FLARE: A Wireless Side-Channel Fingerprinting Attack on Federated Learning

TL;DR

This paper introduces FLARE, a novel wireless side-channel attack that can identify the architecture of federated learning models by analyzing encrypted traffic, revealing a significant privacy vulnerability in FL systems.

Contribution

The paper presents the first method to fingerprint FL model architectures through encrypted wireless traffic analysis, demonstrating high accuracy across various models and scenarios.

Findings

FLARE achieves over 98% F1-score in closed-world scenarios.

The attack maintains high accuracy (up to 91%) in open-world settings.

CNN and RNN models exhibit distinguishable traffic patterns.

Abstract

Federated Learning (FL) enables collaborative model training across distributed devices while safeguarding data and user privacy. However, FL remains susceptible to privacy threats that can compromise data via direct means. That said, indirectly compromising the confidentiality of the FL model architecture (e.g., a convolutional neural network (CNN) or a recurrent neural network (RNN)) on a client device by an outsider remains unexplored. If leaked, this information can enable next-level attacks tailored to the architecture. This paper proposes a novel side-channel fingerprinting attack, leveraging flow-level and packet-level statistics of encrypted wireless traffic from an FL client to infer its deep learning model architecture. We name it FLARE, a fingerprinting framework based on FL Architecture REconnaissance. Evaluation across various CNN and RNN variants-including pre-trained and custom models trained over IEEE 802.11 Wi-Fi-shows that FLARE achieves over 98% F1-score in closed-world and up to 91% in open-world scenarios. These results reveal that CNN and RNN models leak distinguishable traffic patterns, enabling architecture fingerprinting even under realistic FL settings with hardware, software, and data heterogeneity. To our knowledge, this is the first work to fingerprint FL model architectures by sniffing encrypted wireless traffic, exposing a critical side-channel vulnerability in current FL systems.