TraceBleed Artifact

TraceBleed is a source-level membership inference attack against black-box synthetic network trace generators (SynNetGens): given a reference trace $R$ and a synthetic trace $P(D)$, it decides, per source, whether that source's real traffic was used to produce $P(D)$.

This repository contains the source code and instructions for the artifact evaluation of our paper, "Cross-Flow Correlations Survive Synthesis: Measuring Source-Level Privacy Leakage in Synthetic Network Traces." We submit this artifact in support of the Artifact Available, Artifact Functional, and Results Reproduced badges. The instructions below reproduce Figures 4 and 6-15 of the paper.

Getting Started Instructions

Hardware requirements

We validated this artifact on a CloudLab C220G5 node (dual 10-core Intel Xeon Silver 4114 CPUs, 192GB RAM, no GPU by default). We recommend evaluating using an instance at least with 16 CPU cores, 64GB RAM, and 60GB free disk space.

In practice, a smaller CPU-only instance (fewer cores, less RAM) should also be sufficient to finish the artifact — the 16-core/64GB recommendation above is not a hard minimum for evaluation.

Environment setup

1. Git clone the repo.

2. Download the prepared data from this link, untar it, and place the resulting data/ directory under tracebleed/.

   Training every Traffic Encoder and all the SynNetGENs from scratch for all 5 evaluated datasets can take far longer than a 24-hour AE window even when the testbed includes powerful GPU resource such as A100/H100. Therefore, this repo provides the paper-producing checkpoints for artifact evaluation.

3. Install dependencies:

   conda create -n privacy python=3.10 -y
   conda activate privacy
   pip install -r requirements.txt

Artifact Evaluation

To evaluate the artifact, simply run:

cd artifact_script
bash run_all.sh

Sample output:

=== TraceBleed: caida ===
[caida] --use_pretrained set, skipping training, using shipped checkpoint /nfs/tracebleed/pretrained/caida/model.pt

=== [caida] running TraceBleed inference against P(D) ===

...

############################################
# All done.
############################################

Results and figures are saved under artifact_results/figures/, already organized by figure number — e.g., artifact_results/figures/figure_4/ contains everything corresponding to Figure 4 in the paper.

Note: Figures 9 and 13 will not look identical to the submitted paper. The paper is under minor revision, and we are updating both figures to report additional results:

• Figure 9 now includes a theoretical fit of the form $A(1 - e^{-qn})$, with $A$ and $q$ fitted per curve. The plotted curves are therefore this fitted function rather than a line connecting the raw empirical data points.
• Figure 13 now includes additional experiments: source-level DP NetShare at $\epsilon = 40/70$, and flow-level DP NetShare with its $\epsilon$ and $\delta$ re-expressed at the source level (via group-privacy composition over flows-per-source).