Search papers, labs, and topics across Lattice.
This study investigates the vulnerability of federated learning (FL) in vehicular networks to client identity inference attacks, revealing that an honest-but-curious server can achieve near-perfect accuracy in identifying clients from transmitted weight deltas derived from inertial measurements. The research highlights the significant privacy risks associated with FL, particularly for safety-critical vehicle-to-everything (V2X) applications, where anonymity is crucial. A lightweight defense mechanism utilizing a clip-then-noise strategy is proposed, demonstrating a practical balance between privacy and model utility, with minimal impact on FL accuracy.
An honest-but-curious server can identify clients with near-perfect accuracy from federated learning updates, exposing critical privacy vulnerabilities in vehicular networks.
As vehicular networks move toward 5G/6G edge intelligence, federated learning (FL) is widely promoted as a privacy-preserving way for vehicles and infrastructure to train shared models without exposing raw sensor data. Yet the updates clients transmit still leak enough information to identify who sent them, which threatens the anonymity that safety-critical V2X applications assume and adds to existing concerns over adversarial ML, model poisoning, and backdoor attacks. We study server-side client identity inference from transmitted weight deltas using inertial (IMU) measurements, evaluated on the UCI Human Activity Recognition (HAR) benchmark as an accessible proxy for the IMU streams produced onboard connected vehicles. Across five attack classifiers and five non-IID partitions, an honest-but-curious server recovers client identity with near-perfect accuracy (approximately 1.000) from undefended updates, confirming a concrete identifiability risk. We then quantify the privacy-utility trade-off of a lightweight clip-then-noise defense by sweeping Gaussian noise (sigma in {0.00, 0.05, 0.10, 0.20, 0.50, 1.00}) at fixed clipping (C=1.0), and report formal (epsilon, delta)-DP budgets through Renyi accounting. A practical region (sigma in [0.1, 0.2]) drives attack accuracy to near-random while costing under 5% relative FL accuracy. Ensemble FL supplies complementary structural privacy with a 1/K anonymity-set bound and no noise penalty. Results are supported by cryptographic (SHA-256) train/evaluation gradient disjointness, three seeds, and a count-normalized attacker-advantage metric. We position HAR explicitly as a proxy and discuss what validation on true vehicular telemetry would require.
