“if a model can reliably predict user activity, it proves the presence of a signal, but not the cause of that signal.”
A published attack claimed 91.4% accuracy fingerprinting 100 websites through the CPU cache. Cook’s team swapped it for an attacker that just runs value++ in a loop and got about 96.6%, while the cache version managed 72.6% on Safari. Over 99% of the gaps came from interrupts, and the original defence targeted the cache. A classifier that works tells you nothing about why it works.