Safeguarding Federated Learning-based Road Condition Classification

• URL: http://arxiv.org/abs/2507.12568v1
• Date: Wed, 16 Jul 2025 18:33:29 GMT
• Title: Safeguarding Federated Learning-based Road Condition Classification
• Abstract summary: Federated Learning (FL) has emerged as a promising solution for privacy-preserving autonomous driving.<n>However, the collaborative nature of FL-RCC frameworks introduces new vulnerabilities: Targeted Label Flipping Attacks (TLFAs)<n>TLFAs can cause a vehicle to mis-classify slippery, dangerous road conditions as pristine and exceed recommended speed.<n>We address this challenge with a threefold contribution: 1) we disclose the vulnerability of existing FL-RCC systems to TLFAs; 2) we introduce a novel label-distance-based metric to precisely quantify the safety risks posed by TLFAs; and 3) we propose FLARE
• Score: 9.25788964991865
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Federated Learning (FL) has emerged as a promising solution for privacy-preserving autonomous driving, specifically camera-based Road Condition Classification (RCC) systems, harnessing distributed sensing, computing, and communication resources on board vehicles without sharing sensitive image data. However, the collaborative nature of FL-RCC frameworks introduces new vulnerabilities: Targeted Label Flipping Attacks (TLFAs), in which malicious clients (vehicles) deliberately alter their training data labels to compromise the learned model inference performance. Such attacks can, e.g., cause a vehicle to mis-classify slippery, dangerous road conditions as pristine and exceed recommended speed. However, TLFAs for FL-based RCC systems are largely missing. We address this challenge with a threefold contribution: 1) we disclose the vulnerability of existing FL-RCC systems to TLFAs; 2) we introduce a novel label-distance-based metric to precisely quantify the safety risks posed by TLFAs; and 3) we propose FLARE, a defensive mechanism leveraging neuron-wise analysis of the output layer to mitigate TLFA effects. Extensive experiments across three RCC tasks, four evaluation metrics, six baselines, and three deep learning models demonstrate both the severity of TLFAs on FL-RCC systems and the effectiveness of FLARE in mitigating the attack impact.

Related papers

• Securing Autonomous Vehicle Systems via Twin-Aware Federated Reinforcement Learning [18.401916683479676]
  poisoning attacks pose a significant threat to the security and reliability of Federated reinforcement learning (FRL) systems.<n>alg is a framework aimed at enhancing the robustness of FRL systems designed for safety-critical driving scenarios.<n>alg strategically integrates digital twins for rehearsal-based learning and leverages historical aggregated model parameters.
  arXiv  Detail & Related papers  (2026-07-09T06:18:52Z)
• FedTrident: Resilient Road Condition Classification Against Poisoning Attacks in Federated Learning [16.871281029100313]
  FL has emerged as a transformative paradigm for ITS, notably camera-based Road Condition Classification (RCC)<n>RCC exposes the system to adversarial participants launching Targeted Label-Flipping Attacks (TLFAs)<n>We propose FedTrident, which can effectively thwart TLFAs, achieving performance comparable to that in attack-free scenarios.
  arXiv  Detail & Related papers  (2026-03-19T16:26:13Z)
• Blockchain-Enabled Routing for Zero-Trust Low-Altitude Intelligent Networks [77.17664010626726]
  We focus on the routing with multiple UAV clusters in low-altitude intelligent networks (LAINs)<n>To minimize the damage caused by potential threats, we present the zero-trust architecture with the software-defined perimeter and blockchain techniques.<n>We show that the proposed framework reduces the average E2E delay by 59% and improves the TSR by 29% on average compared to benchmarks.
  arXiv  Detail & Related papers  (2026-02-27T04:30:35Z)
• Towards Sample-Efficient and Stable Reinforcement Learning for LLM-based Recommendation [56.92367609590823]
  Long Chain-of-Thought (Long CoT) reasoning has shown promise in Large Language Models (LLMs)<n>We argue that Long CoT is inherently ill-suited for the sequential recommendation domain.<n>We propose RISER, a novel Reinforced Item Space Exploration framework for Recommendation.
  arXiv  Detail & Related papers  (2026-01-31T10:02:43Z)
• From Risk to Resilience: Towards Assessing and Mitigating the Risk of Data Reconstruction Attacks in Federated Learning [21.517278571228076]
  Data Reconstruction Attacks (DRA) pose a significant threat to Federated Learning (FL) systems by enabling adversaries to infer sensitive training data from local clients.<n>Despite extensive research, the question of how to characterize and assess the risk of DRAs in FL systems remains unresolved.<n>We introduce Invertibility Loss (InvLoss) to quantify the maximum achievable effectiveness of DRAs for a given data instance and FL model.
  arXiv  Detail & Related papers  (2025-12-17T14:01:29Z)
• DEFEND: Poisoned Model Detection and Malicious Client Exclusion Mechanism for Secure Federated Learning-based Road Condition Classification [16.871281029100313]
  Federated Learning (FL) has drawn the attention of the Intelligent Transportation Systems (ITS) community.<n>FL can train various models for ITS tasks, notably camera-based Road Condition Classification (RCC)<n>We propose DEFEND, which includes a poisoned model detection strategy.
  arXiv  Detail & Related papers  (2025-12-05T21:50:27Z)
• Empirical Performance Evaluation of Lane Keeping Assist on Modern Production Vehicles [23.265034571289664]
  This paper presents the first comprehensive empirical analysis of real-world Lane Keeping Assist (LKA) performance.<n>Our study yields three key findings: (i) LKA failures can be systematically categorized into perception, planning, and control errors.<n>Building on these insights, we propose a theoretical model that integrates road geometry, speed limits, and LKA steering capability to inform infrastructure design.
  arXiv  Detail & Related papers  (2025-05-14T03:04:22Z)
• Sparsification Under Siege: Defending Against Poisoning Attacks in Communication-Efficient Federated Learning [10.036313132071545]
  Federated Learning (FL) enables collaborative model training across distributed clients while preserving data privacy.<n>It faces significant challenges in communication efficiency and vulnerability to poisoning attacks.<n>We propose FLARE, a novel federated learning framework that integrates sparse index mask inspection and model update sign similarity analysis.
  arXiv  Detail & Related papers  (2025-04-30T14:59:13Z)
• Not All Edges are Equally Robust: Evaluating the Robustness of Ranking-Based Federated Learning [49.68790647579509]
  Federated Ranking Learning (FRL) is a state-of-the-art FL framework that stands out for its communication efficiency and resilience to poisoning attacks.<n>We introduce a novel local model poisoning attack against FRL, namely the Vulnerable Edge Manipulation (VEM) attack.<n>Our attack achieves an overall 53.23% attack impact and is 3.7x more impactful than existing methods.
  arXiv  Detail & Related papers  (2025-03-12T00:38:14Z)
• Refuse Whenever You Feel Unsafe: Improving Safety in LLMs via Decoupled Refusal Training [67.30423823744506]
  We introduce a novel approach, Decoupled Refusal Training (DeRTa), designed to empower LLMs to refuse compliance to harmful prompts at any response position.<n>DeRTa incorporates two novel components: (1) Maximum Likelihood Estimation with Harmful Response Prefix, which trains models to recognize and avoid unsafe content by appending a segment of harmful response to the beginning of a safe response, and (2) Reinforced Transition Optimization (RTO), which equips models with the ability to transition from potential harm to safety refusal consistently throughout the harmful response sequence.
  arXiv  Detail & Related papers  (2024-07-12T09:36:33Z)
• Towards Robust Federated Learning via Logits Calibration on Non-IID Data [49.286558007937856]
  Federated learning (FL) is a privacy-preserving distributed management framework based on collaborative model training of distributed devices in edge networks. Recent studies have shown that FL is vulnerable to adversarial examples, leading to a significant drop in its performance. In this work, we adopt the adversarial training (AT) framework to improve the robustness of FL models against adversarial example (AE) attacks.
  arXiv  Detail & Related papers  (2024-03-05T09:18:29Z)
• FreqFed: A Frequency Analysis-Based Approach for Mitigating Poisoning Attacks in Federated Learning [98.43475653490219]
  Federated learning (FL) is susceptible to poisoning attacks. FreqFed is a novel aggregation mechanism that transforms the model updates into the frequency domain. We demonstrate that FreqFed can mitigate poisoning attacks effectively with a negligible impact on the utility of the aggregated model.
  arXiv  Detail & Related papers  (2023-12-07T16:56:24Z)
• Towards Understanding Adversarial Transferability in Federated Learning [14.417827137513369]
  A group of malicious clients has impacted the model during training by disguising their identities and acting as benign clients but later switching to an adversarial role. This type of attack is subtle and hard to detect because these clients initially appear to be benign. We empirically show that the proposed attack imposes a high security risk to current FL systems.
  arXiv  Detail & Related papers  (2023-10-01T08:35:46Z)
• Enabling Quartile-based Estimated-Mean Gradient Aggregation As Baseline for Federated Image Classifications [5.5099914877576985]
  Federated Learning (FL) has revolutionized how we train deep neural networks by enabling decentralized collaboration while safeguarding sensitive data and improving model performance. This paper introduces an innovative solution named Estimated Mean Aggregation (EMA) that not only addresses these challenges but also provides a fundamental reference point as a $mathsfbaseline$ for advanced aggregation techniques in FL systems.
  arXiv  Detail & Related papers  (2023-09-21T17:17:28Z)
• Learned Risk Metric Maps for Kinodynamic Systems [54.49871675894546]
  We present Learned Risk Metric Maps for real-time estimation of coherent risk metrics of high dimensional dynamical systems. LRMM models are simple to design and train, requiring only procedural generation of obstacle sets, state and control sampling, and supervised training of a function approximator.
  arXiv  Detail & Related papers  (2023-02-28T17:51:43Z)
• FRL-FI: Transient Fault Analysis for Federated Reinforcement Learning-Based Navigation Systems [4.9002824669038265]
  Swarm intelligence is being increasingly deployed in autonomous systems, such as drones and unmanned vehicles. transient faults are increasing in the hardware system with continuous technology node scaling. We propose two cost-effective fault detection and recovery techniques that can achieve up to 3.3x improvement in resilience with 2.7% overhead in FRL systems.
  arXiv  Detail & Related papers  (2022-03-14T16:51:41Z)
• Federated Robustness Propagation: Sharing Adversarial Robustness in Federated Learning [98.05061014090913]
  Federated learning (FL) emerges as a popular distributed learning schema that learns from a set of participating users without requiring raw data to be shared. adversarial training (AT) provides a sound solution for centralized learning, extending its usage for FL users has imposed significant challenges. We show that existing FL techniques cannot effectively propagate adversarial robustness among non-iid users. We propose a simple yet effective propagation approach that transfers robustness through carefully designed batch-normalization statistics.
  arXiv  Detail & Related papers  (2021-06-18T15:52:33Z)
• Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks [62.923992740383966]
  We present the first study of security issues of MSF-based perception in AD systems. We generate a physically-realizable, adversarial 3D-printed object that misleads an AD system to fail in detecting it and thus crash into it. Our results show that the attack achieves over 90% success rate across different object types and MSF.
  arXiv  Detail & Related papers  (2021-06-17T05:11:07Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.