Fingerprinting Deep Learning Models via Network Traffic Patterns in Federated Learning

Md Nahid Hasan Shuvo; Moinul Hossain

REVIEW 3 major objections 4 minor 25 references

Fingerprinting Deep Learning Models via Network Traffic Patterns in Federated Learning

T0 review · 3 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A passive observer can identify a deep learning architecture being trained in a federated learning system just from network packet sizes, directions, and timings.

desk verdict A genuinely new question undermined by perfect confounding: CNN and RNN runs differ in dataset and task, so the classifiers may be detecting data modality, not architecture. read the letter →

arxiv 2506.03207 v1 pith:IENSK4HW submitted 2025-06-02 cs.LG cs.AIcs.CR

Md Nahid Hasan Shuvo , Moinul Hossain This is my paper

classification cs.LGcs.AIcs.CR

keywords federatedlearningnetworktrafficfingerprintingdeeparchitectureCNNRNNpassiveadversarymetadataprivacyleakage

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Federated learning is a training setup where many devices improve a shared model without uploading their raw data, on the theory that the server never sees private inputs. This paper asks whether an outsider who only watches the network can still learn something sensitive: specifically, which deep learning architecture the system is training. Using a small testbed with CNN and RNN models, it derives statistical features from packet sizes, directions, and interarrival times, and shows that standard classifiers separate the two architectures nearly perfectly—Random Forest reached 100 percent accuracy on the test captures, SVM and XGBoost about 95.7 percent. The authors' conclusion is that architecture fingerprinting is feasible with only network-layer metadata, so a passive adversary could identify the model and then tailor attacks to it. That would matter because it undermines the privacy promise of federated learning even when model updates are encrypted.

What carries the argument

The mechanism is a statistical traffic fingerprint built from packet-level metadata. For each captured session, the paper computes packet-length statistics, direction statistics, interarrival-time statistics, and peak counts; Fisher scores, which rank features by how far class means are apart relative to within-class variance, select the most discriminative ones. Those features feed three standard classifiers—Random Forest, SVM, and XGBoost—which learn the CNN-versus-RNN boundary. The load-bearing idea is that architectural differences in compute and communication show up in the size and rhythm of packets exchanged between server and clients, even though the payloads themselves are encrypted.

What would settle it

Capture traffic from an FL testbed where the identical dataset and task are trained with a CNN and an RNN, and separately where each architecture trains on several datasets; if the trained fingerprints no longer separate the architectures or instead separate datasets, the central claim is refuted.

Watch

Extended reading notes

Core claim

The paper's central claim is that deep learning architectures leave distinguishable signatures in the network-layer traffic of federated learning, and that a passive adversary with no access to payloads, flow-level data, or model updates can recover the architecture from packet metadata alone. Concretely, the local training and update exchange of a CNN versus an RNN produce different packet-size distributions, transmission directions, and interarrival-time patterns; statistics computed from these patterns (means, spreads, peak counts, uplink/downlink proportions) are enough for classifiers to tell the two apart. The authors report near-perfect separation on their test data and read this as evidence that FL systems have a previously unexplored indirect privacy vulnerability.

Load-bearing premise

The claim rests on the assumption that traffic differences come from the choice of CNN versus RNN, but since CNNs were trained on image datasets and RNNs on a time-series dataset, the differences could instead come from the dataset or task; the paper never runs the same data through both architectures.

Editorial extensions

If this is right

An FL adversary who can sniff layer-3 traffic can infer the trained architecture without decrypting anything, which is a concrete privacy leak beyond the usual membership or inversion attacks.
The fingerprinting survives at least some background noise, since the paper includes web-browsing traffic during data collection and still gets high accuracy.
Knowing the architecture lets an attacker select model-specific exploits, such as adversarial perturbations tuned to CNNs or RNNs, making the FL system more exposed.
Because the distinguishing signal lives in packet metadata, defenses would have to change traffic shape (padding, rate smoothing, aggregation obfuscation) rather than rely on encryption alone.
Extending the same pipeline to modern architectures (transformers, GANs, RL policies) is a stated next step, with the same passive threat model.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A control experiment that trains both architectures on the same dataset would clarify whether the fingerprint is architectural or driven by data modality, since the current design couples the two.
If workload size is the true signal, the same features might estimate model size, batch size, or local epoch count, giving an adversary finer-grained information than architecture alone.
A defense experiment follows directly: padding packets and regularizing transmission timing should flatten interarrival-time features and lower fingerprinting accuracy, which can be tested on the same testbed.
The mechanism is not FL-specific; any periodic client-server update protocol would expose the same metadata, so the threat may extend to other distributed training schemes.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

You should know two things about this paper. It asks a genuinely new question — can a passive observer infer the DL architecture from FL network traffic — and it attempts a controlled testbed with standard classifiers. But the experiment confounds architecture with dataset and task: every CNN run uses images (CIFAR-10/Fashion-MNIST), every RNN run uses a time series (Sunspot). So the classifiers might be detecting data modality or model size, not architectural family.

What is good: the setup is simple and reproducible, they use standard classifiers with grid-search tuning and report per-class metrics, and the limitations section in Section 5.1 is candid. They also try adding browsing noise. The feature analysis with Fisher scores and KL divergence is a reasonable sanity check, and the paper is clearly written.

The soft spots are serious. The confounding is load-bearing. The test set is 23 captures, so one misclassification moves accuracy from 100% to 95.65%. Model sizes are not reported, so the packet-size differences in Figure 4 could be driven entirely by update size. The abstract and conclusion assert that 'we can identify specific architectures,' but the evidence doesn't support that. The authors acknowledge some limitations, but they don't name the confound itself — they say they used distinct datasets 'to ensure variational workloads,' which is exactly the problem.

Who this is for: researchers working on FL privacy or traffic fingerprinting. They might get ideas for a follow-up study, but the paper as is does not establish the phenomenon. It could become a reasonable workshop paper after adding a control condition where CNN and RNN are trained on the same data type, plus a same-architecture-different-size condition to separate model-size effects.

Recommendation: this deserves a serious referee because the question is important and the first-pass result is a clean failure mode worth correcting. I would not desk-reject it, but I'd expect the review to ask for a redo of the experiment. The authors are honest and the idea is worth taking seriously; the execution just doesn't yet support the claim.

Referee Report

3 major / 4 minor

Summary. The paper proposes a passive network-traffic fingerprinting attack against federated learning systems, aiming to identify whether a CNN or RNN is being trained by analyzing packet sizes, directions, and interarrival times. The authors build a localhost FL testbed, collect traffic from CNN training on image datasets and RNN training on a time-series dataset, extract statistical features, and train Random Forest, SVM, and XGBoost classifiers. They report 100% accuracy for Random Forest and 95.65% for SVM and XGBoost on a held-out set of 23 packet captures, concluding that DL architectures can be fingerprinted from encrypted FL traffic.

Significance. If the finding is robust, it would identify a new privacy risk in FL and motivate network-level defenses. The topic is timely, and the paper is clearly written with a reproducible-looking pipeline. However, the significance is currently conditional: the experiment perfectly confounds architecture family with dataset/task/modality, and the test set is too small to support the claimed precision. The evidence does not yet isolate architecture as the cause of the observable traffic differences.

major comments (3)

[Section 3.4] The central claim that an adversary can identify the DL architecture is not supported because architecture and data modality are perfectly confounded. CNN models are trained on CIFAR-10 and Fashion-MNIST images, while RNN models are trained on the Sunspot time-series dataset, so the two classes differ simultaneously in model family, data modality, dataset, task, and likely model size. A classifier can achieve high accuracy by detecting image training versus time-series training, or by detecting large versus small update payloads, without learning anything architecture-specific. The reported features support this concern: Figure 4 shows that mean_frame (packet size) separates the classes, and in FL, packet size is dominated by model update size, which is not reported or controlled. Please add control conditions that train both architectures on the same data modality and the same architecture on different data modalities, and report model parameter counts and update sizes for every run.
[Section 4.2, Table 1] The test set consists of only 23 packet captures (12 CNN, 11 RNN), and the difference between 100% and 95.65% accuracy is exactly one misclassified instance. No confidence intervals, repeated train/test splits, or per-class confusion counts are reported, so the headline accuracy figures are statistically fragile. The paper should report exact confusion matrices, bootstrap or exact binomial confidence intervals, and, ideally, a larger number of independent captures to demonstrate that the result is not driven by a single instance.
[Sections 3.3 and 5.1] The testbed uses localhost loopback traffic on a single machine with client instances simulated on unique ports. This controlled setting is acknowledged in Section 5.1, but the abstract and introduction claim a general network-layer vulnerability. Since the discriminating features include interarrival times, it is important to show that the observed separation persists under realistic network conditions such as packet loss, jitter, or non-loopback transport. At minimum, the paper should quantify how much of the discriminative signal is carried by timing features versus packet size and direction, and should temper the abstract's claim to match the controlled environment.

minor comments (4)

[Section 3.5.3] The heading 'Feature Section' appears to be a typo for 'Feature Selection', and the sentence 'From here, I took the highest-ranked features' uses first person; please change to 'we selected'.
[Table 1] The Random Forest row reads '100%RNN' without a space; please fix the formatting for readability.
[Figure 4] The caption says 'KL divergence plots', but the panels show density plots and no KL divergence values are reported in the text or figure. Please either report the calculated KL values or revise the caption.
[Section 3.4] The sentence 'For each DL architecture, we use distinct datasets and tasks to ensure variational workloads' is precisely the source of the confounding described above. Please at least justify this design choice and explicitly discuss how it limits the interpretation of the results.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the fingerprinting results are empirical, evaluated on held-out traffic captures, and do not reduce to their inputs by construction.

full rationale

This paper is an empirical study, not a derivation. The claimed result — that machine-learning classifiers can distinguish CNN-generated FL traffic from RNN-generated FL traffic — is obtained by training SVM, Random Forest, and Gradient Boosting classifiers on statistical features extracted from pcap files and evaluating them on an independent test set (Section 4.1, Table 1). No fitted parameter is renamed as a prediction: hyperparameters are tuned by grid-search cross-validation on the training set, and test accuracy is a genuine out-of-sample score. There is no load-bearing self-citation chain, no uniqueness theorem imported from the authors' prior work, and no ansatz smuggled in by citation. The nearest concern is that Section 3.4 uses distinct datasets and tasks for each architecture ('For each DL architecture, we use distinct datasets and tasks to ensure variational workloads'), so CNN runs use CIFAR-10/Fashion-MNIST while RNN runs use Sunspot time series; this confounds architecture with data modality and is a real external-validity threat. However, confounding is not circularity: the classifier could still be learning something predictive of the traffic, and the evaluation does not build the target into the training procedure. The paper's own limitations section acknowledges the small model diversity and potential overfitting, which further supports treating this as an empirical robustness concern rather than a circular argument. Accordingly, no circular step is identified.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The paper introduces no new entities. Its claims rest on the domain assumption that traffic patterns reveal architecture, the representativeness of the localhost testbed, and the untested separation of architecture from dataset. Two sets of tuned values (selected features, classifier hyperparameters) are not reported.

free parameters (2)

Number of Fisher-selected features = not reported
The paper states that the highest-ranked features were selected (Section 3.5.3) but does not give the number or threshold, which affects classifier performance.
Classifier hyperparameters for RF, SVM, XGBoost = not reported
Grid-search cross-validation was used (Section 4.1) but the chosen hyperparameters are not listed, so the exact models are not reproducible.

assumptions (3)

domain assumption CNN and RNN architectures produce distinguishable network-layer traffic patterns in federated learning
This is the central hypothesis, introduced in Section 3.3 and tested by the experiment, but not independently established.
domain assumption Loopback traffic on a single machine is representative of real federated learning network traffic
The testbed runs all clients and the server on localhost with unique ports (Section 3.3); the authors acknowledge this limitation in Section 5.1.
ad hoc to paper Observed traffic differences between CNN and RNN runs are due to architecture rather than dataset or task
Section 3.4 assigns CNN to image datasets and RNN to a time-series dataset, so this untested assumption is required for the central claim.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Fingerprinting Deep Learning Models via Network Traffic Patterns in Federated Learning." pith.science (2026). https://pith.science/paper/IENSK4HW

@misc{pith2026250603207,
  author       = {Pith},
  title        = {Pith review of: Fingerprinting Deep Learning Models via Network Traffic Patterns in Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/IENSK4HW}},
  note         = {Machine review of arXiv:2506.03207}
}

read the original abstract

Federated Learning (FL) is increasingly adopted as a decentralized machine learning paradigm due to its capability to preserve data privacy by training models without centralizing user data. However, FL is susceptible to indirect privacy breaches via network traffic analysis-an area not explored in existing research. The primary objective of this research is to study the feasibility of fingerprinting deep learning models deployed within FL environments by analyzing their network-layer traffic information. In this paper, we conduct an experimental evaluation using various deep learning architectures (i.e., CNN, RNN) within a federated learning testbed. We utilize machine learning algorithms, including Support Vector Machines (SVM), Random Forest, and Gradient-Boosting, to fingerprint unique patterns within the traffic data. Our experiments show high fingerprinting accuracy, achieving 100% accuracy using Random Forest and around 95.7% accuracy using SVM and Gradient Boosting classifiers. This analysis suggests that we can identify specific architectures running within the subsection of the network traffic. Hence, if an adversary knows about the underlying DL architecture, they can exploit that information and conduct targeted attacks. These findings suggest a notable security vulnerability in FL systems and the necessity of strengthening it at the network level.

Figures

Figures reproduced from arXiv: 2506.03207 by the authors.

**Figure 2.** Testbed design for the fingerprint attack. [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 4.** KL divergence plots of selected network traffic fea [PITH_FULL_IMAGE:figures/full_fig_p004_4.png] view at source ↗

Figures from the paper (1 more)

**Figure 5.** Figure 5: Fisher score analysis from the data features. [PITH_FULL_IMAGE:figures/full_fig_p004_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

25 extracted references · 18 canonical work pages

[1]

Abbas Acar, Hossein Fereidooni, Tigist Abera, Amit Kumar Sikder, Markus Mietti- nen, Hidayet Aksu, Mauro Conti, Ahmad-Reza Sadeghi, and Selcuk Uluagac. 2020. Peek-a-boo: I see your smart home activities, even encrypted!. In Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks . 207–218

work page 2020
[2]

Leo Breiman. 2001. Random forests. Machine learning 45 (2001), 5–32

2001
[3]

Tianqi Chen and Carlos Guestrin. 2016. Xgboost: A scalable tree boosting system. In Proceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining . 785–794

2016
[4]

Corinna Cortes and Vladimir Vapnik. 1995. Support-vector networks. Machine learning 20 (1995), 273–297

work page 1995
[5]

Zhimin He, Jie Yin, Yu Wang, Guan Gui, Bamidele Adebisi, Tomoaki Ohtsuki, Haris Gacanin, and Hikmet Sari. 2021. Edge device identification based on federated learning and network traffic feature engineering. IEEE Transactions on Cognitive Communications and Networking 8, 4 (2021), 1898–1909

work page 2021
[6]

Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Ben- nis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. 2021. Advances and open problems in federated learning. Foundations and trends® in machine learning 14, 1–2 (2021), 1–210

2021
[7]

Vishal Kaushal and Sangeeta Sharma. 2025. Securing the collective intelligence: a comprehensive review of federated learning security attacks and defensive strategies. Knowledge and Information Systems (2025), 1–39

work page 2025
[8]

Pierre Laperdrix, Walter Rudametkin, and Benoit Baudry. 2016. Beauty and the beast: Diverting modern web browsers to build unique browser fingerprints. In 2016 IEEE Symposium on Security and Privacy (SP) . IEEE, 878–894

work page 2016

Show all 25 references

[9]

Jianfeng Li, Zheng Lin, Jian Qu, Shuohan Wu, Hao Zhou, Yangyang Liu, Xiaobo Ma, Ting Wang, Xiapu Luo, and Xiaohong Guan. 2024. Robust App Fingerprinting Over the Air. IEEE/ACM Transactions on Networking (2024)

2024
[10]

Xiaobo Ma, Jian Qu, Jianfeng Li, John CS Lui, Zhenhua Li, and Xiaohong Guan
[11]

Xiaobo Ma, Jian Qu, Jianfeng Li, John CS Lui, Zhenhua Li, Wenmao Liu, and Xiaohong Guan. 2021. Inferring hidden IoT devices and user interactions via spatial-temporal traffic fingerprinting. IEEE/ACM Transactions on Networking 30, 1 (2021), 394–408

2021
[12]

Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017. Communication-efficient learning of deep net- works from decentralized data. In Artificial intelligence and statistics . PMLR, 1273–1282

2017
[13]

Luca Melis, Congzheng Song, Emiliano De Cristofaro, and Vitaly Shmatikov
[14]

Andriy Panchenko, Fabian Lanze, Jan Pennekamp, Thomas Engel, Andreas Zin- nen, Martin Henze, and Klaus Wehrle. 2016. Website Fingerprinting at Internet Scale.. In NDSS, Vol. 1. 23477

2016
[15]

Mohammad Saidur Rahman, Payap Sirinam, Nate Mathews, Kantha Girish Gan- gadhara, and Matthew Wright. 2019. Tik-tok: The utility of packet timing in website fingerprinting attacks. arXiv preprint arXiv:1902.06421 (2019)

2019 arXiv
[16]

Chuan Sheng, Wei Zhou, Qing-Long Han, Wanlun Ma, Xiaogang Zhu, Sheng Wen, and Yang Xiang. 2025. Network Traffic Fingerprinting for IIoT Device Identification: A Survey. IEEE Transactions on Industrial Informatics (2025)

2025
[17]

Mengkai Song, Zhibo Wang, Zhifei Zhang, Yang Song, Qian Wang, Ju Ren, and Hairong Qi. 2020. Analyzing user-level privacy attack against federated learning. IEEE Journal on Selected Areas in Communications 38, 10 (2020), 2430–2444

2020
[18]

Vincent F Taylor, Riccardo Spolaor, Mauro Conti, and Ivan Martinovic. 2017. Robust smartphone app identification via encrypted network traffic analysis. IEEE Transactions on Information Forensics and Security 13, 1 (2017), 63–78

2017
[19]

Tao Wang. 2020. High precision open-world website fingerprinting. In 2020 IEEE Symposium on Security and Privacy (SP) . IEEE, 152–167

2020
[20]

Gunwoo Yoon and Byeongdo Hong. 2024. Scalable and Robust Mobile Activity Fingerprinting via Over-the-Air Control Channel in 5G Networks. arXiv preprint arXiv:2409.12572 (2024)

2024 arXiv
[21]

Yifei Zhang, Dun Zeng, Jinglong Luo, Xinyu Fu, Guanzhong Chen, Zenglin Xu, and Irwin King. 2024. A survey of trustworthy federated learning: Issues, solutions, and challenges. ACM Transactions on Intelligent Systems and Technology 15, 6 (2024), 1–47. Fingerprinting Deep Learni...

2024
[22]

Yiwen Zhang and Weilin Zeng. 2024. Local adversarial attack of time series forecasting based on mutual information. In Third International Conference on Machine Vision, Automatic Identification, and Detection (MV AID 2024), Vol. 13230. SPIE, 467–473

2024
[23]

Man Zhou, Wenyu Zhou, Jie Huang, Junhui Yang, Minxin Du, and Qi Li. 2024. Stealthy and effective physical adversarial attacks in autonomous driving. IEEE Transactions on Information Forensics and Security (2024)

2024
[2019]

In 2019 IEEE symposium on security and privacy (SP)

Exploiting unintended feature leakage in collaborative learning. In 2019 IEEE symposium on security and privacy (SP) . IEEE, 691–706

2019
[2020]

In IEEE INFOCOM 2020-IEEE conference on computer communications

Pinpointing hidden IoT devices via spatial-temporal traffic fingerprinting. In IEEE INFOCOM 2020-IEEE conference on computer communications . IEEE, 894– 903

2020

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

Abbas Acar, Hossein Fereidooni, Tigist Abera, Amit Kumar Sikder, Markus Mietti- nen, Hidayet Aksu, Mauro Conti, Ahmad-Reza Sadeghi, and Selcuk Uluagac. 2020. Peek-a-boo: I see your smart home activities, even encrypted!. In Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks . 207–218

work page 2020

[2] [2]

Leo Breiman. 2001. Random forests. Machine learning 45 (2001), 5–32

2001

[3] [3]

Tianqi Chen and Carlos Guestrin. 2016. Xgboost: A scalable tree boosting system. In Proceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining . 785–794

2016

[4] [4]

Corinna Cortes and Vladimir Vapnik. 1995. Support-vector networks. Machine learning 20 (1995), 273–297

work page 1995

[5] [5]

Zhimin He, Jie Yin, Yu Wang, Guan Gui, Bamidele Adebisi, Tomoaki Ohtsuki, Haris Gacanin, and Hikmet Sari. 2021. Edge device identification based on federated learning and network traffic feature engineering. IEEE Transactions on Cognitive Communications and Networking 8, 4 (2021), 1898–1909

work page 2021

[6] [6]

Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Ben- nis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. 2021. Advances and open problems in federated learning. Foundations and trends® in machine learning 14, 1–2 (2021), 1–210

2021

[7] [7]

Vishal Kaushal and Sangeeta Sharma. 2025. Securing the collective intelligence: a comprehensive review of federated learning security attacks and defensive strategies. Knowledge and Information Systems (2025), 1–39

work page 2025

[8] [8]

Pierre Laperdrix, Walter Rudametkin, and Benoit Baudry. 2016. Beauty and the beast: Diverting modern web browsers to build unique browser fingerprints. In 2016 IEEE Symposium on Security and Privacy (SP) . IEEE, 878–894

work page 2016