# FLINT: Fingerprinting Federated Learning Architectures from 5G PHY-Layer Side Channels

arXiv: https://arxiv.org/abs/2607.15469 · HTML: https://mlsanity.com/paper/2607.15469/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 9 of its 36 references that are in the map.
- First posted on arXiv 16 Jul 2026.

## Builds on (most cited first, 9 of 9)

- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- [Advances and Open Problems in Federated Learning](https://mlsanity.com/paper/1912.04977/) (2019)
- [Membership Inference Attacks against Machine Learning Models](https://mlsanity.com/paper/1610.05820/) (2016)
- [Deep Fingerprinting: Undermining Website Fingerprinting Defenses with Deep Learning](https://mlsanity.com/paper/1801.02265/) (2018)
- [Are Your Sensitive Attributes Private? Novel Model Inversion Attribute Inference Attacks on Classification Models](https://mlsanity.com/paper/2201.09370/) (2022)
- [FedMIA: An Effective Membership Inference Attack Exploiting "All for One" Principle in Federated Learning](https://mlsanity.com/paper/2402.06289/) (2024)
- [Deep Learning Model Inversion Attacks and Defenses: A Comprehensive Survey](https://mlsanity.com/paper/2501.18934/) (2025)
- [DeTorrent: An Adversarial Padding-only Traffic Analysis Defense](https://mlsanity.com/paper/2302.02012/) (2023)
- [FLARE: A Wireless Side-Channel Fingerprinting Attack on Federated Learning](https://mlsanity.com/paper/2512.10296/) (2025)

## Abstract (arXiv)

Federated Learning (FL) over 5G cellular networks protects raw data but remains vulnerable to side-channel leakage. Prior fingerprinting attacks assume packet-level network visibility, an assumption that does not hold at the 5G Physical (PHY) layer, where user payloads are encrypted and Radio Network Temporary Identifiers (RNTIs) may change over time. However, we demonstrate that PHY-layer scheduling metadata broadcast over the Physical Downlink Control Channel (PDCCH) preserves architecture-associated temporal patterns. We introduce FLINT, a novel black-box fingerprinting framework that infers FL model architecture families, including CNNs, RNNs, and Transformers, using only coarse PHY-layer observations. FLINT overcomes the lack of network-layer visibility by decoding PDCCH scheduling information, mapping changing RNTIs to physical user devices, and applying multi-view temporal modeling to distinguish architecture-specific training behavior. This leakage is security-critical because knowledge of a client's model architecture can transform passive reconnaissance into targeted downstream exploitation. Extensive experiments on an over-the-air srsRAN-based 5G testbed demonstrate that FLINT achieves a macro F1-score of 0.930 for architecture-family classification. To our knowledge, FLINT is the first work to fingerprint AI/ML model architectures using lower-layer 5G side-channel information obtainable by any protocol-aware adversary.