Redefining Website Fingerprinting Attacks with Multi-Agent LLMs
Authors: Chuxu Song (Rutgers University), Dheekshith Dev Manohar Mekala (Rutgers University), Hao Wang (Rutgers University), Richard Martin (Rutgers University)
Volume: 2026
Issue: 3
Pages: 688–702
DOI: https://doi.org/10.56553/popets-2026-0101
Abstract: Website Fingerprinting (WFP) attacks exploit side-channel leakage from encrypted traffic to infer visited websites. While deep learning has driven major accuracy gains in controlled settings, we show that such progress does not transfer to modern, highly interactive websites. Traffic generated by scripted browser automation — the de facto standard for WFP datasets — fails to capture the behavioral diversity of real users, leading to severe overestimation of attack effectiveness. We introduce a novel data generation pipeline that uses a multi-agent system powered by large language models (LLMs) to simulate persona-driven browsing behavior. These agents coordinate high-level decision making with low-level browser interaction, producing semantically grounded traffic traces at 3--5 times lower cost than human collection. Using traffic collected from 20 modern websites browsed by 30 users, we evaluate nine state-of-the-art WFP models across human, scripted, and LLM-generated datasets. All models achieve under 10% accuracy when trained only on scripted traffic and tested on human traffic. In contrast, training with LLM-generated traces boosts accuracy into the 80% range, demonstrating strong transfer to real browsing patterns. We further conduct an open-world evaluation with 40 unseen websites and find that augmenting human data with LLM-generated traces reduces accuracy degradation by 50% compared to training on human data alone. Our results indicate that the core bottleneck in modern WFP is data realism rather than model design, and that scalable, behavior-rich synthetic traffic is essential for accurately assessing privacy risks under contemporary web conditions.
Keywords: website fingerprinting, LLM, , Computer agent, Privacy
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution 4.0 license.
