arXiv CSopen access

FLINT: Fingerprinting Federated Learning Architectures from 5G PHY-Layer Side Channels

FLINT: Fingerprinting Federated Learning Architectures from 5G PHY-Layer Side Channels Md Nahid Hasan Shuvo, Mahmudul Hassan Ashik, Moinul Hossain

arXiv:2607.15469v1 [cs.CR] 16 Jul 2026

George Mason University, Fairfax, VA, USA Email: [email protected], [email protected], [email protected]

of the model being trained, distinguishing convolutional neural networks (CNNs) from recurrent neural networks (RNNs). This capability has important security implications, as knowledge of a client’s model architecture enables targeted downstream attacks, including architecture-specific adversarial examples, model inversion attacks, and resource denial attacks [7], [8]. However, FLARE and related studies assume access to networklayer packet information, including packet sizes, directions, and inter-arrival times. While this assumption holds in Wi-Fi networks, it does not hold in 5G. In 5G networks, user-plane traffic is protected by the Access Stratum security context, preventing external observers from accessing network-layer packets. Instead, the only information visible over the air is physical-layer control signaling. In particular, scheduling metadata transmitted on the Physical Downlink Control Channel (PDCCH) remains observable. For each scheduling decision, the base station broadcasts Downlink Control Information (DCI) records specifying the scheduled device, allocated resource blocks, and corresponding transport block size. These records are transmitted without encryption and can be decoded by passive software-defined radio receivers without network credentials [9], [10]. Whether this coarser signal still carries sufficient information to fingerprint a client’s I. I NTRODUCTION model architecture remains unexplored, and we address this Federated learning (FL) has emerged as a widely adopted question in this paper. paradigm for training deep learning models across distributed Challenges: Answering this question presents three key devices without collecting their raw data at a central server [1], challenges. First (C1), a passive observer in 5G has access [2]. By keeping data on-device and exchanging only encrypted only to unlabeled physical-layer scheduling records, which model updates, FL has been adopted in privacy-sensitive must be mapped back to individual clients despite rotating domains such as healthcare, mobile robotics, and the Internet identifiers and the complexity of operating in a real 5G testbed of Things. Increasingly, these deployments rely on Fifth environment. This complicates the construction of consistent Generation (5G) cellular networks, which provide the low- per-device activity streams under live network conditions. latency and wide-area connectivity required by geographically Second (C2), packet-level traffic information is not available distributed clients. Encryption, however, protects only the at the physical layer. Instead, the observer sees only schedulercontents of the updates, not the communication patterns generated signals such as resource allocations and transport by which they are exchanged. A growing body of work block sizes. These measurements are indirect and influenced has shown that metadata associated with encrypted traffic, by channel conditions and scheduling decisions, making them including packet sizes, directions, and timing, leaks significantly a coarse proxy for communication activity. Third (C3), traces more information than intended. Such information enables are inherently incomplete due to practical constraints in overadversaries to fingerprint visited websites [3], identify mobile the-air collection and decoding, leading to missing or partially applications [4], and infer device types [5] through passive observed scheduling records. As a result, the adversary must observation alone. infer structure from irregular temporal observations. Finally Recently, this insight has been extended to the federated (C4), simple statistics based on communication activity are learning setting. FLARE [6] demonstrated that a passive adver- insufficient to distinguish between model families, as different sary observing encrypted Wi-Fi traffic can infer the architecture architectures can induce similar overall transmission patterns.

Abstract—Federated Learning (FL) over 5G cellular networks protects raw data but remains vulnerable to side-channel leakage. Prior fingerprinting attacks assume packet-level network visibility, an assumption that does not hold at the 5G Physical (PHY) layer, where user payloads are encrypted and Radio Network Temporary Identifiers (RNTIs) may change over time. However, we demonstrate that PHY-layer scheduling metadata broadcast over the Physical Downlink Control Channel (PDCCH) preserves architecture-associated temporal patterns. We introduce FLINT, a novel black-box fingerprinting framework that infers FL model architecture families, including CNNs, RNNs, and Transformers, using only coarse PHY-layer observations. FLINT overcomes the lack of network-layer visibility by decoding PDCCH scheduling information, mapping changing RNTIs to physical user devices, and applying multi-view temporal modeling to distinguish architecture-specific training behavior. This leakage is security-critical because knowledge of a client’s model architecture can transform passive reconnaissance into targeted downstream exploitation. Extensive experiments on an over-the-air srsRANbased 5G testbed demonstrate that FLINT achieves a macro F1-score of 0.930 for architecture-family classification. To our knowledge, FLINT is the first work to fingerprint AI/ML model architectures using lower- layer 5G side-channel information obtainable by any protocol-aware adversary. Index Terms—AI security, Fingerprinting Federated Learning, Side Channel Attack, 5G vulnerability

This requires representations that capture higher-order temporal updates [14], [15], while property inference attacks recover dynamics. aggregate attributes of local datasets [16], [17]. These attacks typically assume access to model updates or Addressing these challenges requires a fingerprinting approach that operates on incomplete, coarse-grained, and tem- participation in the learning process. In contrast, our work porally irregular physical-layer observations. Building on this considers a fully passive adversary that neither observes insight, we develop F LINT, a passive fingerprinting framework gradients nor participates in training, and instead infers the for identifying federated learning model architectures from 5G model architecture from over-the-air observations. PHY-layer side-channel information. B. Traffic Fingerprinting and Side-Channel Leakage Contributions: We investigate whether federated learning Traffic analysis has been widely used to infer sensitive informodel architectures, including CNNs, RNNs, and Transformers, mation from encrypted communications. Website fingerprinting can be inferred using only 5G physical-layer scheduling metaattacks identify visited pages over Tor or HTTPS using packet data, and show that capturing temporal structure is essential. sizes, directions, and timing information [3], [18], [19], and In summary, our contributions are as follows: remain effective under various defenses [20], [21]. Related • We present a fully black-box data collection pipeline on a approaches infer mobile application usage [4] and identify IoT real srsRAN-based 5G testbed, including an algorithm that device types from network behavior [5], [22]. maps rotating physical-layer identifiers (RNTIs) back to These methods rely on network-layer visibility and access individual client devices using only the timing of decoded to per-packet information. FLARE [6] applies similar ideas records, addressing C1. to federated learning using packet-level statistics of encrypted • We identify a new physical-layer side channel in 5G Wi-Fi traffic to distinguish neural architectures such as CNNs federated learning, in which scheduling metadata broadcast and RNNs. However, it relies on network-layer observability over the PDCCH leaks information about the underlying that is not available in 5G physical-layer settings. We further learning process and can be exploited by an adversary show that coarse communication statistics are insufficient to without network-layer visibility, thereby addressing C2. distinguish among modern model families based on physical• We design a fingerprinting framework that operates on layer observations. incomplete and irregular scheduling observations and captures the temporal evolution of training behavior, C. Recovering Model Properties via Side Channels improving robustness under realistic 5G conditions, adA related line of work studies the recovery of neural dressing C3. network properties from hardware and system-side channels. • We show that simple communication statistics derived Electromagnetic emissions have been used to infer network from resource block allocations and transport block sizes structure and parameters [23], while power-based side channels are insufficient to distinguish among model families, and reveal architectural details in controlled environments [24], [25]. we evaluate robustness under different abalation studies Timing-based attacks can also expose information about dataset to address C4. size and model complexity [11]. These approaches typically assume physical access, coThe remainder of this paper is organized as follows. Seclocation, or controlled execution environments, and are applied tion II discusses the current related research. Section III to centralized training or inference on a single machine. In provides background on 5G cell attachment and DCI decoding. contrast, our work targets a distributed federated learning setting Section IV shows our threat model. Section V presents the and infers architecture remotely using only physical-layer sidesystem model and our fingerprinting framework pipeline. channel metadata. Section VI describes the dataset and results and shows analysis. Finally, Section VII concludes. D. 5G Physical-Layer Monitoring and PDCCH Sniffing II. R ELATED W ORK The openness of the 5G control plane has enabled passive monitoring of scheduling behavior. Tools such as NR-Scope [9] This section reviews prior work on privacy attacks in and 5GSniffer [10] demonstrate that the Physical Downlink federated learning, traffic fingerprinting, side-channel inference Control Channel (PDCCH) can be blind-decoded by unprivof model properties, and 5G physical-layer monitoring. ileged receivers, revealing per-device scheduling decisions, including resource allocations and transport block sizes. A. Privacy Attacks on Federated Learning Prior work has used this visibility to infer coarse user activity Federated learning was introduced to keep training data patterns, analyze information leakage in wireless systems, on-device [1], but extensive prior work has shown that and enable control-channel-based attacks [8]. However, no shared model updates can still leak sensitive information. prior study has used decoded PDCCH metadata to infer Membership inference attacks determine whether a specific federated learning model architectures. Our work builds on record was used during training [11], [12], and have been these decoding capabilities as the data-collection substrate extended to federated settings by exploiting per-round gradients and addresses the challenge of reconstructing per-device traces exchanged during aggregation [13]. Gradient inversion attacks from interleaved scheduling records with rotating physical-layer reconstruct representative training samples directly from shared identifiers.

Every RRC message up to and including Msg4 is sent in plaintext; the adversary’s observation window closes once the Msg1 - RA Preamble (PRACH) Detects preamble AS-SMC activates ciphering on the radio bearer. DCI scheduling Random preamble index, Zadoff-Chu sequence Computes RA-RNTI metadata on the PDCCH, however, is never AS-ciphered [30], Msg2 - RA Response Transmits Msg2 encoded by RAT_C-RNTI, Timing Advance, UL grant for Msg3 RNTI so per-grant scheduling records remain observable for the entire Decodes Msg3 using Msg3 - RRC Setup Request session. T_C-RNTI 39-bit UE-Identity, establishmentCause Blind decoding of the DCI stream. The gNB confines PDCCH Msg4 - Contention Resolution + RRC Setup Transmits Msg4 encoded by T_C-RNTI T_C-RNTI -> C-RNTI CR-MAC-CE (which UE won contention), SRB1 config to CORESETs whose locations are advertised in MIB and SIB1, so a receiver that has decoded both can reconstruct every Fig. 1: Random access establishment. Msg1–Msg4 and all RRC candidate slot and blind-decode it: it applies polar decoding to up to and including RRCSetup and can be decoded by anyone each candidate and checks the appended 24-bit CRC, which with protocol knowledge is scrambled with the recipient’s RNTI, so a clean CRC III. BACKGROUND simultaneously validates the message and reveals the target A. Adversarial View of Cell Attachment and DCI Decoding RNTI [31]. Broadcast messages (SI-RNTI and paging P-RNTI) A UE that powers ON (or toggles airplane mode OFF) decode without any per-device identifier; UE-specific grants must complete cell search, system-information acquisition, require the C-RNTI range obtained during reconnaissance random access, and Radio Resource Control (RRC) connection (§V-B). The output is a time-ordered stream of DCI records, establishment before exchanging user data, and every one each a tuple of timestamp, RNTI, direction, and scheduling of these steps occurs in plaintext on channels that a passive fields. receiver can decode without credentials. We therefore describe a) Vulnerability: Due to a lack of any security protocol at attachment from the adversary’s vantage: it performs the same the start of the RACH process, any UE with a SIM (registered or synchronization and decoding as a legitimate UE but stops not) can trigger the RACH procedure from the base station: the short of completing random access or establishing a security SIM is not authenticated until RRC establishment completes context. and the UE can reach the core network. An adversary can Synchronization and system information. The receiver therefore force the base station to disclose critical configuration captures in-phase/quadrature (IQ) samples at the cell center about itself (e.g., available TC-RNTI, CORESET#1 parameters, frequency and aligns to the 10 ms frame by locating the Syn- DCI format) simply by triggering RACH, with no registered chronization Signal Block (SSB), whose Primary and Secondary SIM required. We show in §V-B how we exploit this to trigger Synchronization Signals (PSS/SSS) yield timing, frequency RACH and obtain the parameters needed to decode UE-specific offset, and the Physical-layer Cell Identity (PCI) [26]. Decoding DCI. the Physical Broadcast Channel (PBCH) returns the Master Information Block (MIB), which locates Control Resource B. Federated Learning over 5G and Its Side-Channel Surface Set 0 (CORESET#0) and the Type0-PDCCH search space. Having described how an adversary decodes DCI records The receiver then decodes SIB1 on the Physical Downlink Shared Channel (PDSCH), scheduled by Downlink Control from the PDCCH, we now explain why those records carry Information (DCI) scrambled with the standardized System information about the model architecture being trained. The Information RNTI (SI-RNTI) on the Physical Downlink Control connection arises from how a federated training session is Channel (PDCCH) [27], [28]. SIB1 exposes the random-access mapped to the radio scheduler. and common radio configuration (e.g., PRACH parameters, The federated round as a communication pattern. We offsetToPointA), which is sufficient to monitor the cell consider synchronous federated learning, the predominant without authentication. setting on mobile and edge deployments and the one used Random access and the plaintext window. Fig. 1 shows in our testbed [1]. Training proceeds in discrete rounds: the the four-message random-access exchange and marks the server broadcasts the current global model; each client trains adversary’s observation window. The UE sends a PRACH locally for several epochs and returns an update; the server preamble (Msg1); the gNB replies with the Random Ac- waits for all selected clients, aggregates, and broadcasts the next cess Response (Msg2, scrambled by RA-RNTI) carrying a model. This yields a repeating per-client pattern, a downlink Timing Advance, a Msg3 grant, and a Temporary C-RNTI burst as the global model arrives, near-silence during local (TC-RNTI) [29]. The UE then transmits RRCSetupRequest computation, and an uplink burst as the update is sent. Two (Msg3) and receives RRCSetup (Msg4, scrambled by TC- quantities of this pattern are set largely by the client’s model RNTI); the Contention Resolution MAC-CE echoes the winning rather than the network. The size of each update scales with UE’s identity, namely a random value at first attach, an S- the trainable-parameter count θ (a single update is on the order TMSI on reconnection, or a C-RNTI on handover [29]. The of 4θ bytes for 32-bit floats), and the duration of the silent winner’s TC-RNTI is then promoted to a C-RNTI and the interval scales with the cost of a forward/backward pass, which UE completes RRCSetupComplete, establishing Signaling differs across architectures even at comparable θ. Architecture Radio Bearer 1 (SRB1). NAS authentication and the NAS and therefore shapes both how much a client transmits per round AS Security Mode Command (SMC) procedures follow [30]. and the rhythm with which it does so. UE

Base Station

Mapping the round onto 5G scheduling. At the physical and model updates remain encrypted under the 5G security layer, this pattern is observed not as packets but as scheduling framework. grants. An upload appears as a series of uplink DCI grants L2. Restricted observation model. The adversary is limited whose transport-block sizes accumulate to the update volume; to physical-layer scheduling metadata obtained from decoded the global-model arrival appears symmetrically as downlink DCI messages. These observations are coarse-grained and do grants; the local-computation interval appears as a gap with not expose packet-level structure or application-layer semantics. few or no grants. Because the adversary decodes every grant addressed to the client (§V), it observes a time-ordered stream V. M ETHODOLOGY of transport-block sizes and directions tracing the upload– This section describes the end-to-end attack pipeline: from compute–download structure of each round, without ever seeing passive over-the-air reconnaissance and DCI decoding, through a user-plane packet. Why architecture leaks, and why volume is not enough. RNTI-to-device mapping via the Conflict-Constrained Chain Architecture influences the signal through two channels. The Decomposition (CCCD) algorithm, to the construction of perfirst is volume: larger parameter counts produce larger transport- device feature datasets suitable for AI/ML fingerprinting. block totals per round. The second is temporal structure: A. System Model and Attack Pipeline the cadence of rounds, the regularity of the upload–compute– download cycle, and the way successive updates evolve. Volume Deployment model. We consider a 5G cell served by a single alone is a strong cue when update sizes are distinctive, but gNodeB (gNB), where three client devices participate in a it becomes ambiguous when two architecture families have federated learning session. Each client is a User Equipment similar parameter counts, as is typical for the compact models (UE) device that trains a deep learning model locally and used at the edge. In that regime, the temporal structure, not exchanges model updates with a federated server over the 5G the volume, separates the families, which motivates the feature network. The gNB schedules uplink and downlink transmissions through the Physical Downlink Control Channel (PDCCH), design of §V. where scheduling decisions are carried as Downlink Control IV. T HREAT M ODEL Information (DCI) records. Given decoded physical-layer We consider an external adversary operating within the scheduling records, the objective is to infer, for each observed coverage area of a 5G cell in a federated learning deployment. client, the model architecture family being trained. The adversary does not participate in training, does not transmit Architecture families. We study three architecture families any interference signal during the fingerprinting stage, and that commonly appear in federated learning workloads: conhas no access to base station infrastructure or client devices. volutional neural networks (CNNs), recurrent neural networks All user-plane communications, including model updates, (RNNs), and Transformer-based models. Each family contains are protected by the 5G security architecture and remain multiple concrete model variants. For example, the CNN family may include both custom networks and standard backbones inaccessible to the adversary. such as ResNet and DenseNet. Thus, the fingerprinting target A. Adversarial Goal is not a specific model instance, but the broader architecture The adversary aims to infer the underlying federated learning family. In the open-world setting, we additionally include an model architecture used by participating clients from over-the- Others category for traffic that does not belong to the trained FL families, such as background non-FL activity or unseen air physical-layer observations. workloads. Observation model. After DCI decoding and per-device B. Adversarial Capabilities separation, the adversary obtains a time-ordered sequence C1. Physical-layer observability. The adversary can passively of scheduling records for each client. We denote a client’s observe and decode downlink control information (DCI) trans- observation stream as mitted on the Physical Downlink Control Channel (PDCCH). n S = (ti , di , bi , pi )i=1 , These observations include scheduling decisions such as the scheduled user identity, allocated resource blocks, and transport where ti denotes the timestamp of the i-th scheduling record, block sizes. di ∈ UL, DL denotes the transmission direction, bi denotes the C2. Passive monitoring. The adversary operates in a fully transport block size in bytes, and pi denotes the number of passive manner using standard software-defined radio reception allocated physical resource blocks. The stream S is segmented capabilities. It does not inject any adversarial traffic, interfere into fixed-duration observation windows. For each window, the with network operation, or modify any transmissions. objective is to infer C. Adversarial Limitations L1. No access to user-plane data. The adversary cannot observe or reconstruct network-layer packets, including packet payloads, sizes, directions, or timing information. All user data

ŷ ∈ CNN, RNN, Transformer, Others. In the closed-world setting, the task is three-way classification among CNN, RNN, and Transformer when the window is known to belong to one of the trained FL families. In the

❶ Sniffing (PDCCH) FL Clients Training

CNN

RNN

D❷ Preprocessing DCI à CSV

Transformer

Deanonymize clients

Sliding Window (w = 300s)

gNB

Passive eavesdropper

Burst detection

Passive PDCCH Sniffing Capture DCI Scheduling grants (Time, TB size, Direction, PRBs)

Round-Cycle Segmentation

Output: Cleaned and reconstructed grants

❻ Fingerprint

View Probabilities

Predicted architecture

𝑃"

XGBoost

Multi resolution Traffic Energy

Normalize energies

Traffic

𝑃!

𝑃"

𝑃#

CNN

Statistical feature

Meta Classifier

Spectral feature Round sequence

Feature Extraction

RNN

Fusion

𝑃!

XGBoost

Cadence and regularity

Bi-LSTM based Model

Transformer

Learned on Training set

𝑃#

Bi-LSTM

Sequential timeseries modeling

Output: Segments with few full FL rounds

❺ Late Fusion

Wavelet transform

View L (LSTM)

Data loss imputation

Time

Output: RAW decoded DCI message

View W (Wavelet)

View R (Rhythm)

TB size filter FL Clients

❹ Three Temporal View

D❸ Segmentation

Others

Output: Fingerprint attack

Output: Final fused class probability

Output: Class Probabilities per view

Fig. 2: Proposed system pipeline, detailing the steps from PDCCH sniffing to fingerprinting. open-world setting, the classifier must also reject windows that do not match any known FL family and assign them to Others. Pipeline overview. Figure 2 summarizes the end-to-end F LINT pipeline. The pipeline begins with passive PDCCH sniffing, which produces raw decoded DCI records. The decoded records are converted into a structured table and preprocessed through transport block filtering, burst detection, data-loss imputation, and RNTI-to-device mapping to reconstruct client-specific traces. The cleaned per-device stream is then segmented into fixed-duration observation windows and further decomposed into round-cycle segments. Each window is represented through three complementary temporal views: a wavelet-based multiresolution energy view (W), a rhythm view that captures cadence and regularity (R), and a Bi-LSTM-based sequential modeling view that captures round-to-round evolution (L). Each view produces a class-probability vector, and a late-fusion metaclassifier combines these view-level probabilities into the final architecture prediction. Stages related to raw DCI collection, preprocessing, dataloss imputation, and RNTI-to-device mapping are described in Sections V-B and V-C. The remaining stages, including segmentation, temporal view extraction, late fusion, and fingerprint decisions, constitute the fingerprinting framework described next. B. Black-box Data Collection Pipeline Before fingerprinting, the adversary must collect a dataset in a black-box manner and map RNTIs to physical UEs before training. Fig. 3 gives the full flow. Reconnaissance reuses the passive decoding chain of §III-A, performed with NR-Scope [32]: the nr-scan module synchronizes to the SSB and recovers the ARFCN, after which MIB/SIB1 decoding yields the numerology (subCarrierSpacingCommon, subcarrierSpacing), k_SSB, PCI, and offsetToPointA. These parameters suffice to synchronize an SDR front-end to the cell and to decode RRC with the RA-RNTI; the only steps specific to data collection are triggering the RACH to expose the UE-specific PDCCH configuration (Step 3) and configuring 5GSniffer to harvest DCI (Step 4).

No

NR-Scope

ARFCN

input

Yes

Cell found

Try to connect an unregister UE

Force gNB to broadcast RRC setup

MIB Decode

SIB1 Decode

RACH Decode

nid, SSB_num, k_SSB, CORESET0

Offset to point A

msg4

Perform Cell Search to find gNB

NR SCAN Intiate

Msg 4 decoded

Collect Log output

No

COERSET_id, n_PRB, Numerology, dci_type, and others

Data collection

Used as input for 5GSniffer

5GSniffer

Fig. 3: Data collection pipeline. Filter out relevant columns

a) Step 3: Triggering the RACH Procedure and Observing the RRC Setup.: To decode UE-specific DCI, the adversary must extract the UE-specific PDCCH configuration from the RRC Setup message in msg4. It triggers a RACH exchange by attempting to attach with an unregistered SIM; this fails authentication but still drives the RACH procedure and the transmission of RRC Setup. NRScope decodes msg4 and reveals the CORESET#1 parameters: controlResourceSetId, duration, the frequencydomain resource bitmap (frequencyDomainResources), the CCE-to-REG mapping type (cce-REG-MappingType), dci-Formats, and nrofCandidates. The adversary also observes the temporary C-RNTI assigned during the exchange. Per 3GPP TS 38.321 §5.1.4, the TC-RNTI assigned in Msg2 is promoted to C-RNTI on successful Msg4 reception without a value change. In our srsRAN-based testbed, C-RNTIs are drawn sequentially from a pool, so the adversary can infer the current assignment range after one or more RACH exchanges; commercial gNBs may randomize this assignment, in which case the inference does not apply, though nothing in the remainder depends on it. These RRC messages are observable before AS security is activated [30], so no cryptographic keys are required. Simultaneous RNTI change?

Yes

No

Temporal DAG

Chain Merging

Draw i->j for non-

Merge conflict-free

conflicting pairs

chains-> UE

HMM resolver -> Viterbi decoding Predict the most probable path States: UEs Observations: Data from 5GSniffer

Assign RNTI to UE

Assign RNTI to UE

b) Step 4: 5GSniffer Configuration and DCI Dataset Collection.: Using the parameters from reconnaissance and Step 3, the adversary configures 5GSniffer [10], an open-source PDCCH decoder, for blind UE-specific DCI decoding. For each slot, 5GSniffer attempts CRC verification of decoded candidates across the configured C-RNTI values, recording successful decodes with their full field sets; restricting the search to the narrow range inferred in Step 3 cuts decoding complexity by several orders of magnitude. The output is a time-ordered sequence of DCI records, one per scheduling decision observed on the PDCCH. C. RNTI to UE Device Mapping

Succession DAG GS = (R, ES , w) encodes candidate samedevice transitions: a directed edge (ri → rj ) ∈ ES exists iff β(ri ) < α(rj ) and (ri , rj ) ∈ / EC . Because time is irreversible, GS is acyclic. Each edge carries a squared-gap cost
2 w(ri , rj ) = α(rj ) − β(ri ) , encoding that a reconnecting device minimizes its own reconnection delay; squaring penalizes long silences superlinearly (a 10 s gap costs 100× as much as a 1 s gap), matching the physical bound that the delay lies between the RRC procedure time and the inactivity timer. Conflict-Constrained Path Cover (CCPC). Partition R into vertex-disjoint directed paths (chains) in GS that (i) cover every r ∈ R exactly once and (ii) place no two GC -adjacent RNTIs on one path (enforced by construction, since ES excludes conflicting pairs), while minimizing X J(P) = w(ri , rj ) + c K(P), (1)

In every 5G system, the gNB assigns a temporary identifier (C-RNTI) to each UE during an RRC connection. These identifiers change across RRC sessions, so an eavesdropper cannot trivially map them to devices: whenever a UE disconnects and reconnects, whether due to mobility, inactivity timers, or RRC re-establishment, it receives a fresh C-RNTI with no (ri →rj )∈P visible link to the previous one. The decoded DCI records therefore appear as a stream of scheduling metadata tagged where K(P) is the number of chains and c > 0 is the cost of with unpredictable identifiers, and to fingerprint per device opening a new chain, equivalently of leaving a node without the adversary must first determine which RNTIs belong to the a matched successor. The penalty c is essential. Without it, every w ≥ 0 makes the empty cover (K = n, J = 0) trivially same physical UE. 1) Motivation for a Graph-Theoretic Approach: The map- optimal, so a plain minimum-weight matching would return ping problem has one hard constraint: two RNTIs active in the the degenerate solution that treats each RNTI as its own device. same time window cannot belong to the same UE, since a UE With it, linking ri → rj is preferred over opening a new chain holds exactly one C-RNTI per active RRC connection [29]. This exactly when w(r√i , rj ) < c, i.e., when the reconnection gap relation is pairwise, and any structure over objects (nodes) and is below τmax = c. We treat τmax as a confidence threshold pairwise relations (edges) is a graph. Representing each RNTI on the reconnection gap rather than a hard physical bound: by its activity interval and joining overlapping pairs yields sub-τmax gaps (e.g., RRC re-establishment or brief idle) are an interval graph [33], which is perfect; its clique number strong evidence of same-device continuity, whereas longer gaps therefore equals its chromatic number, i.e., the minimum are uninformative on their own and are deferred to Phase 3. number of colors, and since one color per device is forced by Reduction to assignment. Minimizing (1) reduces to a bipartite the constraint, that clique number is the tightest lower bound assignment. Split each r into a successor port rL and a predeceson the device count K, computable in polynomial time from sor port rR , and for every (ri → rj ) ∈ ES with w(ri , rj ) < c timestamps alone. add an edge (riL , rjR ) with reward c − w(ri , rj ) > 0. Each The conflict graph states which RNTI pairs cannot share a matched edge merges two chains and lowers J by exactly device but not which non-conflicting pairs do. Resolving that c − w, since K drops by one (c saved) at an added link cost requires a second structure that is (i) derivable from timestamps w. Minimizing J is therefore equivalent to a maximum-weight alone and (ii) asymmetric in time, since reconnection is directed: bipartite matching on these rewards, solved by the Hungarian an old RNTI ends and a new one begins. These properties call algorithm [34] in O(n3 ) time. Because only sub-τmax links for a directed acyclic graph with temporal-gap edge weights, are admitted, genuine but long reconnections are deliberately formalized next. left unlinked, which is what makes the resulting chain count 2) Problem Formulation: The mapping problem takes a set an upper bound on K that Phase 3 then tightens. of observed RNTIs R = {r1 , . . . , rn }, each with an activity 3) Proposed Solution: We solve CCPC with CCCD, which interval [α(ri ), β(ri )] from its first to last DCI timestamp, and uses only timestamp, RNTI, and direction (UL/DL); these produces a partition P = {D1 , . . . , DK } in which each Dk is depend on whether and when a device was scheduled, not the ordered RNTI sequence of one physical UE. Neither K how, making them invariant to the gNB’s resource-allocation nor any device’s reconnection schedule is known in advance. decisions. CCCD has three phases: We define the two graph structures used throughout: 1) Conflict Detection (§V-C4): identify simultaneously active RNTIs that cannot share a device. Conflict graph GC = (R, EC ) encodes the one-RNTI-perconnection invariant [29]: an undirected edge (ri , rj ) ∈ EC 2) Succession Scoring (§V-C5): among non-conflicting RNexists whenever the intervals of ri and rj overlap, i.e., α(ri ) ≤ TIs, score how likely one is the direct temporal successor β(rj ) and α(rj ) ≤ β(ri ). of another.

Phase 1: conflict detection Pairwise interval overlap check

Phase 3: chain cover and model selection Step 1: Hungarian matching on G_S

Initial chains {C_1, ..., C_m}

scheduling profiles (ρ, φ) Conflict graph G_C

K_min = clique(G_C)

G_C

Input DCI records timestamp, RNTI, direction

Step 2: BIC-guided merging Greedy merge of conflict-free chains until BIC stops improving

G_S

Phase 2: succession scoring Non-conflicting, temporally ordered edges Succession DAG G_S, cost = gap²

Output

Device partition P = {D_1, ..., D_K}

Fig. 4: Dataflow of CCCD. 3) Chain Cover and Model Selection (§V-C6): stitch RNTIs into per-device chains via the matching above, then estimate K with the Bayesian Information Criterion (BIC). Figure 4 summarizes the dataflow, and Algorithm 1 gives the consolidated procedure. 4) Phase 1: Conflict Detection: Phase 1 instantiates GC (§V-C2) via the O(n2 ) pairwise interval-overlap test and reports the lower bound Kmin = ω(GC ) at no additional cost. Since n, the number of distinct RNTIs in a session, is on the order of tens to hundreds, this step is negligible in time. 5) Phase 2: Temporal Succession Scoring: Phase 2 instantiates GS (§V-C2), admitting an edge (ri → rj ) only when the pair is conflict-free and forward in time (β(ri ) < α(rj )) and weighting it by the squared gap w(ri , rj ). The first condition ensures conflict feasibility, the second enforces causality, and the weight encodes the preference for short reconnection delays defined above. 6) Phase 3: Chain Cover and Model Selection: Phase 3 converts GS into per-device RNTI sequences and determines the device count. Step 1: Minimum-cost chain cover. A chain is a directed path in GS (e.g., r3 → r7 → r12 means one device used three successive RNTIs), and a chain cover assigns every RNTI to exactly one chain. We compute the cover that minimizes J (1) by the maximum-weight matching of §V-C2, then convert matched successor links into vertex-disjoint chains. Because a link is taken only when its squared gap is below√c, chains break wherever a reconnection gap exceeds τmax = c, so a device that went idle for longer than τmax is split across several chains. This deliberate splitting is what makes the resulting count m an upper bound on K; Step 2 then merges the over-split chains using their temporal profiles rather than the gap. Step 2: BIC-guided merging. The initial count m upperbounds K. To decide whether two chains separated by a gap too long for Phase 2 to link cheaply belong to the same device, we use the Bayesian Information Criterion (BIC) [35], which balances fit against complexity. For each RNTI r with β(r) > α(r) we form a two-dimensional temporal profile
t(r) = ρ(r), ϕ(r) , (2) where ρ(r) = n(r)/(β(r)−α(r)) is the scheduling density and ϕ(r) = nUL (r)/n(r) is the uplink fraction; single-observation RNTIs are retained as singletons. Each device cluster is a

Algorithm 1 Conflict-Constrained Chain Decomposition Require: DCI records X = {(t, r, d)} (t timestamp, r RNTI, d ∈ 2 {U L, DL}); new-chain penalty c = τmax Ensure: Device partition P = {D1 , . . . , DK } and estimated device count K 1: Aggregate X by RNTI to obtain R 2: for all r ∈ R do 3: α(r) ← min{t : (t, r, d) ∈ X }; β(r) ← max{t : (t, r, d) ∈ X } 4: n(r) ← |{(t, r, d) ∈ X }|; nU L (r) ← |{(t, r, U L) ∈ X }| 5: end for // Phase 1: hard conflict constraints 6: GC ← (R, ∅) 7: for all unordered pairs {ri , rj } ⊂ R do 8: if α(ri ) ≤ β(rj ) and α(rj ) ≤ β(ri ) then 9: Add conflict edge {ri , rj } to GC 10: end if 11: end for 12: Kmin ← ω(GC ) ▷ minimum feasible number of physical UEs // Phase 2: feasible temporal transitions 13: GS ← (R, ∅) 14: for all ordered pairs (ri , rj ) with ri ̸= rj do 15: if {ri , rj } ∈ / EC and β(ri ) < α(rj ) then 16: wij ← (α(rj ) − β(ri ))2 17: Add edge (ri → rj ) with cost wij to GS 18: end if 19: end for // Phase 3a: initial chain cover (new-chain penalty c) 20: Split each r ∈ R into left and right copies (rL , rR ) 21: Build a bipartite graph: for every (ri → rj ) ∈ ES with wij < c, add edge (riL , rjR ) with reward c − wij > 0 22: M ← maximum-weight matching on this bipartite graph ▷ minimizes J in (1) 23: Convert matched successor links in M into vertex-disjoint chains C = {C1 , . . . , Cm }, m ≥ K // Phase 3b: BIC-guided model selection 24: for all r ∈ R with β(r) > α(r) do 25: ρ(r) ← n(r)/(β(r) − α(r)); ϕ(r) ← nU L (r)/n(r) 26: t(r) ← (ρ(r), ϕ(r)) 27: end for 28: repeat 29: Among all conflict-free chain pairs, find the pair (Ca , Cb ) with the largest BIC improvement after merging 30: if the best merge strictly improves BIC then 31: C ← (C \ {Ca , Cb }) ∪ {Ca ∪ Cb } 32: end if 33: until no conflict-free merge improves BIC 34: P ← C; K ← |P| 35: return P, K

diagonal bivariate Gaussian over these profiles, and BIC accepts a merge only when the combined model scores strictly better than the two separate models. The procedure is greedy: at each iteration the conflict-free, merge-eligible pair with the largest BIC improvement is merged (a merge is conflict-free if no RNTI in one chain conflicts with any in the other), and iteration stops when no merge improves BIC. The remaining chain count is the estimated K, obtained without specifying K in advance. D. Trace Reconstruction and Preprocessing After RNTI-to-device mapping, the raw DCI stream is separated into client-specific scheduling traces. Each trace is represented as an ordered sequence of decoded scheduling records, each containing a timestamp, transmission direction, transport block size, and physical resource block allocation.

Algorithm 2 Data Reconstruction (Packet-Loss Imputation) Require: Raw grants G; τul =300, τdl =150; δ=1.0s; m; λ=1.8; κ Ensure: Imputed grant set G̃ 1: G ← {g ∈ G : (g.dir=UL ∧ g.tb≥τul ) ∨ (g.dir=DL ∧ g.tb≥τdl )} 2: Bul , Bdl ← D ETECT B URSTS (G, δ); discard bursts with < m grants 3: Bdl ← KM EANS H EIGHT F ILTER(Bdl , k=2) 4: µs ← med(|Bul |); ρ ← med(DL-to-DL spacing) 5: Tul , Tdl ← empirical TB-size pools from Bul , Bdl 6: S ← ∅ 7: for each consecutive pair (di , di+1 ) in Bdl do 8: if no UL burst precedes di then 9: S ← S ∪ S AMPLE B URST(UL, µs , Tul , di ) 10: end if 11: if di+1 .start − di .end > λρ then 12: n ← min(⌊(d Sn i+1 .start − di .end)/ρ⌉ − 1, κ) 13: S ← S ∪ r=1 S AMPLE ROUND(Tul , Tdl , µs , ρ) 14: end if 15: end for 16: G̃ ← (G ∪ S) with UL grants inside DL windows removed 17: return G̃

We then preprocess each per-device trace before extracting temporal fingerprints. First, we remove low-activity or irrelevant scheduling records using a transport block size filter. The remaining records are grouped into uplink and downlink bursts based on temporal proximity. These bursts provide the basis for identifying the FL round-cycle structure, in which each round typically includes downlink activity associated with global model delivery and uplink activity associated with client update transmission. However, passive over-the-air DCI collection is inherently incomplete. A sniffer may miss scheduling records because of decoding failures, temporary synchronization loss, or weak signal conditions. Missing records can introduce artificial gaps in the client-specific trace and distort burst boundaries, which directly affects View R and View L because they rely on cadence and round-to-round temporal structure. To reduce this effect, F LINT applies a missing-grant reconstruction step to each per-device trace. The goal is not to recover packet contents or user-plane data, but to restore the temporal continuity of the scheduling trace by identifying abnormal gaps and imputing likely missing scheduling activity from neighboring observations. Algorithm 2 summarizes this reconstruction process. E. Fingerprinting Framework The fingerprinting framework takes a cleaned per-device DCI stream and produces an architecture label. In Figure 2, we see that it consists of four stages: segmentation into observation windows, extraction of three complementary temporal views, late fusion of view-level predictions, and the final fingerprint decision.

1) Segmentation: A passive observer may begin monitoring a client at any point during the training session. Therefore, F LINT operates on fixed-duration observation windows rather than complete training sessions. We slide a window of length w over each client’s DCI stream and treat each window as an independent attack observation. We set w = 300, s. This duration provides enough time to capture multiple federated training rounds while remaining practical for passive monitoring. Within each window, F LINT identifies round-cycle structure from the alternation between uplink and downlink activity. This produces a sequence of round-level segments used by the rhythm and sequential views. Windows shorter than w at the end of a stream are retained as independent observations only if they contain sufficient activity. 2) Three Temporal Views: Simple statistics derived from transport block sizes and resource block allocations do not reliably distinguish model families when their overall communication patterns are similar. F LINT therefore represents each observation window through three complementary temporal views. Each view is trained independently and produces a classprobability vector. The separate views allow the framework to capture different aspects of training behavior and provide robustness when one representation is less informative for a particular window. a) View W: Multi-Resolution Energy.: View W captures how scheduling activity is distributed across multiple time scales. As summarized in Algorithm 3, we first convert each observation window into a regularly sampled activity signal based on transport block sizes or resource allocation activity. We then apply a discrete wavelet transform to decompose the signal into components at successively coarser resolutions. The energy at each resolution level is summarized and normalized to obtain a scale-aware descriptor of temporal activity. This view captures whether activity appears as sharp short-lived bursts, slower fluctuations, or a mixture of both. The resulting feature vector is classified using XGBoost, producing the probability vector pW . b) View R: Cadence and Regularity.: View R captures the periodicity and regularity of the federated training cycle. As shown in Algorithm 4, we use the round-cycle boundaries identified during segmentation to extract statistical descriptors of the round structure, including timing, uplink activity, downlink activity, and phase durations. We also compute spectral descriptors from round-level sequences to measure how strongly the traffic follows a regular cadence. A stable training loop tends to produce more regular round timing, while irregular computation or communication behavior produces a more diffuse temporal pattern. These features are classified using XGBoost, producing the probability vector pR . c) View L: Sequential Evolution.: View L models the round-to-round evolution of scheduling activity. As described in Algorithm 5, each window is represented as an ordered sequence of per-round descriptors and used to train a bidirectional Long Short-Term Memory network. The Bi-LSTM captures dependencies between consecutive rounds that are not preserved by aggregate statistical features. This view is

Algorithm 3 View W: Wavelet Multi-Resolution Energy

Algorithm 5 View L: Round-Sequence BiLSTM Training

Require: Window grants Gw ; number of slots N =128; wavelet levels L=6; XGBoost classifier hW Ensure: View probability vector pW ∈ ∆2 P 1: x ← ACTIVITY S IGNAL(Gw , N ) ▷ xj = g∈slot j g.tb 2: e ← [ ] 3: for ℓ = 0 to L − 1 do √ 4: ai ← (x2i + x2i+1 )/√2 ▷ Haar approximation 5: di ← (x2i − x2i+1 )/ 2 ▷ Haar detail P 6: Append eℓ ← i d2i to e ▷ Detail energy at scale ℓ 7: x←a ▷ Recurse on approximation 8: end for P 2 9: Append eL ← ▷ Residual approximation i xi to e energy PL 10: xW ← e / ▷ Normalize to energy distribution ℓ=0 eℓ 11: pW ← hW (xW ) 12: return pW

Require: {(Gw , yw )}M w=1 ; class weights wc ∝ 1/nc ; epochs E Ensure: Trained BiLSTM fθ 1: Rw ← E XTRACT ROUNDS(Gw ), z-scored by (µf , σ f ) ∀w 2: Initialize 2-layer BiLSTM fθ with softmax over C = {CNN, RNN, Trans} 3: Optimize θ via Adam (E epochs): M

1 XX L(θ) = − wc yw,c log fθ (Rw )c M w=1 c∈C

4: return fθ

Inference: pL ← fθ (Rw ) ∈ ∆|C|−1

inspected independently, and improves robustness when one view is degraded by missing observations or weak temporal structure and we called this fusion "stacking" fusion. 4) Fingerprint Decision: In the closed-world setting, the predicted architecture is the class with the highest fused probability:

Algorithm 4 View R: Round-Cadence Regularity and Spectral Features Require: Window grants Gw ; XGBoost classifier hR Ensure: pR ∈ ∆2 1: R ← E XTRACT ROUNDS(Gw ) 2: Form sequences: gaps g, UL sizes u, DL sizes d, durations ŷ = arg max pF (c). c∈CNN,RNN,Transformer δ In the open-world setting, F LINT rejects low-confidence 3: for each s ∈ {g, u, d, δ} do windows as unknown: 4: Append µ(s), σ(s), slope(s), AC1 (s) to xstat ( 5: end for Others, if maxc pF (c) < η, ŷ = 6: for each s ∈ {g, u} do P arg maxc pF (c), otherwise. 7: p(f ) ← |FFT(s − µ(s))|2 /P ( f |FFT(s − µ(s))|2 + ϵ) 8: Append arg maxf p(f ), − f p(f ) log p(f ), maxf p(f )The final client-level fingerprint is obtained by aggregating to xspec predictions across multiple windows from the same client. 9: end for VI. E VALUATION R ESULT AND A NALYSIS 10: xR ← [ |R| ∥ xstat ∥ xspec ] A. Experimental Setup and Metrics 11: pR ← hR (xR ) Testbed. We evaluate F LINT on a real 5G federated learning 12: return pR testbed. The testbed consists of heterogeneous FL client devices connected through a 5G cell served by a gNodeB. Each client sensitive to how the training and update pattern changes over trains deep learning model locally and exchanges model updates the observation window. At inference time, the trained Bi- with a federated server through the 5G network. A passive LSTM produces the probability vector pL for each observation SDR-based sniffer collects PDCCH scheduling information and decodes DCI records without interacting with the network, window. 3) Late Fusion: The three views provide complementary the gNodeB, or the FL clients. evidence about the client’s architecture. Instead of concatenat- Architecture families. We evaluate three architecture famiing raw feature vectors, F LINT performs late fusion over the lies: convolutional neural networks (CNNs), recurrent neural view-level probability vectors pW , pR , and pL . Specifically, networks (RNNs), and Transformers. Each family contains multiple concrete model variants so that the classification target it forms a stacked probability representation z = [pW ∥ pR ∥ pL ], is the architecture family rather than a specific model instance. For open-world experiments, we additionally consider unseen where | denotes concatenation. A meta-classifier g ∗ ϕ, implemodel variants and non-FL background traffic as Others. mented as logistic regression, maps this stacked representation Evaluation settings. We evaluate F LINT under closed-world to a fused class-probability vector: and open-world settings. In the closed-world setting, each p ∗ F = g ∗ ϕ(z). observation window belongs to one of the three known FL The meta-classifier is trained using view-level predictions architecture families, and the task is three-way classification generated from the training folds. This probability-level fusion among CNN, RNN, and Transformer. In the open-world setting, keeps the views modular, allows each view to be trained and the model is trained on known FL families and evaluated on

Row-normalized value

True label

unseen model variants or background traffic, requiring the TABLE II: Main closed-world performance at w = 300 s, stacking fusion. classifier to reject unknown windows as Others. Observation windows. Unless otherwise stated, we use fixed Class Precision Recall F1 observation windows of w = 300,s. This window length CNN 0.921 ± 0.047 0.871 ± 0.030 0.895 ± 0.031 captures multiple FL round cycles while remaining practical RNN 0.963 ± 0.030 0.994 ± 0.013 0.978 ± 0.019 for passive monitoring. Section VI-D3 studies the effect of Transformer 0.909 ± 0.018 0.929 ± 0.040 0.918 ± 0.016 different observation window sizes. Macro 0.931 0.931 0.930 ± 0.021 Training protocol. For closed-world evaluation, we use stratified 5-fold cross-validation with balanced class pools. 1 Balancing prevents the classifier from favoring the majority 0.871 0.035 0.094 CNN 0.8 architecture family and ensures that performance reflects per(148) (6) (16) class separability rather than dataset composition. For each fold, 0.6 feature extraction, view-level classifiers, and the fusion meta0.006 0.994 0.000 RNN (1) (154) (0) classifier are trained only on the training split and evaluated 0.4 on the held-out split. Metrics. We report per-class precision, recall, and F1-score, as 0.071 0.000 0.929 0.2 Transformer (12) (0) (158) well as macro-averaged precision, recall, and F1-score. Unless 0 otherwise stated, we report mean and standard deviation across N N er CN RN orm cross-validation folds. For open-world rejection, we also report f s n Tra unknown-detection performance and false-positive behavior for Predicted label the Others class. Fig. 5: Normalized confusion matrix for closed-world fingerB. RNTI Mapping Evaluation printing at w = 300,s using stacking fusion. Rows indicate true Here, we evaluate CCCD on a 613 s capture of 39,669 architecture families and columns indicate predicted families. DCI records carried by eight C-RNTIs from three UEs, using only timestamp, RNTI, and direction with a reconnection window τmax = 500 ms. After aligning each recovered chain the adversary does not see packets or payloads, the timing to a ground-truth device for scoring only, CCCD estimates and size of scheduling grants still reflect how different model K̂ = 3 directly from the data and recovers every chain families behave during federated training. The high F1-score exactly. Therefore, the confusion matrix is diagonal (Table I) shows that FLINT can recover this hidden structure from coarse at 100% RNTI accuracy (8/8) and 100% record accuracy PHY-layer observations. Confusion analysis. Figure 5 shows the normalized confusion (39,669/39,669). matrix for the closed-world setting at w = 300,s using stacking C. Fingerprinting Performance fusion. RNN samples are almost perfectly separated from the

GT

Closed-world performance. Table II reports the closed-world other families, with only one RNN sample misclassified as performance of F LINT using the full three-view configuration CNN. Most errors occur between CNN and Transformer, as with stacking-based late fusion at w = 300,s. F LINT achieves expected, because these families tend to exhibit more similar a macro F1-score of 0.930 ± 0.021 across CNN, RNN, and aggregate scheduling behavior than RNNs. Nevertheless, F LINT Transformer families. RNNs are identified with the highest F1- correctly identifies 87.1% of CNN samples and 92.9% of score, reflecting their distinctive temporal scheduling behavior. Transformer samples, showing that temporal evidence from the CNNs and Transformers are difficult to distinguish because three views substantially reduces CNN-Transformer confusion. they can exhibit similar aggregate communication patterns, yet Insight. The confusion matrix shows that FLINT separates F LINT still reliably identifies both families. RNNs reliably, while most remaining errors occur between Insight. These results confirm that the 5G control channel leaks CNNs and Transformers. This indicates that the main challenge more information than it appears to at first glance. Although is distinguishing architectures with similar communication volume, where temporal structure becomes the key differentiator. Attack reliability. The per-class precision values in Table II TABLE I: Confusion matrix of CCCD RNTI-to-UE mapping show that F LINT does not simply produce high recall with many (row-normalized). Rows are ground-truth UEs. CCCD assigns false positives. For example, the Transformer class achieves a every RNTI to the correct device. precision of 0.908 and a recall of 0.929. A passive adversary can therefore act on high-confidence identifications rather than Predicted (aligned) relying on noisy guesses. UEA UEB UEC Insight. For the fingerprinting attack, precision is as important as recall. High precision indicate that when F LINT identifies UEA 1.00 0.00 0.00 a model family, the adversary can use that information to UEB 0.00 1.00 0.00 support downstream decisions such as architecture-specific UEC 0.00 0.00 1.00 probing, resource targeting, or selective monitoring.

Method

CNN

RNN

Trans.

Macro

FLARE-style 0.825±0.058 0.880±0.099 0.798±0.058 0.834±0.047 FLARE-style+Imp. 0.819±0.035 0.947±0.032 0.865±0.077 0.877±0.033 F LINT w/o Imp. 0.814±0.066 0.884±0.059 0.887±0.067 0.862±0.054 F LINT 0.895±0.031 0.978±0.019 0.918±0.016 0.930±0.021

D. Ablation Studies We conduct ablation studies to explain why F LINT works and which components are necessary. The studies answer five questions: whether simple communication statistics are sufficient, whether the three temporal views provide complementary information, what is the right fusion strategy, whether data-loss imputation matters, and how the observation window affects performance. Baseline and imputation analysis. Table III compares the FLARE baseline with its statistical features to our F LINT and also isolates the effect of data-loss imputation. Also, FLARE relies on packet-level observations, such as packet sizes, directions, timing, and inter-arrival statistics, which are available from encrypted Wi-Fi traffic but are not visible to a passive 5G PHY-layer observer. In contrast, F LINT uses only decoded PDCCH/DCI scheduling records, including transport block sizes, transmission directions, timestamps, and physical resource block allocations. Therefore, we adapt the FLARE baseline by replacing packet-level quantities with their closest observable PHY-layer counterparts, such as TBS, direction, and timing-derived statistics. The F LINT w/o Imp. row removes data-loss imputation from the proposed temporal multi-view pipeline while keeping the rest of the F LINT framework unchanged. The FLARE baseline achieves a macro F1 of 0.834, indicating that statistical summaries of PHY-layer scheduling records provide some architectural signal but are not sufficient. Adding imputation improves the FLARE baseline to 0.877, indicating that missing-grant reconstruction helps recover useful temporal continuity. However, the full F LINT pipeline achieves the best macro F1 of 0.930, showing that imputation and temporal multi-view modeling are both necessary for reliable architecture fingerprinting. Insight. The baseline comparison shows that simple PHYlevel statistics contain useful signal, but they are not sufficient. FLINT performs better because it combines missing-grant reconstruction with temporal multi-view modeling. 1) Multi-View Contribution: Table IV evaluates all combinations of View W, View R, and View L. Single views capture useful but incomplete evidence. Pairwise combinations improve performance, and the full W+R+L configuration achieves the highest macro F1. Insight. No single view fully captures the architecture fingerprint. View W captures multi-scale activity concentration, View R captures round cadence and regularity, and View L captures round-to-round evolution. 2) Fusion Strategy: Table IV also compares average fusion and learning based fusion (stacking). As our dataset is balanced

TABLE IV: View ablation and fusion strategy comparison at w = 300 s. View

CNN F1

RNN F1

Trans. F1

Macro F1

W R L

0.833 ± 0.020 0.864 ± 0.043 0.766 ± 0.049

0.947 ± 0.026 0.981 ± 0.015 0.911 ± 0.037

0.883 ± 0.022 0.881 ± 0.041 0.853 ± 0.037

0.888 ± 0.004 0.909 ± 0.030 0.843 ± 0.036

W+R W+L R+L

0.881 ± 0.033 0.879 ± 0.013 0.851 ± 0.050

0.972 ± 0.023 0.963 ± 0.025 0.968 ± 0.015

0.903 ± 0.033 0.904 ± 0.018 0.884 ± 0.053

0.919 ± 0.023 0.915 ± 0.012 0.901 ± 0.036

W+R+L, avg. W+R+L, stack

0.880 ± 0.037 0.895 ± 0.031

0.976 ± 0.016 0.978 ± 0.019

0.892 ± 0.029 0.918 ± 0.016

0.916 ± 0.024 0.930 ± 0.021

1 0.95 0.9

F1-score

TABLE III: Baseline comparison and imputation ablation at w = 300 s. Entries are F1-scores over 5-fold CV.

0.85 0.8

Optimal sniffing window

0.75 CNN RNN

0.7 0.65

60

0

12

0

18

0

24

0

30

0

36

Transformer Macro-F1 0

42

0

48

0

54

0

60

Sniffing window (s)

Fig. 6: Effect of sniffing window size on F LINT’s fingerprinting performance. F1-score improves rapidly from 60 s to 300 s as longer windows capture more FL round-cycle structure, and then largely saturates. We use w = 300 s as the default operating point because it provides a strong tradeoff between attack accuracy and observation cost.

so, the average and weighted-average fusion both achieve a macro F1 of 0.916, hence we show average fusion result. With compare to average fusion, stacking improves macro F1 to 0.930 and yields the best overall result. Insight. The similar performance of average and weighted fusion suggests that the three views contribute comparably. Stacking performs best because it learns when to trust each view, rather than assigning some fixed weight to every window. 3) Observation Window Analysis: We evaluate how the sniffing window affects F LINT’s performance by varying w from 60 s to 600 s. Short windows may not contain enough FL round-cycle structure, while longer windows increase the adversary’s observation cost. In real scenario, attack window is not fixed, attacker can come and join any time, hence the impact of sniffing window represent the attack impacts with compare to sniffing time. Insight. F LINT does not require observing the full training session. A few minutes of passive PDCCH sniffing are sufficient to recover a reliable architecture fingerprint, while very short observations fail to capture enough FL round-cycle structure. E. Exploratory Open-World Rejection Analysis In practical deployments, the adversary may observe traffic that does not belong to any of the architecture families represented during classifier training. We therefore examine

Softmax threshold

FAR

Known Macro F1

0.111

0.889

0.909

Benign Attack

Round time (s)

Unknown Recall

Round time (s)

Mechanism

600 400 Jamming period 200 0 5

10

15

20

200 150 100 50

Jamming period

TABLE V: Threshold-based unknown rejection at w=300 s. Known Macro F1 measures classification of known architecture families.

Benign

5

25

10

15

Attack

20

25

FL round

FL round

Orange bands mark attack-active observations.

Orange bands mark attack-active observations.

(a) CNN

(b) RNN

Orange bands mark attack-active observations.

Test loss

Test loss

Jamming effect

Orange bands mark attack-active observations.

Jamming period

whether the three-class FLINT classifier can reject unknown observations using a confidence threshold. This analysis is Fig. 7: Targeted jamming under synchronous FL, showing intended to evaluate the limitations of standard softmax-based round completion time for (a) CNN and (b) RNN client. rejection of open-world evaluation. a) Rejection mechanism.: We evaluate confidenceBenign Attack Jamming period 6 threshold-based rejection using the fused three-class softmax 6 Jamming effect probabilities. An observation window is rejected as Others 4 4 when its maximum class probability is below a threshold η; otherwise, it is assigned to the architecture family with the 2 2 highest probability. The threshold η is calibrated using held-out Benign Attack 0 validation windows from the known architecture families to 20 40 60 80 20 40 60 80 FL update FL update retain approximately 90% of known validation observations. Thus, Others is a rejection outcome rather than a separately (a) CNN (b) RNN trained fourth class. b) Metrics.: We report three metrics. Known Macro Fig. 8: Targeted jamming under asynchronous federated learnF1 is the macro-averaged F1-score over CNN, RNN, and ing, showing test loss per asynchronous update for (a) the Transformer observations accepted as known. Unknown Recall convolutional and (b) the recurrent client. is the fraction of true Others observations correctly rejected. 1) Attack on Synchronous Federated Learning: We first The False Acceptance Rate (FAR) is the fraction of true examine synchronous aggregation, where the attack converts Others observations incorrectly accepted as one of the known a single jammed client into a stall of the entire round, and architecture families. both architectures suffer. The mechanism follows directly from c) Results.: Table V reports the performance of the synchronization barrier in FedAvg. Because the aggregator confidence-threshold-based rejection at w = 300 s. The cannot produce the next global model until every selected thresholded softmax maintains a Known Macro F1-score of client has returned its update, jamming the targeted client 0.909 for accepted known observations. However, it correctly stalls communication between clients and the server. For the rejects only 11.1% of Others observations and produces an convolutional client in Fig. 7a, jammed rounds complete in a FAR of 0.889. These results indicate that the three-class mean of 243 s against a clean-round mean of 44 s, an inflation softmax classifier remains overconfident when presented with of roughly 5.5× per jammed round, and the cumulative training observations outside the known architecture families. Conse- time rises by +152% over the benign baseline. quently, confidence thresholding alone is insufficient for reliable Moreover, the recurrent client incurs a higher relative cost. unknown-workload detection. Fig. 7b reports jammed rounds at a mean of 195 s against a Insight. Strong classification performance among known clean-round mean of only 26 s, an inflation of nearly 7.6×, architecture families does not automatically provide reliable with the total training time rising by +157%. The mechanism rejection of unknown observations. The low Unknown Recall is identical to the CNN case. In both cases, the jamming effect and high FAR show that standard softmax confidence is not a stays confined to the jamming period, because every spike sits dependable indicator of whether a PHY-layer trace belongs inside an orange band and the round time returns to baseline to a known architecture family. More specialized open-set the moment the band ends, and the final accuracy converges recognition methods are therefore required for reliable open- to the benign trajectory at 0.894 against 0.892 for the CNN world fingerprinting. client and 0.905 against 0.918 for the recurrent one. The attack F. Downstream Attacks Based on Fingerprinting therefore denies timely convergence rather than accuracy. This subsection establishes the downstream stage of the 2) Attack on Asynchronous Federated Learning: We now attack, in which the adversary converts model architecture turn to asynchronous aggregation, where the global model is into surgical interference against the targeted FL client(s). updated as client updates arrive without waiting. Therefore, The upstream fingerprinting stage has already revealed to the jamming no longer stalls progress. Instead, it injects stale and adversary which architecture the clients run, so the adversary partial contributions into the aggregate. The CNN client in no longer treats the radio link as an opaque pipe and instead Fig. 8a resolves this into two regimes. During the first isolated jams the uplinks of selected clients at the PHY layer during burst near updates 16 through 23, the test loss climbs to roughly FL training. 4 and then falls back toward the benign level within a few

updates after the band ends. However, continuous jamming forces the global model to update with fewer client updates, leading to higher loss and a +6.66 increase over the baseline. The recurrent client in Fig. 8b isolates a single short jamming period and exposes a delayed response that outlives it. The jamming period spans only the band near updates 39 through 45, yet the test loss continues to climb for roughly 15 updates after the band ends, peaks near update 60, and only then decays back toward the benign trajectory, settling a mere +0.16 above baseline by the end while the accuracy tracks benign at 0.626 against 0.628. The aggregate statistics show the same lag because the jammed updates themselves average only +1.47 above benign, while the nominally clean updates average +0.83, confirming that much of the damage falls on updates the adversary never touched. Therefore, the two cases together support a single structural claim: that synchronous federated learning confines the attack to the time domain within the jamming period while asynchronous federated learning relocates it to the training loss and lets it persist beyond the jamming period, and the magnitude and recoverability within each domain depend jointly on the architecture and the jamming duration. Insight. Fingerprinting makes targeted attack possible. Once the adversary identifies which client is training a particular model family, it can selectively jam that client instead of attacking blindly. The resulting stale updates can then propagate through aggregation, turning model-architecture reconnaissance into a practical downstream attack. G. Countermeasure TABLE VI: Effect of countermeasure on F LINT. Class / Target

Correct Misclassified Rejected Not correctly id.

CNN / 5 MB 0.0% CNN / 10 MB 85.2% RNN / 5 MB 100.0% RNN / 10 MB 100.0%

66.7% 0.0% 0.0% 0.0%

33.3% 14.8% 0.0% 0.0%

100.0% 14.8% 0.0% 0.0%

Overall

7.1%

13.1%

20.2%

79.8%

traffic-analysis countermeasures are largely designed for packetlevel fingerprints, where the main observable features are packet size, direction, timing, and burst shape. In contrast, F LINT operates on 5G PHY-layer scheduling metadata, where the attacker observes transport block sizes, resource block allocations, transmission direction, and round-cycle dynamics exposed through PDCCH/DCI records. Future defenses should therefore consider 5G-specific obfuscation mechanisms that jointly hide update size, scheduling cadence, uplink/downlink round structure, and resource allocation patterns while keeping the communication overhead practical for federated learning over cellular networks. VII. C ONCLUSION This paper presented FLINT, a fully black-box framework for fingerprinting federated learning model architectures from 5G physical-layer side channels. Although 5G encryption protects user-plane packets and AI/ML model update contents, FLINT shows that PDCCH scheduling metadata still leaks architecture-dependent patterns. By reconstructing per-device RNTI grants via a novel RNTI-to-UE mapping, imputing incomplete scheduling observations, and combining multiresolution energy, round-cadence, and sequential temporal views, FLINT infers whether a client is training a CNN, RNN, or Transformer without requiring participation in training or access to packet-level traffic. Evaluation on a real 5G FL testbed demonstrates that the proposed RNTI mapping accurately recovers device identities and that temporal multiview fingerprinting substantially outperforms simple PHYlayer statistical baselines. The results further show that openworld rejection and downstream architecture-aware attacks are practical concerns, making this leakage more than a passive privacy issue. Overall, FLINT exposes an overlooked vulnerability at the intersection of 5G control-plane observability and federated learning security, and motivates future defenses that obfuscate or normalize scheduling behavior without degrading FL performance. R EFERENCES

Traffic-analysis defenses commonly use padding, dummy traffic, size normalization, timing obfuscation, burst shaping, and cluster anonymization to reduce side-channel leakage [36], [37], [38]. We evaluate a lightweight size-obfuscation defense in which each FL update is compressed when possible and then padded to a fixed target size. We test two targets, 5 MB and 10 MB, and measure fingerprinting attack performance. Table VI shows that size obfuscation provides only limited protection. For CNN with a 5 MB target, none of the defended samples are correctly identified; however, with a 10 MB target, 85.2% remain correctly identified. RNN is unaffected, with 100.0% correct identification under both targets. Overall, only 20.2% of defended samples are either misclassified or rejected. The defense also increases communication overhead from between 14% - 89%. These results suggest that effective defenses must hide not only updatesize information, but also round-cycle timing and scheduling dynamics exposed through 5G PHY-layer metadata. Existing

[1] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Proc. Artificial Intelligence and Statistics (AISTATS). PMLR, 2017, pp. 1273–1282. [2] P. Kairouz, H. B. McMahan et al., “Advances and open problems in federated learning,” Foundations and Trends in Machine Learning, vol. 14, no. 1–2, pp. 1–210, 2021. [3] T. Wang, “High precision open-world website fingerprinting,” in Proc. 2020 IEEE Symposium on Security and Privacy (SP). IEEE, 2020, pp. 152–167. [4] J. Li, Z. Lin, J. Qu, S. Wu, H. Zhou, Y. Liu, X. Ma, T. Wang, X. Luo, and X. Guan, “Robust app fingerprinting over the air,” IEEE/ACM Transactions on Networking, 2024. [5] R. R. Chowdhury and P. E. Abas, “A survey on device fingerprinting approach for resource-constraint iot devices: Comparative study and research challenges,” Internet of Things, vol. 20, p. 100632, 2022. [6] M. N. H. Shuvo, M. Hossain, A. Mallik, J. Twigg, and F. Dagefu, “FLARE: A wireless side-channel fingerprinting attack on federated learning,” in Proc. IEEE International Conference on Computer Communications (INFOCOM), 2026, to appear. [7] M. Zhou, W. Zhou, J. Huang, J. Yang, M. Du, and Q. Li, “Stealthy and effective physical adversarial attacks in autonomous driving,” IEEE Transactions on Information Forensics and Security, 2024.

[8] M. H. Ashik and M. Hossain, “ReaperPulse: A targeted energy-efficient control channel jamming in 5g,” in Proc. 2025 ACM Workshop on Wireless Security and Machine Learning (WiseML), 2025, pp. 2–7. [9] H. Wan, X. Cao, A. Marder, and K. Jamieson, “NR-Scope: A practical 5g standalone telemetry tool,” in Proc. 20th International Conference on Emerging Networking Experiments and Technologies (CoNEXT), 2024, pp. 73–80. [10] N. Ludant et al., “From 5G sniffing to harvesting leakages of privacypreserving messengers,” in Proc. 2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2023, pp. 3146–3161. [11] R. Shokri, M. Stronati, C. Song, and V. Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE Symposium on Security and Privacy (SP). IEEE, 2017, pp. 3–18. [12] M. Nasr, R. Shokri, and A. Houmansadr, “Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,” in 2019 IEEE Symposium on Security and Privacy (SP). IEEE, 2019, pp. 739–753. [13] G. Zhu, D. Li, H. Gu, Y. Yao, L. Fan, and Y. Han, “FedMIA: An effective membership inference attack exploiting “all for one” principle in federated learning,” in Proc. IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2025, pp. 20 643–20 653. [14] W. Yang, S. Wang, D. Wu, T. Cai, Y. Zhu, S. Wei, Y. Zhang, X. Yang, Z. Tang, and Y. Li, “Deep learning model inversion attacks and defenses: A comprehensive survey,” Artificial Intelligence Review, vol. 58, no. 8, pp. 1–52, 2025. [15] D. Chen, Y. Luo, Q. Qi, and H. Fei, “Deep diffusion gradients leakage in federated learning,” in Proc. ICASSP 2025 – IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2025, pp. 1–5. [16] S. Mehnaz, S. V. Dibbo, E. Kabir, N. Li, and E. Bertino, “Are your sensitive attributes private? novel model inversion attribute inference attacks on classification models,” in 31st USENIX Security Symposium (USENIX Security 22), 2022, pp. 4579–4596. [17] Z. Wang, Y. Huang, M. Song, L. Wu, F. Xue, and K. Ren, “Poisoningassisted property inference attack against federated learning,” IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 4, pp. 3328–3340, 2022. [18] P. Sirinam, M. Imani, M. Juarez, and M. Wright, “Deep fingerprinting: Undermining website fingerprinting defenses with deep learning,” in Proc. 2018 ACM SIGSAC Conference on Computer and Communications Security (CCS), 2018, pp. 1928–1943. [19] A. Panchenko, F. Lanze, J. Pennekamp, T. Engel, A. Zinnen, M. Henze, and K. Wehrle, “Website fingerprinting at internet scale,” in Network and Distributed System Security Symposium (NDSS), 2016. [20] M. Shen, K. Ji, Z. Gao, Q. Li, L. Zhu, and K. Xu, “Subverting website fingerprinting defenses with robust traffic representation,” in Proc. 32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 607–624. [21] X. Deng, R. Zhao, Y. Wang, M. Zhan, Z. Xue, and Y. Wang, “CountMamba: A generalized website fingerprinting attack via coarsegrained representation and fine-grained prediction,” in Proc. 2025 IEEE Symposium on Security and Privacy (SP). IEEE, 2025. [22] C. Sheng, W. Zhou, Q.-L. Han, W. Ma, X. Zhu, S. Wen, and Y. Xiang, “Network traffic fingerprinting for IIoT device identification: A survey,” IEEE Transactions on Industrial Informatics, 2025. [23] L. Batina, S. Bhasin, D. Jap, and S. Picek, “CSI NN: Reverse engineering of neural network architectures through electromagnetic side channel,” in 28th USENIX Security Symposium (USENIX Security 19), 2019, pp. 515–532. [24] X. Zhang, A. A. Ding, and Y. Fei, “Deep-learning model extraction through software-based power side-channel,” in 2023 IEEE/ACM International Conference on Computer Aided Design (ICCAD). IEEE, 2023, pp. 1–9. [25] H. Chabanne, J.-L. Danger, L. Guiga, and U. Kuhne, “Side channel attacks for architecture extraction of neural networks,” CAAI Transactions on Intelligence Technology, vol. 6, no. 1, pp. 3–16, 2021. [26] 3GPP, “NR; Physical channels and modulation,” ETSI, Technical Specification (TS) 3GPP TS 38.211 (ETSI TS 138 211), Apr. 2025, release 18. [Online]. Available: https://www.etsi.org/deliver/etsi_ts/ 138200_138299/138211/18.06.00_60/ts_138211v180600p.pdf [27] ——, “NR; Radio Resource Control (RRC); Protocol specification,” ETSI, Technical Specification (TS) 3GPP TS 38.331 (ETSI TS 138 331), Jul. 2025, release 18. [Online]. Available: https://www.etsi.org/deliver/ etsi_ts/138300_138399/138331/18.06.00_60/ts_138331v180600p.pdf

[28] ——, “NR; Physical layer procedures for control,” ETSI, Technical Specification (TS) 3GPP TS 38.213 (ETSI TS 138 213), Apr. 2025, release 18. [Online]. Available: https://www.etsi.org/deliver/etsi_ts/ 138200_138299/138213/18.06.00_60/ts_138213v180600p.pdf [29] ——, “NR; Medium Access Control (MAC) protocol specification,” ETSI, Technical Specification (TS) 3GPP TS 38.321 (ETSI TS 138 321), Feb. 2026, release 18. [Online]. Available: https://www.etsi.org/deliver/ etsi_ts/138300_138399/138321/18.08.00_60/ts_138321v180800p.pdf [30] ——, “Security architecture and procedures for 5G System,” ETSI, Technical Specification (TS) 3GPP TS 33.501 (ETSI TS 133 501), Apr. 2025, release 18. [Online]. Available: https://www.etsi.org/deliver/etsi_ ts/133500_133599/133501/18.09.00_60/ts_133501v180900p.pdf [31] ——, “NR; Multiplexing and channel coding,” ETSI, Technical Specification (TS) 3GPP TS 38.212 (ETSI TS 138 212), Apr. 2025, release 18. [Online]. Available: https://www.etsi.org/deliver/etsi_ts/ 138200_138299/138212/18.06.00_60/ts_138212v180600p.pdf [32] H. Wan, X. Cao, A. Marder, and K. Jamieson, “Nr-scope: A practical 5g standalone telemetry tool,” in Proc. the 20th International Conference on Emerging Networking EXperiments and Technologies, ser. CoNEXT ’24. New York, NY, USA: Association for Computing Machinery, 2024, p. 73–80. [Online]. Available: https://doi.org/10.1145/3680121.3697808 [33] M. C. Golumbic, Algorithmic graph theory and perfect graphs. Elsevier, 2004, vol. 57. [34] H. W. Kuhn, “The hungarian method for the assignment problem,” Naval research logistics quarterly, vol. 2, no. 1-2, pp. 83–97, 1955. [35] G. Schwarz, “Estimating the dimension of a model,” The annals of statistics, pp. 461–464, 1978. [36] K. P. Dyer, S. E. Coull, T. Ristenpart, and T. Shrimpton, “Peek-a-boo, i still see you: Why efficient traffic analysis countermeasures fail,” in 2012 IEEE symposium on security and privacy. IEEE, 2012, pp. 332–346. [37] J. K. Holland, J. Carpenter, S. E. Oh, and N. Hopper, “Detorrent: An adversarial padding-only traffic analysis defense,” in Proc. 24th Privacy Enhancing Technologies Symposium (PETS 2024), 2023. [38] M. Shen, K. Ji, J. Wu, Q. Li, X. Kong, K. Xu, and L. Zhu, “Real-time website fingerprinting defense via traffic cluster anonymization,” in Proc. 2024 IEEE Symposium on Security and Privacy (SP). IEEE, 2024, pp. 3238–3256.