TLDR
- What: FLINT is a passive, over-the-air side-channel attack that reconstructs rotating temporary physical-layer identifiers (RNTIs) and uses multi-view temporal modeling of unencrypted 5G control channel (PDCCH) metadata to fingerprint the neural network architecture family of a target Federated Learning (FL) client.
- Who's at risk: Distributed Federated Learning deployments running over cellular networks (such as edge devices or mobile apps training models like CNNs, RNNs, or Transformers over 5G).
- Key number: FLINT achieves a closed-world macro F1-score of $0.930 \pm 0.021$ in classifying whether a client is training a CNN, RNN, or Transformer, using only 300 seconds of coarse physical-layer metadata.
FLINT: Fingerprinting Federated Learning Architectures via 5G PHY-Layer Control Channels
While Federated Learning (FL) is designed to protect user privacy by keeping training data local and transmitting only encrypted model updates, it remains vulnerable to side-channel leakage. This threat is particularly acute in mobile and edge computing settings, where client devices rely on 5G cellular networks to communicate with a central aggregation server. If a passive over-the-air adversary can identify the specific neural network architecture a client is training, they can transition from passive reconnaissance to targeted downstream exploits, such as architecture-specific adversarial perturbation, model inversion, or targeted radio-jamming attacks.
Threat Model
| Attacker | Fully passive over-the-air eavesdropper with standard Software-Defined Radio (SDR) hardware and protocol-aware decoding software (e.g., NR-Scope, 5GSniffer). No network credentials, no participation in the FL protocol, and no access to the encrypted user-plane traffic. |
| Victim | Edge client devices (UEs) participating in a federated learning session over a standard 5G gNodeB cell. |
| Goal | Infer the deep learning model architecture family (e.g., CNN, RNN, Transformer) being trained on the victim device. |
| Budget | Zero transmission budget (completely silent). Low-cost SDR hardware capable of capture at the cell's center frequency, and off-the-shelf GPU/CPU for decoding and inference. |
Background & Problem Setup
Previous side-channel attacks on federated learning, such as FLARE (Shuvo et al., INFOCOM 2026), assume network-layer packet visibility. In Wi-Fi or wired networks, a passive sniffer can observe precise IP packet sizes, directions, and inter-arrival times.
In 5G networks, however, user-plane traffic is fully protected by the Access Stratum (AS) security context. Packet-level headers, sizes, and payloads are encrypted before they hit the air. The only raw data observable to an over-the-air eavesdropper is physical-layer control signaling on the Physical Downlink Control Channel (PDCCH).
To schedule transmissions, the base station (gNodeB) broadcasts unencrypted Downlink Control Information (DCI) records. These records specify:
- Which temporary device identifier (C-RNTI) is scheduled.
- The number of allocated physical resource blocks (PRBs).
- The corresponding transport block size (TBS).
An adversary can capture and decode these DCI records. However, translating this coarse, noisy physical-layer stream into a model fingerprint presents severe challenges that previous network-layer attacks do not address:
| Feature / Capability | FLARE-style baseline | FLINT (This Paper) |
|---|---|---|
| Observable Layer | Network-layer (IP/TCP/UDP) | Physical-layer (PHY) Control Plane |
| Input Metadata | Packet sizes, IP headers, inter-arrival times | DCI records (TBS, PRB allocation, direction) |
| Client Identification | Persistent IP/MAC addresses | Rotating physical-layer identifiers (C-RNTIs) |
| Signal Granularity | High (actual packet boundaries) | Coarse (scheduler-driven transport block sizes) |
| Tolerance to Packet Loss | Low (missing packets distort statistical features) | High (handles loss via missing-grant imputation) |
Methodology
The FLINT pipeline operates in five distinct phases as illustrated in the paper's system architecture (Figure 2):
[ PDCCH Sniffing ] ──> [ Preprocessing & CCCD ] ──> [ Missing-Grant Imputation ]
│
▼
[ Late Fusion Meta-Classifier ] <── [ Three Temporal Views (W, R, L) ]
Step 1: Black-Box Data Collection & RNTI Sniffing
To decode user-specific DCI records, the attacker first triggers a silent Random Access Channel (RACH) procedure. By attempting to attach with an unregistered SIM card, the attacker forces the gNodeB to transmit an unencrypted RRCSetup message (msg4).
As detailed in Section V-B, decoding this message reveals the UE-specific PDCCH configuration parameters (controlResourceSetId, frequencyDomainResources, etc.) and the temporary C-RNTI assigned to the device. Once configured with these parameters, an open-source PDCCH decoder like 5GSniffer can blind-decode the DCI stream.
Step 2: RNTI-to-UE Device Mapping (CCCD Algorithm)
Because 5G base stations periodically rotate C-RNTIs to prevent tracking, a single device will use multiple identifiers over a single training session. FLINT solves this with the Conflict-Constrained Chain Decomposition (CCCD) algorithm (Algorithm 1).
- Conflict Graph (): An undirected graph where nodes are active RNTI lifespans. An edge is drawn if two RNTIs overlap in time (since a single physical device can hold only one C-RNTI at any given instant).
- Succession DAG (): A directed acyclic graph mapping potential temporal transitions between RNTIs. Edges are weighted by a squared-gap transition cost:
w(r_i, r_j) = (\alpha(r_j) - \beta(r_i))^2
where $\alpha$ is the start time of $r_j$ and $\beta$ is the end time of $r_i$. 3. **Chain Cover and BIC Merging:** The algorithm first runs a maximum-weight bipartite matching (via the Hungarian algorithm) to group RNTIs into conflict-free chains. It then greedily merges these chains using the **Bayesian Information Criterion (BIC)** based on a 2D temporal profile of scheduling density ($\rho$) and uplink fraction ($\phi$). #### Step 3: Missing-Grant Imputation Over-the-air sniffing is inherently lossy. Signal fades and decoding failures lead to missing DCI records, which introduce artificial gaps in the reconstructed trace. FLINT applies a **Packet-Loss Imputation** step (Algorithm 2) to restore the temporal continuity of the communication patterns. It uses a K-Means height filter ($k=2$) on detected burst windows, computing median downlink-to-downlink spacing ($\rho$) to identify missing scheduling cycles and reconstruct surrogate dummy grants to maintain temporal alignment. #### Step 4: Feature Extraction via Three Temporal Views To bypass the limitations of simple, easily obfuscated traffic statistics, FLINT models the reconstructed device trace through three independent, complementary feature extractors: - **View W (Wavelet Multi-Resolution Energy):** Represents the DCI grant series as a regularly sampled activity signal. It applies a 6-level discrete wavelet transform (DWT) using a Haar wavelet to capture energy distribution across multiple timescales. An XGBoost model classifies the normalized energy vector. - **View R (Round-Cadence Regularity & Spectral):** Measures the periodicity of the FL training cycle. It segments the window into individual FL training rounds (downlink burst $\rightarrow$ silence/computation $\rightarrow$ uplink burst). It extracts statistical metrics (mean/variance of phase durations) and applies a Fast Fourier Transform (FFT) to the sequence of round durations to detect training rhythm. Classified using XGBoost. - **View L (Sequential Evolution):** Uses a bidirectional Long Short-Term Memory (Bi-LSTM) network to model the round-to-round sequential evolution of training step times and update volumes. #### Step 5: Late Fusion (Stacking) Instead of flattening and concatenating the raw features from the three views, FLINT performs probability-level late fusion. It stacks the class probability outputs:z = [p_W \parallel p_R \parallel p_L]
A logistic regression meta-classifier $g * \phi(z)$ is trained on these stacked probabilities to produce the final classification decision ($\hat{y} \in \{\text{CNN, RNN, Transformer}\}$). --- ### Key Results The authors evaluated FLINT using an over-the-air 5G testbed built on **srsRAN**, utilizing software-defined radio hardware to simulate the gNodeB and client UEs. #### 1. RNTI-to-UE Mapping Accuracy Evaluating the CCCD algorithm on a 613-second capture containing 39,669 DCI records from three active UEs using eight different rotating C-RNTIs yielded perfect results: * **RNTI-to-UE Matching Accuracy:** **100% (8/8)** * **Record Association Accuracy:** **100% (39,669 / 39,669)** * **Device Count Estimation ($K$):** Exactly predicted the true count ($\hat{K}=3$). #### 2. Closed-World Architecture Fingerprinting Table II of the paper summarizes the classification performance of FLINT compared to the adapted FLARE baseline on a 300-second sniffing window ($w=300$ s) using the stacking fusion method: | Method / Configuration | CNN F1-Score | RNN F1-Score | Transformer F1-Score | Macro F1-Score | |---|---|---|---|---| | **FLARE-style Baseline** | \$0.825 \pm 0.058$ | \$0.880 \pm 0.099$ | \$0.798 \pm 0.058$ | \$0.834 \pm 0.047$ | | **FLARE-style + Imputation**| \$0.819 \pm 0.035$ | \$0.947 \pm 0.032$ | \$0.865 \pm 0.077$ | \$0.877 \pm 0.033$ | | **FLINT (No Imputation)** | \$0.814 \pm 0.066$ | \$0.884 \pm 0.059$ | \$0.887 \pm 0.067$ | \$0.862 \pm 0.054$ | | **FLINT (Full Pipeline)** | **\$0.895 \pm 0.031$** | **\$0.978 \pm 0.019$** | **\$0.918 \pm 0.016$** | **\$0.930 \pm 0.021$** | *Note: The normalized confusion matrix (Figure 5) reveals that while RNNs are classified with near-perfect accuracy (\$99.4\%$), the primary point of confusion lies between CNNs and Transformers (\$9.4\%$ of CNNs misclassified as Transformers).* --- ### Limitations & Open Questions While the closed-world results are strong, a critical reading of the paper reveals significant open challenges: 1. **Poor Open-World Rejection:** In Table V, the authors attempt open-world detection using a simple softmax thresholding mechanism to reject unseen background traffic and arbitrary workloads as "Others". - **Unknown Recall:** Only **11.1%** of non-FL background traffic/unseen models were correctly rejected. - **False Acceptance Rate (FAR):** **88.9%** of background traffic was incorrectly classified as a known FL architecture. This shows that the standard classifier is highly overconfident. A realistic attacker operating in a busy 5G cell would face high false-positive architecture detections unless they implement more specialized open-set recognition frameworks. 2. **C-RNTI Allocation Predictability:** The RNTI matching mechanism relies on the fact that C-RNTIs in the srsRAN testbed are drawn sequentially from a pool. While the authors state that the mathematical constraints of the Conflict Graph still hold when C-RNTIs are randomized, highly dynamic, heavily loaded commercial 5G cells with thousands of fast-switching RNTIs may degrade CCCD's performance. 3. **Scale of Evaluation:** The physical testbed evaluations were conducted with only **three** concurrent client UEs. It remains unproven how gracefully the imputation and RNTI-to-device mapping scale when dozens of UEs are simultaneously multiplexed on the same physical channels. --- ### What Practitioners Should Do If you are deploying Federated Learning over cellular networks, consider the following defensive mitigations discussed in the paper: 1. **Implement Dynamic Padding at the Application Layer:** As shown in Section VI-G, standard size obfuscation (e.g., padding model updates up to a static 5MB or 10MB) is only partially effective. Defenses must consider hiding update size information, round-cycle timing, and scheduling dynamics. 2. **Inject Dummy Uplink Traffic:** Since FLINT relies on tracking the computational silence periods between model downloads and uploads, client devices or the network can introduce dummy traffic to obfuscate scheduling cadence, uplink/downlink round structure, and resource allocation patterns. 3. **Randomize gNodeB Control State Allocations:** For cellular network operators, implementing randomized RNTI assignment pools complicates the temporal succession mapping phase of CCCD. --- ### The Takeaway FLINT demonstrates that 5G's physical-layer control plane leaks highly structured metadata. Even when user data is fully encrypted, the unencrypted scheduling signals (DCI) broadcast over the air are expressive enough to reconstruct the training characteristics of deep learning models. This highlights a critical, cross-layer security gap at the intersection of wireless network scheduling and distributed ML systems. --- ## Den's Take The most striking aspect of FLINT is its brutally realistic threat model. A common assumption is that because 5G Access Stratum (AS) encryption secures user-plane traffic, over-the-air eavesdroppers are blind. FLINT completely upends this by exploiting unencrypted physical-layer control metadata (PDCCH DCI records) to track rotating C-RNTIs and reconstruct transmission patterns. The authors' closed-world macro F1-score of \$0.930 \pm 0.021$ in classifying whether a client is training a CNN, RNN, or Transformer using only 300 seconds of coarse physical-layer metadata is a notable result. It demonstrates that scheduling allocations (PRBs and TBS) leak distinct computational footprints. The limitations, however, deserve equal weight: this is still a closed-world evaluation. In actual deployments with highly dynamic channel conditions, adaptive gNodeB scheduling, and concurrent background applications running on the target user equipment, these clean temporal signatures will inevitably degrade. The physical and side-channel vulnerabilities inherent to localized deployments are covered in [Securing LLMs in the Wild: Privacy and Security Challenges at the Edge](/writing/securing_llms_in_the_wild_privacy_and_security_challenges_at), which is directly relevant here because it highlights how moving computation to the edge often trades centralized security for unmonitored physical exposure. FLINT shows that even when training data never leaves the device, radio emissions can still betray its architecture.