analiza aiqbench
This research exposes a critical vulnerability in federated learning for vehicular networks, demonstrating that transmitted model updates can reveal client identities with near-perfect accuracy using inertial sensor data. The authors validate a practical defense strategy involving gradient clipping and Gaussian noise addition, which effectively neutralizes identity inference attacks while preserving acceptable model utility. This work is essential for advancing secure edge intelligence in 5G/6G ecosystems where privacy guarantees are paramount for safety-critical applications.
Privacy Leakage in Federated Learning: Gradient-Based Client Identity Inference and Defenses for Inertial Sensing in Vehicular Edge Networks
arXiv:2609.02971v1 Announce Type: cross Abstract: As vehicular networks move toward 5G/6G edge intelligence, federated learning (FL) is widely promoted as a privacy-preserving way for vehicles and infrastructure to train shared models without exposing raw sensor data. Yet the updates clients transmit still leak enough information to identify who sent them, which threatens the anonymity that safety-critical V2X applications assume and adds to existing concerns over adversarial ML, model poisoning, and backdoor attacks. We study server-side client identity inference from transmitted weight deltas using inertial (IMU) measurements, evaluated on the UCI Human Activity Recognition (HAR) benchmark as an accessible proxy for the IMU streams produced onboard connected vehicles. Across five attack classifiers and five non-IID partitions, an honest-but-curious server recovers client identity with near-perfect accuracy (approximately 1.000) from undefended updates, confirming a concrete identifiability risk. We then quantify the privacy-utility trade-off of a lightweight clip-then-noise defense by sweeping Gaussian noise (sigma in {0.00, 0.05, 0.10, 0.20, 0.50, 1.00}) at fixed clipping (C=1.0), and report formal (epsilon, delta)-DP budgets through Renyi accounting. A practical region (sigma in [0.1, 0.2]) drives attack accuracy to near-random while costing under 5% relative FL accuracy. Ensemble FL supplies complementary structural privacy with a 1/K anonymity-set bound and no noise penalty. Results are supported by cryptographic (SHA-256) train/evaluation gradient disjointness, three seeds, and a count-normalized attacker-advantage metric. We position HAR explicitly as a proxy and discuss what validation on true vehicular telemetry would require.
Authors:Ali Akarma (1 and 2), Toqeer Ali Syed (1), Muhammad Khan (3), Qurat-ul-ain Mastoi (3), Adeel Ahmad (1) ((1) Islamic University of Madinah, Madinah, Saudi Arabia, (2) King Fahd University of Petroleum and Minerals, Dhahran, Saudi Arabia, (3) University of the West of England, Bristol, U.K.)
Abstract:As vehicular networks move toward 5G/6G edge intelligence, federated learning (FL) is widely promoted as a privacy-preserving way for vehicles and infrastructure to train shared models without exposing raw sensor data. Yet the updates clients transmit still leak enough information to identify who sent them, which threatens the anonymity that safety-critical V2X applications assume and adds to existing concerns over adversarial ML, model poisoning, and backdoor attacks. We study server-side client identity inference from transmitted weight deltas using inertial (IMU) measurements, evaluated on the UCI Human Activity Recognition (HAR) benchmark as an accessible proxy for the IMU streams produced onboard connected vehicles. Across five attack classifiers and five non-IID partitions, an honest-but-curious server recovers client identity with near-perfect accuracy (approximately 1.000) from undefended updates, confirming a concrete identifiability risk. We then quantify the privacy-utility trade-off of a lightweight clip-then-noise defense by sweeping Gaussian noise (sigma in {0.00, 0.05, 0.10, 0.20, 0.50, 1.00}) at fixed clipping (C=1.0), and report formal (epsilon, delta)-DP budgets through Renyi accounting. A practical region (sigma in [0.1, 0.2]) drives attack accuracy to near-random while costing under 5% relative FL accuracy. Ensemble FL supplies complementary structural privacy with a 1/K anonymity-set bound and no noise penalty. Results are supported by cryptographic (SHA-256) train/evaluation gradient disjointness, three seeds, and a count-normalized attacker-advantage metric. We position HAR explicitly as a proxy and discuss what validation on true vehicular telemetry would require.
Cryptography and Security (cs.CR); Machine Learning (cs.LG); Networking and Internet Architecture (cs.NI)
arXiv:2609.02971 [cs.CR]
(or arXiv:2609.02971v1 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2609.02971 arXiv-issued DOI via DataCite (pending registration)
Text integral sub licența deschisă a publicației · 305 cuvinte
Subiecte conexe
OPFL: Optimistic Verification of Federated Learning via Empirical Boundary
arXiv · 30 sept. 2026
SpecGradFilter: A Spectral Gradient Filtering Framework for Taming Federated Heterogeneity
arXiv · 31 aug. 2026
Keyed Provenance Watermarking with Complementary Lattice-Based Secure Aggregation for Federated Learning
arXiv · 24 aug. 2026
Federated Lightweight Fine-Tuning
arXiv · 23 iul. 2026