The Training Rhythm Survives Encryption

TL;DR for operators

A federated-learning client repeatedly downloads a model, computes locally, and uploads an update while the mobile network assigns radio resources to each step. Encryption hides the transmitted contents, but not the timing, direction, allocation size, and recurring cadence created by this training cycle.

FLINT¹ reconstructs those scheduling traces and uses them to classify CNN, RNN, and Transformer families. With a 300-second observation window, it reaches a macro F1 of 0.930 ± 0.021 in the evaluated closed-world testbed.

For security teams, the result changes the control question. Payload encryption should not be treated as proof that model-design information is concealed. Private-5G and edge-AI deployments may require radio-level red testing, while proposed traffic-shaping defenses must be judged against their spectrum, latency, and communication costs.

Encryption hides the payload, not the allocation process

A federated-learning client repeatedly receives a model, performs local computation, and uploads an update. The mobile network must allocate spectrum, time, and transmission resources throughout this cycle. Those allocation decisions remain observable even when the data being transmitted is encrypted.

In 5G, these assignments are signalled through the Physical Downlink Control Channel. Its Downlink Control Information records indicate when a device may transmit or receive, the direction of the allocation, the transport-block size, and the assigned physical resources. FLINT observes these records passively rather than accessing user-plane packets, model parameters, the base station, or the training software.

This makes architecture inference mechanically plausible. Model families can differ in parameter volume, computation time, upload duration, and round-to-round behavior. The scheduler converts those differences into timing gaps, resource allocations, traffic direction, accumulated transmission volume, and recurring download-compute-upload cycles.

The paper does not show that an observer can reconstruct an exact neural network or recover its parameters. The evaluated target is narrower: distinguishing three broad families—CNN, RNN, and Transformer—inside a known class set.

FLINT must reconstruct a device before classifying its workload

A passive observer does not initially receive a clean, persistent trace for each physical client. Devices are represented by temporary radio identifiers called C-RNTIs, which can change after reconnection. If records associated with successive identifiers are not linked, one client’s training history is fragmented across several apparent identities.

FLINT addresses this with Conflict-Constrained Chain Decomposition. The procedure first rules out impossible assignments: two identifiers active during overlapping intervals cannot represent the same physical device. It then favors forward links with short temporal gaps and penalizes solutions that create an excessive number of separate device chains. Longer-gap candidates are compared using scheduling density and the proportion of uplink activity, with a model-selection criterion deciding whether chains should be merged.

This identity-reconstruction component is evaluated as main enabling evidence, not merely an implementation detail. In a 613-second capture containing 39,669 scheduling records, eight C-RNTIs, and three physical devices, the method estimates the correct device count and assigns every identifier and record correctly after label alignment.

That result establishes feasibility in the testbed. It does not establish equivalent performance under commercial identifier policies, larger populations, mobility, handovers, or multiple cells. The disclosed mapping evaluation contains only three devices.

Accuracy comes from repaired temporal structure

Passive physical-layer collection is incomplete because a sniffer may miss scheduling grants. FLINT therefore reconstructs missing activity from empirically observed neighboring patterns before segmenting each device trace into fixed observation windows.

The classifier then reads the reconstructed trace through three views:

• A wavelet view captures energy at different temporal scales.
• A cadence and regularity view measures round timing, statistical structure, autocorrelation, and spectral concentration.
• A sequence view uses a bidirectional LSTM to model how per-round descriptors evolve.

The three classifiers produce probability vectors that are combined by a logistic-regression stacker. This late-fusion design allows the final model to learn when one representation should be trusted more than another.

The ablations clarify what the main result depends on. A FLARE-style baseline adapted to physical-layer statistics reaches 0.834 ± 0.047 macro F1. Adding missing-grant imputation lifts that baseline to 0.877 ± 0.033. The FLINT architecture without imputation reaches 0.862 ± 0.054, while the complete pipeline reaches 0.930 ± 0.021.

No single representation fully explains the performance. The strongest individual view—cadence and regularity—reaches 0.909 ± 0.030. Combining all three through simple averaging reaches 0.916 ± 0.024; learned stacking raises this to 0.930 ± 0.021. Class-level F1 is 0.895 for CNNs, 0.978 for RNNs, and 0.918 for Transformers.

The relevant signal is therefore not just update volume. Temporal continuity, round regularity, multi-scale behavior, and sequential evolution contribute complementary information. A defense that modifies only message size leaves several other discriminative dimensions intact.

Observation duration also changes the attack cost. Performance rises sharply as the window grows from 60 seconds to roughly 300 seconds and then largely saturates. Under the evaluated conditions, several minutes of observation are enough to capture multiple federated rounds without requiring a prolonged collection period.

Closed-world F1 does not provide open-world reliability

The headline result assumes every evaluated observation belongs to one of the three architecture families seen during training. That is a closed-world classification task. Production radio traffic is not closed: a detector may encounter unseen architectures, new model variants, unrelated applications, or non-federated background activity.

The paper tests this boundary by adding an “Others” outcome. Others is not a separately trained fourth class. FLINT rejects a window only when the highest known-class probability falls below a threshold calibrated to retain approximately 90% of known validation observations.

This exploratory open-world test performs poorly. Unknown recall is 0.111, meaning only 11.1% of unknown observations are rejected. The false acceptance rate is 0.889, while known-family macro F1 remains 0.909.

The classifier can distinguish familiar categories without possessing a dependable signal for unfamiliarity. Softmax confidence remains high on many unseen workloads, so a confident output cannot be interpreted as proof that the observation belongs to a known family.

For governance teams, this changes the acceptance criterion. A system intended for controlled red-team measurement may be useful with closed-world metrics. A system intended to identify arbitrary production workloads needs open-set evaluation, false-acceptance targets, and unknown classes that reflect the deployment environment.

Fingerprinting can guide an active attack, but it is not itself jamming

FLINT’s fingerprinting stage is passive. The paper separately demonstrates how architecture knowledge could support targeted physical-layer interference. This experiment establishes downstream security relevance; it is not part of the passive adversary’s original capability set.

Under synchronous federated learning, targeted interference increases the CNN client’s mean round time from 44 to 243 seconds and the RNN client’s from 26 to 195 seconds. Cumulative training time rises by 152% and 157%, respectively, because the aggregation barrier forces the server to wait for delayed participants. Final accuracy remains close to the benign trajectory, so the principal effect is service degradation rather than immediate model failure.

Under asynchronous aggregation, updates need not arrive together, but delayed or missing contributions become stale. Continuous CNN-targeted interference raises test loss by 6.66 over baseline. A short RNN-targeted burst produces a delayed response that persists after interference stops and finishes 0.16 above baseline.

These demonstrations indicate that architecture information can help an attacker choose where interference may have different consequences. They do not quantify attack effectiveness across commercial radios, schedulers, client mixes, or broader federated protocols.

Size padding spends bandwidth without closing the channel

The paper also tests fixed-size update obfuscation. Updates are compressed when possible and padded to either 5 MB or 10 MB, reducing the direct relationship between architecture and communication volume.

Across the defended samples, 79.8% remain correctly identified. RNN observations retain 100% correct identification under both padding targets. Only 20.2% of samples are either rejected or misclassified, while communication overhead ranges from 14% to 89%.

This is a countermeasure experiment, not a comprehensive defense evaluation. Its value is diagnostic: normalizing one observable feature does not conceal the cadence, downlink-uplink structure, computation gaps, spectral patterns, or resource-allocation dynamics that the full classifier uses.

Cognaptus infers that defense design should be evaluated as a joint traffic-shaping problem. Candidate controls may include cadence normalization, randomized allocation patterns, dummy activity, cross-client batching, or changes to round scheduling. Each would need measurement against latency, spectrum utilization, device energy, training convergence, and residual inference accuracy. The paper does not test those alternatives.

The deployment decision is a measurement decision

For private-5G operators and edge-AI teams, the paper supports a specific change in security review practice:

Several uncertainties remain material. The total number of classification windows is not reported. The model-variant composition is not described in enough detail to assess diversity within each family. Collection and reconstruction depend on missed-grant assumptions. Commercial networks may produce different identifiers, scheduler behavior, interference patterns, and radio conditions.

Within its testbed, however, the central security result is coherent: encryption removes payload visibility while leaving repeated allocation behavior observable. FLINT shows that an engineered adversary can turn that behavior into a strong closed-world architecture fingerprint. It also shows why the resulting F1 score should not be mistaken for dependable recognition of whatever a production network happens to carry.

Cognaptus: Automate the Present, Incubate the Future.