FedLeaks: Creating Timing Channel Leaks in Federated Learning of Adaptive Neural Networks

Previous work [6, 28, 38] has demonstrated the vulnerability of adaptive neural networks (AdNNs) to privacy attacks via timing channels. While these privacy attacks may leak sensitive information about user-provided input, not all AdNNs are vulnerable, and an attacker's success is directly related to degree of vulnerability in the target AdNN. Previous work has assumed an adversary entirely removed from the AdNN's training process; however, in many real-world settings, an adversary may possess both the capability and incentive to influence the AdNN training in order to deliberately create privacy-compromising timing channels within it.In this work, we investigate scenarios where an adversary can intentionally craft timing channels in AdNNs in order to later launch privacy attacks. Our study focuses on the federated learning of AdNNs, where multiple parties collaboratively train a shared model without directly exchanging their private datasets. We propose FedLeaks, a method for crafting timing channels in AdNNs, and evaluate FedLeaks on three datasets and three AdNN architectures. Our experiments show that FedLeaks can effectively introduce strong timing channels in AdNNs compared to benign training strategies without any adversarial influence.We further demonstrate that existing mitigation strategies, while effective against the benignly-introduced timing channels previously studied, fail to adequately defend against timing channels crafted using FedLeaks. In these cases, mitigation leads to significant accuracy and/or efficiency degradation, making the model impractical without extensive retraining or redevelopment. Overall, Our findings demonstrate that an informed adversary can maliciously introduce exploitable timing channels into AdNNs, undermining model trustworthiness and exposing users to privacy risks.