Adversarial Latency Watermarking: Covertly Encoding Zero Bit Keys in Federated Learning Model Updates
TL;DR
These findings expose time as a first class security primitive in FL systems and recommend integrating timing randomization, lightweight monitoring, and scheduler level defenses into frameworks such as Tensor Flow Federated.
Abstract
Federated learning (FL) protects client data by sharing only model updates, yet current defences ignore timing metadata. We show that a single malicious client can embed a 128 bit cryptographic key into the final global model by modulating update latency alone, bypassing gradient-value inspections, differential privacy (DP), and secure aggregation (SecAgg). We model the latency-to-weight channel as an additive white Gaussian noise (AWGN) process with CPU jitter and derive its information-theoretic capacity, demonstrating that 134 rounds suffice to transmit 128 bits at ε=500 μs. We design Jitter Deconv, a spread-spectrum encoder/decoder that maps Gold-code delays to weight-space imprints and recovers keys with bit-error rate (BER) 1.02×10⁻³ under DP-SGD (σ=10⁻²) and SecAgg. To detect the covert channel, we introduce Latency Print, a lightweight autocovariance-based statistic achieving AUC=0.98 and ≤0.7 % false-positive rate with <0.1 % CPU overhead. Experiments on CIFAR-10, FEMNIST, and Stack Overflow under realistic FL hyperparameters and hardware time-stamping (PTP, ±1 μs) confirm that our attack incurs ≤0.18 % accuracy degradation and survives network congestion. We further compare Latency Print to an SVM-based arrival-pattern classifier, demonstrating superior detection speed and reliability. Our findings expose time as a first class security primitive in FL systems and recommend integrating timing randomization, lightweight monitoring, and scheduler level defenses into frameworks such as Tensor Flow Federated.