ML Security PapersFLARE: A Wireless Side-Channel Fingerprinting Attack on Federated Learning
Md Nahid Hasan Shuvo 1, Moinul Hossain 1, Anik Mallik 2, Jeffrey Twigg 3, Fikadu Dagefu 3
Published on arXiv
2512.10296
Model Theft
OWASP ML Top 10 — ML05
Key Finding
FLARE achieves over 98% F1-score in closed-world and up to 91% in open-world model architecture fingerprinting from encrypted wireless FL traffic, exposing a novel side-channel vulnerability in FL systems.
FLARE
Novel technique introduced
Federated Learning (FL) enables collaborative model training across distributed devices while safeguarding data and user privacy. However, FL remains susceptible to privacy threats that can compromise data via direct means. That said, indirectly compromising the confidentiality of the FL model architecture (e.g., a convolutional neural network (CNN) or a recurrent neural network (RNN)) on a client device by an outsider remains unexplored. If leaked, this information can enable next-level attacks tailored to the architecture. This paper proposes a novel side-channel fingerprinting attack, leveraging flow-level and packet-level statistics of encrypted wireless traffic from an FL client to infer its deep learning model architecture. We name it FLARE, a fingerprinting framework based on FL Architecture REconnaissance. Evaluation across various CNN and RNN variants-including pre-trained and custom models trained over IEEE 802.11 Wi-Fi-shows that FLARE achieves over 98% F1-score in closed-world and up to 91% in open-world scenarios. These results reveal that CNN and RNN models leak distinguishable traffic patterns, enabling architecture fingerprinting even under realistic FL settings with hardware, software, and data heterogeneity. To our knowledge, this is the first work to fingerprint FL model architectures by sniffing encrypted wireless traffic, exposing a critical side-channel vulnerability in current FL systems.
Key Contributions
- First work to fingerprint FL client model architectures by passively sniffing encrypted IEEE 802.11 Wi-Fi traffic
- FLARE framework that extracts flow-level and packet-level traffic statistics to distinguish CNN and RNN architecture variants
- Evaluation across realistic FL heterogeneity (hardware, software, data) achieving 98%+ F1-score closed-world and 91% open-world
🛡️ Threat Analysis
FLARE is a side-channel attack that extracts model architecture information (CNN vs. RNN variants) — a core component of model IP — by sniffing encrypted wireless traffic from FL clients. ML05 explicitly includes side-channel attacks to extract model architecture, weights, and hyperparameters, making this a direct fit for model theft via side-channel.