💻 computer science

The Collateral Damage Trap: Understanding UPGen and Proteus for Censorship Evasion

This paper evaluates the UPGen and Proteus censorship circumvention systems, revealing that while UPGen's "collateral damage trap" theoretically prevents blocking without massive collateral damage, experimental reproduction shows that publicly available artifacts fail to achieve this resistance, as standard classifiers can reliably distinguish their traffic from benign protocols.

Original authors: Lakshit Singh Bisht

Published 2026-09-29✓ Author reviewed ⓘ

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Lakshit Singh Bisht

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the digital age, the internet is often treated as a public square where information flows freely, but for many people, that flow is tightly controlled. Governments in various nations act as gatekeepers, using sophisticated tools to inspect the data packets traveling across their networks. These tools, known as deep packet inspection, can look inside the digital envelopes of internet traffic to identify and block specific services, such as encrypted messaging apps or anonymous browsing networks. To fight back, researchers have developed "pluggable transports," which are like digital camouflage. These tools try to disguise blocked traffic so it looks like harmless, everyday internet activity, slipping past the censors' filters. The goal is to keep the lines of communication open without the censors realizing they are being bypassed.

A recent study by Lakshit Singh Bisht examines a new pair of tools designed to outsmart these censors: UPGen and Proteus. Unlike traditional camouflage that tries to mimic a single, specific type of traffic, this system attempts a different strategy. UPGen is a generator that creates entirely new, unique protocols for data transmission. Proteus is the engine that runs these protocols. The core idea is what the researchers call a "collateral damage trap." The theory is that because UPGen can create a vast number of different, distinct protocols, a censor cannot simply block one specific type of traffic to stop it. If the censor tries to block the new traffic, they risk accidentally blocking a huge amount of normal, harmless internet traffic that happens to look similar. This makes the act of censorship so messy and disruptive that the censor might be forced to give up.

The researchers set out to test if this theory holds up in the real world. They analyzed the public code for UPGen and Proteus, generating thousands of these unique protocol specifications to see how they behaved. They found that the system is indeed capable of creating an enormous variety of protocols. Their calculations suggest there are approximately 41 septillion possible configurations, a number so large it is difficult to comprehend. In their experiments, every single protocol they generated was unique, confirming that the system can produce a massive diversity of digital "signatures." This diversity is the foundation of the trap; if there are that many different ways to send a message, it becomes incredibly hard for a censor to know exactly what to block without causing chaos.

However, the study also uncovered significant cracks in the armor. While the system generates a huge number of possibilities, the researchers found that the actual software released to the public contains several programming errors. These bugs meant that some of the settings intended to create variety were not working as designed, effectively reducing the number of unique protocols the system could actually produce. More importantly, when the researchers tried to test how well these new protocols could hide from automated detection systems, the results were surprising. In the original research that introduced UPGen, the author claimed that machine learning classifiers could not distinguish this new traffic from normal internet traffic. But in this new study, using the publicly available data, machine learning classifiers were able to identify the UPGen traffic with near-perfect accuracy.

This discrepancy suggests that the "collateral damage trap" might not work as well as originally hoped, at least with the current version of the software. The classifiers used in the study were able to spot the patterns in the UPGen traffic that the original authors believed were hidden. The researchers noted that the public version of the software might not include all the parameters used in the original, more successful experiments, and that the bugs they found likely made the traffic easier to identify. Despite these setbacks, the study confirms that the approach is technically feasible and that the system can be deployed. The author successfully set up a working bridge, allowing a user to connect to the Tor network through a server running Proteus, proving that the technology can function in a real-world environment.

The paper concludes that while UPGen and Proteus represent a bold and novel idea for evading censorship, the publicly available tools do not yet fully deliver on the promise of being unblockable. The system creates a vast space of possibilities, but implementation errors and detection vulnerabilities mean it is not yet a solved problem. The researchers emphasize that this work should be seen as a foundation for future development rather than a finished product. They suggest that fixing the software bugs and refining the protocol generation could help the system reach its potential. For now, the study serves as a crucial reality check, showing that while the idea of overwhelming a censor with infinite options is powerful, the practical execution requires much more work before it can reliably protect users against sophisticated nation-state censors.

Technical Summary: The Collateral Damage Trap: Understanding UPGen and Proteus for Censorship Evasion

Problem Statement
Nation-state censors increasingly employ Deep Packet Inspection (DPI) and blocklists to restrict access to online services, undermining internet freedom. Traditional censorship circumvention tools, such as TLS with ESNI or fixed obfuscation protocols like obfs4, are vulnerable to being identified and blocked by sophisticated classifiers. Once a specific protocol signature is recognized, the censor can block it without significant "collateral damage" (i.e., blocking benign traffic). The core problem addressed by this paper is the lack of adaptability in existing tools: they rely on a static set of protocols, making them susceptible to targeted blocking. The author investigates whether generating a vast space of unique, plausible, yet unlinkable protocols can force censors into a "collateral damage trap," where blocking the circumvention tool requires blocking a prohibitively large portion of general internet traffic.

Methodology
The study analyzes two complementary systems: UPGen (Unidentified Protocol Generation), a protocol generator, and Proteus, a programmable protocol engine.

UPGen: Designed to generate Protocol Specification Files (PSFs) that define novel, structured encrypted protocols. It utilizes a neural network to generate greeting strings resembling repository names and a configuration space involving cryptographic parameters (ciphers, key encodings), structural fields (length, version, padding), and handshake patterns.
Proteus: A Rust-based execution engine that interprets PSFs to establish communication tunnels. It features a restricted runtime environment to ensure safety and supports programmable protocols that can be adapted to changing censorship environments.
Experimental Approach: The author conducted small-scale local experiments to evaluate the public implementations of UPGen and Proteus (v0.2.0).
1. Configuration Space Analysis: They derived an independent estimate of the protocol configuration space based on the public source code and configuration files.
2. PSF Generation and Validation: They generated 3,111 PSFs and validated them using the Proteus compiler to check for structural integrity and execution errors.
3. Greeting String Analysis: They evaluated the impact of training corpus size on the "plausibility" of generated greeting strings.
4. Classifier Reproduction: Using the public artifact dataset (16,500 PCAP samples), they trained Random Forest, 1D-CNN, and Deep Fingerprinting classifiers to distinguish UPGen traffic from benign protocols (TLS, SSH, obfs4, etc.).
5. Deployment: A functional deployment of a Proteus bridge was performed on a VPS to verify end-to-end connectivity with Tor.

Key Contributions

Independent Configuration Space Estimation: The author derived an estimate of approximately $4.1 \times 10^{25}$ possible protocol configurations for the public UPGen implementation. The paper notes that the original work reported a diversity estimate of $4.2 \times 10^{22}$ , but explicitly states this figure should be interpreted as the original authors' report rather than a result independently reproduced in this study, as some parameters used in the original evaluation were intentionally withheld from the public release.
Implementation Bug Discovery: The study identified five implementation bugs in the public UPGen release. A primary issue involved string-valued boolean parameters (e.g., "False" vs. False) being evaluated as truthy in Python, causing certain configuration parameters to remain constant rather than randomizing as intended. Despite these bugs, all generated PSFs remained structurally unique.
Classifier Resistance Discrepancy: Contrary to the original work's claim that UPGen traffic is indistinguishable from benign traffic, the author's reproduction experiments found that Random Forest, 1D-CNN, and Deep Fingerprinting classifiers could reliably distinguish UPGen traffic from benign protocols with near-perfect accuracy (TPR/FPR of 1.00/0.00 in most cases).
Operational Deployment Guide: The paper provides a detailed, step-by-step guide for deploying Proteus as a Tor pluggable transport on both proxy and client sides, including configuration of torrc, capability assignment for port binding, and bridge fingerprint verification.

Results

Protocol Diversity: All 3,111 generated PSFs were unique at both the file and structural levels. However, the diversity was lower than the theoretical maximum due to the identified implementation bugs.
Validation Success: Approximately 77.7% of generated PSFs passed Proteus validation. Failures were primarily attributed to PEM parsing errors, public-key decoding failures, and payload mismatches.
Greeting Strings: Larger training corpora (10,000 entries) produced greeting strings that were more "repository-like" and longer, whereas smaller corpora produced nonsensical strings.
Classifier Performance: The classifiers successfully identified UPGen traffic. The author attributes this to the specific characteristics of the public dataset, noting that benign protocols in the dataset exhibited very low sequence diversity (e.g., TLS had only 3 unique sequences out of 1000 samples), which may have allowed classifiers to memorize benign patterns and easily flag the more diverse UPGen traffic.
Deployment: The Proteus bridge successfully connected to the Tor network, allowing the client to access onion services and clearnet websites with no observable latency hindrances during the test period.

Significance and Claims
The paper positions UPGen and Proteus as a novel, programmable approach to censorship evasion that aims to exploit the "collateral damage trap." The significance lies in the potential to generate a protocol space so large that censors cannot block all variants without disrupting legitimate traffic.

However, the author maintains a modest stance regarding the current state of the technology. They explicitly state that their evaluation of the publicly released artifacts does not reproduce the classifier resistance reported in the original work. They clarify that their findings indicate a "reproducibility gap" rather than a contradiction of the original research, likely due to differences in the dataset, implementation bugs, and the specific experimental environment.

The paper concludes that while UPGen and Proteus offer a substantial foundation for future research and provide significant protocol-level diversity, the current public implementation requires further development, bug fixing, and rigorous testing against real-world censorship systems (such as the Great Firewall of China) before it can be considered a viable alternative to established tools like obfs4 and Snowflake. The work serves as a critical technical analysis and a practical deployment guide, highlighting both the theoretical promise and the practical limitations of the current system.

More like this