Blending Different Latency Traffic With Beta Mixing

We analyze the anonymity provided by continuous mixnets (e.g., Loopix) when messages with different latency requirements are sent through the same network. The anonymity provided by existing mixnets that offer bounded latency guarantees has only been studied considering that all the traffic in the network follows the same latency distribution. In this work we evaluate whether it is beneficial to aggregate different types of traffic in the same network compared to keeping them separate, when the latency distributions are exponential and the traffic arrivals are a Poisson process — as is the case in Loopix and related designs. We present a novel evaluation method to analyze the leakage to the adversary when multiple different types of traffic are sent through the same network of continuous mixes. We apply the method to empirically evaluate the end-to-end anonymity (in terms of entropy) for each type of traffic in the presence of a global passive adversary that may additionally compromise a constant fraction of mixes or may have knowledge about the type of traffic of network output messages. Finally we show via empirical evaluation using our analytical framework that it is beneficial for anonymity to blend different types of traffic in the same mixnet.


INTRODUCTION
Over the past few decades, a wide range of literature has emerged discussing Anonymous Communications Networks (ACNs) [1,6,7,10,[20][21][22]24], paralleled by the deployment of real-world mixnetbased systems [12].Mix networks, or mixnets, are a variant of Anonymous Communications Networks (ACN) [1,6,7,10,[20][21][22]24] that were designed to protect against traffic correlation by global adversaries who can observe all the traffic in the network.They reroute the traffic through multiple servers known as mixnodes, that delay and reorder the messages before forwarding them, in order to hide the correlation between the input and output messages of the mixnet.While there exist a variety of mixing strategies in the literature [14], such as threshold and timed mixing, they either add an unpredictable end-to-end latency or they provide anonymity that do not take traffic levels into consideration.For instance, threshold mixing waits for a threshold number of messages before the messages are forwarded, and therefore, adds an unpredictable end-to-end latency.Designs based on timed mixing flush out messages at predetermined time intervals, even if there are only a few messages inside the mixnodes.Tuning these parameters, such as a smaller threshold or higher time intervals, according to the needs of different applications is a tradeoff between latency and anonymity as shown in [8,9].On the other hand, continuous mixnets [12,22] based on a stop-and-go mixing strategy adds a random delay (typically from exponential distribution) on each hop of a message, independent of other messages, to offer a predictable end-to-end latency as well as an average anonymity that is correlated with the traffic amount.
Therefore, this stop-and-go mixing strategy allows blending different types of traffic, each having a different latency requirement in the same mixnet, simply by drawing the different delays for each traffic type from different distributions.In this work, we investigate the implications on anonymity of blending different traffic types, each having a different latency requirement, in a single mixnet.We call the strategy of blending different traffic with different latency requirements beta-mixing.
The impact of blending different types of traffic on anonymity guarantees of the mixnet is an open question -all the existing analyses on continuous mixnets [3,5,11,15,17,22] consider that all the messages delayed according to the same distribution.Their techniques are not adequate to handle the scenario when the delays for different messages are drawn from different distributions.This work aims to address this problem and answer relevant questions related to continuous mixes when multiple traffic types with different latency requirements are blended together: (1) How do we quantify the anonymity provided by the mixnet when different types of traffic are blended together?(2) Are there any advantages or disadvantages to anonymity when different types of traffic with different latency requirements are blended through the same mixnet, compared to routing each type via a separate mixnet?(3) Do other factors such as the number of layers, the number of mixes per layer, the rate delays and the traffic generations rates of each traffic type have an impact on each or both traffic types when blended together?

Contributions
This work provides the first quantitative analysis on anonymity when multiple different types of traffic are blended through a mixnet.Our results demonstrate that blending multiple traffic types does not harm the anonymity guarantees, rather improves for continuous mixnets when the latency distributions on the mixnodes are exponential and the traffic arrivals are poisson processes -as is the case in Loopix [22] and related designs [12].As part of our analysis technique, we present novel mathematical foundations to analyze the correlation between input and output messages of an honest mixnode in the presence an adversary that observes all the traffic in the network and derives probabilistic relationships between network inputs and outputs.Even though messages from multiple different types of traffic could potentially mix in an honest mixnode, an adversary might still be able to separate the traffic based on their individual delays, which might help the adversary track a specific message.We show that there is indeed a leakage to such an adversary, and quantify the leakage as a function of the distribution parameters of the traffic types and the observed delays ( §3).
Based on our proposed mathematical foundations, we evaluate the anonymity in terms of entropy for the entire mixnet using empirical evaluations ( §4), with an illustrative example of two different types of traffic.Our evaluation results provide important insights demonstrating the benefits of blending two different types of traffic over sending them through separate mixnets: (1) Blending improves anonymity when the adversary can see the type of all messages entering the mixnet, but not the types of the messages exiting the mixnet.(2) If the adversary can observe the types of all incoming and outgoing messages, blending does not offer any advantages nor disadvantages.
(3) The delay parameter for one traffic type impacts not only the anonymity of messages within that specific type but also of those from the other type.(4) Even when a single message from one traffic type is blended with messages all belonging to the other type, that message achieves significant anonymity (compared to zero anonymity when it is not blended).
The insights from the results with two types of traffic are immediately translatable to the case with more than two types ( §4.6).Our methods and results allow protocol designers to quantitatively evaluate the anonymity guarantees of supporting multiple applications with different latency requirements through the same mixnet deployment, and shows that it is beneficial to do so.Especially for an application with very few users, blending with other traffic provides tremendous advantage compared to not blending (which would provide almost no anonymity because of the scarcity of messages).

Related Works
In an interesting work by Dingledine et al. [16], the authors propose a technique called "alpha-mixing" to mix messages with different latencies in a mixnet.Their technique proposes a hybrid mix batching strategy to integrate users with diverse anonymity and performance goals.Senders allocate a security parameter "" to each mix in a message's route, determining its time in each mix.Users can enhance their anonymity by increasing , and the overall anonymity of the network increases.However, their technique is restricted to traditional deterministic batching strategies and cannot provide predictable latency for the messages.Moreover, they do not provide any quantitative anonymity analysis.
Continuous mixnets [12,22] are particularly suited for meeting latency constraints, since the sender encodes the delays for each mixnode and can thus predict the overall latency of a message.They can, therefore, support multiple traffic with different delay distributions.In fact it is already possible to use mixnet-based network Nym [12] for Telegram and crypto-currency transactions.To the best of our knowledge, all existing analyses [3,11,17,22] of continuous mixnets focus on a single type of traffic following the same exponential delay distribution.Therefore these anonymity evaluation techniques are not suitable for situations involving multiple traffic types.Even though continuous mixnets are around for two decades, our work closes the above gap for the first time by providing the mathematical tools and quantitative evaluations.

PROBLEM STATEMENT AND OVERVIEW 2.1 System Model
Users.We consider a user population U where each user generates traffic independently of other users.Message generation for each traffic type  follows a Poisson distribution with rate  ′  messages per user second.We note that only messages generated by honest users (not controlled by the adversary) are relevant to anonymity, and thus U excludes malicious users.The overall network traffic generation is therefore U.  T =1   , where  T is the number of traffic types blended in the same mixnet.Source routing.We consider a source-routed continuous mixnet [12,22], where the sending user chooses the sequence of overlay mixnodes that compose the route of a message, as well as the mixing delay to be applied to the message by each intermediary mixnode on its route.Mixing Delays.A message's per-mix delays are drawn as independent samples from an exponential distribution [18].The mean of the used exponential distribution depends on the type of application and its latency tolerance.The per-mix delays are encoded by the sender in the message headers.Upon decrypting a received message, a mix node retains the message in its internal memory for the specified delay, before proceeding to forward it to its next destination in the route.Topology.We consider a network topology where mixes are arranged in  ordered layers.The layers are interconnected such that each mix in layer  receives messages from mixes in layer  − 1 and sends messages to mixes in layer  + 1; while the first layer receives messages from senders and the last layer forwards messages to their final recipients.The path length of message routes is determined by the number of layers .To select a message route, each user chooses the nodes for each message uniformly at random from each layer.Prior work has found that layered network topology provides better anonymity properties than free routes [13].

Beta-mixing
We consider the scenarios where users are using different applications and send their traffic via the mixnet.This is already the case in the Nym network [12], where users are able to send their Telegram traffic as well as cryptocurrency transactions using the same network.Currently the Nym network is using the same default delay parameters for both of the traffic types.However, users have higher latency tolerance for cryptocurrency transactions reaching 10 minutes for bitcoin 1 , and lower latency tolerance for instant messages.We denote each traffic type by T  ), the delays are chosen from exponential distribution with rate parameter   .Overall, the total amount of T  traffic entering the network follows Poisson distribution with parameter  ′  messages per second.We summarize the notations in Table 1.

Attacker Model And Security Goals
The adversary observes all the traffic exchanged in the network links.We assume the adversary monitors the network from the first message sent.Additionally, the adversary may compromise a fraction of the nodes (e.g., 10% of all nodes are compromised, and 90% nodes are honest).The compromised nodes are honest but curiousi.e., they still route messages following the protocol specifications but leak to the adversary their internal state, which per message includes the amount of delay applied in the compromised node, and its immediate predecessor and successor in the message route.Finally, we also consider an adversary who knows the type of traffic of all the network output messages.Compromised users and active attacks.For our analysis we assume that all the senders are honest.Note that compromised senders that leak to the adversary information about their messages simply achieve that their fully traceable messages do not contribute to the anonymity of honest senders, but still cannot undermine the anonymity that honest users provide to each other.Thus, the anonymity of messages from honest users in a scenario with compromised users is simply equivalent to only considering the messages sent by the subset of honest users.We do not consider any active attacks, noting that the relevant active attacks and corresponding defense strategies mentioned in Loopix [22] are applicable, independently of using a single or multiple mixing delay distributions.We thus consider active attacks to be orthogonal to the analysis presented in this work.

Anonymity Metric
We evaluate anonymity using the entropy metric [15,23].Although indistinguishability based metrics [2,19] are suitable for measuring worst-case scenarios, entropy-based metrics are better suited to capture the effect of network scaling (in terms of anonymity set size) on average anonymity.An entropy of, e.g., 10 bits, indicates that a message is as anonymous as if it was perfectly indistinguishable among about a thousand (2 10 = 1024) other messages, while 11

Overview of Evaluation Strategy
In order to evaluate the entropy for an input message to the mixnet, we need to derive the probabilities that correlates the input message to the output messages.We do that in two steps: (1) first, we derive the correlation between the input and output messages of an honest mixnode based on the observations of the adversary; (2) then, based on the above mathematical derivations, we experimentally evaluate the probabilities correlating the input and output messages of a large mixnet.
When there is a single type of traffic, all the messages inside a node are equally likely to be the next message to come out next [3,11,17,22].However, when many types of traffic are blended, the adversary might be able to partially guess the type of an outgoing message (fast traffic tend to go out earlier than slow traffic); and that would allow the adversary to correlate messages given some background knowledge about the types of the input messages.In the next section, we derive the probabilities that correlate one input message to output messages of one honest mixnode.Finally, in Section 4, we employ this probability distribution within the entropy metric to evaluate various configurations of mixnets.

ANALYSIS FOR A SINGLE MIXNODE
In this section we derive the probabilities connecting the input and output messages of a single standalone honest mixnode.For the ease of explanation, we derive the probabilities in the following steps: (1) first consider the most simple case when the adversary knows the types of all messages inside the mixnode; (2) then we derive the probability distributions for the number of messages of each type (assuming only two types) when the adversary knows the types of all incoming messages, but does not know which of them are still in the mixnode; (3) in Section 3.3, we extend our analysis for a more general case (still with two types) where the adversary knows the types of incoming messages only with certain probabilities; (4) finally in Section 3.5, we provide the full derivation for more than two types.
While the traffic type entering the mixnet is not immediately visible, it may be possible to infer it for the first layer, for example if the message sending rate is indicative of which application may be generating the traffic.For the second and subsequent layers, that information is not available to the adversary; however, as we will see in our derivations shortly, the adversary might be able to guess the types of messages with certain probabilities based on the observed delays in the previous layer.

Very Simple Case
As mentioned above, we first consider the most simple case where the adversary knows the types of all messages inside the mixnode.We assume that the outgoing traffic type is not directly available to the adversary, and thus we want to calculate the probability that a specific outgoing message is a target input message of a known type when the adversary does not know the types of the outgoing messages.Since the delays of the different messages are chosen from different delay distributions, based on the observed delays the adversary can partially guess which outgoing message may be of which type.
Consider the example in Figure 1: five messages  1 ,  2 ,  3 ,  4 ,  5 are received by the mixnode at different times, and the adversary knows the types of each of them.No other messages have been received by the mixnode and no messages have left the mixnode yet.Then the first output message  ′ 1 goes out of the mixnode with relative time differences  1 ,  2 ,  3 ,  4 ,  5 with each of the input arrivals, respectively.Suppose one of those five incoming messages, e.g.,  1 was sent by the target user, and the adversary wants to track that message.Let us assume that  1 ∈ T 1 .We denote  1 =  target .We want to calculate the probability that  ′ 1 =  target .Given that  1 did not go out before  1 , the probability that  1 has a delay in [ 1 ,  1 + Δ) (assuming  1 ∈ T 1 ) can be written as follows: To generalize, let us assume that there are a total of  types of traffic and total   input messages of each type T  ,  ∈ {1, 2, . . .,  }.
After the observations until time  1 (denoted as O) of the incoming messages and the first outgoing message, the probability that  ′ 1 is a specific message  1 can be calculated as follows: , and therefore, there is a bias for the message  ′ 1 to be a specific incoming message depending on the   values.Intuitively, the messages with smaller delays are more likely to be from the type with smaller average delays.We also want to compute the probability that the message  ′ 1 is of type T 1 , and is computed as, Hereafter we drop the notation for the adversarial observations O for brevity, and assume all the probabilities are conditional to those observations.

Second and Subsequent Output Messages
After the first message  ′ 1 has left from the mixnode in the above example (c.f.Fig. 1), we want to calculate the probability of the next message  ′ 2 that is coming out of the mixnode is the target message  target .However, now the adversary does not know the exact number of messages of each type inside the mixnode.Let us still assume that  1 =  target .There are three possible states for the mixnode after  ′ 1 has left: • P0:  ′ 1 was actually  1 , which means that the mixnode does not contain  1 anymore; • P1:  ′ 1 was of type T 1 but not  1 , and now there is one less message of type T 1 contained in the mixnode; • P2:  ′ 1 was of not of type T 1 and the number of messages of type T 1 contained in the mix remains the same.
For this subsection we assume (for simplicity) that there are only two types T 1 and T 2 of messages.We extend the analysis for more than two types in Section 3.5.With the above assumption, the probability that the next message  ′ 2 is the specific input message  1 can be calculated as: Consequently, after  messages have left the mixnode, we need to consider all possible such combinations.Additionally, any new incoming message (after  ′ 1 has left) would also impact the probabilities corresponding to the later messages.Most importantly, the target message could arrive anytime (possibly after  ′ 1 has left).We need to consider all those possibilities to calculate the probabilities of the outgoing messages being the target message.So, given a specific target message  target of type T 1 (and it can arrive anytime during the protocol run), we keep track of the state of the mixnode with the following set of random variables: •  ( ) denotes the probability that there are exactly  messages of type T 1 inside the mixnode, and the target  target has not yet arrived to the mixnode.We use G to denote the event that the target message has not arrived to the mixnode.•  ( ) denotes the event that there are exactly  messages of type T 1 inside the mixnode and the target message is in the mixnode.We use Q to denote the event that target message has arrived and is still in the mixnode.• ( ) denotes the probability that there are exactly  messages of type T 1 inside the mixnode, and the target message has left the mixnode.We use R to denote the event that the target message has left the mixnode.
The quantities  ( ),  ( ) and ( ) are defined over  ∈ [0, ] where  =  1 +  2 −  denotes the total number of messages inside the mixnode; and  denotes the number of messages left the mixnode.Effectively, and Pr[G] =  =0  ( ).Each of these quantities are updated when a new message arrives or a message leaves the mixnode.Additionally, as we will see shortly that ( ) is maintained solely for the purpose of calculating the probability of an outgoing message being of type T 1 or T 2 .Initialization.We initialize  (0) = 1,  (0) = 0 and (0) = 0 before any messages arrive, since there are exactly 0 messages of type T 1 inside the mixnode, and the target message has not yet arrived.This is consistent with the definitions of , , and .

When A Message Arrives.
Until the target message arrives,  ( ) is updated for each  ∈ [0,  + 1] for each new incoming message  as follows: To explain briefly, whenever a message of type T 1 arrives, the number of messages of type T 1 in the mixnode goes from (  − 1) to .If the mixnode had (  − 1) messages of type T 1 with probability  (  −1), now the mixnode has  messages with the same probability; and therefore, we have  ( )  =  (  − 1).When the incoming message is of type T 2 , if the mixnode had  messages of type T 1 , the mixnode still has  messages of type T 1 ; and therefore, the  ( ) remains unmodified.After the target message arrives,  ( ) becomes 0 for all  ∈ [1, ], since the types of all incoming messages are known to the adversary.
Note that  ( )  (and  ( )  , ( )  resp.)denotes the new value that will replace  ( ) (and  ( ), ( ) resp.) after the calculations are done for all the  values.
After the mixnode has received the target message, when a new message  arrives (including the target message itself),  ( ) is updated for each  ∈ [0,  + 1] as follows: Note that  ( ) values are 0's for all for each  ∈ [0,  + 1] until the target message arrives to the mixnode.The main purpose of maintaining  ( ) values is to be able to correctly set the  ( ) values when the target message arrives.And after the target message arrives, the update rules for  ( ) are very similar to that of  ( ).However, very soon we are going to see that the  ( ) and  ( ) values can be simultaneously non-zero when the adversary does not exactly know when the target message arrives (for a mixnode in the second and subsequent layers).
Analogous to  ( ) values, ( ) is updated for each  ∈ [0,  + 1] as follows: Note that, similar to  ( ) values, we need to keep track of ( ) values only after the target message has arrived to the mixnode.It is worth to mention here that   ( ) quantifies the probability that  target is in the mixnode, whereas,   ( ) quantifies the probability that  target has not yet arrived to the mixnode.And,  ( ) quantifies the probability that  target has left the mixnode.

When A Message
Leaves.Whenever a message  ′ leaves the mixnode, the probability that the message is the target message  target can be calculated as (for a total number of  messages inside the mixnode before  ′ leaves), (7) Explanation of Equation (7).Given that there are exactly  messages of type T 1 and ( − ) messages of type T 2 held by the mixnode and the target message is one of those  messages, we know that the probability of the next outgoing message being the target message can be calculated as The probability that the mixnode has  messages of type T 1 and the target is inside the mixnode is given by  ( ).And, we have to consider the sum over all possible  values for which  ( ) is non-zero.If the mixnode does not have the target message the next outgoing message cannot be the target message, and therefore, we do not need to consider the  ( ) or ( ) values.Other Probabilities of an Outgoing Message.We also want to compute the probability that the message  ′ is of type T 1 , and can be computed as, Note that when the mixnode has  messages, either the target message has not yet arrived, or it is inside the mixnode, or it has left the mixnode.Therefore, the quantity ( ( )+ ( )+( )) represents the probability of the mixnode holding exactly  messages of type Similarly, the probability that the message  ′ 1 is of type T 2 can be computed as, Update G, Q, R When A Message Leaves.After the message  ′ leaves the mixnode, we also need to update  ( ) and  ( ) values, and they are updated for each  ∈ [0,  − 1] as follows: For  = , we update  ()  = 0, since there are only ( − 1) messages left in the mixnode after  ′ has left.And, (11) For  = , we update  ()  = 0. Additionally, (12) For  = , we update ()  = 0.

General Case With Two Traffic Types
For a mixnode on the second and consequent layers of a mixnet, the adversary might not exactly know the types of the incoming messages to the mixnode.However, based on the observed delays on the previous layers (and following the analysis in Section 3.2), the adversary can guess the type of each message with some probability.With that consideration, we want to analyze how easily the adversary can correlate the outgoing messages with the incoming messages.For example, for a mixnode on the second layer the adversary can compute the probabilities of each incoming message being type T 1 (as shown in Section 3.2), and each of them will have a probability of being the target message (we are still assuming that the target message is a message from the traffic type T 1 ).In such cases, we want to compute the probabilities of the outgoing messages of being the target message.
Similar to Section 3.2, we still assume that there are only two types of messages: T 1 and T 2 .We keep track of the state of the mixnode using the variables  ( ),  ( ) and ( ) for  ∈ [0, ] where  denotes the total number of message held by the mixnode.For a mixnode in the first layer, the adversary knows the exact number  1 (resp. 2 ) of messages of type T 1 (resp.T 2 ) came to the mixnode.However, for a mixnode in the second layer, those quantities are probabilistic and dependent on the first layer.Additionally, the adversary does not know when the target message arrives to the mixnode, if at all (since there can many mixnodes in every layer).

Update 𝐺, 𝑄, 𝑅
And for  = 0 we can update Note that the number of messages of type T 1 in the mixnode on the second (or subsequent) layer depends on the state of the previous layer(s).In that sense, Pr[ ∈ T 2 | G ∧ count(T 1 ) = ] depends on the state of the mixnode, which in turn depends on the state of previous layers.We consider the following approximation: the probability of an incoming message being of type T 1 (resp.type T 2 ) is independent of count(T 1 ) of the current mixnode; and therefore, Note that the type of the incoming message  is always independent of where the target message is, however, Pr[ =  target ] is not.So, we have the following, Note that we have used Pr in the final equation.That is because the target message can be present only with one mixnode.Therefore,  could only be a target message if it has not arrived to the current mixnode before, or in other words, if G is true.Consequently, Justification for the Approximation.The justification is actually two-fold: (1) In a steady-state flow, based on the analysis from [4], it is a good approximation to consider each mixnode as an independent //∞ queue.That means, the internal states of the nodes can be considered independent of each other; except for the adversarial knowledge of the total number of messages contained in a node.With that approximation, the probability that an incoming message from the previous layer is of type T 1 or T 2 is independent of the state of current mixnode.However, the adversary has the knowledge that the target message can be held by only one mixnode at any given point.And therefore, Pr[ =  target ] for an incoming message  is not independent of the state of the current mixnode, and is bounded by Pr[G].
(2) If we want to plug-in these probability calculations in a simulator (which we do in Section 4), maintaining the inter-dependent states for a mixnet with multiple layers and multiple mixnodes per layer explodes the computational complexity, and becomes a serious performance bottleneck. ( ) is updated for each  ∈ [1,  + 1] as: And for  = 0, we update  (0 Explanation for Equations ( 14) and ( 15) in Simple Words.The concept of transition between  and  is still similar to the previous section (Section 3.2).However, now the transition is probabilistic, since the adversary does not certainly know if an incoming message  is the target message.If  has a probability P of being the target message, overall Pr[Q  ] should be equal to Pr[Q] + P; in other words,  ( )  =  ( ) + .
For each ,  ( )  is contributed by  ( ) with an amount exactly as the probability that  belongs to T 2 , and  (  − 1) with an amount exactly as the probability that  belongs to T 1 but not the target.So, in total  quantities are reduced by an amount same as the probability of  being the target.And, that amount is added to the total of  quantities by adding the amounts that we have just reduced from  values to each  ( )  .So, for each ,  ( )  is contributed by  ( ) (with an amount exactly as the probability that  belongs to T 2 ),  (  −1) (with an amount exactly as the probability that  belongs to T 1 ), and the amount laid off from  (  − 1).
Note that  ( )  (resp. ( )  ) is contributed by  ( ) (resp. ( )) for the amount as the probability that  belongs to T 2 because the number of messages of T 1 remains the same when  ∈ T 2 .Analogously,  ( )  (resp. ( )  ) is contributed by  (  − 1) because the number of messages of T 1 increases by 1 when  ∈ T 1 .

When A Message
Leaves.When a message leaves from the mixnode we update the quantities  ( ),  ( ), ( ) for  ∈ [0, ] exactly same as in Section 3.2.The probability that an outgoing message is the target message, the probability that it belongs to a specific type (e.g., T 1 ) are also computed in the same way as in Section 3.2.We present the overall methodology to calculate the probabilities for a given mixnode as part of a simulator in Algorithm 1.It is worth to mention here that our method also works when there is only one type of traffic going through the mixnet, and provides the same results as the existing methods [15,23] for a single traffic type.Target Is From Type T 2 .When the target message is from T 2 the derivation remain exactly the same, however, all the quantities are to be defined for type T 2 -which is equivalent to swapping the assignment of the types in the notation.

When the Recipient Leaks the Types
If the mixnode is the last layer and the recipient leaks the type of the message it is receiving, the adversary gains additional knowledge.In such cases, the probabilities need to be adjusted to consider that factor.Suppose, the outgoing messages from the mixnode are denoted with  ′ 1 ,  ′ 2 , . . .etc.And the probabilities of them being the target message  target are  1 ,  2 , . . .respectively, without using the knowledge from the recipient side.Let us consider that  target ∈ T 1 .With the additional knowledge from the recipient side, we can derive the following for an outgoing message where Similarly, for an outgoing message  ′  ∈ T 2 we can derive, Therefore, we can adjust the probabilities for the leakage on the recipient side by normalizing them for all the outgoing messages of type T 1 (for the target message  target ∈ T 1 ).

More Than Two Types of Traffic
The methodology presented until now can be extended to analyze anonymity when there are more than two types of traffic.However, an additional set of quantities would be required to keep track of the number of messages for each type inside the mixnode, except the type of the target. 2However, we do not need to modify , ,  calculations, because they only concern about if an incoming or outgoing message is of the same type as the target or not.The new quantities corresponding to every type are very similar to e.g.,  with a slight difference -they are not conditional on the arrival (or departure) of the target message.How they are updated when a message arrives or leaves are also similar.
Assuming that the target is from type T 1 , let   ( ) denote the probability that there are  messages inside the mixnode of type T  except  = 1; and, denote the probability that there are  messages inside the mixnode of type T  but conditioned on  < .Note that  1 ( ) =  ( ) +  ( ) + ( ).Once the   quantities are in place, the probabilities of an outgoing message being a target message, or of a specific type can be computed similar to Section 3.3.For example, the probability of an outgoing message being the target message can be calculated as (assuming a total of  types), However, the   quantities need to be updated whenever a message arrives or leaves.Whenever a new message arrives,   ( ) values can be updated as follows, where Pr[ ∈ T  ] and Pr[ ∉ T  ] are calculated based on the previous layer.And when a message leaves, For  = 1 we can say, and The evaluation is exactly the same for any other , except for the switched indices of the variables.

END-TO-END ANONYMITY ANALYSIS FOR MIXNETS WITH BETA-MIXING
In order to demonstrate the effect of blending, we provide empirical analysis for end-to-end mixnets with the simple case of two types of traffic, and discuss in Section 4.6 how to extend the insights from these analysis when there are more types.

Methodology
Our methodology to evaluate the impact of blending different traffic types on top of the same mixnet is as follows: First, we presented our analytical method in the previous section which shows how to calculate the probability of an output message being one input message.We then modified the open-source simulator used in [3] by implementing our analytical method.The modifications made to the simulator are summarized in Algorithm 1.We executed the updated simulator across various mixnet configurations (number of nodes, number of layers, rates of the different traffic generations etc).Finally, as a measure of anonymity, we evaluate the entropy of the probability distribution linking the mixnet's input and output messages [15,23].For our evaluations, we assume that the adversary knows the types of the messages coming to the mixnet.Note that, while the traffic type is not immediately visible, it may be possible to infer it, for example if the message sending rate is indicative of which application may be generating the traffic.
Algorithm 1: Probability computation on a single node with two types of traffic.

Experimental Setup
The simulation starts with users generating messages, selecting a route for each message, and sending them through the network to their respective recipients.Each user generates messages from two traffic types, T 1 and T 2 , following a Poisson distribution with parameters  ′ 1 and  ′ 2 .The delays parameters of each message belonging to either T 1 or T 2 also follow Poisson Distribution with parameters  1 and  2 , respectively.We consider a user population of U = 100 users, each user generating a total of 5 messages per second for the two types of traffic combined.The total traffic generation rate is 500 messages per second with a total of 100000 messages.For each simulation run, each run representing one data point in the graphs, once the network has been initialized and is in a steady state we choose 50 input target messages 3 .In order to evaluate the impact of blending two types of traffic on the anonymity of the system for each of these types of traffic, we choose target messages from each type of traffic. target is the message that the adversary follows.At the end of the simulations, all the 100000 received messages, in one simulation run, have a probability of being  target .Finally we plug this probability distribution in the entropy metric in order to evaluate the anonymity provided by the mixnet.
We vary for different experiments the generation rates of each traffic such that the sum of the two rates of traffic generations ) is equal to 5. Our goal is to evaluate whether there are advantages of blending two different traffic types with different latency requirements in the same mixnet over maintaining separate mixnet infrastructures as well as determining the significance of the traffic generation ratios ( ′ 1 : ′ 2 ).We consider T 1 as fast traffic, and T 2 as slow traffic, meaning all messages belonging to T 1 have an average delay 1  1 =  1 = 1, and messages from T 2 have higher delays.For each experiment, we plot the entropy values, for two cases: (i) for target messages belonging to T 1 and (ii) for messages belonging to T 2 .To evaluate the impact of blending traffic on the anonymity provided by the mixnet for messages from: • T 1 (target messages are from type T 1 ): The first 4 data points represent the entropy values for : ).The 5th data point of this graph represent only one target message from T 2 and the rest of the network traffic is from T 1 with  ′ 1 = 5.In order to compare anonymity of the messages of T 1 (resp.T 2 ) where traffic are blended to the anonymity where there's a dedicated infrastructure for each traffic type, we also plot the entropy values for the same values of  ′ 1 (resp. ′ 2 ) but all values of  ′ 2 (resp. ′ 1 ) are equal to 0. We call the scenario a Solo case, meaning that the network only has messages from the the type traffic T 1 ( T 2 ).Finally, in the scenario of one single message from either T 1 or T 2 , we want to evaluate the anonymity provided by the network when there's only one message from that type of traffic and the rest of the 500 messages per second are from the opposite traffic.Such scenarios can manifest in real-world situations.For instance, in the case of Nym [12], a practical scenario might involve one user initiating a cryptocurrency transaction, while the rest of the network during a rather large period of time, are sending Telegram messages.We consider the following mixnet settings for our evaluations: (1) Cascade: One mixnode per layer for  = 1,  = 2 and  = 3 ( §4.3); (2) 3x10: A mixnet consisting of 3 layers with 10 mixnodes per layer ( §4.4): • against a Global Passive Adversary (GPA); • the GPA additionally compromises 10% mixnodes; • the GPA can see the types of all output messages; (3)  1 : 2 : Different ratios of per-mix delays; T 1 with an average delay  1 =1 and T 2 with average delays  2 = 5,  2 = 10,  2 = 15 and  2 = 20 ( §4.5);

Evaluation: One Mixnode Per Layer
First, we evaluate the entropy for a small mixnet: one mixnode per layer for  = 1 (one single standalone mixnode),  = 2 and for  = 3 .We plot the entropy values for the different  ′ 1 and  ′ 2 ratios evaluating the anonymity provided by the mixnet for messages from T 1 in Figure 2a and from T 2 in Figure 2b.
In these figures, the blue lines denote the entropy values for 1 single mixnode, the red ones denote the entropy for  = 2 and the black is for  = 3.The solid lines for each of these configuration denote the entropy values of the two types of traffic blended together and the dashed lines are for the Solo cases, meaning that all  ′ values from the opposite traffic are equal to 0.
As we can see in Figure 2a, as the ratio  ′ 1 :  ′ 2 declines when blending traffic (solid lines), the entropy only slightly decreases.The Solo cases, represented by the dashed lines, show the entropy values for single traffic T 1 in the mixnet.The decreasing entropy values of the Solo cases are to be expected since there is a decrease in the traffic generation rate  ′ 1 in 2a.We use the Solo cases as reference in order to compare the impact of blending on anonymity to dedicating a different mixnet per traffic type.We conclude from this graph that even though there's a slight decrease, the overall anonymity is much better when blending traffic.This is due to the fact that messages from T 2 do make up for the reduced number of messages of T 1 .
Figure 2b provides similar observations.Additionally, it shows that the slow traffic (T 2 ) has much better entropy compared to the fast traffic (T 1 ) for both Solo and with blending.This is due to the higher per-mix delay ( 2 = 5) for messages from T 2 compared to messages from T 1 ( 1 = 1).However we do notice a slight increase in anonymity for traffic type T 2 when the ratios  ′ 2 :  ′ 1 declines.This is due to the fact that messages T 2 are able to meet with many more messages of fast traffic (T 1 ) when they are inside the mix because of their higher delays.In other words, for a message with a large delay, having other messages with small delays decrease the probability of that message being one input message and hence this provide higher value of entropy.
When comparing the entropy values for a single mixnode to the case of  = 2 and  = 3, we notice that adding layers increase anonymity, a result that is consistent with previous works [3,17,22] analysing only a single type of traffic.For example, when having  = 1 and  = 1 (a single standalone mixnode represented by the blue lines), we have entropy values of around 10.3 for type T 1 and  ′ 1 = 1,  ′ 2 = 4; and entropy values of around 11.5 for the same  ′ when  = 3 and  = 1 (black lines).
However, when there's only one single unique target message, we notice that adding layers has the opposite impacts, especially for the slow traffic.This is due to the fact that the adversary has more advantages in following this unique target message that has a different delay compared to all ther other messages in the network.We emphasize however the importance of blending, because otherwise this unlucky message would be 100% de-anonymized as shown by the dashed lines representing the solo cases.
We emphasize the validity of our analysis by comparing our simulation results in Solo cases with those from [17].This comparison is justified as the authors in [17] exclusively evaluated one type of traffic, and both methods yield identical entropy values when utilizing the same network size, user population, and traffic generation parameters.

Evaluation: 3 Layers, 10 Mixnodes Per Layer
In this section, we evaluate the impact of blending the two types of traffic in a network with  = 3 and  = 10.We maintain the same experimental setups, in terms of number of clients and number of messages per second, as in the previous experiments.Additionally, we evaluate the impact of having an adversary who is corrupting 10% of the network ( = 3) as well as the impact of an adversary that additionally knows the traffic type of each output message.We symbolise by A the adversary who only knows the types of input messages and by B the adversary who knows the the types of traffic of all input and output messages.The type of messages when received by the recipient can be leaked when the adversary can compromise the recipient, or controls the ISP of the recipient.In order to quantify this knowledge of the adversary in our empirical analysis, we normalize the probabilities of all messages being the target as explained in Section 3.4.We report the entropy values in Figure 3.
In Figure 3, the solid lines represent the entropy values when the two types of traffic are blended and the dashed line represent the Solo cases.The red lines represent the entropy values for 0 corruption, the blue lines represent the adversary who corrupts 10% of all the nodes ( = 3) and the black lines represent the scenario B where the adversary knows the types of traffic of all the input and output messages.Similar to previous experiments, we observe that the entropy decreases as  ′ 1 (resp. ′ 2 ) decreases when traffic types are not blended; however, when we blend messages from different traffic types, the messages from the second traffic type compensates for the lack of messages from T 1 (resp.T 2 ).Similar to previous evaluation, the slow traffic benefits slightly more from blending than the fast traffic.
When we consider 10% of the mixnodes are compromised (we choose them by choosing one corrupt mixnode per layer), we observe slight decrease in entropy values for each type of traffic, and in both blended and non-blended scenario (c.f. Figure 3).The black lines, representing adversary B, shows that the entropy is lower when the adversary knows the types of output messages than when the adversary does not know -which was expected, since the adversary has the additional information of the output traffic types.In fact, the entropy values closely match the dashed red lines depicting entropy of single-type traffic.This indicates that, even in the worst-case scenario where the adversary knows the types of traffic of all input and output messages, blending traffic is as effective as dedicating the entire network to each traffic type.We can summarize the insights as follows:   (1) Blending traffic is slightly more advantageous for the slow traffic than for the fast traffic.(2) However even for the fast traffic, blending two different types of traffic into the same mixnet infrastructure is more beneficial in terms of anonymity compared to sending them through separate mixnets.
(3) On the other hand, anonymity for the slow traffic improves as the difference between the delay parameters increases.T 3 with an average delay  3 = 5.In Figure 5a, we present entropy values for target messages from traffic type T 1 under different scenarios: when there are messages only from T 1 (red), when there are messages from both T 1 and T 2 (black), when there are messages from T 1 and T 3 (green), and when there are messages from all three types of traffic (blue).Similarly, we repeat this analysis for target messages from T 2 in Figure 5b and for T 3 in Figure 5c.In all three figures, there is a noticeable increase in entropy values when blending different types of traffic.Specifically, the highest entropy values are observed when messages from all three traffic types are combined.

DISCUSSION AND CONCLUSION 5.1 Broader Impact and Future Work
We have showed, through a diverse set of experiments in multiple settings, that the blending traffic types improves anonymity.The degree of this improvement, however, depends on the different average delays of the traffics and their respective generation ratios.In this paper, we assume that the end-to-end latency is set by the application using the mixnet-based system, leaving users with limited control over this aspect.However, envisioning a more user-centric mixnet-based system can consider the possibility of allowing users to choose delays to improve anonymity, as proposed by the authors in [16].In this paper, the authors let senders specify for each message whether they prefer security or speed and hence end-to-end delays is chosen by the users.In such a scenario, a systematic study of the effects of different generation ratios along with the different average delays on anonymity is needed.Furthermore, we assumed in this paper that the adversary knows the type of traffic of input messages.However, it is not always straightforward for an adversary to deduce the types of messages, particularly when this information is not overtly leaked from client behaviors.An indepth exploration of different applications that enable adversaries to infer message types is deferred for future research.In addition, future research should also consider more real-world scenarios: while our analysis and insights remain the same irrespective of message volume or the geo-location of the different mixes, exploring the impact of real data in practical settings may yield valuable additional insights.Such analysis will not reverse the relevance of our observations but may reveal nuanced insights that can be crucial in real-world implementations.Finally, due to limitations in simulation constraints, we regrettably had to work with a relatively small number of messages per second.Exploring the impact of blending different traffic types on anonymity in scenarios with a substantial volume of traffic presents an intriguing avenue for future research.Investigating by how much does the anonymity increases with blending traffic in high-volume situations could provide valuable insights for a more comprehensive understanding of the blending traffics.

Conclusion
We have provided the first quantitative analysis of the anonymity offered by continuous mixnets when multiple different traffic types are blended together.To that end, we provided (i) a novel analytical framework to compute the probabilities connecting the input and output messages of a mixnode when different traffic types with different latency requirements are blended together; (ii) a simulation-based evaluation of anonymity based on the proposed analytical framework considering varying proportions of traffic types, different average delays per traffic type, and diverse network settings.Our evaluations reveal that blending different traffic types through a mixnet enhances anonymity compared to dedicating a different mixnet to each traffic type.

Figure 3 : 1 𝜆 1 = 1 1 𝜆 2 = 5
Figure 3: Evaluation of anonymity in terms of entropy for continuous mixnets with width  = 10 (number of mixnodes per layer), number of layers  = 3, average delay  1 = 1  1 = 1 for traffic type T 1 , average delay  2 = 1  2 = 5 for traffic type T 2 . is the number of compromised mixnodes in the network.Scenario A: Adversary only knows the input types of traffic.Scenario B: Adversary knows the type of traffic of input and output messages

( a )
Entropy for target messages of type T 1 (b) Entropy for target messages of type T 2 (c) Entropy for target messages of type T 3 .