Waterfall: A Capsule-Based Framework for Evaluating Traffic Watermarking in Anonymity Systems
Authors: Dimitri Mankowski (Ruhr University Bochum), Eduard Marin (Telefonica Research), Nuno Santos (INESC-ID / IST, University of Lisbon), Veelasha Moonsamy (Ruhr University Bochum)
Volume: 2026
Issue: 4
Pages: 1022–1040
DOI: https://doi.org/10.56553/popets-2026-0157
Abstract: Traffic watermarking is a powerful traffic-analysis technique and remains a practical threat to anonymous communication systems, yet its real-world feasibility is still poorly understood. Prior schemes are typically evaluated in narrow, single-scenario setups with ad hoc implementations and implicit assumptions about flow structure, coordination between embedder and detector, and how perturbations survive network noise. This makes results hard to reproduce, compare across contexts, and stress-test against modern network protocol features. This paper introduces Waterfall, a capsule-based framework for implementing and evaluating watermarking techniques on real traffic. Waterfall captures common semantic foundations of watermarking and exposes them via a unified capsule abstraction with a programmable API and declarative configuration. We implement Waterfall and validate it by reproducing and stress-testing representative schemes from the literature, and by deriving self-adaptive variants that tune their behavior using live traffic measurements. We further use Waterfall to analyze Tor's deployed Conflux protocol and show that its traffic-splitting design can unintentionally amplify watermark detectability. Finally, we demonstrate that Waterfall is also suitable for implementing and evaluating defenses against watermarking attacks.
Keywords: Traffic analysis, watermarking, anonymity networks, Tor
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution 4.0 license.
