diff --git a/REPRODUCE.md b/REPRODUCE.md new file mode 100644 index 0000000..8e78d40 --- /dev/null +++ b/REPRODUCE.md @@ -0,0 +1,167 @@ +# Reproducing the `sor-consent` study + +A step-by-step checklist for reproducing the linkability / anonymity-set / churn-resilience +measurements reported in `docs/stage-07-paper-draft.md` and `docs/stage-07-companion-methods.md`. + +This instrument is built for **defensive measurement** of a trust model's exposure. It moves only +**self-generated fixture traffic** on **our own lab grid**, and every forwarder runs **inside an +isolated engine** (docker / multipass) — never on the host (`assert engine != local` or the code +refuses). Reproduce it in the same spirit: no external targets, no third-party traffic. + +**Self-contained.** Everything needed to reproduce is committed in this repo — no `sci-method` +checkout is required. The reproduction deposits are: + +| Deposit | Path | Purpose | +|---|---|---| +| Frozen pre-registration | `docs/prereg/sor-consent-prereg.md` (+ `.sha256`) | the hashed, frozen design; the launcher SHA-checks it | +| Bibliography | `docs/sor-consent-bibliography.md` | full 36-source reference list for the paper | +| Analysis + instrument | `cmd_chat/sor/` | every DV measure and analysis pass lives here | +| Analysis results + integrity manifest | `output/sor-confirmatory//` — `analysis/stage06-results.json`, `SHA256SUMS.txt`, `INTEGRITY-REPORT.md`, `provenance.json` | the committed, verifiable outputs of the frozen run | + +> **Raw data is *not* committed.** The per-run pcaps + event logs +> (`output/sor-confirmatory//confirmatory-data/`, ~1.2 GB: 9,000 `events.jsonl` + +> 27,000 pcaps) are `.gitignore`d for size. What *is* committed is their `SHA256SUMS.txt` +> manifest and the analysis results. To re-run the analysis from raw pcaps you must either obtain +> that archive out-of-band or re-collect it via §5; a clean clone can still **verify** the +> committed results and the integrity manifest. + +--- + +## 0. Where does the code run? (the common confusion) + +| Component | Runs where | How | +|---|---|---| +| Clone, venv, orchestration, analysis | **On the host** (your laptop) | you drive everything from the repo checkout | +| Circuit **forwarders / hops** | **Inside an isolated engine** (docker container or multipass VM) | spawned automatically by the code via the isolation prefix (`cmd_chat/agent/bridge.py:517-530`); the host never forwards | + +You **clone once, on the host.** You do **not** clone inside the VM. When a run starts, each hop is +launched into its own container/VM for you. There is a hard containment check: if the engine +resolves to `local`, the forwarder refuses to run. + +--- + +## 1. Get the code + +```bash +git clone https://git.churchofmalware.org/trilltechnician/hack-house.git +cd hack-house +git checkout feat/sor-consent-relay # the branch this study lives on +``` + +## 2. Set up the environment (host) + +```bash +hh/scripts/bootstrap.sh # Python venv + server deps + Rust client build +# (or: python3 -m venv .venv && . .venv/bin/activate && pip install -r requirements.txt) +``` + +Requires **Python 3.10+** and a Rust toolchain (bootstrap builds the client). + +Install **at least one isolated engine** — forwarders will not run without one: + +```bash +hh/scripts/ensure-docker.sh # docker (the default engine, --engine docker) +hh/scripts/ensure-multipass.sh # multipass (full-VM isolation), optional +``` + +## 3. Verify the instrument (no grid, no confirmatory data) + +```bash +pytest tests/ # Python acceptance checks (R1–R7) +cd hh && cargo test && cd .. # Rust `_sor` consent-parser proptests + +# Safe start-line preflight — runs the §5 gate, grid inventory, cell plan, +# a 2-run deterministic dry provenance pass, and the assembler dry check. +# Collects NO confirmatory data; prints a GO/NO-GO summary. +python -m cmd_chat.sor.confirmatory_run +``` + +A green preflight means the six instrument-validation gate items pass: 3-hop end-to-end delivery +with per-hop pcap + checksum, seeded reproducibility, correlator calibration (linked AUC≈1 / +unlinked≈0.5), entropy calibration (H=log₂N), isolated-engine-only forwarders, and append-only +provenance whose `events.jsonl` SHA-256 matches the manifest. + +## 4. Reproduce the reported analysis + +Every number in the paper is deterministically regenerable from the frozen raw data and the single +base seed **S0 = 20260719** — same seed → identical output. + +**Two things a clean clone can always do (no grid, no raw data):** re-hash the committed results +and verify the raw-data integrity manifest: + +```bash +cd output/sor-confirmatory/20260720T060132Z && sha256sum -c SHA256SUMS.txt # needs raw data present +# and inspect the committed frozen outputs directly: +cat output/sor-confirmatory/20260720T060132Z/analysis/stage06-results.json +``` + +**To regenerate the numbers from raw pcaps** you need the ~1.2 GB `confirmatory-data/` archive +present (obtain out-of-band, or re-collect via §5). With it in place: + +```bash +# Lead paper — RQ1-P1, RQ1-P2, RQ2-P1, RQ2-P3 (Holm family_size=7, report 4) +python -m cmd_chat.sor.analysis.stage06_run \ + output/sor-confirmatory/20260720T060132Z/confirmatory-data \ + --out output/sor-confirmatory/20260720T060132Z/analysis/stage06-results.json + +# Companion — RQ2-P3′ mechanism study and RQ3 +python -m cmd_chat.sor.analysis.rq2p3_confirm # shared-pool anonymity-set mechanism +python -m cmd_chat.sor.analysis.rq3_confirm # churn-resilience selector +``` + +Same seed → identical output (10,000 BCa bootstrap resamples, α = 0.05). Verify integrity by +re-hashing each run's `events.jsonl` against its `manifest.json`, and confirming the frozen prereg +still hashes to `f22331a72e0d0ccf38b787e63acabbe9d666456ec76076787a6d545c3193425b`. + +## 5. Re-run the full confirmatory battery (human-gated — needs the lab grid) + +The immutable data run (**R = 30 runs × C = 50 circuits = 9,000 live circuits**) is deliberately +**human-gated**. It is triple-locked and refuses to launch unless all four hold: + +1. **Operator token** — `SOR_CONFIRMATORY_GO=1` in the environment. +2. **Frozen prereg** — the on-disk prereg hashes to `f22331a7…` (see §6 caveat). +3. **Isolation** — `--engine docker` (or `multipass`); never `local`. +4. **Full grid** — every device reachable (the launcher refuses a degraded grid rather than + fabricate cells). + +```bash +SOR_CONFIRMATORY_GO=1 python -m cmd_chat.sor.confirmatory_run --operator-go --engine docker +python -m cmd_chat.sor.rq3_confirmatory_run --engine docker # companion RQ3 battery +``` + +Then re-run the §4 analysis over the freshly collected `confirmatory-data/`. + +--- + +## Seeds & determinism + +- **Base seed:** `S0 = 20260719` (fixed pre-data). +- **Per-cell seed:** `SHA256(S0 ‖ cell_id ‖ run_index)` — drives every stochastic element (path + selection, churn schedule, padding jitter) so two runs with the same seed produce an identical + circuit-build sequence. +- Seed + git SHA + node-role→device mapping are echoed into each run's immutable `manifest.json`. + +## Outputs (treat as immutable once written) + +``` +output/sor-runs// manifest.json · events.jsonl · pcap/hop.pcap · metrics.json +output/sor-confirmatory// preflight artifacts · confirmatory-data/ · analysis/ +``` + +## Honest reproduction caveats + +- **The frozen prereg is vendored.** The confirmatory launcher (§5) hard-refuses unless the + pre-registration is present and hashes to `f22331a7…`. The frozen prereg is committed in-repo at + `docs/prereg/sor-consent-prereg.md` (with `.sha256`), so this checkout is self-contained — no + `sci-method` access is needed. The launcher prefers the in-repo copy and falls back to the + operator's canonical `sci-method` checkout; the SHA-256 pin (not the path) is the integrity + guarantee. Verify it yourself: `cd docs/prereg && sha256sum -c sor-consent-prereg.sha256`. +- **The physical grid is lab-specific.** The reported run distributes hops across our own 2 phones + + laptop + hack-house VM churn fabric. An external reproducer instead uses the + **containerised-hop fallback** (all hops as isolated docker containers) — this reproduces the + instrument and the analysis, but not the exact physical device distribution. +- **Agent arm (RQ3).** Local open-weight (Ollama, temp 0) is **not** bit-identical across machines + (quantization / GPU logit drift). The agent arm reproduces via the **committed decision-log + + `(seed, state-hash)` cache replay**, not via independent cross-hardware model re-execution. + +See `CLAUDE.md` for the containment law and `docs/stage-07-paper-draft.md` §4 for the frozen method. diff --git a/cmd_chat/sor/confirmatory_run.py b/cmd_chat/sor/confirmatory_run.py index 9a321e5..2593518 100644 --- a/cmd_chat/sor/confirmatory_run.py +++ b/cmd_chat/sor/confirmatory_run.py @@ -45,8 +45,14 @@ from cmd_chat.sor.forwarder import assert_isolated # The frozen prereg (read-only source of truth) and its pinned SHA-256. A GO is # refused unless the on-disk prereg still hashes to this — no confirmatory run -# against an unfrozen/edited prereg. -FROZEN_PREREG = Path.home() / "coding/sci-method/stages/03-design/output/sor-consent-prereg.md" +# against an unfrozen/edited prereg. Two locations are accepted, in order: the +# in-repo vendored copy (so external reproducers have a self-contained artifact) +# and the operator's canonical sci-method checkout. The SHA-256 gate is identical +# for both — the pin, not the path, is the integrity guarantee. +_REPO_ROOT = Path(__file__).resolve().parents[2] +VENDORED_PREREG = _REPO_ROOT / "docs/prereg/sor-consent-prereg.md" +CANONICAL_PREREG = Path.home() / "coding/sci-method/stages/03-design/output/sor-consent-prereg.md" +FROZEN_PREREG_CANDIDATES = (VENDORED_PREREG, CANONICAL_PREREG) FROZEN_PREREG_SHA256 = "f22331a72e0d0ccf38b787e63acabbe9d666456ec76076787a6d545c3193425b" OPERATOR_TOKEN_ENV = "SOR_CONFIRMATORY_GO" @@ -57,12 +63,16 @@ def _ts() -> str: def verify_freeze() -> bool: - """True iff the on-disk frozen prereg still matches its pinned SHA-256.""" - try: - got = hashlib.sha256(FROZEN_PREREG.read_bytes()).hexdigest() - except OSError: - return False - return got == FROZEN_PREREG_SHA256 + """True iff a frozen prereg is present (vendored or canonical) and its bytes + still hash to the pinned SHA-256.""" + for path in FROZEN_PREREG_CANDIDATES: + try: + got = hashlib.sha256(path.read_bytes()).hexdigest() + except OSError: + continue + if got == FROZEN_PREREG_SHA256: + return True + return False def preflight(out_dir: Path, *, order_seed: int = battery.S0, allow_live_gate: bool = True) -> Dict[str, Any]: diff --git a/docs/prereg/sor-consent-prereg.md b/docs/prereg/sor-consent-prereg.md new file mode 100644 index 0000000..4d86e8a --- /dev/null +++ b/docs/prereg/sor-consent-prereg.md @@ -0,0 +1,322 @@ +# Pre-registration — sor-consent (FROZEN) + +> **STATUS: FROZEN — human-approved at the stage-03 checkpoint on 2026-07-19.** +> The SHA-256 of this file is recorded in `sor-consent-prereg.sha256` and must be echoed into +> every run manifest (R2). Every item previously marked **[APPROVAL]** is hereby **approved as +> stated**. From here, **no change edits this file** — any deviation appears only in stage 05's +> `sor-consent-deviations.md` (§8). No confirmatory data-collecting run may occur until the +> instrument-validation gate (§5) passes green. Per `shared/GOAL-sor-consent.md` the prereg freeze +> (now done) and any containment-boundary change are the human gates; the paid frontier-model +> selector arm is **off the confirmatory path** (decision D1, §9 — the agent arm runs on a local +> model at $0) and only re-engages the budget gate if run as an EXPLORATORY contrast. + +## 1. Study information + +- **Title:** Consent-Gated Federated Onion Routing: Linkability, Anonymity Set, and + Churn Resilience of an In-Band Accept/Reject Relay Model +- **Slug:** sor-consent · **Draft date:** 2026-07-19 · **Author:** operator + Claude (sci-method pipeline) +- **Hypotheses:** normative in `../../02-hypothesis/output/sor-consent-hypothesis.md` + §H-RQ1, §H-RQ2, §H-RQ3 (each H1/H0, predictions P1–P3, falsification condition, operational + definitions, scope). That file is authoritative; no rewording here. Reproduced references + below point to it by section, not by copy. +- **Build dependency:** every DV is gated behind `shared/roadmap-sor-consent.md` items + R1–R7 [REQUIRED-for-H1]. hack-house has no data plane today; the instrument is built in the + worktree `/home/dell/coding/learning/hack-house-sor-consent` (branch `feat/sor-consent-relay`) + before any confirmatory run. sci-method and hack-house `main` are never modified. + +## 2. Design + +- **Type:** Confirmatory factorial controlled comparison (systems measurement / simulation), + three RQ families sharing one instrument, each with its own control arm. Traffic is + self-generated to our own fixtures; measurement is on our own lab grid only. +- **Justification vs alternatives:** + - *Analytical modelling alone* (e.g., entropy bounds from a graph model) cannot capture the + consent-gating funnel effect or a real nested-SSH rebuild fingerprint — the phenomena under + test are emergent from the actual data plane, so a built instrument is required. + - *Single-factor A/B per RQ* would miss cross-factor interactions (e.g., topology × selector) + and force three separate underpowered studies; a shared factorial instrument amortizes the + (large) build cost across all three DV families. + - *Internet-scale / live-network measurement* is out of scope and out of the containment + envelope; the claim is deliberately scoped to the local grid (§7 External). +- **Design matrix (confirmatory cells):** + - **RQ1 (linkability):** bridge {off, on, on+padding} — 3 levels. + - **RQ2 (anonymity set):** topology {1-house-N, bridge-federated, directory-federated} at + **matched total node count N** — 3 levels. + - **RQ3 (churn resilience):** selector {static, random, agent} × churn schedule {seeded set, + §4} — 3 selector levels. + - Full crossing is **not** run; cells are organized per RQ with the other factors held at + their declared control (RQ1 at single-house/static; RQ2 at bridge-off/static; RQ3 at + single-house/bridge-off). **N/A cells are declared here, not dropped ad hoc:** padding is + only defined for bridge-on (bridge-off+padding is N/A). **The `agent` selector runs on a + pinned local/open-weight model from the hackhouse agent fabric (decided 2026-07-19, §Design + decisions), so RQ3 is confirmatory at $0 with no paid-budget gate;** a paid frontier model is + an optional EXPLORATORY "stronger-model" contrast only. If the local model fails the §5 + latency/quality calibration, RQ3's agent arm falls back to a funded follow-on — a data-driven + fallback at the gate, not a pre-commitment. +- **Assignment / order:** materials are fixed (no unit randomization); **run order is + randomized within each cell and controls are interleaved with treatments** (control arm of + each RQ scheduled before and after its treatments) so calibration drift on the grid is caught. + All stochastic elements are seed-controlled (§4, R1). +- **Blinding:** the correlator/entropy/classifier code (R7) is written and calibrated on the + instrument-validation fixtures (§5) — known-linked/known-unlinked control pairs and + equiprobable-sender synthetic sets — **before any confirmatory cell is run**; no per-cell + tuning of any detector is permitted (deviations policy §8). No human inspects confirmatory + intermediate results before the full battery completes. + +## 3. Variables + +- **Independent variables (levels → how manipulated):** + - *Bridge condition* {off, on, on+padding} — R6 bridge mode + R1/R4 padding config. + - *Federation topology* {1-house-N, bridge-federated, directory-federated} — R6 federation. + - *Selector strategy* {static, random, agent} — R7 selector module; `agent` = **local/open-weight + model** from the hackhouse agent fabric, **[APPROVAL]** exact model ID + weights digest pinned + at freeze; confirmatory, no paid-budget gate (§Design decisions, 2026-07-19). + - *Churn schedule* — seeded VM spin/kill schedule over the hackhouse VM fabric (R7 churn, R1 seed). + - *(EXPLORATORY — decided 2026-07-19, §Design decisions)* transport arm {TCP-nested, + QUIC-nested `ssh3`} — R1/R4. **TCP-nested is the confirmatory workhorse; QUIC stays + EXPLORATORY** (orthogonal to all three RQs; a weak lit-gap; avoids doubling cells + build). + Labeled EXPLORATORY in analysis and paper. +- **Dependent variables (exact metric → measurement procedure):** + - **RQ1 — correlation AUC:** area under the ROC of the R7 flow-correlation detector (inherited + from hh-agents R8/R10) scoring (entry-segment, exit-segment) pairs as same/different circuit. + Computed from `bridge_forward` byte/latency events (R3) at the bridge node. 95% CI by + bootstrap over circuit pairs. + - **RQ2 — anonymity-set entropy H:** Shannon entropy of the adversary's posterior over + candidate senders per circuit; effective set size S = 2^H per [Serjantov2002], normalized + d = H/log2(N) per [Diaz2002]. **Estimator [APPROVAL]:** plug-in (MLE) entropy with + **Miller–Madow bias correction** for finite-sample bias; 95% CI by bootstrap over circuits. + ΔH = H(federated) − H(single-house, matched N). + - **RQ3 — throughput retention, added latency, rebuild-classifier AUC:** throughput retention = + (throughput under churn) / (no-churn baseline throughput), per selector; added latency = + median end-to-end latency(selector) − median latency(best baseline), in ms; rebuild-classifier + AUC = AUC of the R7 classifier on the rebuild-event time series (per [Barton2025] CLASI + spirit). All from R3 event logs + R4 per-hop byte/latency events. +- **Confounds → strategy:** + | Confound | Strategy | + |---|---| + | Background load / thermal throttling on grid devices (2 phones + laptop) | RANDOMIZE run order + interleave controls; MEASURE per-device idle baseline each session; report as covariate | + | Device heterogeneity (phone vs laptop hop capacity) | HOLD CONSTANT — node-role→device mapping fixed across all cells of a comparison; documented in manifest (R2) | + | Detector overfitting / tuning contamination | ELIMINATE — detectors frozen + calibrated on §5 fixtures pre-battery; no per-cell retuning (blinding, §2) | + | Seed leakage / non-determinism | ELIMINATE — single base seed → per-cell derived seeds in config; R1 determinism acceptance check | + | Wall-clock timestamps entering the correlator | HOLD CONSTANT — detector consumes only R3 event features declared at freeze; wall-clock excluded from features | + | Self-generated traffic ≠ real user traffic | ACCEPT (construct) — scoped in §7; fixtures documented and versioned | + | Isolation escape (forwarder on host) | ELIMINATE — `assert engine != local` or refuse (R4; `bridge.py:528-529`); containment gate §5 | + | Small number of houses/nodes for RQ2 entropy | MEASURE + ACCEPT — node counts reported; underpowered-for-large-N caveat → Limitations | + +## 4. Sampling & power + +- **Unit of analysis:** RQ1 — the (entry, exit) circuit-segment pair (AUC over the pair set); + RQ2 — the circuit (entropy of the per-circuit sender posterior); RQ3 — the seeded run + (throughput/latency aggregate) and the rebuild event (classifier). +- **Repetition count [APPROVAL]:** **R = 30 independent seeded runs per design cell**; each run + builds a fixed **C = 50 circuits** (→ ≥ 50 same-circuit and ≥ 50 different-circuit pairs per + run for RQ1, ≥ 1500 pairs/cell). Rationale is a **precision target**, not a formal power + analysis: with ≥ 1500 scored pairs per cell the bootstrap 95% CI half-width on AUC is + expected ≤ 0.03, sufficient to resolve the RQ1 floor (§6) away from 0.5; 30 runs satisfies the + CLT/dispersion requirement in `_config/rigor-standards.md §Statistics` for stochastic systems. + Exact R, C confirmed at freeze against the §5 calibration CI widths. +- **Seeds:** one base seed **`S0 = 20260719`** (fixed at freeze; the freeze date, no hidden + structure); per-cell seed = `SHA256(S0 ‖ cell_id ‖ run_index)` truncated to u64, echoed into + every `manifest.json` (R2) and + `events.jsonl` (R3). Determinism verified by R1's acceptance check on a spot-checked cell. +- **Stopping rule (fixed, pre-registered):** all cells × R runs are run to completion; **no + optional stopping, no peeking-driven extension, no interim looks.** If a cell's CI is + uninformative at the frozen R, that cell is reported **inconclusive** — the battery is not + extended to chase significance (`rigor-standards §Statistics`; GOAL Phase T). + +## 5. Materials & procedure + +- **Instrument (built, worktree):** R1–R7 in `hack-house-sor-consent` @ branch + `feat/sor-consent-relay`; git SHA recorded per run (R2). Components: seed plumbing (R1), + provenance writer (R2), immutable JSONL event log + SHA-256 (R3), nested-SSH data plane (R4), + consent handshake + X25519 hop credentials (R5), federation/bridge (R6), churn generator + + selector + correlator/entropy/classifier (R7). +- **Compute grid:** 2 Android phones + laptop as nested-SSH relay hops (SSH); hackhouse VM + fabric as churn source. Node-role→device mapping pinned per comparison and recorded in R2. +- **Isolation / containment (binding at every cell):** every forwarder runs in an **isolated + engine only** (docker/multipass via `bridge.py:517-530`); **`assert engine != local` or the + run refuses.** All traffic is **self-generated to our own fixtures**, lab-only across our own + houses/VMs. No external target, no live-network relay — a hard stop requiring explicit human + approval (GOAL envelope (b)). Fixtures (payload streams, synthetic sender sets) versioned in + the worktree and checksummed. +- **Models:** static/random selectors need no model — **RQ1 and RQ2 use no selector model at all** + (selector held at `static` for their controls), so the lead paper (G4+RQ1+RQ2) is fully pinned by + this freeze. The `agent` selector arm (RQ3 only) uses a **single pinned local/open-weight model** + served from the hackhouse agent fabric. **Bounded instrument-pin (the one value not nameable at + freeze):** the exact model ID + weights digest + sampling params (temperature, top_p, max tokens) + are fixed at the **§5 RQ3 calibration gate — before any RQ3 confirmatory run — recorded in the + run manifest (R2), and immutable for the entire RQ3 battery;** any change is a §8 deviation. This + bound touches RQ3 alone and never RQ1/RQ2. This supersedes the roadmap's "frontier-model arm" + assumption: choosing a local model + **eliminates** the paid-frontier budget gate (GOAL envelope (c)) rather than bypassing it, and + improves reproducibility (pinned weights vs a moving hosted endpoint). A paid frontier model, if + ever run, is an EXPLORATORY contrast, separately budget-gated. The arm's prompt text is versioned + and included in the paper appendix (`rigor-standards §LLM/agent`). +- **Instrument-validation HARD GATE (must pass before ANY confirmatory run; boolean, from + GOAL "Done" and roadmap Phase IV — each maps to an R-item acceptance check):** + 1. **End-to-end delivery:** a 3-hop self-traffic circuit across the grid delivers a known + payload end-to-end; each hop's pcap exists and checksums (R4). + 2. **Seeded reproducibility:** `smoke-e2e.sh`-style bringup is reproducible from a seed — + same seed + same churn script → identical circuit-build sequence and selector choices, + diff-clean modulo wall-clock (R1). + 3. **Correlator calibration (= P3-RQ1):** the R7 correlator scores a known-linked control + pair at AUC ≈ 1 and a known-unlinked pair at AUC ≈ 0.5. + 4. **Entropy calibration (= P2-RQ2):** the estimator returns H = log2(N) (within MC error) + for N equiprobable synthetic senders. + 5. **Isolation:** forwarders confirmed isolated engine only — `assert engine != local` or + refuse (R4; `bridge.py:528-529`). + 6. **Provenance integrity:** replaying a fixture circuit yields a schema-valid `events.jsonl` + whose SHA-256 matches `manifest.json`; log is append-only (R2/R3). + Gate is boolean; any red → back to the failing R-item; **no confirmatory cell runs until all + green** (GOAL; roadmap Phase IV). +- **Procedure (numbered; becomes the stage-04/05 run spec):** + 1. Build R1–R7; pass every [REQUIRED-for-H1] acceptance check as a test where feasible. + 2. Run the §5 instrument-validation gate; record the gate report. + 3. Freeze seeds + thresholds (this document, on approval) and hash. + 4. Run the confirmatory battery: all §2 cells × R runs, controls interleaved, order randomized + within cell. Each run writes `manifest.json` (R2), appends `events.jsonl` (R3), writes + per-hop `pcap/hop.pcap` (R4) — all SHA-256'd and immutable. + 5. R7 analysis reads `events.jsonl` + pcaps → `metrics.json` (AUC, H, throughput/latency, + rebuild AUC) per cell. + 6. Lock raw outputs (stage 05 immutability). No edits; cleaning only in analysis code on copies. + +## 6. Analysis plan + +Effect size + 95% CI reported for **every** comparison (`rigor-standards §Statistics`); +p-values never reported alone. All confirmatory tests below; anything else EXPLORATORY. + +- **RQ1 (H-RQ1 P1, P2):** + - *P1 (leak):* bridge-on correlation AUC with bootstrap 95% CI. **Confirmation gate = the CI + excludes 0.5** (a leak is present); **NULL/refute** if the CI includes 0.5. This mirrors the + stage-02 falsification condition exactly and removes a dead zone (see below). Materiality is a + **separate pre-registered label, not the gate:** AUC CI-lower-bound ≥ **0.60 [APPROVAL]** ⇒ + "material leak"; between 0.5 and 0.60 ⇒ "weak-but-real leak." Raw AUC + CI are reported in + every case. *(Refines the stage-02 P1 operationalization pre-data — legitimate, not HARKing: + the original "AUC > AUC_floor AND CI excludes 0.5" created an un-adjudicable zone where a real + leak, e.g. AUC 0.57 / CI [0.53, 0.61], was neither confirmable nor refutable; §Design decisions.)* + - *P2 (padding efficacy):* ΔAUC = AUC(bridge-on, no-pad) − AUC(bridge-on, +pad); paired + bootstrap 95% CI. Padding effective iff ΔAUC CI **> 0**. +- **RQ2 (H-RQ2 P1, P3):** + - *P1 (two-sided):* ΔH = H(federated) − H(single-house, matched N), bootstrap 95% CI; + **the design does not presume the sign.** **CONFIRM-grow** if ΔH CI **> 0**; + **CONFIRM-shrink (honest null, published with equal prominence)** if ΔH CI **< 0**; + **inconclusive** if the CI spans 0. *Matched-N rule [APPROVAL]:* single-house arm sized so + its node count equals the **total consenting nodes** of the federated arm. + - *P3 (mechanism, confirmatory):* Spearman ρ between top-k bridge concentration (fraction of + circuits through the top-k willing bridges) and per-circuit H, with 95% CI; negative ρ + quantifies funneling. **k = 3 [APPROVAL].** +- **RQ3 (H-RQ3 P1, P2, joint P3):** + - *P1 (perf):* throughput_retention(agent) − max(static, random), bootstrap 95% CI, plus + added-latency(agent) 95% CI. Perf holds iff retention-margin CI lower bound **≥ X%** AND + added-latency CI upper bound **≤ Y ms**. **X = 10 percentage points; Y = 100 ms [APPROVAL]** + (grid is a LAN of phones+laptop; Y is the added-latency budget over the best baseline; both + reconfirmed against §5 baseline latencies at freeze). + - *P2 (anonymity):* rebuild-classifier AUC with 95% CI. Anonymity holds iff the CI **upper + bound ≤ AUC_ceiling**. **AUC_ceiling = 0.60 [APPROVAL]** (symmetric with the RQ1 floor: + a rebuild pattern discriminable at ≤ 0.60 is not a usable fingerprint). + - *P3 (joint):* **CONFIRM** iff P1 AND P2 both hold; **H0** if either fails. +- **Multiple-comparison correction [APPROVAL]:** the confirmatory hypothesis tests across all + three RQ families are corrected together by **Holm–Bonferroni** (`rigor-standards §Statistics` + default). Test family (7 confirmatory tests): {RQ1-P1, RQ1-P2, RQ2-P1, RQ2-P3, RQ3-P1-perf, + RQ3-P1-latency, RQ3-P2}. RQ3-P3 is a logical AND of already-corrected tests, not a new test. + CIs are reported at the Holm-adjusted level for the confirmatory family. EXPLORATORY results + (transport arm; any post-hoc contrast) are labeled and excluded from the confirmatory column. +- **Assumption checks + fallbacks:** all inference is **bootstrap/permutation-based** and + therefore assumption-light by construction; no normality assumed. Bootstrap: 10,000 resamples, + BCa intervals; seed spot-check (3 seeds must agree to MC error). Entropy bias handled by + Miller–Madow (§3); sensitivity to a second estimator (NSB) reported EXPLORATORY. +- **Data exclusion rules (pre-data):** a cell/run is quarantined (logged, never silently + dropped) **only** if its data-integrity check fails — `events.jsonl` SHA-256 ≠ manifest, a + pcap fails checksum, an in-place edit is detected, or the seed does not reproduce the logged + circuit-build sequence for that spot-checked cell. No performance-based exclusions. +- **Outcome mapping (decision rule, frozen now; thresholds frozen on approval):** + - RQ1: P1 confirm ⇒ bridge linkability leak (motivates the padding artifact); P1 null ⇒ + headline null (bridge present, no measurable leak — reportable). P2 sign gives padding efficacy. + - RQ2: ΔH CI > 0 ⇒ federation grows the anonymity set; ΔH CI < 0 ⇒ **honest null / shrink, + reported as prominently as growth**; spans 0 ⇒ inconclusive. Expectation-bias guard binding + (`rigor-standards`; GOAL honest-expectation). + - RQ3: P1 ∧ P2 ⇒ agent selector helps without a rebuild fingerprint; either fails ⇒ H0 + (perf gain cancelled by teardown overhead, or rebuild timing is classifiable). + +## 7. Threats to validity + +| Threat | Type | Disposition | +|---|---|---| +| Background load / thermal throttling skews throughput & latency | Internal | MITIGATED — randomized order, interleaved controls, per-session idle baseline measured & modelled | +| Detector tuning contamination (correlator/classifier fit to confirmatory data) | Internal | ELIMINATED — detectors frozen + calibrated on §5 fixtures pre-battery; no per-cell retuning | +| Device heterogeneity confounds topology/selector effects | Internal | HOLD CONSTANT — node-role→device mapping pinned per comparison, recorded in R2 manifest | +| Local grid (2 phones + laptop, few houses) ≠ internet-scale; not a global passive adversary | External | ACCEPTED + scoped — claims restricted to the tested topology/scale → Limitations | +| Self-generated fixture traffic ≠ real user traffic patterns | Construct | ACCEPTED — inherent to a lab measurement; scoped → Limitations; fixtures versioned | +| A single detector's AUC as "linkability"; plug-in H as "anonymity" | Construct | MITIGATED — calibrated instruments (§5 P3/P2 gates); H reported with S=2^H and normalized d; second estimator (NSB) as EXPLORATORY sensitivity | +| Multiplicity across three RQ families | Statistical | Holm–Bonferroni over the 7 confirmatory tests (§6); EXPLORATORY family labeled | +| Small node/house counts → wide entropy CIs | Statistical | ACCEPTED + reported — node counts stated; underpowered-for-large-N caveat → Limitations | +| Bootstrap CI validity at small per-cell N | Statistical | MITIGATED — R=30 runs × C=50 circuits (§4); BCa intervals; seed spot-check | +| Agent-arm model non-determinism (temp>0) | Statistical | R repeated runs; variance reported; model ID + params pinned (§5) | +| Isolation escape / traffic leaving the lab | Internal/containment | ELIMINATED — `assert engine != local` or refuse; self-fixtures only; external target = human-gated hard stop | +| Dual-use of an onion-routing data plane | Construct/ethics | Defensive-measurement framing load-bearing; containment (scout §6) binding; stage-08 red-teams the framing | + +**Citation-integrity notes (carried forward):** [Stutzbach2006] session-count figures are +**secondary-sourced** — re-confirm against the primary before any load-bearing use in the paper; +[Constantinides2026] is a **Feb-2026 preprint** — re-confirm status/claims before citing as +support. Neither is load-bearing for any confirmatory threshold above. + +## 8. Freeze block (ACTIVE) + +- **Freeze date: 2026-07-19** (human-approved at the stage-03 checkpoint). **SHA-256:** recorded + in `sor-consent-prereg.sha256` (external, so this file's own hash is well-defined) and echoed + into every run manifest (R2). All [APPROVAL] values (§4/§6 thresholds, base seed S0, matched-N, + top-k, X%, Y ms, ceilings, estimator, R and C, Holm family) are **approved as stated**. The one + bounded post-freeze pin — the RQ3 local agent-model ID/digest — is fixed at the §5 calibration + gate before any RQ3 confirmatory run and recorded immutably (§5); it does not affect RQ1/RQ2. +- **Frozen on approval:** the three RQ hypotheses (by reference to the stage-02 file); all IV + levels (§2–3); all DV operationalizations (§3, R7 metrics); the numeric thresholds now marked + [APPROVAL] — RQ1 confirmation gate (CI excludes 0.5) + the 0.60 materiality label, matched-N + rule, top-k, X%, Y ms, AUC_ceiling, entropy estimator, local agent-model ID + weights digest, + base seed S0, R and C; the Holm confirmatory family (§6); and the stopping rule (§4). +- **Reporting/packaging (frozen intent, not a statistical commitment):** all three RQs are + pre-registered as confirmatory now; the **lead paper = G4 + RQ1 + RQ2**; **RQ3 is a designated + severable follow-on** (§Design decisions). Packaging is finalized at stage 07 from the results; + the shared prereg + Holm family are disclosed in whichever papers result. +- **Post-freeze policy:** any change of any kind — including promoting the transport arm or the + paid frontier selector arm — appears **only** in stage 05's `sor-consent-deviations.md` with + reason and expected impact; the frozen file is never edited. No HARKing; confirmatory ≠ exploratory. +- **Attestation at freeze:** detectors (correlator, entropy estimator, rebuild classifier) were + calibrated only on the §5 instrument-validation fixtures, with no exposure to confirmatory-cell + data, before the battery. + +## 9. Design decisions (pre-freeze, 2026-07-19) + +Recorded so the human approver and stage-08 reviewer can audit the reasoning and **circle back** +if any assumption changes. All predate any confirmatory data. Full rationale + +rejected-alternatives in `sor-consent-design-notes.md`. + +| # | Fork | Decision | Why | +|---|---|---|---| +| D1 | Agent selector: paid frontier vs {static,random} only | **Local/open-weight model** from hackhouse fabric; confirmatory, $0 | Answers RQ3's actual question; eliminates (not bypasses) the paid-budget gate; better reproducibility than a hosted endpoint. Fallback: funded follow-on only if it fails §5 calibration | +| D2 | RQ1 confirmation gate | **Gate = CI excludes 0.5**; 0.60 becomes a materiality *label* | Removes an un-adjudicable dead zone (real leak that was neither confirmable nor refutable); mirrors the stage-02 falsification condition | +| D3 | Transport arm (TCP vs QUIC/ssh3) | **TCP-nested confirmatory; QUIC EXPLORATORY** | Orthogonal to all three RQs; a weak lit-gap; avoids doubling cells, build, and multiplicity | +| D4 | Containment boundary | **Unchanged, verbatim** | Isolated-engine-only / self-fixtures / lab-only is the dual-use ethical backbone; no reason to touch | +| D5 | Freeze/hash | **Deferred** — remains DRAFT until explicit human "freeze" | Operator wants the packaging fork (D6) kept open to circle back before committing | + +### D6 — Packaging fork: one paper vs several (the explicit "circle-back" record) + +- **The fork:** bundle all three RQs into one paper, or split per-RQ into several. +- **Structure of the evidence:** RQ1 (bridge linkability) and RQ2 (federation's anonymity-set + effect) are two halves of **one** story — the anonymity properties of the consent-gated federated + topology, measured with the same anonymity metrics for the same reader. RQ3 (churn resilience + + agent-managed rebuilds) is a **different axis** (availability / AI-network-control) with a + different reviewer pool. Natural fracture line = **RQ1+RQ2 | RQ3**. Three papers = over-fragmented + (RQ1 alone is thin, and salami-slicing RQ1 from RQ2 is unjustifiable). +- **Decision (revisable at stage 07):** **Lead paper = G4 + RQ1 + RQ2; RQ3 = designated severable + follow-on.** Matches roadmap Phase P (2026-07-19), now on firmer footing because D1 makes RQ3 a + $0 confirmatory arm rather than a budget-fragile one. +- **Why this is safe to defer:** the packaging choice lives at **stage 07 (drafting)**, not here. + We **build once** (R1–R7), **pre-register all three RQs as confirmatory now**, **run the battery + once**, and only *then* decide packaging from the observed results. Deferring costs nothing and is + **not** salami-slicing: they are one pre-registered instrument + battery, and the shared prereg + + Holm-corrected family are disclosed in whichever papers result (which is *more* rigorous). The + only property this preserves that dropping RQ3 would forfeit is RQ3's confirmatory eligibility. +- **Circle-back triggers:** revisit at stage 07 if — RQ3's results are strong enough to headline on + their own (→ firm split), or thin enough to fold in as a section (→ single bundled paper); or if a + target venue's scope forces a particular cut. Record any change in the stage-05 deviations log if + it touches a frozen item, otherwise as a stage-07 drafting note. diff --git a/docs/prereg/sor-consent-prereg.sha256 b/docs/prereg/sor-consent-prereg.sha256 new file mode 100644 index 0000000..0478828 --- /dev/null +++ b/docs/prereg/sor-consent-prereg.sha256 @@ -0,0 +1 @@ +f22331a72e0d0ccf38b787e63acabbe9d666456ec76076787a6d545c3193425b sor-consent-prereg.md diff --git a/docs/sor-consent-bibliography.md b/docs/sor-consent-bibliography.md new file mode 100644 index 0000000..adeb531 --- /dev/null +++ b/docs/sor-consent-bibliography.md @@ -0,0 +1,253 @@ +# Bibliography — sor-consent + +Slug: `sor-consent` · Stage 01 · Compiled 2026-07-19 · Format per `_config/citations.md` +36 sources. Every entry verified via ≥1 of: Semantic Scholar, arXiv, Crossref, DBLP, or full-PDF +extraction. No entry asserted from title alone. Access date 2026-07-19 unless noted. + +--- + +## A. Onion-routing foundations & nested-tunnel transport + +### [Chaum1981] +Chaum, D. L. (1981). Untraceable Electronic Mail, Return Addresses, and Digital Pseudonyms. +*Communications of the ACM*, 24(2), 84–90. +DOI/URL: https://doi.org/10.1145/358549.358563 +Accessed: 2026-07-19 · Tier: 1 + +### [Reed1997] +Reed, M. G., Syverson, P. F., & Goldschlag, D. M. (1997). Anonymous Connections and Onion Routing. +*Proc. 1997 IEEE Symposium on Security and Privacy*, 44–54. +DOI/URL: https://doi.org/10.1109/secpri.1997.601314 +Accessed: 2026-07-19 · Tier: 1 + +### [Dingledine2004] +Dingledine, R., Mathewson, N., & Syverson, P. (2004). Tor: The Second-Generation Onion Router. +*Proc. 13th USENIX Security Symposium*. +DOI/URL: https://www.usenix.org/conference/13th-usenix-security-symposium/tor-second-generation-onion-router +(DTIC report DOI: https://doi.org/10.21236/ada465464) · Accessed: 2026-07-19 · Tier: 1 + +### [Egners2012] +Egners, A., Gatzen, D., Panchenko, A., & Meyer, U. (2012). Introducing SOR: SSH-based Onion Routing. +*Proc. 2012 26th Int'l Conf. on Advanced Information Networking and Applications Workshops (WAINA)*, +280–286. [IEEE Xplore doc 6185136] +DOI/URL: https://doi.org/10.1109/WAINA.2012.89 +Accessed: 2026-07-19 · Tier: 1 ← **direct prior art (SOR)** + +### [Honda2005] +Honda, O., Ohsaki, H., Imase, M., Ishizuka, M., & Murayama, J. (2005). Understanding TCP over TCP: +Effects of TCP Tunneling on End-to-End Throughput and Latency. *SPIE Proc. Vol. 6011* (Optics East). +DOI/URL: https://doi.org/10.1117/12.630496 +Accessed: 2026-07-19 · Tier: 1 + +### [Michel2023] +Michel, F., & Bonaventure, O. (2023). Towards SSH3: How HTTP/3 Improves Secure Shells. +*arXiv preprint* arXiv:2312.08396 [cs.NI]. (impl: github.com/francoismichel/ssh3) +DOI/URL: https://arxiv.org/abs/2312.08396 +Accessed: 2026-07-19 · Tier: 2 (preprint) + +### [AlAzad2023] +Al Azad, M. W., Zahan, H., Taki, S. U., & Mastorakis, S. (2023). DarkHorse: A UDP-based Framework to +Improve the Latency of Tor Onion Services. *Proc. 48th IEEE Conf. on Local Computer Networks (LCN)*. +DOI/URL: https://arxiv.org/abs/2307.02429 +Accessed: 2026-07-19 · Tier: 1 (conf.; arXiv copy) + +--- + +## B. Traffic correlation / flow-linkability (RQ1) + +### [NasrBH18] +Nasr, M., Bahramali, A., & Houmansadr, A. (2018). DeepCorr: Strong Flow Correlation Attacks on Tor +Using Deep Learning. *Proc. 2018 ACM SIGSAC CCS*, 1962–1976. +DOI/URL: https://doi.org/10.1145/3243734.3243824 (arXiv:1808.07285) +Accessed: 2026-07-19 · Tier: 1 + +### [OhYMH22] +Oh, S. E., Yang, T., Mathews, N., Holland, J. K., Rahman, M. S., Hopper, N., & Wright, M. (2022). +DeepCoFFEA: Improved Flow Correlation Attacks on Tor via Metric Learning and Amplification. +*43rd IEEE Symposium on Security and Privacy (S&P)*, 1915–1932. +DOI/URL: https://doi.org/10.1109/SP46214.2022.9833801 +Accessed: 2026-07-19 · Tier: 1 + +### [SunEVLRCM15] +Sun, Y., Edmundson, A., Vanbever, L., Li, O., Rexford, J., Chiang, M., & Mittal, P. (2015). RAPTOR: +Routing Attacks on Privacy in Tor. *24th USENIX Security Symposium*, 271–286. +DOI/URL: https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/sun (arXiv:1503.03940) +Accessed: 2026-07-19 · Tier: 1 + +### [JohnsonWJSS13] +Johnson, A., Wacek, C., Jansen, R., Sherr, M., & Syverson, P. (2013). Users Get Routed: Traffic +Correlation on Tor by Realistic Adversaries. *Proc. 2013 ACM SIGSAC CCS*, 337–348. +DOI/URL: https://doi.org/10.1145/2508859.2516651 +Accessed: 2026-07-19 · Tier: 1 + +### [SirinamIJW18] +Sirinam, P., Imani, M., Juarez, M., & Wright, M. (2018). Deep Fingerprinting: Undermining Website +Fingerprinting Defenses with Deep Learning. *Proc. 2018 ACM SIGSAC CCS*, 1928–1943. +DOI/URL: https://doi.org/10.1145/3243734.3243768 (arXiv:1801.02265) +Accessed: 2026-07-19 · Tier: 1 + +### [RahmanSMGW20] +Rahman, M. S., Sirinam, P., Mathews, N., Gangadhara, K. G., & Wright, M. (2020). Tik-Tok: The Utility +of Packet Timing in Website Fingerprinting Attacks. *Proc. on Privacy Enhancing Technologies (PoPETs)* +2020(3). +DOI/URL: https://doi.org/10.2478/popets-2020-0043 (arXiv:1902.06421) +Accessed: 2026-07-19 · Tier: 1 + +### [MurdochD05] +Murdoch, S. J., & Danezis, G. (2005). Low-Cost Traffic Analysis of Tor. *2005 IEEE Symposium on +Security and Privacy*, 183–195. +DOI/URL: https://doi.org/10.1109/SP.2005.12 +Accessed: 2026-07-19 · Tier: 1 + +--- + +## C. Anonymity-set / entropy metrics, decentralized directory, Sybil (RQ2) + +### [Serjantov2002] +Serjantov, A., & Danezis, G. (2002). Towards an Information Theoretic Metric for Anonymity. +*Privacy Enhancing Technologies (PET 2002)*, LNCS 2482, 41–53. Springer. +DOI/URL: https://doi.org/10.1007/3-540-36467-6_4 +Accessed: 2026-07-19 · Tier: 1 + +### [Diaz2002] +Díaz, C., Seys, S., Claessens, J., & Preneel, B. (2002). Towards Measuring Anonymity. +*Privacy Enhancing Technologies (PET 2002)*, LNCS 2482, 54–68. Springer. +DOI/URL: https://doi.org/10.1007/3-540-36467-6_5 +Accessed: 2026-07-19 · Tier: 1 + +### [Freedman2002] +Freedman, M. J., & Morris, R. (2002). Tarzan: A Peer-to-Peer Anonymizing Network Layer. +*Proc. 9th ACM CCS*, 193–206. +DOI/URL: https://doi.org/10.1145/586110.586137 +Accessed: 2026-07-19 · Tier: 1 + +### [Mittal2011] +Mittal, P., Olumofin, F. G., Troncoso, C., Borisov, N., & Goldberg, I. (2011). PIR-Tor: Scalable +Anonymous Communication Using Private Information Retrieval. *20th USENIX Security Symposium*. +DOI/URL: https://www.usenix.org/conference/usenix-security-11/pir-tor-scalable-anonymous-communication-using-private-information +Accessed: 2026-07-19 · Tier: 1 + +### [Douceur2002] +Douceur, J. R. (2002). The Sybil Attack. *1st Int'l Workshop on Peer-to-Peer Systems (IPTPS)*, +LNCS 2429, 251–260. Springer. +DOI/URL: https://doi.org/10.1007/3-540-45748-8_24 +Accessed: 2026-07-19 · Tier: 1 + +### [Danezis2003] +Danezis, G. (2003). Statistical Disclosure Attacks: Traffic Confirmation in Open Environments. +*Security and Privacy in the Age of Uncertainty (IFIP SEC 2003)*. (companion: Danezis & Serjantov, +*Information Hiding 2004*, LNCS 3200, 293–308, https://doi.org/10.1007/978-3-540-30114-1_21) +DOI/URL: https://www.freehaven.net/anonbib/cache/statistical-disclosure.pdf +Accessed: 2026-07-19 · Tier: 2 + +### [Winter2016] +Winter, P., Ensafi, R., Loesing, K., & Feamster, N. (2016). Identifying and Characterizing Sybils in +the Tor Network. *25th USENIX Security Symposium*, 1169–1185. +DOI/URL: https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/winter (arXiv:1602.07787) +Accessed: 2026-07-19 · Tier: 1 + +--- + +## D. Path selection, churn, learning-driven routing (RQ3) + +### [Snader2008] +Snader, R., & Borisov, N. (2008). A Tune-up for Tor: Improving Security and Performance in the Tor +Network. *Network and Distributed System Security Symposium (NDSS)*. +DOI/URL: https://www.ndss-symposium.org/ndss2008/a-tune-up-for-tor-improving-security-and-performance-in-the-tor-network/ +Accessed: 2026-07-19 · Tier: 1 + +### [Akhoondi2012] +Akhoondi, M., Yu, C., & Madhyastha, H. V. (2012). LASTor: A Low-Latency AS-Aware Tor Client. +*2012 IEEE Symposium on Security and Privacy*, 476–490. +DOI/URL: https://doi.org/10.1109/SP.2012.35 +Accessed: 2026-07-19 · Tier: 1 + +### [Imani2017] +Imani, M., Amirabadi, M., & Wright, M. (2017). The Evaluation of Circuit Selection Methods on Tor. +*arXiv preprint* arXiv:1706.06457. +DOI/URL: https://arxiv.org/abs/1706.06457 +Accessed: 2026-07-19 · Tier: 2 (preprint) + +### [Stutzbach2006] +Stutzbach, D., & Rejaie, R. (2006). Understanding Churn in Peer-to-Peer Networks. *Proc. 6th ACM +SIGCOMM Internet Measurement Conference (IMC)*, 189–202. +DOI/URL: https://doi.org/10.1145/1177080.1177105 +Accessed: 2026-07-19 · Tier: 1 · NOTE: abstract publisher-gated; quantitative session-length figures +cited from secondary literature, flagged as secondary in the review. + +### [HassanzadehNazarabadi2019] +Hassanzadeh-Nazarabadi, Y., Küpçü, A., & Özkasap, Ö. (2019). Interlaced: Fully Decentralized Churn +Stabilization for Skip Graph-Based DHTs. *arXiv:1903.07289* (peer-reviewed: IEEE IPDPS 2021). +DOI/URL: https://arxiv.org/abs/1903.07289 +Accessed: 2026-07-19 · Tier: 2 + +### [Barton2025] +Barton, A., Walsh, T., Imani, M., Ming, J., & Wright, M. (2025). PredicTor: A Global, Machine Learning +Approach to Tor Path Selection. *ACM Transactions on Privacy and Security*, 28(3), 1–31. +DOI/URL: https://doi.org/10.1145/3723356 +Accessed: 2026-07-19 · Tier: 1 + +### [Constantinides2026] +Constantinides, N. (2026). A Traffic Analysis Attack Against Introduction Protocol and Onion Services. +*arXiv:2602.23560*. +DOI/URL: https://arxiv.org/abs/2602.23560 +Accessed: 2026-07-19 · Tier: 2 (very recent preprint; not load-bearing — corroborate before citing a claim on it) + +### [Abrol2024] +Abrol, A., Mohan, P. M., & Truong-Huu, T. (2024). A Deep Reinforcement Learning Approach for Adaptive +Traffic Routing in Next-gen Networks. *arXiv:2402.04515*. +DOI/URL: https://arxiv.org/abs/2402.04515 +Accessed: 2026-07-19 · Tier: 2 + +--- + +## F. Friend-to-friend / social-trust / membership-concealing (G4 novelty neighbors) + +### [Clarke2000] +Clarke, I., Sandberg, O., Wiley, B., & Hong, T. W. (2000/2001). Freenet: A Distributed Anonymous +Information Storage and Retrieval System. *Designing Privacy Enhancing Technologies*, LNCS 2009. +DOI/URL: https://doi.org/10.1007/3-540-44702-4_4 +Accessed: 2026-07-19 · Tier: 1 + +### [Yu2006] +Yu, H., Kaminsky, M., Gibbons, P. B., & Flaxman, A. (2006). SybilGuard: Defending Against Sybil +Attacks via Social Networks. *Proc. ACM SIGCOMM 2006*, 267–278. +DOI/URL: https://doi.org/10.1145/1159913.1159945 +Accessed: 2026-07-19 · Tier: 1 + +### [Vasserman2009] +Vasserman, E. Y., Jansen, R., Tyra, J., Hopper, N., & Kim, Y. (2009). Membership-Concealing Overlay +Networks. *Proc. 16th ACM CCS*, 390–399. +DOI/URL: https://doi.org/10.1145/1653662.1653709 +Accessed: 2026-07-19 · Tier: 1 + +### [Danezis2010] +Danezis, G., Díaz, C., Troncoso, C., & Laurie, B. (2010). Drac: An Architecture for Anonymous +Low-Volume Communications. *Privacy Enhancing Technologies (PETS 2010)*, LNCS 6205, 202–219. +DOI/URL: https://doi.org/10.1007/978-3-642-14527-8_12 +Accessed: 2026-07-19 · Tier: 1 + +### [Mittal2012] +Mittal, P., Wright, M., & Borisov, N. (2012). Pisces: Anonymous Communication Using Social Networks. +*arXiv:1208.6326* [cs.CR] (NDSS 2013). +DOI/URL: https://arxiv.org/abs/1208.6326 +Accessed: 2026-07-19 · Tier: 2 + +### [Mittal2012b] +Mittal, P., Caesar, M., & Borisov, N. (2012). X-Vine: Secure and Pseudonymous Routing in DHTs Using +Social Networks. *NDSS 2012*. +DOI/URL: https://arxiv.org/abs/1109.0971 +Accessed: 2026-07-19 · Tier: 1 + +### [Zhou2011] +Zhou, P., Luo, X., Chen, A., & Chang, R. K. C. (2011/2013). STor: Social Network based Anonymous +Communication in Tor. *arXiv:1110.5794* [cs.CR]. +DOI/URL: https://arxiv.org/abs/1110.5794 +Accessed: 2026-07-19 · Tier: 2 + +--- + +## Provenance note +Verification methods per source recorded in `sor-consent-search-log.md`. Two integrity flags carried +forward: [Stutzbach2006] numbers are secondary-sourced; [Constantinides2026] is a Feb-2026 preprint to +re-confirm before any load-bearing citation.