发表机构
George Mason University（乔治·马歇尔大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
研究5G物理层边信道泄漏，提出FLINT黑盒指纹框架，通过解码物理下行控制信道调度信息等方法，仅用粗略物理层观察推断联邦学习模型架构家族，实验表明其在架构家族分类上宏F1分数达0.930。
AI 中文摘要
5G蜂窝网络上的联邦学习保护原始数据，但仍易受边信道泄漏影响。先前的指纹攻击假设数据包级网络可见性，这在5G物理层不成立，那里用户载荷加密且无线网络临时标识符可能随时间变化。然而，物理下行控制信道上广播的物理层调度元数据保留了与架构相关的时间模式。我们引入FLINT，一个新颖的黑盒指纹框架，仅使用粗略的物理层观察来推断联邦学习模型架构家族，包括卷积神经网络、循环神经网络和变换器。FLINT通过解码物理下行控制信道调度信息、将变化的无线网络临时标识符映射到物理用户设备以及应用多视图时间建模来区分特定于架构的训练行为，克服了网络层可见性的不足。这种泄漏在安全方面至关重要，因为了解客户端模型架构可将被动侦察转变为有针对性的下游利用。在基于空中srsRAN的5G测试平台上进行的大量实验表明FLINT在架构家族分类方面实现了0.930的宏F1分数。据我们所知，FLINT是第一项使用任何协议感知对手可获取的5G下层边信道信息对人工智能/机器学习模型架构进行指纹识别的工作。
英文摘要
Federated Learning (FL) over 5G cellular networks protects raw data but remains vulnerable to side-channel leakage. Prior fingerprinting attacks assume packet-level network visibility, an assumption that does not hold at the 5G Physical (PHY) layer, where user payloads are encrypted and Radio Network Temporary Identifiers (RNTIs) may change over time. However, we demonstrate that PHY-layer scheduling metadata broadcast over the Physical Downlink Control Channel (PDCCH) preserves architecture-associated temporal patterns. We introduce FLINT, a novel black-box fingerprinting framework that infers FL model architecture families, including CNNs, RNNs, and Transformers, using only coarse PHY-layer observations. FLINT overcomes the lack of network-layer visibility by decoding PDCCH scheduling information, mapping changing RNTIs to physical user devices, and applying multi-view temporal modeling to distinguish architecture-specific training behavior. This leakage is security-critical because knowledge of a client's model architecture can transform passive reconnaissance into targeted downstream exploitation. Extensive experiments on an over-the-air srsRAN-based 5G testbed demonstrate that FLINT achieves a macro F1-score of 0.930 for architecture-family classification. To our knowledge, FLINT is the first work to fingerprint AI/ML model architectures using lower-layer 5G side-channel information obtainable by any protocol-aware adversary.
Comments14 page, 8 figures
