Technical Summary: PersonaFingerprint

Problem Definition

This paper identifies and quantifies a novel privacy risk in modern web browsing: Persona Fingerprinting. While traditional Website Fingerprinting (WFP) focuses on inferring which website a user visits from encrypted traffic metadata (packet sizes and inter-arrival times), this work investigates whether an adversary can infer who is browsing—specifically, the user's behavioral persona—even when multiple users visit the same set of sites.

The study operates under a standard WFP threat model: a passive network adversary (e.g., an ISP, VPN provider, or Tor exit node) observes encrypted traffic but has no access to application payloads, URLs, cookies, or browser identifiers. The adversary is restricted to observing fixed-length windows of 1,000 consecutive packets, represented solely by signed packet lengths (indicating direction) and inter-arrival times. The challenge is compounded by modern web architectures (single-page applications, infinite scrolling, lazy loading) which blur traditional page boundaries, making fixed-length packet windows the only viable observation unit.

Methodology

1. LLM-Driven Multi-Agent Browsing Framework

To address the difficulty of collecting large-scale, labeled traffic from human users with diverse behavioral patterns, the authors constructed a controllable, reproducible framework using Large Language Model (LLM) agents. This framework avoids direct collection of sensitive user data while generating realistic traffic traces.

• Decision Agent: An LLM acts as a "persona-conditioned" decision maker. It receives a structured persona profile (background, goals, interaction style, content preferences) and a screenshot of the current page. Based on this context, it generates high-level natural language instructions (e.g., "scroll through reviews," "search for alternatives").
• Computer-Use Agent: A separate agent executes these instructions in a real browser via DOM interactions (clicks, scrolling, typing).
• Traffic Capture: The browser is instrumented to capture encrypted packet-level metadata. The framework generates approximately 800,000 labeled packet windows across 10 websites and 15 distinct personas (plus an Open-World class).
• Quality Controls: The system includes metrics for Persona Consistency (alignment between generated behavior and the persona profile) and Behavioral Diversity (preventing degenerate, scripted behavior), ensuring the generated traffic reflects coherent yet varied human-like browsing.

2. Formalization of Persona Fingerprinting

The authors formalize the task under two settings:

• Per-Site: The adversary knows the target website and attempts to distinguish between personas within that specific site.
• Mixed-Site: The adversary does not know the target website and must infer personas from traffic pooled across multiple heterogeneous sites.
• Open-World: The system must handle an "Open-World" (OW) label, aggregating unseen personas to measure misattribution risk (i.e., the risk of assigning an unknown user to a specific known persona).

3. Modeling and Evaluation

The study evaluates three attacker pathways:

1. Direct Persona Classification: Training a classifier directly on packet windows to predict personas.
2. Representation Probing: Freezing a standard WFP encoder (trained only on site identification) and attaching a lightweight MLP probe to determine if persona information is incidentally encoded in the WFP representations.
3. Joint Multi-Task Learning: Training a shared encoder with two heads (site and persona) to quantify the trade-off between site classification accuracy and persona inference capability.

Key Results

1. High Accuracy in Persona Inference

• Per-Site: The system achieves strong persona classification performance across all 10 tested websites (Amazon, YouTube, Reddit, Bilibili, LinkedIn, etc.). Macro-F1 scores for individual personas typically range from 0.78 to 0.91.
• Mixed-Site: Even without knowing the target site, persona inference achieves approximately 84% accuracy on mixed-site traffic (15 personas + OW). This suggests that behavioral signatures are robust and site-agnostic.
• Open-World Risk: While the model can often recognize unseen behaviors (OW F1 ~65.6%), there is a significant misattribution risk. Approximately 34.4% of unseen persona windows are incorrectly assigned to a specific canonical persona rather than labeled as "other." These misattributions often collapse into a small set of top-3 personas, potentially creating false but actionable behavioral profiles.

2. Incidental Leakage in WFP Models

• Probing Results: A lightweight MLP probe trained on top of a frozen, site-only WFP encoder achieves persona accuracy 20–30 percentage points higher than a probe trained on a random encoder. This demonstrates that standard WFP models implicitly encode rich persona information without explicit training for it.
• Joint Training: By adding a persona objective to a WFP model (joint multi-task learning), persona accuracy can be boosted to ~80% while retaining strong site classification performance (~93% baseline). This indicates that upgrading an existing WFP pipeline to include persona inference requires minimal additional effort.

3. Scalability

The study demonstrates that attack accuracy scales rapidly with the volume of persona-labeled traffic. Mixed-site open-world accuracy rises from 55% (500 windows/persona) to 84% (5,000 windows/persona), suggesting that the ability to generate labeled traffic at scale (via LLM agents) significantly lowers the barrier for attackers to build powerful inference models.

Significance and Claims

The paper claims that encrypted traffic metadata on modern websites leaks not only the identity of the visited site but also the behavioral persona of the user. The significance of this work lies in three main contributions:

1. New Privacy Risk Definition: It formally defines "Persona Fingerprinting" as a distinct and sensitive privacy threat, showing that "how" a user browses is as inferable as "where" they browse.
2. Scalable Data Generation: It introduces a controllable, LLM-driven framework for generating realistic, persona-conditioned browsing traces at scale, bypassing the ethical and logistical hurdles of recruiting human participants for such studies.
3. Incidental Leakage: It reveals that existing WFP defenses and models may be insufficient because they inadvertently encode persona signals. The finding that a simple probe can extract persona data from a site-only model implies that current privacy-preserving measures focused solely on site obfuscation may fail to protect user behavioral profiles.

The authors conclude that persona fingerprinting deserves attention alongside traditional WFP in the design and evaluation of privacy-preserving web systems, as the structure of encrypted traffic inherently reveals stable behavioral patterns.