2026/07/20 by Guangjie Liu, Guang Cheng, Weiwei Liu +1
#cs.CR
Parameter selection for encrypted traffic defense has long relied on empirical tuning, yet the fundamental question -- given a QoS cost budget D, how low can the leakage rate go under sustained observation? -- lacks a provable, computable baseline. Taking the semantic label sequence Xn as the source, the defended feature sequence Yn as the observation, and Wasserstein-1 distance as the defense cost, we define the side-channel rate-distortion function Rsc(D) within the stationary memoryless defense class Θiid and provide its complete characterization. We prove that Rsc(D) is monotone decreasing, convex, and continuous, with exact endpoints; the optimal defense has an exponential-tilting (Boltzmann) structure governed by KKT conditions; and the curve constitutes the exact Pareto frontier within Θiid. For binary equal-prior tasks, Dmax = \tfrac12W1(P0,P1) via Kantorovich--Rubinstein duality. On real-world website-fingerprinting defenses, the framework locates Front (Δgap=0.028 bits), WTF-PAD (0.034 bits), and TrafficSliver (0.124 bits) above the theoretical curve, quantifying their suboptimality gaps.