + CI.]**
 ### 5.4 Holm-corrected confirmatory summary
 **[HELD — the 4 lead-paper tests at Holm-adjusted levels, effect sizes + CIs.]**
 ---
 ## 6. Discussion *(HELD BLIND — placeholder)*
 **[HELD — interpretation of the confirmed/null/inconclusive outcomes; the honest-null story if
 ΔH shrinks; what the funnelling ρ implies for consent-gated federation; padding efficacy.]**
 ---
 ## 7. Limitations & threats to validity
 - **Scale / adversary model (External).** The grid is two phones + a laptop and few houses; this
  is **not** internet-scale and **not** a global passive adversary. Claims are scoped to the
  tested topology/scale; entropy CIs are wide at small node counts (accepted, node counts
  reported).
 - **Construct.** Self-generated fixture traffic is not real user traffic (inherent to lab
  measurement; fixtures versioned/checksummed). A single correlator's AUC stands in for
  "linkability" and plug-in H for "anonymity" — mitigated by fixture calibration (§4.4) and by
  reporting S = 2^H and normalized d; a second entropy estimator (NSB) is reported EXPLORATORY as
  a sensitivity check.
 - **Internal.** Thermal/background load and device heterogeneity are mitigated by randomised
  order, interleaved controls, per-session idle baselines, and a pinned node-role→device mapping.
  Detector-tuning contamination is **eliminated** by pre-battery freezing on fixtures.
 - **RQ2 construction dependency.** The RQ2 result depends on the ratified posterior construction
  (§4.2 caveat); the construction is pre-specified blind, two-sided, and grounded only in cited
  metrics — but it is a specification the frozen prereg did not pin, and is disclosed as such.
 - **Dual-use (ethics).** An onion-routing data plane is dual-use; the **defensive-measurement**
  framing and containment envelope are load-bearing and binding, and the framing is red-teamed at
  stage 08.
 ---
 ## 8. Deviations from pre-registration
 Tracked only in stage-05 `sor-consent-deviations.md` (none edit the frozen prereg). Two
 clarifications recorded to date: the Holm family-size restatement
 (`docs/stage-05-holm-clarification.md`, **ratified**) and the RQ2 posterior construction
 (`docs/stage-05-rq2-posterior-clarification.md`, **PROPOSED — pending operator ratification**).
 ---
 ## References
 - **[Chaum1981]** Chaum, D. L. (1981). Untraceable Electronic Mail, Return Addresses, and Digital
  Pseudonyms. *CACM* 24(2), 84–90. https://doi.org/10.1145/358549.358563
 - **[Reed1997]** Reed, M. G., Syverson, P. F., & Goldschlag, D. M. (1997). Anonymous Connections
  and Onion Routing. *IEEE S&P 1997*, 44–54. https://doi.org/10.1109/secpri.1997.601314
 - **[Dingledine2004]** Dingledine, R., Mathewson, N., & Syverson, P. (2004). Tor: The
  Second-Generation Onion Router. *USENIX Security 2004*.
 - **[Egners2012]** Egners, A., Gatzen, D., Panchenko, A., & Meyer, U. (2012). Introducing SOR:
  SSH-based Onion Routing. *IEEE WAINA 2012*, 280–286. https://doi.org/10.1109/WAINA.2012.89
 - **[Honda2005]** Honda, O., et al. (2005). Understanding TCP over TCP. *SPIE 6011*.
  https://doi.org/10.1117/12.630496
 - **[Michel2023]** Michel, F., & Bonaventure, O. (2023). Towards SSH3. arXiv:2312.08396.
 - **[AlAzad2023]** Al Azad, M. W., et al. (2023). DarkHorse. *IEEE LCN 2023*. arXiv:2307.02429.
 - **[MurdochD05]** Murdoch, S. J., & Danezis, G. (2005). Low-Cost Traffic Analysis of Tor.
  *IEEE S&P 2005*, 183–195. https://doi.org/10.1109/SP.2005.12
 - **[JohnsonWJSS13]** Johnson, A., et al. (2013). Users Get Routed. *ACM CCS 2013*, 337–348.
  https://doi.org/10.1145/2508859.2516651
 - **[NasrBH18]** Nasr, M., Bahramali, A., & Houmansadr, A. (2018). DeepCorr. *ACM CCS 2018*,
  1962–1976. https://doi.org/10.1145/3243734.3243824
 - **[OhYMH22]** Oh, S. E., et al. (2022). DeepCoFFEA. *IEEE S&P 2022*, 1915–1932.
  https://doi.org/10.1109/SP46214.2022.9833801
 - **[RahmanSMGW20]** Rahman, M. S., et al. (2020). Tik-Tok. *PoPETs* 2020(3).
  https://doi.org/10.2478/popets-2020-0043
 - **[SirinamIJW18]** Sirinam, P., et al. (2018). Deep Fingerprinting. *ACM CCS 2018*, 1928–1943.
  https://doi.org/10.1145/3243734.3243768
 - **[Serjantov2002]** Serjantov, A., & Danezis, G. (2002). Towards an Information Theoretic Metric
  for Anonymity. *PET 2002*, LNCS 2482, 41–53. https://doi.org/10.1007/3-540-36467-6_4
 - **[Diaz2002]** Díaz, C., et al. (2002). Towards Measuring Anonymity. *PET 2002*, LNCS 2482,
  54–68. https://doi.org/10.1007/3-540-36467-6_5
 - **[Douceur2002]** Douceur, J. R. (2002). The Sybil Attack. *IPTPS 2002*, LNCS 2429, 251–260.
  https://doi.org/10.1007/3-540-45748-8_24
 - **[Danezis2003]** Danezis, G. (2003). Statistical Disclosure Attacks. *IFIP SEC 2003*.
 - **[Winter2016]** Winter, P., et al. (2016). Identifying and Characterizing Sybils in the Tor
  Network. *USENIX Security 2016*, 1169–1185.
 - **[Clarke2000]** Clarke, I., et al. (2000/2001). Freenet. *Designing PETs*, LNCS 2009.
  https://doi.org/10.1007/3-540-44702-4_4
 - **[Vasserman2009]** Vasserman, E. Y., et al. (2009). Membership-Concealing Overlay Networks.
  *ACM CCS 2009*, 390–399. https://doi.org/10.1145/1653662.1653709
 - **[Danezis2010]** Danezis, G., et al. (2010). Drac. *PETS 2010*, LNCS 6205, 202–219.
  https://doi.org/10.1007/978-3-642-14527-8_12
 - **[Mittal2012]** Mittal, P., Wright, M., & Borisov, N. (2012). Pisces. *NDSS 2013*.
  arXiv:1208.6326.
 - **[Mittal2012b]** Mittal, P., Caesar, M., & Borisov, N. (2012). X-Vine. *NDSS 2012*.
  arXiv:1109.0971.
 - **[Zhou2011]** Zhou, P., et al. (2011/2013). STor. arXiv:1110.5794.
 *(Full bibliography: `~/coding/sci-method/stages/01-literature/output/sor-consent-bibliography.md`.
 Integrity flags carried forward: [Stutzbach2006] secondary-sourced; [Constantinides2026] recent
 preprint — neither is load-bearing in this lead paper.)*