You know how a witness protection program works? Give someone a new identity — new name, new city, new job. Works great until the marshals always send people to the same three cities using the same relocation playbook. A determined investigator doesn't need to find the person; they just need to learn the playbook. That's exactly the problem with every Tor website fingerprinting defense until now. Defenses like Tamaraw and its variants morph traffic into disguised patterns, but each webpage consistently maps to the same disguised form. An attacker who learns the mapping — especially with a defense-aware autoencoder (DAAE) — sees right through it. Chameleon's committed claim: many-to-many randomized traffic morphing defeats both adversarial-training-based and DAAE-based fingerprinting attacks simultaneously, something no prior WF defense achieves. This is not a minor tweak to Tamaraw. The paper identifies a structural vulnerability in all one-to-one and many-to-one morphing schemes — they create learnable trace mappings — and replaces the paradigm entirely. Each webpage trace maps randomly to multiple morphing candidates, and different webpages share morphing targets. The attacker can't learn the mapping because the mapping changes every time. The numbers against Adaptive Tamaraw, the current strongest defense, are striking. On adversarial-training attacks, Chameleon drops accuracy by up to 36.74%. On DAAE-based RF attacks using the GTT23 dataset, Chameleon limits the attacker to 35.19% F1-score where Adaptive Tamaraw allows 88.22%. That's not incremental — it's a category shift. Meanwhile, Chameleon actually costs less: 34.12% less bandwidth overhead and 60.38% less time overhead than Adaptive Tamaraw. Defenses that are both more effective AND cheaper are rare in security research. Architecturally, Chameleon belongs to the traffic-morphing family of WF defenses but introduces two key structural choices. First, morphing candidate selection uses high intra-class diversity and low inter-class disparity — you want the disguises to look maximally different from each other within a class but similar across classes, so the attacker can't cluster. Second, a radix-trie-based synchronization mechanism lets pluggable transport (PT) endpoints at both ends of the Tor circuit agree on morphing traces using packet-direction prefixes without extra round trips. Trace mutation and normalized prefix matching keep the synchronization overhead manageable. The evaluation is thorough by WF defense standards: six state-of-the-art defenses compared, five WF attacks tested, three public datasets, both closed-world and open-world settings. The real-world PT bridge evaluation is the standout — Chameleon actually runs on Tor's pluggable transport infrastructure, not just in simulation, and limits strong attacks while adding only 16.25% time overhead. That said, the authors are grading their own homework. No independent team has replicated these results, and the attack models tested are the ones the authors chose. The obvious next experiment is scaling Chameleon under adversarial adaptation — what happens when an attacker specifically trains against Chameleon's many-to-many morphing with knowledge of the candidate selection algorithm? The paper argues the randomization makes this hard, but doesn't run an attacker with full white-box access to the morphing strategy. My read: this is partly (c) — saving the adaptive attacker arms race for a follow-up — and partly (a) — running a truly adaptive attacker against a randomized defense requires significant compute to generate meaningful attack statistics across the randomization space. The field fight here is real. One camp believes WF defenses are fundamentally doomed because ML-based attacks will always learn the mapping. The other believes that sufficient randomization in the defense breaks the learning signal. Chameleon lands squarely in the second camp, and the DAAE results are the strongest evidence yet that randomization can work — if you randomize the right thing (the mapping itself, not just the padding).
