> to understand whether an adversary can deduce the websites a user is trying to connect to, using a set of IP addresses originating from the user’s device alone.

If you as a residential broadband singlehomed user in, let's say, China, have all of your traffic going through an advanced DPI system run by an authoritarian state, they absolutely can correlate your activity on a number of metrics and statistical methods even if the crypto for end-to-end transport of your content is flawless.