FLINT: Fingerprinting Federated Learning Architectures from 5G PHY-Layer Side Channels

2026-07-16

AI Summary

While 5G federated learning preserves raw data privacy, it remains vulnerable to physical-layer side-channel leakage. Existing fingerprinting attacks fail due to inaccessibility of encrypted payloads and dynamic RNTIs. This work proposes a novel approach that leverages scheduling metadata broadcast over the Physical Downlink Control Channel (PDCCH). By decoding scheduling information, mapping dynamic RNTIs, and constructing a multi-view temporal model, the method enables precise identification of model architecture families—including CNNs, RNNs, and Transformers—under a black-box setting relying solely on coarse-grained physical-layer observations. Evaluated on a real-world 5G over-the-air platform based on srsRAN, the approach achieves a macro F1-score of 0.930, surpassing conventional limitations that depend on network-layer visibility.

Abstract

Federated Learning (FL) over 5G cellular networks protects raw data but remains vulnerable to side-channel leakage. Prior fingerprinting attacks assume packet-level network visibility, an assumption that does not hold at the 5G Physical (PHY) layer, where user payloads are encrypted and Radio Network Temporary Identifiers (RNTIs) may change over time. However, we demonstrate that PHY-layer scheduling metadata broadcast over the Physical Downlink Control Channel (PDCCH) preserves architecture-associated temporal patterns. We introduce FLINT, a novel black-box fingerprinting framework that infers FL model architecture families, including CNNs, RNNs, and Transformers, using only coarse PHY-layer observations. FLINT overcomes the lack of network-layer visibility by decoding PDCCH scheduling information, mapping changing RNTIs to physical user devices, and applying multi-view temporal modeling to distinguish architecture-specific training behavior. This leakage is security-critical because knowledge of a client's model architecture can transform passive reconnaissance into targeted downstream exploitation. Extensive experiments on an over-the-air srsRAN-based 5G testbed demonstrate that FLINT achieves a macro F1-score of 0.930 for architecture-family classification. To our knowledge, FLINT is the first work to fingerprint AI/ML model architectures using lower-layer 5G side-channel information obtainable by any protocol-aware adversary.

Problem

• Federated Learning
• 5G PHY-layer
• Side-channel leakage
• Model fingerprinting
• Architecture identification

Innovation

• Federated Learning
• 5G PHY-layer side channels
• Model fingerprinting
• PDCCH scheduling
• Black-box inference