Adversarial Latency Watermarking: Covertly Encoding Zero Bit Keys in Federated Learning Model Updates
Federated learning (FL) protects client data by sharing only model updates, yet current defences ignore timing metadata. We show that a single malicious client can embed a 128 bit cryptographic key into the final global model by modulating update latency alone, bypassing gradient-value inspections, differential privacy (DP), and secure aggregation (SecAgg). We model the latency-to-weight channel as an additive white Gaussian noise (AWGN) process with CPU jitter and derive its information-theoretic capacity, demonstrating that 134 rounds suffice to transmit 128 bits at ε=500 μs. We design Jitter Deconv, a spread-spectrum encoder/decoder that maps Gold-code delays to weight-space imprints and recovers keys with bit-error rate (BER) 1.02×10⁻³ under DP-SGD (σ=10⁻²) and SecAgg. To detect the covert channel, we introduce Latency Print, a lightweight autocovariance-based statistic achieving AUC=0.98 and ≤0.7 % false-positive rate with <0.1 % CPU overhead. Experiments on CIFAR-10, FEMNIST, and Stack Overflow under realistic FL hyperparameters and hardware time-stamping (PTP, ±1 μs) confirm that our attack incurs ≤0.18 % accuracy degradation and survives network congestion. We further compare Latency Print to an SVM-based arrival-pattern classifier, demonstrating superior detection speed and reliability. Our findings expose time as a first class security primitive in FL systems and recommend integrating timing randomization, lightweight monitoring, and scheduler level defenses into frameworks such as Tensor Flow Federated.