Russia's AI VPN filter: what it sees without decrypting, and where it misfires

What this is about

A VPN encrypts everything that passes through the tunnel. Even so, Russia's media regulator Roskomnadzor wants to find those tunnels with AI. Forbes Russia analyzed the agency's program passport for digitalization in 2026–2028. It states that the agency developed a machine learning filtering mechanism and spent 2.27 billion rubles on it, roughly 25 million euros. According to 3DNews and the Moscow Times, the system is integrated into ASBI. That's the central control system Roskomnadzor uses to steer the TSPU, the filter boxes installed in the traffic path at every provider.

This article answers two questions. What can a filter like this actually see? And what has public research measured? Our argument: good detection algorithms have existed for years. What decides the outcome is the base rate, meaning how rare the target is in overall traffic. Filter at national scale and you'll inevitably block lots of harmless connections. So how well the AI works is secondary. What matters more is how much collateral damage the state is willing to accept.

What's confirmed and what isn't

The figure isn't entirely new. Back in January 2026, Kommersant, citing Forbes, reported that Roskomnadzor was planning to spend 2.27 billion rubles on such a system. What's new is that the current program document books the development as done. That hasn't been independently confirmed. According to the document, the model is "domestic," runs on the agency's own infrastructure and isn't a large language model. The document doesn't name it. In the spring, Astra AI from the Astra group was mentioned, but that name is missing from the new paper. According to Rambler, the word VPN doesn't even appear explicitly in the mechanism's description. The agency hasn't published test results, detection rates or false-positive statistics.

The budget puts the sum in context. According to Meduza, around 60 billion rubles are earmarked for traffic filtering over the next three years. Building and upgrading the TSPU alone accounts for 3.99 plus 6.2 billion rubles this year. According to Vërstka, capacity is set to grow to 954 terabits per second by 2030. By then, signature-based VPN blocking is supposed to be 92 percent effective. In October, a proposal from the Ministry of Digital Development to reach 95 percent with AI also surfaced. The ministry denies that this proposal is still in the current draft plan.

What a filter sees without decrypting anything

Encryption hides the content. But the shape of a data stream stays visible, much like a sealed letter whose weight, format and return address anyone can see. According to the Moscow Times, Dmitry Kuteynikov of RKS Global suspects a predictive model that estimates the probability of VPN use from external features. Research mainly points to these four angles:

• Randomness (entropy): Well-encrypted data looks like noise. According to a study by GFW Report (USENIX Security 2023), starting in November 2021, China's Great Firewall inspected the first message of every connection. The key factors were how many bits per byte were set and whether printable characters appeared. Anything that looked like pure randomness and resembled neither TLS nor HTTP got blocked.
• Packet sizes and timing: A protocol's handshake has typical sizes and sequences. That stays visible even when every byte is encrypted.
• TLS in TLS: A proxy like VLESS disguises itself as a normal HTTPS connection. But when the user opens an HTTPS site through the tunnel, a second handshake sits inside the first. Its back-and-forth of packets creates a recognizable pattern.
• Server and surroundings: A server in a foreign hosting provider's data center behaves differently from a big web portal. According to Kommersant, the Ministry of Digital Development also wanted to analyze node behavior, the hosting provider and neighboring IP addresses.

What research has measured

The OpenVPN study shows how thin many disguises are. Most "obfuscated" commercial services used only a simple XOR patch, basically flipping bits according to a fixed pattern. Detection ran in two stages: first, suspicious connections were passively pre-filtered, then the researchers probed the servers with targeted test requests. In the TLS-in-TLS study, the authors stress a basic principle: random padding and bundling many connections (multiplexing) reduce neither the size of data bursts nor the number of round trips. The developers of REALITY write in their own GitHub README that other proxy protocols have

"obvious TLS-in-TLS characteristics that are already being specifically targeted."

The real problem: the base rate

The study by Wails and colleagues spells out what lab results leave out. An earlier classifier was right 97 percent of the time on a 50:50 test dataset. When the share of tunnel connections dropped to 0.1 percent, only 3 percent of its hits were real. The reason is simple arithmetic: a small error rate applied to a huge volume of harmless connections produces more false alarms than there are actual tunnels.

Here's our own example calculation per 10 million connections, with a classifier that catches 99 percent of tunnels:

Two caveats apply. First, the base rate in Russia is probably higher than in the Tor data. According to Carnegie, more than half of 18- to 45-year-olds use VPNs, but there are no reliable per-connection figures. Second, Wails himself names the fix: instead of scoring each connection individually, collect evidence per server over time, and the circumvention servers in their data are found without errors. In practice, that means blocking entire IP addresses. That's exactly where collateral damage comes in, because a hosting provider's IP often hosts harmless services too. According to a Vërstka source, the error rate of the existing algorithms is 5 to 6 percent.

What Russia already does, no AI required

Community measurements show that Russia accepts collateral damage. Since June 2025, a net4people thread has documented the following: connections to "suspicious" foreign data centers like Hetzner or DigitalOcean freeze after about 15 to 20 KB, with no error message. The author stresses that it makes no difference whether the traffic is real HTTPS or an imitation. You can check this with a tool in the hyperion-cs/dpi-checkers repository. Since November 2025, users in another thread have reported that some home ISPs interfere with VLESS+REALITY+Vision on port 443. The trigger appears to be the number of simultaneous TLS connections, not their content.

On top of that comes pressure on the services themselves. According to Meduza, since mid-April 2026, Gosuslugi, Sberbank, Ozon, Wildberries and Yandex services have been locking out users with an active VPN. That hits Russians abroad too. On April 3, according to The Record, card payments at major banks went down for hours, even at Moscow Metro turnstiles. Natalya Kasperskaya blamed the VPN blocks; officially, the cause was never determined.

Countermeasures and their cost

Research is fairly clear about countermeasures. In 2023, printable leading bytes were enough to beat China's entropy rules. Against TLS-in-TLS, Xue et al. recommend actively shaping data bursts as well, with artificial pauses and uniform packet sizes. That costs speed and bandwidth. XTLS-Vision takes the opposite approach: it passes the inner TLS data through instead of encrypting it twice, which according to the Xray documentation actually makes it several times faster. But Vision is precisely what came under fire in Russia in 2025. According to Tom's Guide, AmneziaVPN admits that the junk packets in its versions 1.0 and 1.5 are no longer enough in 2026. Nobody has yet found a way around the blanket 16 KB limit.

The bigger picture

Our take: the 2.27 billion ruble filter is less a technical breakthrough than a tool to speed up the existing cat-and-mouse game. Rambler suggests the model might not run live in the traffic stream at all. It could instead generate new signatures that the TSPU then apply mechanically. Alexei Lukatsky of Positive Technologies warns that real-time AI could become a bottleneck. Research shows that obfuscated tunnels can be detected. But it shows just as clearly that any detection at national scale drags harmless connections down with it. Whether the ML system is even better than the existing signatures is completely unknown, because Roskomnadzor hasn't published any numbers. Kudryashov of Strategy Partners considers a wrong call on corporate VPNs, cloud services and voice traffic more costly than one VPN user slipping through. Russia's approach so far, with the 16 KB limit, hosting provider blocks and VPN bans at banks, suggests the state is deliberately accepting those costs. The algorithms aren't the bottleneck. The only real limit is how much trouble Moscow is willing to inflict on its own economy.