essentially what this means is that when you exit Tor, it is probably not correct to look at individual circuits, but rather positions across circuits. Imagine that each attacker controlled node is a 1 and each good node is a 0. Normally any circuit other than 1x1 means that you are fine, but when you close out of Tor it is like each of the positions on each of the circuits bitwise or with the nodes on your other open circuits at the same position. 001 000 100 000 000 001 |=____ 101 == compromised (exit traffic from circuits in pattern xx1 is linkable to you) this attack can also be used to break circuit isolation. Assume all letters are good nodes other than A which is attacker controlled node. BCA DEA FGA now you should already know that the controller of node A is capable of determining all of your exit traffic, but they can not trace you as the middle and entry nodes are good. However it is generally thought that the controller of node A is incapable of determining that traffic from node E C and G originates from the same entity, and thus there is per circuit traffic isolation. Well, on exit timing attack of circuit shut down packet probably can be used to link all three circuits together, and thus link all exit traffic from these circuits together to the same entity, breaking circuit exit traffic isolation.