Abstract

Distributing information about unlisted relays ( bridges ) to users of an Internet blocking evasion system is a key unsolved problem for resilient access under strong network information controls. This is due to the tension between allowing access to users while preventing blocking authorities from enumerating bridges, and is made more difficult by the requirement to retain no metadata. We present G-Lox ( group-adaptive Lox ), a bridge-distribution system that preserves Lox-style distributor blindness while enabling hidden, stateful adaptation at the group level. G-Lox places adaptive assignment logic behind a two-server privacy wall: no single server learns group identifiers or group-to-bridge assignments, while private state access and state-dependent updates are carried out using two-server DPF/FSS protocols and secure two-party computation. This supports blockage reporting, transport-aware reassignment, and privacy-preserving group splitting without exposing sensitive assignment information. We evaluate G-Lox through both system measurements and policy simulation. Our C++/EMP implementation over real TCP sockets shows that the client-visible overhead of private state access remains small: across state sizes up to 2[16] , communication stays in the low-KiB range per end-to-end iteration. At __ = 1024, the client sends 1 _,_ 968 bytes, receives 1 _,_ 280 bytes, and completes an iteration in about 0 _._ 25 s. Memory use is also modest, staying near 5 MB on the client and below 18 MB (9 _._ 79 MB at __ = 1024) on the state servers in our experiments. At the policy level, simulations with group-specific blocking and Sybil enumeration show that G- Lox consistently improves robustness over Lox- and rBridge-like baselines among systems that maintain broad issuance. Overall, our results show that stronger privacy for bridge-state access can be achieved with practical overhead while improving robustness under adaptive network information control.