Website fingerprinting (WF) enables a passive eavesdropper to infer which web page a client is visiting, even when communications are encrypted or anonymized. In this paper, we study the vulnerability to website fingerprinting of Nym, a mix network based on the Loopix design that enables users to browse the Web. We show that although Nym adds delays and cover traffic to change packet patterns compared to Tor, it still leaks features that website fingerprinting attacks can exploit in both closed‑ and open‑world settings. We carry out an in-depth analysis of the effectiveness of Nym's obfuscation mechanisms, originally designed to provide anonymity in messaging, in thwarting website fingerprinting. We show that mix delays, counterintuitively, not only fail to protect against website fingerprinting but actually make the attack more effective as the mix delays make it easier to distinguish incoming from outgoing packets. We also demonstrate that the current cover traffic strategy of Nym is not effective in thwarting website fingerprinting attacks unless it imposes a large overhead. To address these limitations, we design two new WF defenses based on Nym's existing obfuscation mechanisms that significantly reduce WF effectiveness. The first defense introduces cover traffic to match the bursty nature of real-world web traffic, reducing the F1 score to 0.39 (compared to 0.65 obtained by similar defenses applied on Tor) at moderate overhead increase. The second defense plummets the F1 score to 0.06 by channeling web traffic via Nym's constant traffic capabilities, at the cost of bandwidth.
Private information retrieval (PIR) allows a client to query a public database privately and serves as a key building block for privacy-enhancing applications. Minimizing query size is particularly important in many use cases, for example, when clients operate on bandwidth-constrained devices. However, existing PIR protocols exhibit large query sizes: to query 225 records, the smallest query size of 14.8 KB is reported in Respire [Burton et al., CCS24]. Respire is based on fully homomorphic encryption (FHE), where a common approach to lower the client-to-server communication cost is transciphering. When combining the state-of-the-art transciphering [Bon et al., CHES24] with Respire, the resulting protocol (which we refer to as T-Respire) has a 336 B query size, while incurring a 16.2x times higher server computation cost than Respire. Our work introduces a novel alternative to transciphering for reducing the client-to-server communication: the client transmits only one component of a high-precision LWE ciphertext, from which we design a modular procedure to extract the inputs for the subsequent homomorphic computation. The efficiency of this approach is demonstrated by our Pirouette protocol, which achieves a query size of just 36 B. This represents a 9.3x reduction compared to T-Respire and a 420x reduction to Respire. For queries over 225 records, the single-core server computation in Pirouette is only 2x slower than Respire and 8.1x faster than T-Respire, and the server computation is highly parallelizable. Furthermore, Pirouette requires no database-specific hint for clients, and its variant PirouetteH enables additional tradeoffs among query size, throughput, and offline communication, demonstrating the flexibility of our design
Coinjoin is a collaborative Bitcoin transaction designed to enhance users' privacy by joining coins of multiple parties. Coinjoin implementations with a centralized trust-minimized coordinator have mixed more than 391,000 bitcoins since 2018. In June 2024, law enforcement actions led to the shutdown of coordinators of all three leading coinjoin designs-Wasabi 1.x, Wasabi 2.x, and Whirlpool-prompting a proliferation of new independent coordinators. Prior studies of this ecosystem offer little information beyond coinjoin detection and aggregation of related statistics, primarily due to the unavailability of information (intentionally) obscured by coinjoins. To overcome this limitation, we combine on-chain transaction analysis, coordinator monitoring, and active coinjoin participation, complemented by tailored analysis and visualizations, to: 1) provide a model for estimation of the number of active users at a time, 2) detect previously unknown coordinators, 3) retrospectively observe activity patterns of prominent parties, and 4) deliver continuously updated insights into the ecosystem. We show that while Wasabi 1.x remains inactive and recently resumed Whirlpool exhibits little activity, the Wasabi 2.x mixing has exceeded pre-shutdown levels under the new coordinator kruw.io, which now accounts for 99% of mixed inputs (over 46,000 bitcoins in the past 18 months) with raising concurrently active users now estimated to 70+ in average coinjoin, providing the first data-based estimate of the participants’ anonymity set. We revealed a previously unknown but significant coordinator active from early May to November 2024, with a method capable of identifying emerging coordinators. Although WW2 conceals large-input wallet activity more effectively than WW1, it is still detected by the proposed transaction-centric liquidity analysis.
Lookup table (LUT) is an important cryptography primitive, widely used in secure applications such as private set intersection, boolean circuit evaluation, and privacy-preserving machine learning. However, existing LUT constructions suffer from either high overhead or limited functionality. In this paper, we propose ROTL, a secure two-party protocol for arithmetic LUT evaluation. Compared with SP-LUT (the state-of-the-art arithmetic LUT presented at NDSS '17), it achieves up to 3.3x speedup and 10.5x communication reduction in overall (preprocessing + online) and 21x speedup and 60x communication reduction in terms of the online phase. At the heart of ROTL is a novel protocol for secret-sharing rotation, which allows two parties to generate additive secret shares of the rotated table without revealing the rotation offset. We believe this protocol is of independent interest. Based on ROTL, we design a novel secure comparison protocol; compared with the state-of-the-art (USENIX '22), it achieves a 5x runtime speedup and 2.5x communication reduction in the online performance. To support boolean secret sharing, we further provide an optimization (named FLUTE+) for FLUTE (the state-of-the-art boolean LUT presented at Oakland '23). For a boolean LUT with table size n and elements bit-width l, we reduce FLUTE's computation complexity from O(n^2 l) to O(n log n + n l) and shift O(n log n) computation to the preprocessing phase without introducing communication overhead. As a result, FLUTE+ achieves up to 5x speedup in terms of overall (preprocessing and online) and over 600x speedup in terms of the online phase compared with FLUTE. The communication cost of FLUTE+ is exactly the same as FLUTE's in both the preprocessing phase and the online phase.
Graph Neural Networks (GNNs) are deep learning models designed to address the complexities of graph-structured, non-Euclidean data. Due to their complexity, knowledge distillation (KD) is often employed to transfer knowledge from a GNN to a simpler, more efficient student model, such as a Multi-Layer Perceptron (MLP), enabling deployment in large-scale industrial applications. However, KD can inadvertently leak sensitive information from the teacher to the student, posing significant privacy risks. We present the first membership inference attacks targeting GNNs in KD pipeline, showing that student MLPs can reveal whether a node appeared in the teacher’s training data. Our attacks operate in a black-box setting, requiring access only to the student outputs, and remain effective in cross-dataset scenarios. Experimental evaluations across four GNN models and eight datasets show the effectiveness of our approach, achieving up to 0.9014 precision under low FPR of 1% in cross-dataset settings. These results expose significant vulnerabilities in GNN-based KD frameworks, emphasizing the need for strong security measures during the KD process involving GNNs.
