PETS 2026#

Core#

Cryptographically-Secured Domain Validation#

Recording

Authors: Henry Birge-Lee (Princeton University), Grace H. Cimaszewski (Princeton University), Cyrill Krähenbühl (Princeton University), Liang Wang (Princeton University), Aaron Gable (Let's Encrypt), Prateek Mittal (Princeton University)

• Why: Domain control validation is the weakest link in web PKI, and it fails at exactly your intersection — routing (BGP/IP hijack of ACME challenges) meets certificate identity. The Princeton group has previously published real attacks on certificate issuance via network-level manipulation, and the Let's Encrypt co-author signals this is aimed at deployable CA-side change, not a paper-only fix.
• What: Apparently a scheme to make the domain validation step of certificate issuance cryptographically verifiable rather than trusting the network path (title/author line only — no abstract in program).
• How: Not described in the program; given the team's prior work, expect mechanisms that bind validation evidence to authenticated infrastructure or challenge exchanges so a network adversary can't satisfy a challenge they don't control.
• Where applicable: The ACME/web PKI ecosystem broadly — any CA, and by extension every TLS-terminated service. The Let's Encrypt involvement makes the deployment path unusually credible for a PETS paper.

zkRevoke: Configurable Untraceability for Verifiable Credentials using ZKPs#

Recording

Authors: praveensankar manimaran (University of Oslo, Norway), Mayank Raikwar (University of Oslo, Norway), Thiago Garrett (University of Oslo, Norway), Arlindo F. da Conceição (Federal University of São Paulo, Brazil), Leander Jehl (University of Stavanger, Norway), Roman Vitenberg (University of Oslo, Norway)

• Why: Revocation and unlinkability are in direct tension in the W3C Verifiable Credentials / digital wallet world: naive revocation checks let the issuer or verifier correlate presentations. This is a live standards debate (Status List 2021 vs. accumulators vs. ZK approaches) that any identity PM building on VCs has to reason about.
• What: Apparently a scheme letting credential holders prove validity (including non-revocation) via zero-knowledge proofs with a configurable knob for how much untraceability they get (title/author line only — no abstract in program).
• How: Presumably ZK proofs over credential attributes and revocation state (accumulator- or commitment-based), with the "configurable" part trading proof size/verification cost against correlation resistance.
• Where applicable: VC/DID wallet ecosystems, enterprise credentials, and any selective-disclosure identity scheme; general technique, not tied to one issuer.

Personalizing Agent Privacy Decisions via Logical Entailment#

Recording

Authors: James Flemings (University of Southern California), Ren Yi (Google), Octavian Suciu (Google), Kassem Fawaz (University of Wisconsin--Madison), Murali Annavaram (University of Southern California), Marco Gruteser (Google)

• Why: This is the agentic-identity paper of the program. As AI agents act on users' behalf, the question shifts from authentication ("is this agent who it says it is") to authorization policy ("what may it disclose, to whom, in this context"). A Google co-authorship suggests the problem is real at production scale.
• What: Apparently a formal-logic approach to encoding user privacy preferences and checking whether a proposed agent action follows from them — turning agent decisions into a personalized policy-entailment problem (title/author line only — no abstract in program).
• How: Inference: user preferences expressed as logical rules; an agent's intended action (or data disclosure) is evaluated by entailment against those rules, with personalization meaning the rule set is learned/derived per user.
• Where applicable: Assistant/agent platforms and any system where delegated AI acts for a user — the natural companion to SPIFFE-style workload identity: proving who the agent is only matters once you can also decide what it may do.

CODoH: Privacy-Preserving Caching for Oblivious DNS over HTTPS#

Recording

Authors: Pankaj Niroula (William & Mary), Lily Gloudemans (William & Mary), Aashutosh Poudel (William & Mary), Collin MacDonald (William & Mary), Stephen Herwig (William & Mary)

• Why: ODoH's fatal flaw for deployment is that relaying through an oblivious proxy destroys resolver-side caching, inflating latency and cost. Solving cache while preserving obliviousness is a real distributed-systems problem at the heart of privacy-preserving network infrastructure — the same tension as anonymous credentials vs. CDN economics.
• What: Apparently a mechanism that restores caching benefits for ODoH without letting the resolver or proxy link queries to clients (title/author line only — no abstract in program).
• How: Not described in the program; plausible routes are oblivious caching (private information retrieval over cache contents) or cache-shared constructions where hit/miss patterns don't leak identity. Herwig's group works in network measurement and systems security, so expect implementation and latency evaluation.
• Where applicable: DNS resolution infrastructure — DoH/ODoH deployments, corporate resolvers, privacy-relay services. Broadly applicable to any CDN/caching service that wants unlinkability, not DNS-specific in concept.

Ephemeral Network-Layer Fingerprinting Defenses#

Recording

Authors: Tobias Pulls (Karlstad University), Topi Korhonen (Independent), Ethan Witwer (Linköping University), Niklas Carlsson (Linköping University)

• Why: Passive network-layer fingerprinting (TCP/IP stack and header-level characteristics, p0f-style) is how censors and adversaries identify proxies, bridges, and tunnel traffic without decrypting anything. Pulls is a long-time traffic-analysis researcher, and this sits squarely in network security operations: it's the same fingerprinting your anti-abuse or DLP stack might do — from the other side.
• What: Apparently defenses that make a host's network-layer fingerprint ephemeral — changing over time so long-lived passive classifiers can't match or block on stack characteristics (title/author line only — no abstract in program).
• How: Presumably systematic mutation of network-layer identifiers (header options, timing, fragmentation behavior) on a rotating basis, with evaluation against real classifiers.
• Where applicable: Circumvention/proxy infrastructure (Tor bridges, VPN endpoints) and any deployment that must survive passive, low-cost classification by a network observer. General technique at the OS/network-stack level.

Evaluating connection migration based QUIC censorship circumvention#

Recording

Authors: Seungju Lee (Princeton University), Mona Wang (Princeton University), Watson Jia (Princeton University), Qiang Wu (GFW Report), Henry Birge-Lee (Princeton University), Liang Wang (Princeton University), Prateek Mittal (Princeton University)

• Why: This is QUIC protocol internals (connection IDs, migration, path validation) weaponized for censorship resistance — and the GFW Report co-authors signal measurement against a live national censor, not a lab adversary. For anyone who reasons about QUIC/HTTP3 deployment, seeing the protocol's mobility feature double as an evasion primitive is valuable.
• What: Apparently an evaluation of using QUIC connection migration — moving an established connection across paths/addresses without re-handshaking — as a censorship circumvention strategy, including how a censor responds (title/author line only — no abstract in program).
• How: Inference: leverage migration to relocate a connection away from blocked paths (e.g., blocked server IPs or links), evaluating blocking asymmetries the GFW exploits and whether CID rotation defeats correlation.
• Where applicable: Circumvention tools on QUIC-capable endpoints and, in the mirror direction, any middlebox/policy enforcement design that assumes connection↔address binding. Adversary-specific results (GFW) but the technique is general QUIC.

Di5Guise: 5G Privacy with vSIM#

Recording

Authors: Shirin Ebadi (University of Colorado Boulder), Zach Moolman (University of Colorado Boulder), Tamara Lehman (University of Colorado Boulder), Eric Keller (University of Colorado Boulder)

• Why: This hits both halves of your identity/networking background at once: 5G subscriber identity (SUPI/SUCI, IMSI-catcher history) and network function virtualization — Eric Keller's presence signals an SDN/NFV systems approach rather than pure crypto theory.
• What: Apparently the use of virtualized SIMs (vSIM) — decoupling subscriber credentials from a physical SIM/eSIM — to improve subscriber privacy in 5G, presumably by making identity easier to rotate or compartmentalize per device/service (title/author line only — no abstract in program).
• How: Not described in the program; plausibly per-context virtual identities provisioned on demand so that long-term subscriber identifiers are never exposed on the radio or core interfaces.
• Where applicable: 5G core and RAN ecosystems, MVNOs, and eSIM/iSIM device fleets. Realistically operator-dependent: requires core-network support for virtualized credentials, so nearer-term for private 5G or MVNO deployments than for consumer carriers.

Understanding Privacy and Quality Tradeoffs in Synthetic Network Data#

Recording

Authors: Andrew Chu (University of Chicago), Kyle MacMillan (University of Chicago), Paul Schmitt (Cal Poly), Nick Feamster (University of Chicago)

• Why: The closest thing to your home turf in the whole program: network measurement data (topologies, flow records, telemetry) is notoriously hard to share across orgs — vendors, operators, researchers — because it's simultaneously sensitive and operationally precious. Feamster's group doing a privacy/utility tradeoff study means real network datasets and network-quality metrics, not generic tabular-DP benchmarks.
• What: Apparently an empirical study of how privacy mechanisms applied when generating synthetic network data degrade the properties that make the data useful — quantifying the privacy/quality frontier (title/author line only — no abstract in program).
• How: Presumably generative models over network data (topology and/or traffic) with differential privacy or sanitization on the training side, evaluated on downstream network-analysis tasks.
• Where applicable: Broadly applicable to any org that shares network telemetry externally (benchmarks, incident collaboration, regulatory reporting, research datasets); not tied to a single operator's setup, though dataset specifics will matter.

Adjacent#

SoK: Offline Finding Protocols for Lightweight Location Tracking#

Recording

Authors: Akshaya Kumar (Georgia Institute of Technology), Carolina Ortega Pérez (Cornell University), Joseph Jaeger (Georgia Institute of Technology), Thomas Ristenpart (Univeristy of Toronto), Michael Specter (Georgia Institute of Technology)

• Why: The Find My-style crowdsourced location ecosystem (Apple, Google, Samsung, third-party tags) is a large, deployed, cryptographically interesting protocol family with live standardization pressure (unwanted-tracking mitigation). A SoK from the GT/Cornell/Toronto systems-security corridor is the map of that ecosystem.
• What: A systematization of offline-finding protocols — how lightweight devices with no connectivity broadcast cryptographically protected beacons that nearby crowd devices relay to the owner (title/author line only — no abstract in program).
• How: Expect a taxonomy of beacon privacy mechanisms (rotating public keys, address rotation), relay and discovery architectures, and attacker models including stalking/unwanted tracking.
• Where applicable: Device-finding networks and BLE-based crowd location infrastructure; increasingly relevant as anti-stalking features become a cross-vendor interoperability problem.

What-App? App usage detection using encrypted LTE/5G traffic#

Recording

Authors: Jinjin WANG (University of Birmingham), Zishuai Cheng (Beijing University of Posts, Telecommunications), Mihai Ordean (University of Birmingham), Baojiang Cui (Beijing University of Posts, Telecommunications)

• Why: Even with full payload encryption, the radio-access layer leaks enough (bearer patterns, QoS flows, timing) for a passive observer to classify which app is in use. For a PM with RAN and security background, this is the canonical "encryption is not traffic confidentiality" result, measured on modern 4G/5G.
• What: Apparently a traffic-analysis attack that identifies applications from encrypted LTE/5G captures, demonstrating app-level fingerprinting despite payload and much metadata protection (title/author line only — no abstract in program).
• How: Presumably supervised classification over radio-layer and flow features (bearer/QCI characteristics, timing, volume) rather than packet contents.
• Where applicable: Threat model is the mobile network operator or an on-path observer with RAN visibility — relevant to zero-rating, lawful-intercept debates, and privacy claims of 5G (SUCI protects identity, not behavior).

More Space, Less Privacy? Measuring the Effectiveness of IP-based Website Fingerprinting in IPv6#

Recording

Authors: Sumeer Ahmad (Stony Brook University), Michalis Polychronakis (Stony Brook University), Theophilus A. Benson (Carnegie Mellon University), Nguyen Phong Hoang (University of British Columbia)

• Why: IPv6's address-space semantics — per-flow addresses, rotating /64s, SLAAC privacy extensions — are usually framed as a privacy win. This paper asks whether the expanded space (or its addressing habits) actually enables IP-based website linking/fingerprinting instead. That's a networking-semantics question with direct privacy consequences, from a strong measurement group (Polychronakis, Benson).
• What: Apparently a measurement of how effectively websites or on-path observers can fingerprint/link clients by IP address in the IPv6 world — testing the assumption that IPv6 rotation defeats tracking (title/author line only — no abstract in program).
• How: Not described in the program; expect large-scale measurement of IPv6 address stability, prefix behavior, and address-to-identity linkability across visits.
• Where applicable: Web tracking, CDN/anti-abuse design, and any privacy engineering that relies on IPv6 address rotation; broadly applicable, not org-specific.

CensorLess: Cost-Efficient Censorship Circumvention Through Serverless Cloud Functions#

Recording

Authors: Dayeon Kang (University of Massachusetts Amherst), Jade Sheffey (University of Massachusetts Amherst), Mingshi Wu (GFW Report), Pubali Datta (University of Massachusetts Amherst), Amir Houmansadr (University of Massachusetts Amherst)

• Why: Houmansadr's group treating circumvention as a cost problem: serverless functions give you disposable, auto-scaling egress from cloud provider ranges that censors are reluctant to block wholesale. It's a systems/economics answer rather than a protocol trick, and the GFW Report co-author again signals real-adversary grounding.
• What: Apparently a circumvention design that uses serverless cloud functions as ephemeral proxies, driving per-use cost down and re-provisioning speed up so address-blocking is ineffective (title/author line only — no abstract in program).
• How: Inference: clients reach FaaS endpoints (function URLs, API gateways) that relay traffic; blocked functions are replaced cheaply, exploiting the shared, economically-entangled cloud IP space.
• Where applicable: Client tools that can reach major cloud providers; constrained by provider acceptable-use enforcement and function runtime/networking limits. Adversary economics are specific to censors that tolerate cloud IP ranges.

Privacy Pass is Anamorphic: Practical Consequences and Attacks in the Black-box Model#

Recording

Authors: Mirosław Kutyłowski (NASK National Research Institute), Oliwer Sobolewski (NASK National Research Institute)

• Why: Privacy Pass is deployed, IETF-standardized anonymous-access token infrastructure (Cloudflare, Apple) — essentially blind-signature rate-limiting credentials sitting in your identity perimeter. A paper showing it admits "anamorphic" properties (hidden information flowing inside otherwise sound protocol runs) is a property-type analysis of a protocol you may actually run.
• What: Apparently a demonstration that Privacy Pass exchanges can carry concealed channels in the black-box model, with practical consequences for deployments that assumed the tokens reveal nothing beyond validity (title/author line only — no abstract in program).
• How: Anamorphic cryptography lens: a party with secret knowledge (e.g., a malicious or colluding issuer/verifier) can encode hidden bits into seemingly random protocol fields such that normal participants detect nothing.
• Where applicable: Any Privacy Pass / private-access-token deployment (privacy passes, PATs, anti-bot integrations); the black-box model makes the results deployment-relevant rather than purely theoretical.

Wildcard#

Themes#

• Circumvention has become a full systems discipline. QUIC connection migration, WebRTC media encapsulation, serverless-egress proxies, bridge-reporting pipelines, onion-routing fragmentation, and mixnet latency studies together form an engineering stack — protocol features, cover traffic, infrastructure economics, and user reporting — rather than a set of isolated protocol tricks.
• Fingerprinting is the arms race of the cycle. Network-layer stacks, IPv6 addresses, browsers, video content, voice assistants, and Android devices all get dedicated fingerprinting papers — and nearly each attack has a paired client-side defense (ephemeral defenses, Dodge, PriVA-C). Any deployment that assumes "encrypted means unidentifiable" is being disproven layer by layer.
• Identity infrastructure is absorbing privacy constraints. Digital-ID risk frameworks, OAuth scope overreach, revocable-but-unlinkable verifiable credentials, and Privacy Pass property analysis show the identity layer being redesigned around correlation resistance — the same forces reshaping passkeys, PATs, and federation.
• Agentic AI has arrived as a governance problem. Agent decision logic via logical entailment, automated compliance auditing of AI agents, web-agent security/privacy evals, and GPT-integration dataflow tracing mark the emergence of a policy/authorization surface for AI agents — the natural extension of workload identity into what the workload may do.
• Encrypted computation is getting a cost model. FHE-for-AI SoKs, query-efficient PIR, HE-accelerated training, and private transformer inference (SPRINT, from SAP) show the field moving from "possible in principle" to dollars-per-inference accounting.
• Regulation is driving measurement science. DSA ad-transparency audits, TCF/GDPR compliance analysis, CCPA opt-out usability, and policy-label accuracy studies make legal regimes a first-class experimental target — a trend that increasingly touches anyone operating consumer-facing networked services.