The "best" attacks from "Untrusted Peer + local wiretrap" requires that the attacker is able to inject packets. Basically the attack works by spoofing tpc rst packets to disconnect all your friends except the one they control. If you respond to any searches after that they know that you must have that data since you can't have forwarded it to anyone.
If they only have packet logs things are harder, basically they need to start a download from you, then stop it, then start it and so on to create a traffic pattern. After that they can look in the log to see if the difference in upload-download rate for you follows that pattern at that specific time. This attack is much harder since:
1: it requires that you have enough spare capacity that you can serve their request with high enough speed that the pattern appears over the normal traffic/forwarding noise.
2: they can only "test" one file at the time, text search packets are too small to register with this method.
For OneSwarm to protect against the traffic pattern attack would require us to send dummy data all the time which would cause significant overhead (making us reluctant to do it). Also, this attack works against all anonymity systems where users only store data on their disk that they previously downloaded (including annonymous VPN services).
As far as I know ISPs are not keeping detailed enough logs for this attack to work yet. They need to store not only flow information (ip A is talking to ip B), but also each individual packet header + timing information.