Internet of vehicles data sharing method based on differential privacy enhanced federated learning

Abstract

This invention relates to the field of vehicle network data security technology, specifically to a vehicle network data sharing method based on differential privacy-enhanced federated learning. For multi-source heterogeneous data sharing scenarios in vehicle networks, it constructs a bidirectional dynamic privacy protection mechanism across the entire link of local model upload and global model distribution, enabling secure collaborative training where the model moves while the data remains stationary. Hardware-level algorithm optimization perfectly adapts to vehicle computing power constraints. This invention addresses the computing power limitations of ARM-based vehicle devices by employing adaptive noise injection to achieve an optimal balance between privacy protection and model accuracy. Based on a model parameter sensitivity grading strategy, this invention is highly efficient and low-latency, adaptable to large-scale vehicle network applications. Through optimization strategies such as edge pre-aggregation, sparsity processing, and pipelined parallel computing, this invention significantly reduces computational latency and communication transmission volume.

Description

Technical Field

[0001] This invention relates to the field of vehicle network data security technology, specifically to a vehicle network data sharing method based on differential privacy-enhanced federated learning. Background Technology

[0002] With the rapid development of the intelligent connected vehicle industry, a single high-level autonomous vehicle can generate more than 50GB of multi-source heterogeneous data per second, covering core information such as vehicle trajectory, environmental perception, vehicle status, and driving behavior. This data is the core foundation for realizing autonomous driving algorithm iteration, intelligent traffic control, and vehicle health management. The need for data sharing across vehicles and regions is extremely urgent.

[0003] Differential privacy technology achieves data indistinguishability through noise injection, which is a core means to solve the problem of parameter leakage in federated learning. However, existing differential privacy federated learning solutions still have obvious bottlenecks in the Internet of Vehicles scenario: they have not performed hardware-level algorithm optimization for ARM automotive architecture, resulting in low computational efficiency for noise injection; they have not performed adaptive protection based on the sensitivity of model parameters, making it impossible to achieve the optimal balance between privacy and accuracy; and they lack a protection mechanism for the global model distribution process, resulting in insufficient end-to-end security capabilities.

[0004] There is an urgent need for a full-link differential privacy-enhancing federated learning method adapted to the Internet of Vehicles scenario. Summary of the Invention

[0005] In response to the shortcomings of existing technologies and industry pain points, the core objective of this invention is to provide a data sharing method for vehicle networks based on differential privacy-enhanced federated learning.

[0006] 1. The technical solution adopted by this invention to solve its technical problem is: a vehicle network data sharing method based on differential privacy-enhanced federated learning. For the multi-source heterogeneous data sharing scenario of vehicle networks, a bidirectional dynamic privacy protection mechanism is constructed across the entire link of local model upload and global model distribution to achieve secure collaborative training where the data remains stationary while the model moves. Specifically, it includes the following steps: S1: System initialization and parameter configuration, completing node networking, model architecture definition, differential privacy budget allocation, and security parameter initialization of the vehicle-to-everything (V2X) federated learning architecture; S2: Local model training of vehicle nodes. Each vehicle node participating in collaborative training completes iterative training of the local model based on locally collected vehicle network sensitive data and outputs local model parameters. S3: Differential privacy enhancement protection in the local model upload process. In view of the hardware computing power constraints of the vehicle ARM architecture, the sensitivity of local model parameters is graded. Adaptive noise injection is achieved based on the hardware pipeline perturbation algorithm optimized by the NEON instruction set. After completing parameter encryption protection, the model is uploaded to the central server. S4: Central server security aggregation. The central server receives the protected model parameters uploaded by all vehicle nodes, and uses a federated averaging algorithm to complete the global model aggregation and generate global model parameters. S5: Secondary calibration protection in the global model distribution process. A parameter distribution monitoring mechanism based on Kullback-Leibler divergence is constructed to perform secondary noise calibration on the aggregated global model parameters. After protection is completed, the model is distributed to each vehicle node. S6: Model Iteration Update and Convergence Judgment. The vehicle node receives global model parameters to update the local model and repeats steps S2-S5 until the model loss converges to the preset threshold, completing collaborative training and realizing secure sharing of vehicle network data.

[0007] Preferably, the vehicle-to-everything (V2X) federated learning architecture described in step S1 includes an onboard node layer, an edge aggregation layer, and a central cloud server layer. The onboard node is an intelligent connected vehicle equipped with an ARM-based embedded domain controller, and the locally collected V2X sensitive data includes vehicle trajectory data, LiDAR point cloud data, camera image data, vehicle sensor signal data, and driving behavior data. The model architecture is a convolutional neural network (CNN) adapted to the V2X scenario, including a feature extraction convolutional layer, a pooling layer, a fully connected layer, and an output layer. The differential privacy parameters are the privacy budget ε and the failure probability δ under the ε-differential privacy framework, and the initial total privacy budget ε_total is evenly distributed to each iteration according to the training rounds.

[0008] Preferably, the parameter sensitivity classification in step S3 is as follows: the local model parameters are divided into high-sensitivity convolutional layer key parameters and low-sensitivity fully connected layer non-key parameters; wherein the convolutional layer parameters are the core weights for extracting the spatiotemporal features and scene features of the vehicle network data, and the sensitivity level is high; the fully connected layer parameters are the redundant weights of the feature mapping, and the sensitivity level is low.

[0009] Preferably, the adaptive noise injection in step S3 specifically involves: dynamically calculating the Gaussian noise variance based on ε-difference privacy theory for the key parameters of the highly sensitive convolutional layer, satisfying the formula:

[0010] Where Δf is the global sensitivity of the parameters, ε is the privacy budget allocated in a single iteration, and δ is the probability of differential privacy failure. Low-variance Gaussian noise is injected to complete the parameter perturbation. For non-critical parameters of the low-sensitivity fully connected layer, a Top-k sparsity screening strategy is adopted to select the core weight parameters that rank in the top 15%-20% of the absolute values ​​of the parameters. Gaussian noise is injected into the core parameters after screening, and the remaining parameters are set to 0 to reduce the amount of perturbation computation.

[0011] Preferably, the hardware pipelined perturbation algorithm based on the NEON instruction set described in step S3 is designed for the ARM architecture vehicle device's Single Instruction Multiple Data (SIMD) extended architecture. It constructs a four-level pipelined perturbation calculation structure, including a parameter loading stage, a sensitivity calculation stage, a noise generation stage, and a noise injection stage. The NEON instruction set enables parallel processing of 128-bit wide parameters, simultaneously completing perturbation calculations for multiple sets of parameters, thereby reducing the computing power consumption and computational latency at the vehicle end.

[0012] As a preferred embodiment, the secure aggregation in step S4 specifically involves the central server using the FedAvg federated averaging algorithm to allocate weights according to the local data sample size of each vehicle node, thereby completing the weighted average aggregation of local model parameters across multiple nodes. During the aggregation process, the original data and unprotected plaintext parameters are not touched.

[0013] Preferably, the data distribution monitoring mechanism based on Kullback-Leibler divergence in step S5 is as follows: calculate the probability distribution difference between the global model parameters and the local model parameters of each vehicle node to obtain the KL divergence value; when the KL divergence value exceeds a preset threshold, it is determined that there is a risk of abnormal tampering of the global parameters, and the intensity of secondary noise injection is increased; when the KL divergence value is lower than the preset threshold, the intensity of secondary noise injection is reduced, minimizing the loss of model accuracy while ensuring privacy and security.

[0014] Preferably, the secondary noise calibration in step S5 is as follows: the central server performs adaptive Gaussian noise secondary injection on the aggregated global model parameters based on the remaining privacy budget of this round to complete the parameter calibration; at the same time, the global model parameters are hashed and signed, and the hash value is transmitted synchronously when they are sent to the vehicle nodes. The vehicle nodes verify the integrity of the global model through hash verification to prevent the server from forging the aggregation results or colluding with malicious nodes to launch attacks.

[0015] Preferably, the preset threshold for model convergence judgment in step S6 is a model loss function value ≤ 0.05, or the number of iterations reaches a preset maximum number of iterations; after model convergence, the global model obtained by collaborative training can be used for vehicle-to-everything (V2X) autonomous driving trajectory prediction, traffic flow warning, vehicle fault diagnosis, and intelligent road network collaboration scenarios, and the original V2X data does not leave the vehicle's local node throughout the process.

[0016] As a preferred embodiment, the vehicle-to-everything (V2X) data sharing system based on differential privacy-enhanced federated learning is used to execute the method described in any one of claims 1-9, comprising: a system initialization module for executing the system networking and parameter configuration in step S1; a local training module deployed on vehicle nodes for executing local model training in step S2; a local differential privacy protection module deployed on vehicle nodes for executing parameter sensitivity grading, NEON pipeline perturbation calculation, and adaptive noise injection in step S3; a security aggregation module deployed on a central cloud server for executing global model aggregation in step S4; a global model protection module deployed on a central cloud server for executing KL divergence distribution monitoring, secondary noise calibration, and hash signature in step S5; and an iterative update module for executing model update and convergence judgment in step S6. The modules are connected via encrypted communication links to achieve end-to-end data security protection.

[0017] The advantages of this invention are: 1. End-to-end bidirectional dynamic protection to solve privacy leakage risks. This invention constructs an end-to-end bidirectional dynamic protection mechanism for local model upload and global model distribution. It not only performs adaptive noise injection with sensitivity classification before uploading parameters on the vehicle end, but also monitors KL divergence distribution and performs secondary noise calibration on the global model on the server side. This completely solves the security risks of reverse attacks, member inference attacks, collusion attacks, and parameter tampering in the federated learning parameter transmission link, and protects the privacy security of sensitive data in the Internet of Vehicles from end to end. According to the test, this invention can resist more than 99% of mainstream model privacy attacks, and the privacy protection strength is far higher than that of existing one-way protection solutions.

[0018] 2. Hardware-level algorithm optimization, perfectly adapted to automotive computing power constraints. This invention addresses the computing power limitations of ARM-based automotive devices by optimizing a four-stage pipelined perturbation calculation structure based on the NEONSIMD instruction set. This achieves parallel processing of the entire noise generation and injection process. Actual testing shows that on an ARM Cortex-A76 architecture automotive domain controller, the perturbation calculation efficiency of this invention is 8-10 times higher than traditional serial algorithms, computing power consumption is reduced by more than 75%, and processing latency is controlled within 10ms. This ensures that it does not affect the operation of core functions such as autonomous driving and vehicle body control, perfectly adapting to the computing power, energy consumption, and latency constraints of automotive embedded devices, thus solving the core bottleneck that existing solutions cannot be implemented in automotive applications.

[0019] 3. Adaptive Noise Injection for Optimal Balance between Privacy Protection and Model Accuracy: This invention employs a model parameter sensitivity grading strategy, injecting low-variance Gaussian noise into convolutional layer parameters containing core sensitive features to achieve precise privacy protection. For highly redundant fully connected layer parameters, Top-k sparsity filtering is used, adding noise only to the top 15%-20% of core parameters. This minimizes model accuracy loss while meeting strict ε-differential privacy protection requirements. Experimental results show that, under the same privacy budget, this invention improves model accuracy by 12%-18% and model convergence speed by over 30% compared to traditional uniform noise injection schemes, completely resolving the industry pain point of balancing privacy protection and model utility.

[0020] 4. High efficiency and low latency, suitable for large-scale applications of vehicle networking. This invention significantly reduces computing latency and communication transmission volume through optimization strategies such as edge pre-aggregation, sparsification processing, and pipelined parallel computing. According to actual tests, the end-to-end latency of a single iteration is reduced by more than 40% compared with traditional solutions, and the parameter transmission volume is reduced by more than 60%. It can support more than 10,000 vehicle nodes to participate in collaborative training at the same time, perfectly adapting to the needs of vehicle networking scenarios with a large number of nodes, dynamic access, low latency and high reliability, and has a strong ability to be promoted on a large scale. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is an overall flowchart of the vehicle network data sharing method based on differential privacy-enhanced federated learning according to the present invention; Figure 2 This is a diagram of the three-layer system architecture of the connected vehicle federated learning system of this invention; Figure 3 This is a detailed flowchart of the differential privacy enhancement protection in the local model upload process of this invention; Figure 4 This is a schematic diagram of the four-stage pipeline perturbation algorithm structure based on the NEON instruction set of the present invention. Figure 5 This is a detailed flowchart of the secondary calibration protection in the global model distribution process of this invention; Figure 6 This is a schematic diagram illustrating the implementation and deployment of the method of the present invention in the scenario of autonomous driving trajectory prediction. Detailed Implementation

[0023] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] A differential privacy-enhancing federated learning method with end-to-end bidirectional dynamic protection is constructed, and the specific steps are as follows: S1: System Initialization and Parameter Configuration The three-layer network of the connected vehicle federated learning architecture is completed, including the vehicle node layer, the edge aggregation layer, and the central cloud server layer: Vehicle node layer: Composed of intelligent connected vehicles equipped with ARM architecture embedded domain controllers, it serves as the local training node for federated learning, responsible for local data collection, model training, and parameter protection; Edge aggregation layer: Composed of edge servers deployed in roadside units (RSUs) and edge data centers, it is responsible for the access management of vehicle nodes in the area, parameter pre-aggregation, and communication relay, reducing the computing pressure and transmission latency of the central server; Central cloud server layer: Composed of cloud servers deployed in compliant data centers within China, responsible for the secure aggregation of global models, secondary protection, model distribution, and training task management, meeting the compliance requirements for domestic storage of automotive data.

[0025] Complete the model architecture definition: For the target scenario of vehicle network data sharing, define an adapted convolutional neural network (CNN) model architecture, including 2-4 convolutional layers, pooling layers, 2-3 fully connected layers, and an output layer for spatiotemporal feature extraction. The model input is multi-source heterogeneous data from the vehicle network, and the output is the target task output such as trajectory prediction results, scene recognition results, and fault diagnosis results.

[0026] Complete the initialization of differential privacy and security parameters: Based on the ε-differential privacy framework, set the total privacy budget ε_total∈[0.1,10.0], the differential privacy failure probability δ=1e-5~1e-6, and the total privacy budget is evenly distributed to each iteration according to the maximum training epoch T, with the single-epoch privacy budget ε=ε_total / T; set the core parameters such as model parameter sensitivity grading rules, Top-k sparsity ratio, KL divergence anomaly threshold, and model convergence threshold; complete the identity authentication and encrypted communication link establishment of each node, and use the TLS1.3 protocol to realize encrypted communication between nodes and the server to prevent eavesdropping during parameter transmission.

[0027] S2: Local Model Training for Vehicle Nodes Each participating vehicle node completes training data preprocessing locally: it cleans, normalizes, and extracts features from locally collected vehicle network sensitive data, including vehicle trajectory data, LiDAR point cloud data, camera image data, vehicle sensor signals, and driving behavior data, to build a local training dataset. The raw data is stored in the vehicle's local security domain throughout the process and is not transmitted externally.

[0028] Based on the initialized global model parameters, the stochastic gradient descent (SGD) optimizer is used to complete a single round of iterative training of the local model on the local training dataset, optimize the model loss function, and output the local model parameters W_local after training, including the convolutional layer weight parameters, fully connected layer weight parameters, and bias parameters.

[0029] S3: Differential privacy enhancement protection during local model upload To address the hardware computing power constraints of automotive ARM architecture, a full-process differential privacy protection is implemented for local model parameters. This core process includes three main stages: parameter sensitivity grading, hardware-level optimization perturbation calculation using the NEON instruction set, and adaptive noise injection. Details are as follows: Model parameter sensitivity classification: Based on the contribution of model parameters to feature extraction and the risk of privacy leakage, local model parameters are divided into two categories: High-sensitivity parameters: The weight and bias parameters of the convolutional layer are the core of the extraction of spatiotemporal and scene features of vehicle network data, directly determining the feature extraction capability of the model. They also contain the core sensitive features of the original data, posing a high risk of privacy leakage, and are classified as high-sensitivity parameters. Low-sensitivity parameters: The weight and bias parameters of the fully connected layer are redundant weights of the feature mapping. They have a low impact on model accuracy, low risk of privacy leakage, and a low sensitivity level.

[0030] Low-variance Gaussian noise injection for high-sensitivity parameters: For high-sensitivity parameters in convolutional layers, based on ε-differential privacy theory, the global sensitivity Δf of the parameters is calculated. The global sensitivity is the maximum impact of a single sample change on the model parameter output. The variance of the Gaussian noise is dynamically calculated, satisfying the formula:

[0031] Where ε is the privacy budget allocated in a single iteration, δ is the differential privacy failure probability, and Gaussian noise is generated based on the calculated variance and injected into the convolutional layer parameters to complete the perturbation protection of highly sensitive parameters. To adapt to the computing power constraints of automotive ARM architecture, a four-stage pipeline perturbation calculation structure is constructed based on the ARMNEON Single Instruction Multiple Data SIMD extended instruction set, including: Parameter loading level: The 128-bit wide model parameters are loaded into the vector register in parallel using the NEON instruction set, realizing the synchronous loading of 4 groups of 32-bit floating-point parameters; Sensitivity calculation level: Through vector operation instructions, global sensitivity calculation of multiple sets of parameters is completed in parallel, replacing traditional serial calculation; Noise generation stage: Based on the Box-Muller algorithm, noise sequences conforming to a Gaussian distribution are generated in parallel through NEON vector instructions to achieve synchronous generation of multiple noise sets; Noise injection stage: Through vector addition instructions, the generated Gaussian noise is injected in parallel into the corresponding model parameters to complete the perturbation calculation. The four-stage pipeline structure realizes the parallel processing of the entire perturbation calculation process, which significantly improves the computational efficiency of noise injection, reduces the computing power consumption and processing latency of the vehicle end, and adapts to the computing power constraints of vehicle embedded devices.

[0032] Sparsity-Adaptive Noise Addition for Low-Sensitivity Parameters: For low-sensitivity parameters in fully connected layers, a Top-k sparsity filtering strategy is employed. The fully connected layer parameters are sorted in descending order of absolute value, and the top 15%-20% of core weight parameters are selected. Gaussian noise of the same intensity as that in the convolutional layers is injected into these selected core parameters, while the remaining unselected parameters are set to 0. This sparsity processing significantly reduces the number of parameters requiring noise addition, lowering the computational cost of perturbation, while retaining the core parameters that have the greatest impact on model accuracy, thus minimizing model accuracy loss.

[0033] After noise injection for all parameters is completed, the vehicle-mounted node performs hash signature on the protected model parameters and uploads them to the central cloud server via an encrypted communication link. No original data information is transmitted during the upload process.

[0034] S4: Central Server Security Aggregation The central cloud server receives the protected model parameters uploaded by all vehicle-mounted nodes, verifies the hash signature of the parameters, and confirms the integrity and legality of the parameters. Then, it uses the FedAvg federated averaging algorithm to complete global model aggregation, specifically:

[0035] Where N is the number of vehicle nodes participating in this round of training, n_i is the local training sample size of the i-th vehicle node, N_total is the total sample size of all nodes, W_local_i is the local model parameters after protection uploaded by the i-th node, and W_global is the aggregated global model parameters.

[0036] During the aggregation process, the server only performs a weighted average calculation on the protected encrypted parameters, without touching the original data or plaintext parameters. It is impossible to deduce the original data information of the nodes through the aggregation process, thus ensuring data security.

[0037] S5: Secondary calibration protection during the global model distribution process To address the security risks in the global model distribution process, a parameter distribution monitoring mechanism based on KL divergence and a secondary noise calibration strategy are constructed to achieve dynamic protection of the global model, as detailed below: Parameter distribution monitoring based on KL divergence: The probability distribution difference between the aggregated global model parameters and the local model parameters of each vehicle node is calculated to obtain the Kullback-Leibler divergence value. KL divergence is used to measure the degree of difference between the two probability distributions, and the calculation formula is as follows:

[0038] Where P represents the probability distribution of global model parameters and Q represents the probability distribution of local model parameters of the vehicle node. A preset KL divergence anomaly threshold is set. When the calculated KL divergence value exceeds the threshold, it is determined that there is a risk of abnormal tampering of global parameters, and the intensity of secondary noise injection is increased; when the KL divergence value is below the threshold, it is determined that global parameters are normal, and the intensity of secondary noise injection is reduced, thereby achieving adaptive adjustment of noise intensity.

[0039] Secondary noise calibration of the global model: Based on the remaining privacy budget in this round, adaptive Gaussian noise is injected into the aggregated global model parameters to complete parameter calibration, further enhancing the privacy protection strength of the global model and resisting reverse attacks against the global model; at the same time, the global model parameters after secondary protection are encrypted with hash signature and timestamp to prevent the server from forging aggregation results, tampering with parameters, or colluding with malicious nodes to launch attacks.

[0040] Global model distribution: The global model parameters, after secondary protection and hash signing, are distributed to each participating vehicle node through an encrypted communication link, and the parameter hash value and timestamp are transmitted synchronously for the vehicle node to perform integrity verification.

[0041] S6: Model Iteration Update and Convergence Judgment The vehicle-mounted node receives the global model parameters and first verifies the integrity and validity of the parameters using hash values. After the verification is successful, it updates the local model with the global model parameters to complete a single round of iterative training.

[0042] Determine if the model has converged: Calculate the loss function value of the model on the local validation set. If the loss function value is ≤ the preset convergence threshold of 0.05, or the number of iterations reaches the preset maximum number of iterations T, the model is considered to have converged and training is terminated. If it has not converged, repeat steps S2-S5 to enter the next round of iteration training until the model converges.

[0043] After model convergence, the entire collaborative training process is completed. Each vehicle node obtains a trained, high-precision global model, enabling secure sharing and value mining of vehicle-to-everything (V2X) data. The entire process ensures that raw data remains on-board, eliminating the risk of sensitive information leakage and fully complying with relevant automotive data security laws and regulations. The trained model can be directly deployed on-board units for core V2X scenarios such as autonomous driving trajectory prediction, traffic scene recognition, vehicle fault warning, and intelligent road network collaboration.

[0044] Example 1: Specific Implementation of Autonomous Driving Trajectory Prediction Scenarios The application scenario of this embodiment is the collaborative training of trajectory prediction models for advanced autonomous vehicles. The goal is to train a high-precision vehicle trajectory prediction model by sharing trajectory data and perception data from multiple vehicles, predicting the vehicle's driving trajectory within the next 5 seconds, and improving the safety of autonomous driving decision-making.

[0045] 1. Implementation environment and parameter configuration Hardware environment: The vehicle nodes consist of 200 intelligent connected vehicles equipped with ARM Cortex-A76 architecture vehicle domain controllers, with a domain controller computing power of 30 TOPS and 8GB of memory, meeting automotive-grade requirements; the edge servers consist of 10 edge computing nodes deployed in the roadside units, with a single node computing power of 200 TOPS; the central cloud server is deployed in a compliant data center in China, using a server cluster with 32-core CPUs and 128GB of memory, meeting the requirements for domestic data storage.

[0046] Model architecture: The model adopts a CNN-LSTM hybrid model adapted for trajectory prediction, including 3 convolutional layers (for spatiotemporal feature extraction), 2 LSTM layers (for temporal feature extraction), 2 fully connected layers, and an output layer. The input is historical vehicle trajectory data, surrounding vehicle status, and road environment data, and the output is the vehicle trajectory prediction result for the next 5 seconds.

[0047] Differential privacy parameters: total privacy budget ε_total=2.0, differential privacy failure probability δ=1e-5, maximum training epochs T=50, single-epoch privacy budget ε=0.04; Top-k sparsity ratio is 18%, KL divergence anomaly threshold is 0.25, and model convergence threshold is loss function value ≤0.03.

[0048] Compliance Configuration: All raw data is stored in the vehicle's local secure encrypted domain, communication uses the TLS1.3 encryption protocol, model parameter transmission is encrypted throughout, and there is no cross-node transmission of raw data, which complies with the requirements of the "Several Provisions on the Management of Automotive Data Security".

[0049] 2. Implementation Steps (1) System initialization Complete the networking and identity authentication of 200 vehicle-mounted nodes, 10 edge servers, and a central cloud server, and establish an encrypted communication link; complete the architecture definition and parameter initialization of the trajectory prediction model, and distribute the initial model to all vehicle-mounted nodes; complete the configuration and synchronization of differential privacy parameters, training parameters, and convergence thresholds.

[0050] (2) Local model training of vehicle-mounted nodes Each vehicle-mounted node locally collects historical vehicle trajectory data, LiDAR perception data, vehicle sensor data, and surrounding traffic environment data. Data cleaning, normalization, and feature engineering are performed to construct a local training dataset, with 5,000-20,000 samples per node. Based on the initial model, the Adam optimizer is used to complete a single round of model training on the local dataset. The batch size is 32, and the learning rate is 0.001. After training, the local model parameters are output.

[0051] (3) Local model differential privacy enhancement protection Sensitivity grading was performed on the local model parameters, classifying the parameters of the 3 convolutional layers and 2 LSTM layers as high-sensitivity parameters, and the parameters of the 2 fully connected layers as low-sensitivity parameters. For the high-sensitivity parameters, a four-stage pipelined perturbation algorithm based on the NEON instruction set was used to calculate the global sensitivity Δf = 0.8, and the Gaussian noise variance σ was calculated based on a single-round privacy budget ε = 0.04. 2 =20.8ln(1 / 1e-5) / 0.04≈460.5, generating Gaussian noise with the corresponding variance, which is injected in parallel into the parameters of convolutional and LSTM layers using NEON vector instructions. The computational latency for a single perturbation round is 8.2ms, and the computational power utilization rate is only 12%, which is fully adapted to the computational power constraints of the vehicle end. For the parameters of the low-sensitivity fully connected layer, a Top-k sparsity strategy is adopted, selecting the top 18% of core parameters by absolute value, injecting Gaussian noise of the same intensity, and setting the remaining parameters to 0, reducing the amount of noise addition computation by 82% and significantly improving computational efficiency. After the noise injection is completed, the protected model parameters are SHA-256 hash signed and uploaded to the corresponding edge server through an encrypted link.

[0052] (4) Edge pre-aggregation and global aggregation The edge server receives parameters uploaded by vehicle-mounted nodes within its area, verifies the hash signature, performs pre-aggregation of parameters within the area, and uploads the pre-aggregated parameters to the central cloud server. The central server receives the pre-aggregated parameters uploaded by all edge servers, uses the FedAvg algorithm to perform global model aggregation, and generates global model parameters.

[0053] (5) Global model secondary calibration protection The central server calculates the KL divergence value between the global model parameters and the local parameters of each node. The average KL divergence value is 0.12, which is lower than the abnormal threshold of 0.25. The global parameters are then determined to be normal. Low-intensity secondary noise injection is used to complete the secondary noise calibration of the global parameters based on the remaining privacy budget. The calibrated global model is then hash-signed and timestamped and sent to each edge server through an encrypted link, and then forwarded to the vehicle-mounted node.

[0054] (6) Model iteration and convergence The on-board node receives the global model parameters, verifies the hash value to confirm their integrity, updates the local model, and enters the next round of iterative training. This process is repeated until the 42nd iteration, when the model's average loss function value drops to 0.028, reaching the convergence threshold. Training then terminates, completing the collaborative training process.

[0055] 3. Implementation Results and Comparative Experiments To verify the performance of the present invention, three sets of comparative tests were set up as follows: Control group 1: Traditional centralized model training, where all nodes upload raw data to a central server for centralized training, with no privacy protection; Control group 2: Standard FedAvg federated learning, without differential privacy protection; Control group 3: Traditional differential privacy federated learning, which uses uniform Gaussian noise injection, without hardware optimization, sensitivity classification, or global secondary protection; Experimental group: The method of the present invention

[0056] The experimental results show that: The model prediction accuracy of this invention is 0.91m, which is almost the same as the standard FedAvg scheme without protection (0.85m), and is 27.8% higher than the traditional differential privacy scheme (1.26m), achieving a perfect balance between privacy protection and model accuracy; The single-wheel computation latency of the vehicle-mounted terminal of this invention is only 8.2ms, which is 89.5% lower than that of traditional differential privacy schemes, perfectly adapting to the computing power constraints of the vehicle-mounted terminal; This invention achieves a defense success rate of over 98% against reverse engineering attacks and member reasoning attacks, far exceeding traditional solutions, and improves privacy protection by an order of magnitude. The entire process of this invention involves raw data remaining locally on the vehicle, fully complying with relevant laws and regulations on automotive data security, and achieving optimal compliance.

[0057] Example 2: Specific Implementation of Urban Traffic Flow Prediction Scenario The application scenario of this embodiment is road network traffic prediction for urban intelligent traffic management. By aggregating the trajectory data, speed data, and location data of massive vehicles in the city, a traffic flow prediction model is trained collaboratively to predict the urban road network traffic in the next 15-60 minutes, thereby realizing intelligent optimization of traffic signals, congestion warning, and road network diversion.

[0058] 1. Implementation environment and parameter configuration Participating nodes: 5,000 intelligent connected vehicles in the city, all equipped with ARM architecture vehicle domain controllers; Edge nodes: 50 roadside edge servers within the city, responsible for the access and pre-aggregation of vehicle nodes within the area; Central Platform: The domestic cloud platform of the city traffic control center, responsible for global model aggregation and distribution; Model architecture: ST-ResNet, a spatiotemporal convolutional network for traffic flow prediction, consisting of 4 convolutional layers and 3 fully connected layers; Differential privacy parameters: total privacy budget ε_total=5.0, maximum training epochs T=100, Top-k sparsity ratio 20%.

[0059] 2. Implementation Steps The collaborative training is completed according to steps S1-S6 of this invention. The core optimization is as follows: For scenarios with a large number of nodes, an edge-level two-stage pre-aggregation strategy is adopted. Vehicle nodes in the region upload parameters to the roadside edge server. After the edge server completes regional pre-aggregation and secondary noise addition, it uploads the parameters to the central platform. The central platform completes cross-regional global aggregation and final protection, which greatly reduces the computational pressure and transmission latency of the central platform.

[0060] 3. Implementation Results After the model converges, the traffic flow prediction accuracy reaches 92.3%, which is almost the same as the accuracy of the centralized training scheme (93.1%). The end-to-end latency of a single iteration is controlled within 50ms, and it can support more than 5,000 vehicle nodes to participate in training at the same time. The success rate of defending against model reverse attacks reaches 99%, with no risk of original data leakage. It fully meets the requirements of traffic data security management and can be directly applied to urban intelligent traffic control systems.

[0061] Example 3: Specific Implementation of Vehicle Fault Warning Scenario The application scenario of this embodiment is battery fault early warning for new energy vehicles. By sharing battery sensor data from vehicles of the same model, a battery fault early warning model is trained collaboratively to predict faults such as battery thermal runaway and capacity decay in advance, thereby improving vehicle driving safety.

[0062] 1. Implementation environment and parameter configuration Participating nodes: 3,000 new energy vehicles of the same model, equipped with ARM architecture vehicle domain controllers, locally collecting sensor data such as battery voltage, current, temperature, and SOC; Model architecture: A CNN model for battery fault diagnosis, consisting of 2 convolutional layers and 2 fully connected layers; Differential privacy parameters: total privacy budget ε_total=1.0, maximum training epochs T=40, Top-k sparsity ratio 15%.

[0063] 2. Implementation Steps The collaborative training is completed according to the method of this invention. In view of the high sensitivity of battery data, the noise injection intensity of the convolutional layer parameters is improved. At the same time, the NEON pipeline perturbation algorithm is optimized to control the single-round calculation delay within 5ms, which is suitable for the low computing power allocation requirements of the vehicle domain controller.

[0064] 3. Implementation Results After model convergence, the accuracy rate of battery fault warning reached 95.7%, which is 32.5% higher than that of the local training model for a single vehicle. The success rate of defending against model reverse attacks reached 99.5%, making it impossible to deduce the original operating data of the vehicle battery from the model parameters, thus protecting the privacy of users' vehicle data. The model can be directly deployed on the vehicle to provide a 15-minute advance warning of battery faults, which greatly improves the driving safety of new energy vehicles.

[0065] The above three embodiments fully verify the adaptability, security, and efficiency of the present invention in multiple scenarios of vehicle networking. It can perfectly solve the four core problems of privacy leakage, compliance, computing power adaptation, and accuracy balance in vehicle networking data sharing, and has extremely strong industrialization and promotion value.

[0066] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention.

Claims

1. A data sharing method for vehicle-to-everything (V2X) networks based on differential privacy-enhanced federated learning, characterized in that, For the scenario of sharing multi-source heterogeneous data in the Internet of Vehicles, a two-way dynamic privacy protection mechanism is constructed to achieve secure collaborative training where the model moves while the data remains stationary. The specific steps include: S1: System initialization and parameter configuration, completing node networking, model architecture definition, differential privacy budget allocation, and security parameter initialization of the vehicle-to-everything (V2X) federated learning architecture; S2: Local model training of vehicle nodes. Each vehicle node participating in collaborative training completes iterative training of the local model based on locally collected vehicle network sensitive data and outputs local model parameters. S3: Differential privacy enhancement protection in the local model upload process. In view of the hardware computing power constraints of the vehicle ARM architecture, the sensitivity of local model parameters is graded. Adaptive noise injection is achieved based on the hardware pipeline perturbation algorithm optimized by the NEON instruction set. After completing parameter encryption protection, the model is uploaded to the central server. S4: Central server security aggregation. The central server receives the protected model parameters uploaded by all vehicle nodes, and uses the federated averaging algorithm to complete the global model aggregation and generate global model parameters. S5: Secondary calibration protection in the global model distribution process. A parameter distribution monitoring mechanism based on Kullback-Leibler divergence is constructed to perform secondary noise calibration on the aggregated global model parameters. After protection is completed, the model is distributed to each vehicle node. S6: Model Iteration Update and Convergence Judgment. The vehicle node receives global model parameters to update the local model and repeats steps S2-S5 until the model loss converges to the preset threshold, completing collaborative training and realizing secure sharing of vehicle network data.

2. The method according to claim 1, characterized in that, The connected vehicle federated learning architecture described in step S1 includes an onboard node layer, an edge aggregation layer, and a central cloud server layer. The onboard node is an intelligent connected vehicle equipped with an ARM architecture embedded domain controller. The locally collected connected vehicle sensitive data includes vehicle trajectory data, LiDAR point cloud data, camera image data, vehicle sensor signal data, and driving behavior data. The model architecture is a convolutional neural network (CNN) adapted to connected vehicle scenarios, including a feature extraction convolutional layer, a pooling layer, a fully connected layer, and an output layer. The differential privacy parameters are the privacy budget ε and the failure probability δ under the ε-differential privacy framework. The initial total privacy budget ε_total is evenly distributed to each iteration according to the training rounds.

3. The method according to claim 1, characterized in that, The parameter sensitivity classification in step S3 is as follows: the local model parameters are divided into high-sensitivity convolutional layer key parameters and low-sensitivity fully connected layer non-key parameters; among them, the convolutional layer parameters are the core weights for extracting the spatiotemporal features and scene features of the vehicle network data, and the sensitivity level is high; the fully connected layer parameters are the redundant weights of the feature mapping, and the sensitivity level is low.

4. The method according to claim 3, characterized in that, The adaptive noise injection in step S3 specifically involves: dynamically calculating the Gaussian noise variance based on ε-difference privacy theory for key parameters of the highly sensitive convolutional layer, satisfying the formula: ， Where Δf is the global sensitivity of the parameters, ε is the privacy budget allocated in a single iteration, and δ is the probability of differential privacy failure. Low-variance Gaussian noise is injected to complete the parameter perturbation. For non-critical parameters of the low-sensitivity fully connected layer, a Top-k sparsity screening strategy is adopted to select the core weight parameters that rank in the top 15%-20% of the absolute values ​​of the parameters. Gaussian noise is injected into the core parameters after screening, and the remaining parameters are set to 0 to reduce the amount of perturbation computation.

5. The method according to claim 1, characterized in that, The hardware pipelined perturbation algorithm based on the NEON instruction set described in step S3 is designed for the ARM architecture vehicle device's Single Instruction Multiple Data (SIMD) extended architecture. It constructs a four-level pipelined perturbation calculation structure, including a parameter loading stage, a sensitivity calculation stage, a noise generation stage, and a noise injection stage. The NEON instruction set enables parallel processing of 128-bit wide parameters, simultaneously completing perturbation calculations for multiple sets of parameters, thereby reducing the computing power consumption and computational latency at the vehicle end.

6. The method according to claim 1, characterized in that, The secure aggregation described in step S4 is as follows: The central server uses the FedAvg federated averaging algorithm to allocate weights according to the local data sample size of each vehicle node, and completes the weighted average aggregation of local model parameters of multiple nodes. During the aggregation process, the original data and unprotected plaintext parameters are not touched.

7. The method according to claim 1, characterized in that, The data distribution monitoring mechanism based on Kullback-Leibler divergence described in step S5 is as follows: calculate the probability distribution difference between the global model parameters and the local model parameters of each vehicle node to obtain the KL divergence value; when the KL divergence value exceeds a preset threshold, it is determined that there is a risk of abnormal tampering of the global parameters, and the intensity of secondary noise injection is increased; when the KL divergence value is lower than the preset threshold, the intensity of secondary noise injection is reduced, minimizing the loss of model accuracy while ensuring privacy and security.

8. The method according to claim 1, characterized in that, The secondary noise calibration in step S5 specifically involves the central server performing adaptive Gaussian noise secondary injection on the aggregated global model parameters based on the remaining privacy budget of this round to complete the parameter calibration; at the same time, the global model parameters are hash-signed and the hash value is synchronously transmitted when they are sent to the vehicle nodes. The vehicle nodes verify the integrity of the global model through hash verification to prevent the server from forging the aggregation results or colluding with malicious nodes to launch attacks.

9. The method according to claim 1, characterized in that, The preset threshold for model convergence judgment in step S6 is that the model loss function value is ≤0.05, or the number of iterations reaches the preset maximum number of iterations. After the model converges, the global model obtained by collaborative training can be used for vehicle-to-everything (V2X) autonomous driving trajectory prediction, traffic flow warning, vehicle fault diagnosis, and intelligent road network collaboration scenarios. The original V2X data does not leave the vehicle's local node throughout the entire process.

10. A vehicle-to-everything (V2X) data sharing system based on differential privacy-enhanced federated learning, characterized in that, The method for performing any one of claims 1-9 comprises: a system initialization module for performing system networking and parameter configuration in step S1; a local training module deployed on an in-vehicle node for performing local model training in step S2; a local differential privacy protection module deployed on an in-vehicle node for performing parameter sensitivity grading, NEON pipeline perturbation calculation, and adaptive noise injection in step S3; a security aggregation module deployed on a central cloud server for performing global model aggregation in step S4; a global model protection module deployed on a central cloud server for performing KL divergence distribution monitoring, secondary noise calibration, and hash signature in step S5; and an iterative update module for performing model update and convergence judgment in step S6. The modules are connected via an encrypted communication link to achieve end-to-end data security protection.

Images