From Trust Scores to Driver Decisions: An Abstaining Evidential Decision Layer for Event Validation in VANETs

From Trust Scores to Driver Decisions: An Abstaining Evidential Decision Layer for Event Validation in VANETs

arXiv:2610.24810v1 [cs.CR] 17 Oct 2026

Ipek Abasıkeleş-Turgut∗ Computer Engineering Department, Iskenderun Technical University, Iskenderun, Hatay, 31200, Türkiye

Abstract Trust management in vehicular ad hoc networks is highly active, yet the decision that a driver needs, whether a reported event is real, has received far less attention; the schemes that make it force every decision into two outcomes, even on thin or conflicting evidence. This paper presents CREST, a vehicle-side event-decision framework that can withhold a decision its evidence does not support. Each vehicle weights the reports it holds by the trust, proximity and freshness of their senders, fuses them with Yager’s rule, and decides only when the fused margin reaches an abstention threshold. Abstention is a waiting state: a vehicle still unsure at the event is resolved by an explicit application policy, which makes the trade-off between missed hazards and unnecessary detours visible. CREST requires only a scalar trust per reporter and is built here on an evidential trust model whose consensus and revocation steps are updated to support the decision layer. A single report is shown to change the decision margin by at most its weight, which bounds the influence of an attacker coalition by its trust. In a pre-registered simulation study with fourteen attacks, including position spoofing and trustgated camouflage, and with all unspecified parameters of all systems tuned by the same procedure, CREST reduces the decision error of two published trust-based dissemination systems from 0.162 and 0.106 to 0.051. With the best-guess policy it also lowers both missed and unnecessary reroutes and ∗

Corresponding author. Email address: ipek.abasikeles@iste.edu.tr (Ipek Abasıkeleş-Turgut)

outperforms the forced binary rule on both error types in every cell. Keywords: Vehicular ad hoc networks, event validation, trust management, decision making, Dempster–Shafer theory, abstention 1. Introduction Safety applications in vehicular networks depend on what vehicles tell each other. A vehicle that reports an accident, a flooded road or a blocked lane allows the vehicles behind it to slow down or to change their route before they can see the hazard themselves. The same channel can be abused by insiders: a vehicle with valid credentials may hide a real hazard or announce one that does not exist, and the consequences range from congestion to accidents [1, 2]. Authentication schemes ensure that a message comes from a legitimate vehicle and has not been modified [3, 4, 5], but they cannot tell whether the reported event is real. Trust management addresses this gap and has become one of the most active topics in vehicular security. Recent proposals evolve trust formulas with genetic programming [6], organise trust evaluation in social communities [1], store reputation in blockchains [7, 8, 9], combine trust with incentive mechanisms [10, 9], and fuse trust evidence with Dempster–Shafer theory [11, 12]. Most of these models end with a trust score: a value per vehicle or per message, a set of revoked vehicles, or a selected service provider [10, 13, 7]. A driver, however, does not act on a trust score but on a decision about the event: is the reported hazard there or not. The step from the trust values of several, possibly conflicting reports to this decision receives far less attention than the trust computation itself. It is often assumed to be solved, as when trust evaluation starts “once a true emergency situation is validated” [1], and Sharma and Thakur describe an earlier trust model as one that “focuses on trust observation and not on decision making” [10]. The schemes that do define an event decision share three limitations (Section 2). First, they force every decision into two outcomes, even when the evidence is thin or contradictory [14, 15, 16, 17, 18]; one of them explicitly counts an undecided case as unacceptable [16], and another rejects waiting for confirmations as too slow [18]. A forced decision converts the lack of evidence into false alarms or missed hazards and lets a single report tip a balanced case. Second, the reports are weighted by the proximity of their senders to the event, but the positions are self-declared, and position falsifi2

cation is not evaluated [17, 9, 6]. Third, the evaluation stops at trust values or decision accuracy and does not show what a decision costs the driver, i.e. how many hazards are missed and how many detours are unnecessary. This paper proposes CREST, a vehicle-side event-decision framework that allows a vehicle to withhold a decision that its evidence does not support. Each vehicle weights the reports it holds by the trust of their senders, by their proximity to the event and by their freshness, and fuses them with Yager’s rule, which moves conflicting evidence to ignorance instead of renormalising it away. The vehicle decides only when the fused margin between the two hypotheses reaches an abstention threshold; otherwise it waits for more evidence. Abstention is thereby a waiting state, not an outcome: a vehicle that is still unsure when it reaches the event resolves the case by an explicit application policy, and the cost of remaining unsure is measured rather than hidden. CREST requires only a scalar trust value per reporter and is instantiated here on the evidential trust model IPEK [12], whose consensus and revocation steps are updated to support the decision layer. The contributions of this paper are as follows. • An abstaining evidential decision framework for event validation on the vehicle, with explicit policies for vehicles that remain unsure, so that the trade-off between missed hazards and unnecessary detours can be chosen by the application (Section 4). • Analytical properties that link the trust layer to the robustness of the decision: a single report changes the decision margin by at most its weight, so that reversing a correct decision requires a coalition whose trust-bounded weights reach twice the abstention threshold; the conditions under which an honest vehicle abstains; and the breakdown point of the credibility-weighted consensus (Section 5). • Two updates of the trust substrate motivated by the decision layer: a credibility-weighted median consensus that keeps the attackers’ trust low under local attacker majorities, and a time-based revocation rule whose delay does not depend on the update tempo (Section 4.2). • An evaluation of complete systems against HTEMD [15] and TCEMD [14], and of decision rules including AR-NDA [17] on a common trust substrate, under fourteen attacks, among them position spoofing and trust-gated camouflage, at two traffic densities and four 3

decision geometries. The protocol was registered before the runs, all unspecified parameters of all systems were tuned with the same procedure, and the results are reported at the trust, decision and application levels (Sections 6 and 7). The remainder of the paper is organised as follows. Section 2 reviews trust management and event decision schemes. Section 3 defines the system, the decision geometry and the threat model. Section 4 presents CREST, and Section 5 derives its analytical properties. Section 6 describes the evaluation methodology, and Section 7 the results. Section 8 discusses limitations, and Section 9 concludes the paper. 2. Related work 2.1. Trust management in vehicular networks Trust in vehicular networks is used in at least three different senses. In authentication and key-agreement schemes, trust is the property of a credential or of the infrastructure: a receiver accepts a message when its signature, pseudonym and freshness are valid [3, 2, 4, 5]. Such schemes establish who sent a message, but not whether its content is true, and a vehicle with valid credentials can still report a false event. Several of them take trust values as an external input [3] or leave misbehaviour detection to future work [5]. In resource-oriented schemes, a reputation score selects service providers, such as parked computing vehicles [10], task-offloading servers [13] or cache providers [7], by comparing the score with a threshold. In such schemes trust drives a selection rather than an assessment of content. The third sense, which is the one addressed here, is trust in the content of event reports. Entity-centric models rate the senders, data-centric models rate the messages, and hybrid models combine both [14, 15, 6]. Recent work has made the trust computation itself increasingly elaborate: genetic programming evolves the trust formula from many local evidences and adapts it when traffic conditions change [6]; community detection and a forest-fire spreading model select the vehicles that aggregate trust and relay emergency messages [1]; blockchains store reputation and game-theoretic incentives discourage false reports [8, 9]; and evidential models fuse feedback with Dempster–Shafer theory [11, 12]. The output of these models is a trust score or a set of revoked vehicles. How a receiving vehicle should turn the scores of several, possibly conflicting, reports into a decision about the event is often 4

taken for granted. Fabi and Thampi, for instance, start the trust evaluation “once a true emergency situation is validated” [1], without specifying the validation. IPEK [12], the trust substrate used in this work, belongs to the evidential family. It scales rewards and penalties with event severity and location criticality, discounts feedback from reporters that deviate systematically from the consensus of witnesses, and fuses the feedback with Yager’s rule into a global trust. Like most trust models, IPEK produces trust values and revocation decisions at the CA and does not decide on the vehicle whether an event is real. 2.2. Event decision schemes A smaller group of schemes defines an explicit decision about the event. Table 1 compares them with CREST. Trust-weighted voting. TCEMD [14] weights the ±1 opinion of each report by the CA-certified trust of its sender. A vehicle stores the messages it receives until it reaches a fixed decision distance and then follows the sign of the weighted vote, even on a single message; low-confidence results are acted upon but not rebroadcast. HTEMD [15] maps each message to an event probability from the hybrid certificate and direct trust of the sender, shrinks the mean probability towards 0.5 in proportion to the entropy of the message set, and compares the result with a threshold. Han et al. [9] accept a road-event message when a weighted sum of sender reputation, an exponential decay with the distance to the event and the similarity to already accepted messages exceeds a threshold. In all three schemes the decision is a threshold on a trust-weighted score. Freshness is at most a validity cut-off, and uncertainty is either not represented or, in HTEMD, represented as a neutral score that is still thresholded. A consistent colluding majority lowers the entropy in HTEMD instead of raising it. Risk- and learning-based rules. RTEAM [16] estimates, from trust-, hop-, time- and location-weighted report mass, the likelihood that the event is real and takes the action with the lowest Bayes risk, with error costs that depend on the time to reach the event and on the number of following vehicles. RTEAM is one of the few schemes with asymmetric decision costs, but it regards the case “where a vehicle could not determine the event state” as “unacceptable” and is designed to decide in all cases. MDF-TDM [18] decides 5

on each event message from the reputation of the sender, two feedback-driven risk scores and a context-predicted prior probability of the event, and explicitly argues against waiting for confirmations, since “waiting . . . may result in significant delays”. Aslan and Sen [6] evolve the data-trust formula with genetic programming over 18 local evidences, including proximity, recency and the share of vehicles reporting the same event, and accept or reject each message by a threshold. These rules use richer evidence than voting, but each message or event is still forced into one of two classes, and the cases with thin evidence, which Aslan and Sen identify as the hardest [6], are decided like all others. Evidential rules. Dempster–Shafer theory can represent the absence of evidence explicitly as mass on the whole frame. Peng et al. [8] fuse reputationweighted votes with Dempster’s rule in a hierarchical blockchain, but assign mass only to singleton hypotheses, so that no ignorance is represented, and select the level with the largest belief. DUEL [11] introduces an explicit uncertainty level into the trust opinion and divides its decision ratio by the uncertainty mass, so that a receiver may act at once, verify with neighbours or discard a message; the uncertainty, however, concerns the sender rather than the event, and under high uncertainty the receiver “is bound to react according to the majority”. AR-NDA [17] is the most complete evidential scheme. The RSU weights each opinion by a fuzzy trustworthiness of reputation and spatio-temporal proximity, fuses the opinions with Dempster’s rule, and switches to a vote-count and role-aware inference when the fused masses differ by less than a tolerance. The uncertainty thus changes the rule but never the binary form of the output; the decision is centralised at the RSU, and the authors state that they do not consider location forgery, although proximity is an input of the trust. 2.3. Abstention and robustness The option to withhold a decision is classical in pattern recognition. Chow [19] showed that a classifier that rejects inputs whose posterior falls below a threshold trades a lower error rate on the accepted inputs against the rate of rejected ones. Two properties distinguish the vehicular setting. First, the evidence of a vehicle approaching an event grows with time, so that a withheld decision can be taken later on more evidence; abstention is a waiting state rather than a final outcome. Second, the vehicle must eventually act, so that the cost of remaining unsure has to be counted as a missed 6

Table 1: Comparison of event decision schemes. Site: where the event decision is taken (V: vehicle, R: RSU, B: blockchain miners). Weights of the reports: T trust, P proximity, F freshness. Unc.: uncertainty represented and used in the decision. Abst.: the decision can be deferred because of insufficient evidence. Rev.: revocation of attackers. Attacks evaluated: Hid. hiding true events, Fab. fabricated events, Col. collusion, Pos. position falsification. Metrics: Dec. decision-level, App. application-level. ✓: yes; ∼: partly; –: no. Weights

Attacks

Metrics

Scheme

Year Site T P F Unc. Abst. Rev. Hid. Fab. Col. Pos. Dec. App.

TCEMD [14] RTEAM [16] DUEL [11] Aslan & Sen [6] HTEMD [15] Peng et al. [8] Han et al. [9] AR-NDA [17] MDF-TDM [18]

2020 2021 2022 2023 2024 2024 2024 2026 2026

V V V V V B V R V

✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓

∼ ✓ ∼ ✓ – – ∼ ✓ –

– – ∼ – ∼ – – ✓ –

– – – – – – – – –

✓ – – – ✓ – ✓ – –

✓ ✓ ✓ – – – – ✓ –

✓ – ✓ ✓ ✓ ✓ ✓ ✓ ✓

✓ – – – ✓ – – ✓ ✓

– – – – – – – – –

✓ ✓ – ✓ ✓ ✓ ∼ ✓ ✓

– – – – – – – – –

–

V

✓ ✓ ✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

CREST (this work)

– ✓ – ✓ – – ✓ ✓ –

hazard or as a detour. The schemes of Section 2.2 wait at most for a fixed distance or time window and then force a decision [14, 15, 6]; none of them defers a decision because its evidence is insufficient, and none reports what deferral costs at the application level. Two further aspects concern robustness. The decision schemes that weight reports by proximity [16, 9, 17, 6] rely on positions declared by the reporters; position falsification is a well-known misbehaviour in cooperative intelligent transportation systems [20], but none of the schemes evaluates it, and AR-NDA excludes it explicitly [17]. In addition, consensus-based filters such as the median of IPEK [12] or the outlier filter of HTEMD [15] break down once colluding attackers form a local majority among the reporters of a target [21]. 2.4. Positioning Table 1 shows a consistent pattern. Every scheme that decides about an event forces the decision into two outcomes. Explicit uncertainty, where present, either concerns the sender [11] or selects a fallback rule [17]. Proximity weights rest on unverified positions, and the evaluation stops at decision accuracy or trust values without measuring what the decision costs the driver. CREST addresses these gaps on the vehicle side: it represents the lack of evidence explicitly, defers decisions that the evidence does not 7

support, makes the cost of remaining unsure visible through explicit application policies, bounds the influence of an attacker coalition analytically, and is evaluated against complete competing systems at the trust, decision and application levels, including position spoofing and trust-gated camouflage. 3. System and threat model CREST is a vehicle-side decision framework that determines whether a reported event is genuine from the reports received by the vehicle and the trust of their senders. The framework does not define a trust model of its own; in common with decision schemes that rely on an external reputation source [17], it requires only a scalar trust value in [0, 1] for each reporter. In the present work, this trust value is provided by IPEK [12], whose system, event and perception models are adopted without modification. This section summarises the elements of the trust substrate on which the decision layer depends and defines the decision geometry and the threat model. The values of all parameters are listed in Tables 3 and 4 (Section 6.1). 3.1. Network, events and perception The system consists of vehicles, road-side units (RSUs) and a central authority (CA). The CA computes the global trust of every vehicle and the revocation list; RSUs relay feedback to the CA and the trust state back to the vehicles. The CA and the RSUs are trusted. Vehicles have unique identities and know their own positions. Message delivery within the broadcast range rb is assumed reliable, so that the evaluation isolates the trust and decision logic from channel effects. NE traffic events are placed at fixed, randomly drawn locations, equally many in each quadrant of the map. Each event e has an event severity SE and a location criticality SL , combined into the criticality factor CF = SE + SL − SE SL . Events belong to three classes: non-critical (Class 1, both dimensions low), mixed (Class 2, one dimension high) and critical (Class 3, both dimensions high). An event is active for De = D0 (1+CF ), then passive, and it reactivates at the same location after a class-dependent random delay. The location criticality is static map information and is therefore known to every vehicle; the event severity and the current state are known only to vehicles that observe the event.

8

Every event has an impact radius R. A vehicle within R is a witness: it perceives the state of the event with error probability perr (d) = p0

d , R

(1)

where d is its distance from the event and p0 the base error probability, and it broadcasts an event report every Trep while it remains within R. A report carries the sender identity, the event identifier, the reported state (active or not active), the sender position and a timestamp. A receiver keeps only the most recent report of each sender per event, discards reports of revoked senders, reports received farther than the acceptance distance Dacc from the event, and reports older than De /2. 3.2. Trust substrate IPEK [12] computes trust in two steps. A witness Vj compares each recorded report of a reporter Vi with its own perception and updates a local trust LTji ∈ [0, 1]. Agreement is rewarded with rate r+ = µ ω, where ω = ωE SE + ωL SL ; disagreement is penalised with rate r− = min(1, κ r+ CF ) γji , where the penalty ratio κ > 1 makes trust harder to gain than to lose and the observation-reliability factor γji discounts disagreements that may be caused by perception errors. The local trust values are sent to the CA as feedback. At the end of each round of length ∆, the CA first updates the credibility cj of every reporter from its mean absolute deviation from a per-target consensus of the feedback, where the deviation d0 maps to zero credibility and ρ is the smoothing factor. It then converts each feedback item into a simple mass function over {trusted, risky}, discounted by wj = GTj cj , fuses the items of each target sequentially with Yager’s rule [22], combines the result with the previous state, applies risk accentuation, and obtains the scalar global trust GTi by the pignistic transformation. A vehicle whose global trust stays below a detection threshold θ is revoked; IPEK uses Nr consecutive rounds for this test. The decision layer of CREST adopts the global trust GTi as the trust of reporter Vi (Section 4.1). Two steps of the substrate, namely the consensus used in the credibility test and the revocation rule, are updated in this work (Section 4.2); all remaining components and parameters of IPEK are retained as published [12]. The trust-layer parameters were re-tuned under the fairness protocol of Section 6, which applies the same procedure to every compared system. The tuning retained the published penalty ratio κ and changed the 9

acceptance distance Dacc βR

reports decider

receives and stores reports

R

event impact radius (witnesses) decision ring R < d ≤ βR

Figure 1: Decision geometry (schematic, not to scale). Witnesses inside the impact radius R observe the event and broadcast reports; a vehicle in the decision ring R < d ≤ βR decides from the reports it holds before it reaches the event. Vehicles farther away store reports up to the acceptance distance Dacc . The schematic was drawn with code prepared with the assistance of an AI tool (see the declaration of generative AI use).

two credibility parameters d0 and ρ, which IPEK had fixed without tuning (Table 3). 3.3. Decision geometry A trust substrate such as IPEK serves the CA by determining which vehicles are trustworthy and which are to be revoked. A driver, in contrast, requires a decision about the event before reaching it, and this decision is made on the vehicle side. A vehicle approaching an event becomes a decider when it enters the decision ring R < d ≤ βR, where β > 1 is the ring ratio; its task is to decide whether the event is active before it enters the impact radius, where it would observe the event itself (Fig. 1). The decider bases its decision on the reports it holds for the event (Section 3.1). Optionally, a vehicle that has reached a firm decision forwards the original reports it used, unchanged and with their original timestamps and positions, for up to h hops; forwarded reports are used for decisions only and never as trust evidence. The main evaluation uses no relaying (h = 0); a larger ring ratio βL and relaying over hmax hops are evaluated as a sensitivity analysis. 10

A decider that leaves the decision ring without having received any report about the event is uninformed. Uninformed vehicles occur in every compared system, are a property of the geometry and the traffic density, and do not change their route in any system. 3.4. Threat model The adversary is an insider with a valid identity that follows the protocol in form and falsifies its content. Each vehicle becomes an attacker independently with probability a ∈ A, and all attackers know each other and collude. An attacker acts on up to three channels: the report channel (the state it broadcasts), the feedback channel (the local trust values it sends to the CA, set to the extreme values 0 for honest targets and 1 for accomplices) and, newly in this work, the position channel (the position it declares in its reports). Outside its trigger condition the attacker behaves honestly and accumulates reputation. Table 2 lists the fourteen attacks. The eight attacks of IPEK combine four triggers with two channel configurations [12]. The severity trigger attacks events with SE ≥ θE , the location trigger events with SL ≥ θL , the on-off trigger attacks in the first half of every period Too , and the continuous trigger attacks at every opportunity; in these attacks an attacker reports an active event as not active. CREST adds three families that target the decision layer: • Fabrication. An attacker that witnesses a passive event reports it as active, always (Fab) or within the on-off window (Fab-OnOff). This attack targets false alarms, the error type that hiding attacks do not produce. • Position spoofing. The attacker hides active severe events as in RSev, but declares a position drawn uniformly from a disk of radius rs around the event centre, so that its report appears to come from the most reliable location. In addition, a spoofing attacker that is not a witness but is inside the decision ring sends the same false report remotely. The attack exploits any decision rule that rewards proximity. • Trust-gated camouflage. The attacker uses the severity trigger but attacks only while its own global trust satisfies GT ≥ θ +δ for a margin δ > 0; otherwise it behaves honestly to recover. This attacker knows the detection threshold θ and stays above it by design, which makes it the strongest adversary for any threshold-based revocation. 11

Table 2: Attacks used in the evaluation. Channels: R = report, F = feedback, P = position.

Attack

Channels

Trigger

Falsification

D-Sev, D-Loc, D-OnOff, D-Cont

R+F

active reported as not active

R-Sev, R-Loc, R-OnOff, R-Cont

R

Fab, Fab-OnOff

R

Spoof, Spoof-OnOff

R+P

severity / location / on-off / continuous severity / location / on-off / continuous passive event / on-off severity / on-off

Camo-R, Camo-D

R/R+ F

severity and GT ≥ θ + δ

active reported as not active passive reported as active as R-Sev, position near the centre, remote reports as R-Sev / D-Sev

Sybil identities, external attackers, silent attackers and attacks on the CA or the RSUs are outside the scope of this work. 4. CREST CREST is an event-decision framework executed on every vehicle. Its core is an abstaining evidential decision rule (Section 4.1), under which a vehicle fuses the reports it holds, weighted by the trust of their senders, commits to a firm decision only when the accumulated evidence is sufficiently strong, and otherwise defers the decision until further evidence arrives. Since the rule requires only a scalar trust value for each reporter, it is not tied to a particular trust model; in this study, the trust values are supplied by IPEK. The robustness of the decision nevertheless depends on the quality of the trust substrate: according to Proposition 2, the coalition required to reverse a decision grows as the trust of the attackers decreases. For this reason, two steps of the substrate are additionally updated (Section 4.2). The first is the consensus of the credibility test, which breaks down under local attacker majorities and thereby allows the trust of the attackers to rise; the second is the revocation rule, whose delay depends on the update tempo. These updates apply to IPEK rather than to the decision framework and 12

Decision framework (every vehicle) yes Reports held (si , ti , xi )

Weights wi = GTi πi ϕi

Yager fusion g = MA − MN

Firm decision: reroute or keep route

|g| ≥ τ no

Defer

re-evaluate every Tu Unsure on leaving the ring: no action, CREST+T or CREST+I feedback of witnesses

GTi , revocation list

Trust substrate at the CA (IPEK) Feedback LTji from witnesses

Credibility cj : weighted-median consensus

Global trust GTi : Yager, history, risk accentuation

Revocation: time rule (W , θ)

update of the trust substrate in this work

Figure 2: Overview of CREST. On every vehicle, the reports held about an event are weighted by the trust of their senders, by proximity and by freshness and fused with Yager’s rule; a firm decision is taken only when the margin reaches the abstention threshold τ , otherwise the decision is deferred. The trust substrate at the CA supplies the global trust values and the revocation list; the two dashed components are the updates of the substrate introduced in this work. The schematic was drawn with code prepared with the assistance of an AI tool (see the declaration of generative AI use).

are therefore evaluated separately through ablation. An optional plausibility check, which is not part of the CREST core, is described in Section 4.3. Fig. 2 gives an overview of the framework and of its interface to the trust substrate. 4.1. Abstaining evidential decision layer Report weights. Let a decider hold the reports {(si , ti , xi )}ni=1 about event e, where si ∈ {A, N} is the reported state (active or not active), ti the timestamp and xi the declared reporter position. Each report receives the weight wi = GTi · πi · ϕi ,     ∥xi − xe ∥ t − ti πi = max 0, 1 − , ϕi = max 0, 1 − , R De /2 13

(2)

where GTi is the current global trust of the reporter as broadcast by the CA, xe the event location and t the current time. The proximity factor πi follows the perception model (1): a report from the edge of the impact radius is the least reliable. The freshness factor ϕi decreases to zero at the report-age limit De /2 (Section 3.1), so that a report about to expire contributes little. All three factors lie in [0, 1], hence wi ∈ [0, 1]. Evidential fusion. Each report is a simple support function on the frame {A, N}: it assigns mass wi to the reported state and 1 − wi to the whole frame Θ, which represents ignorance. The reports are fused sequentially with Yager’s rule [22], in the order in which their senders were first heard (a newer report of the same sender replaces the older one in place). For two mass functions m1 , m2 with components (mA , mN , mΘ ), A A Θ Θ A mA = mA 1 m2 + m1 m2 + m1 m2 , N N Θ Θ N mN = mN 1 m2 + m1 m2 + m1 m2 , Θ mΘ = mΘ 1 m2 + K,

(3)

N N A K = mA 1 m2 + m1 m2 .

Unlike Dempster’s rule [23], Yager’s rule does not renormalise the conflict K away but moves it to ignorance. Contradicting reports therefore do not yield a confident result but increase the uncertainty, which is precisely the situation in which the decider ought to defer. The same rule is employed by IPEK for global trust [12]; in CREST it is applied to event reports rather than to trust feedback. Decision rule. Let M = (M A , M N , M Θ ) be the fused state and g = M A − M N ∈ [−1, 1] the decision margin. The decider takes a firm decision when the margin is large enough:   if g ≥ τ, active decision = not active if g ≤ −τ, (4)   defer otherwise, with the abstention threshold τ ∈ (0, 1). A firm decision is final for the current activation of the event. A deferred decision is re-evaluated at every position update of the decider, i.e. every Tu , with the reports held at that moment, until it either becomes firm or the decider leaves the decision ring, by entering the impact radius or by driving away. A decider that leaves 14

the ring without a firm decision but with at least one report is unsure; one without any report is uninformed (Section 3.3). Only firm decisions trigger relaying (Section 3.3). The threshold τ bounds the influence of an attacker coalition: as shown in Section 5, a single report changes g by at most its weight wi , so that reversing a correct firm decision requires reports whose weights sum to at least 2τ . Since wi ≤ GTi , a coalition of attackers with low global trust must be large to reverse a decision. This links the quality of the trust layer to the robustness of the decision. A forced binary rule corresponds to τ = 0 and loses this protection. Abstention as a waiting state. Abstention in CREST is a waiting state, not an outcome. A deferring vehicle keeps collecting reports, and its later firm decision rests on more evidence than an immediate forced one. If the vehicle is still unsure when it reaches the event, the application has to act, and CREST leaves this choice to an explicit policy. Three policies are considered: • No action: an unsure vehicle keeps its route. This minimises unnecessary reroutes but misses every active event on which the vehicle stays unsure. • CREST+T (best guess): an unsure vehicle acts on the sign of its last margin g, i.e. it reroutes if M A ≥ M N . • CREST+I (cautious): an unsure vehicle reroutes, treating a potential hazard as present. CREST+T is the default. CREST+I suits applications in which a missed hazard is much more costly than a detour. The three policies differ only for unsure vehicles; they share every firm decision, so they can be compared on the same simulation runs. 4.2. Updates to the trust substrate 4.2.1. Credibility-weighted median consensus The credibility test of IPEK compares the feedback of each reporter with a per-target consensus, computed as the plain median of the local trust values reported about the target in the round [12]. A plain median has a breakdown point of one half: once colluding attackers are a local majority among the reporters of a target, they determine the consensus. The credibility test then 15

reverses: honest reporters appear deviant and lose credibility, while attackers appear consistent. This happens in practice at high attacker shares, because attackers are not spread evenly over the targets. CREST replaces the plain median by the credibility-weighted median. For target Vi with reported values {LTji }j∈Ri , the consensus is n X o X cj , (5) ℓ̃i = min ℓ ∈ {LTji } : cj ≥ 12 j∈Ri , LTji ≤ℓ

j∈Ri

where cj is the credibility of reporter Vj from the previous round; if the cumulative weight equals exactly one half, the two adjacent values are averaged, and if all weights are zero, the plain median is used. As in IPEK, the consensus is defined only for targets with at least nmin reporters, and revoked reporters are excluded. The deviations and the credibility update of IPEK are then computed against ℓ̃i . The weighting moves the breakdown point from a share of reporters to a share of credibility. Attackers can control ℓ̃i only when their total credibility reaches half of the total (Section 5). Because the credibility of attackers decreases as long as the consensus is honest, the margin of protection grows by itself. The weight uses credibility only: a variant weighted by cj GTj performed worse in the tuning stage, since the global trust is itself corrupted at high attacker shares (Section 8). 4.2.2. Time-based revocation IPEK revokes a vehicle whose global trust stays below θ for Nr consecutive rounds [12]. The resulting revocation delay is proportional to the round length ∆, so any change of the update tempo changes the delay. CREST replaces the round count by a time window: a vehicle is revoked at the first round boundary at which its global trust has been below θ continuously for at least W seconds, revoke Vi at tk ⇐⇒ GTi (tm ) < θ for all round boundaries tm ∈ [tk − W, tk ]. (6) A round in which the global trust is at or above θ restarts the window. The delay then lies in [W, W + ∆) for any ∆ (Section 5), so that the update tempo enters only as a rounding term. In this study the window equals W = (Nr − 1)∆ (Table 3), so that at the fixed round length the time rule yields the same decisions as the round rule; the benefit of the rule is that it decouples revocation from the tempo, not a different behaviour at the operating point. 16

4.3. Optional position plausibility check Position spoofing (Section 3.4) exploits the proximity factor πi of (2). As an optional add-on, a receiver can test every directly received report against two plausibility conditions: • P1: the declared reporter position is farther from the receiver than rb + mp , the broadcast range plus a margin; ˆ > τp d, ˆ where ddecl is the distance implied by the de• P2: |ddecl − d| clared position and dˆ a noisy distance estimate from the received signal, modelled as dˆ = d (1 + ε) with ε ∼ N (0, σp2 ), and τp is the tolerance. A report that fails either condition is dropped without penalising its sender. A penalising variant was rejected in the tuning stage because noise-induced rejections of honest reports reduced honest trust. Forwarded reports cannot be checked in this way, because the receiver has no signal from the original reporter. The check is therefore evaluated separately as an add-on (Section 7) and is not part of the CREST configuration compared in the main results. 5. Analytical properties This section derives five properties that follow from the rules of the decision framework and of the substrate updates. Propositions 1 and 2 bound the influence of a reporter on the decision and link the trust layer to the robustness of the decision layer. Proposition 3 states when an honest decider abstains. Proposition 4 shows that the revocation delay of CREST does not scale with the round length. Proposition 5 gives the breakdown point of the credibility-weighted consensus. 5.1. Influence of a reporter on the decision Fusing a report with state A and weight w into a state M = A (M , M N , M Θ ) with Yager’s rule (3) gives
(M A , M N , M Θ ) 7→ M A + wM Θ , (1 − w)M N , (1 − w)M Θ + wM N , (7) and symmetrically for a report with state N. The map is linear in M , and starting from the vacuous state (0, 0, 1) it also produces the first fused report. The fused state of a report list is therefore the product of linear maps applied to (0, 0, 1). 17

Proposition 1 (Single-reporter influence). Inserting one report of weight w at any position of any report list changes the decision margin g = M A − M N by at most w.PA coalition of reports with weights w1 , . . . , wk changes it by at most min(2, j wj ). Proof. Let the report be inserted after a prefix with fused state s = (M A , M N , M Θ ), and assume it reports A (the other case is symmetric). By (7) the insertion changes the state by
δ = w M Θ , −M N , M N − M Θ . The suffix acts as a linear map L, so the final margin is f · s with the row vector f = (f1 , f2 , f3 ) = (1, −1, 0) L, and the change of the margin is   f · δ = w M Θ (f1 − f3 ) + M N (f3 − f2 ) . It is shown by backward induction over the suffix that f1 ≥ f3 ≥ f2 , f1 −f3 ≤ 1 and f3 − f2 ≤ 1. For the empty suffix, f = (1, −1, 0) satisfies these conditions. Prepending
an A report of′ weight u maps f to f1 , (1 ′− u)f′2 + uf3 , uf1 + (1 − u)f3 ; hence f1 − f3 = (1 − u)(f1 − f3 ) and f3 − f2 = u(f1 − f3 ) + (1 − u)(f3 − f2 ), which preserve the order and both bounds. An N report is symmetric. Therefore |f · δ| ≤ w (M Θ + M N ) ≤ w. The coalition bound follows by inserting the reports one at a time and applying the triangle inequality; since g ∈ [−1, 1], no change exceeds 2. The bound does not depend on the position of the report, so it holds for every fusion order. A numerical check over 5 · 104 random report lists (n ≤ 30, random insertion positions) foundQno violation larger than 3 · 10−16 ; a tighter coalition bound of the form 1 − j (1 − wj ) does not hold. Proposition 2 (Cost of reversing a decision). Let a decider hold a correct firm decisionPwith margin g ≥ τ . Pushing it into abstention requires coalition P weight j wj > g − τ ; reversing it into a wrong firm decision requires j wj ≥ g + τ ≥ 2τ . Since wj ≤ GTj by (2), k attackers with global trust at most Ta can reverse a correct firm decision only if k ≥ 2τ /Ta . Proof. Immediate from Proposition 1. Proposition 2 is the quantitative link between the two layers: every reduction of the attackers’ global trust by the trust layer enlarges the coalition 18

that the decision layer can withstand. The two alternative rules lose this property in different ways. A forced binary rule has τ = 0, so the barrier 2τ disappears and a single report can tip a balanced list. A majority vote gives every report the same weight, so the influence of a report is independent of its trust. 5.2. Abstention of honest deciders Proposition 3 (Abstention condition). If a decider holds n concordant reports of equal weight w ∈ (0, 1), its margin is g = 1 − (1 − w)n , and it decides firmly if and only if   ln(1 − τ ) ∗ . n ≥ n (τ, w) = ln(1 − w) Proof. By (7) with M N = 0, the ignorance mass is multiplied by 1 − w at each step, so M Θ = (1 − w)n and g = M A = 1 − (1 − w)n . The condition g ≥ τ is equivalent to the stated bound. A single report suffices if its weight satisfies w ≥ τ , whereas for a small threshold a weight of τ /2 already requires three reports. Since w decreases with the distance of the reporter from the event and with the age of the report, abstention among honest deciders is caused by sparse, distant or stale evidence. It therefore decreases with traffic density, and its application cost, the hazards missed by vehicles that remain unsure, is largest in sparse traffic. Section 7 confirms both effects. 5.3. Revocation delay Proposition 4 (Tempo independence of time-based revocation). Let the global trust of a vehicle fall below θ at round boundary t0 and remain below it. Under the round rule with Nr rounds the vehicle is revoked at t0 + (Nr − 1)∆. Under the time rule (6) with window W it is revoked at t0 + ⌈W/∆⌉∆, i.e. after a delay in [W, W + ∆). Proof. Global trust and the revocation test change only at round boundaries t0 + k∆. The round rule counts boundaries and fires at the Nr -th one, k = Nr − 1. The time rule fires at the first boundary with k∆ ≥ W , k = ⌈W/∆⌉.

19

Under the round rule the delay grows linearly with ∆, so any change of the update tempo, for instance an adaptive tempo, also changes the revocation delay. Under the time rule ∆ enters only as a rounding term smaller than one round. With the parameters of this study, W = (Nr − 1)∆ (Table 3), so that both rules revoke after exactly W , which is why the two rules produce identical results at the operating point of this study (Section 7). The proposition covers the revocation rule only: the convergence of global trust itself still depends on the number of rounds, so the detection delay as a whole is not tempo-free. 5.4. Breakdown point of the weighted consensus Proposition 5 (Breakdown point). Let the reporters of a target be split into honest reporters H and attackers A, and let ℓ̃ be the credibility-weighted median (5). If X 1 X cj , ca < 2 j∈H∪A a∈A then ℓ̃ lies within the range of the honest values, minh∈H LTh ≤ ℓ̃ ≤ maxh∈H LTh , whatever values the attackers report. If all honest reporters have credibility ch and all attackers ca , the consensus is safe as long as the local attacker share satisfies p < p∗ =

ch . ch + c a

Proof. Let C be the total credibility. The cumulative credibility of all values up to the largest honest value contains the whole honest credibility, which exceeds C/2; hence the weighted median, the smallest value at which the cumulative credibility reaches C/2, is not larger than that value. When the cumulative credibility equals exactly C/2 at some value, the median is averaged with the next value of positive weight, which is again not larger than the largest honest value, since honest credibility remains above it. Conversely, the values below the smallest honest value carry only attacker credibility, which is less than C/2, so the median is not smaller than the smallest honest value. With uniform credibilities the condition reads p ca < (1 − p) ch , which gives p∗ . For the plain median of IPEK, ca = ch and p∗ = 1/2. With credibility weighting, p∗ > 1/2 as soon as attackers have lower credibility than honest 20

reporters. The update of the credibility makes this margin self-reinforcing: while the consensus is honest, attackers deviate from it, their credibility ca decreases and p∗ increases. Once p > p∗ , the mechanism reverses and the honest reporters become the deviant ones. Since attackers are not spread evenly over the targets, local attacker majorities occur even when the global share is below one half; this is where the weighted consensus matters (Section 7). 6. Evaluation methodology The evaluation addresses three questions: how CREST performs as a complete system against complete competing systems, how much of its benefit is due to the decision rule itself, and how much is due to the updates of the trust substrate. The protocol, including all hypotheses, arms, cells and statistical procedures, was registered before the corresponding simulation runs; deviations are reported in Section 6.6. 6.1. Simulation setup The simulations are carried out with OMNeT++ 5.6.2 [24, 25], the Veins 5.2 framework [26, 27] and the SUMO 1.8.0 traffic simulator [28, 29]. The road network is a Manhattan grid. Two traffic densities are considered, a base scenario with NV vehicles and a dense scenario with NVd vehicles; each run lasts Tsim and uses one CA. Event, perception and attack models are those of Section 3. The ideal channel model is identical for all systems, so that differences between systems are due to their trust and decision logic. Table 3 lists the parameters of the system, the attacks, the trust substrate and CREST with their values; Table 4 lists those of the compared systems. 6.2. Compared systems The comparison is organised in three groups. Each group answers one question and changes only the components relevant to that question. Group 1: complete systems. The main comparison is between complete systems, each consisting of its own trust model, decision rule and revocation rule as specified in its original paper. Attaching the CREST decision rule to the trust models of the competitors would not test the competitors as published, and attaching their decision rules to IPEK would not test CREST; therefore no such hybrids are used. 21

Table 3: Parameters of the system, the attacks, the trust substrate and CREST. Values marked ∗ were tuned under the fairness protocol (Section 6.4); the published value is given in parentheses. Sensitivity values are listed after the main value. The parameters of the compared systems are given in Table 4. Symbol

Description

Value

Simulation – NV , NVd Tsim Tu

Road network Number of vehicles, base / dense scenario Simulated time per run Position update period of a vehicle

5 × 5 grid, 2000 × 2000 m 150 / 300 1000 s 1s

Network, events and perception (Section 3.1) rb Broadcast range NE Number of events SE , SL Event severity / location criticality: Class 1; Class 2; Class 3 D0 Base active duration, De = D0 (1 + CF ) R Impact radius of an event p0 Base perception-error probability Trep Report period of a witness Dacc Acceptance distance of reports Decision geometry (Section 3.3) β; βL Ring ratio of the decision ring R < d ≤ βR; enlarged ratio h; hmax Relaying hops; sensitivity value Attacks (Section 3.4) A; A3 Attacker ratios a; subset used for Groups 2, 3, the dense scenario and the geometry analysis θE , θL Severity and location triggers Too On-off period (attacks in the first half) rs Radius of the spoofed-position disk around the event centre δ; δ − , δ + Camouflage margin; sensitivity values Trust substrate: IPEK (Section 3.2) GT 0 Initial global trust (vacuous mass) µ; ωE , ωL Balance coefficient; weights of SE and SL in the reward κ Penalty ratio d0 Deviation at zero credibility ρ Credibility smoothing factor nmin Minimum reporters per target (and targets per reporter) ∆ Round length of the global-trust update CREST (Section 4) τ Abstention threshold θ Detection threshold W Revocation window of the time rule Nr Rounds of the round rule (IPEK; ablation) m p , σp , τ p Plausibility check: range margin, distance-estimate noise, tolerance

22

500 m 40 0.2 / 0.2; one in [0.7, 1.0], the other in [0.1, 0.6]; 0.9 / 0.9 100 s 250 m 0.1 5s 800 m 1.3; 2 0; 2 {0.10, 0.25, 0.30, 0.35, 0.40}; {0.10, 0.25, 0.40} 0.6, 0.4 40 s 50 m 0.10; 0.05, 0.20 0.5 0.15; 0.6, 0.4 5∗ (5) 0.3∗ (0.5) 1.0∗ (0.5) 3 50 s 0.10 0.35∗ 100 s 3 50 m, 0.2, 1.0

Table 4: Parameters of the compared systems. Values marked ∗ were tuned under the fairness protocol (Section 6.4); all other values are those of the original papers. Symbol HTEMD [15] αH λH kH 0 GTH τH

θH TCEMD [14] ΘT θT λT Tp AR-NDA [17] ∆A n0 ; ∆n Thr 1 , Thr 2 aA , bA

Description

Value

Penalty rate of the local update Coefficient of the activity term of direct trust Width of the outlier filter in units of 1.4826 MAD Initial trust Decision threshold

0.3∗ (unspecified; initial guess 0.3) 2.0∗ (unspecified; 0.5) 1.0∗ (unspecified; 3)

Distinct negative reporters required for revocation Revocation threshold on trust Trust decay without feedback Relaying threshold of a vehicle, drawn once

50

Belief difference for a direct decision Vote threshold; increment per importance level Confidence thresholds (several reports / a single report) Coefficients of the weighting factor aA + bA exp(m)

0.9 15 (sensitivity 5, 10); 10

0.2 0.5 (paper: drawn from N (0.5, 0.5)) Revocation threshold (immediate revocation) 0.05

0.05 0.95 N (0.5, 0.5), clipped to [0, 1]

0.7, 0.6 0.4, 0.2

• CREST: IPEK trust with the substrate updates of Section 4.2 (credibility-weighted median consensus, time-based revocation with window W and threshold θ) and the abstaining decision rule with threshold τ . Application results are reported for the policies CREST+T and CREST+I of Section 4.1. • HTEMD [15]: hybrid direct and certificate trust, an entropy-weighted forced binary decision taken once when the vehicle enters the decision area, and immediate revocation when trust falls below θH , as in the paper. • TCEMD [14]: cascading P trust, aPtrust-weighted forced binary decision on the sign of Dt = i si T ri / i T ri with si = ±1, and revocation when the number of distinct negative reporters exceeds ΘT and trust falls below θT , as in the paper. Group 2: decision rules on a common trust substrate. To isolate the contribution of the decision rule, the decision rules are compared on the same trust 23

substrate, revocation rule and threshold as CREST; only the rule that turns the received reports into a decision differs. • Majority: unweighted vote; the vehicle abstains when the normalised vote difference |nA − nN |/n is below τ . • Forced binary: the CREST fusion of Section 4.1 without abstention, i.e. with the threshold set to zero; a decision is taken as soon as one report is available. • Unweighted: the CREST fusion and threshold with all weights set to one, i.e. without trust, proximity and freshness. • AR-NDA [17]: fuzzy trustworthiness from reputation and proximity, Bayesian-approximated Dempster combination, direct decision when the belief difference exceeds ∆A , and the paper’s vote-count inference otherwise, with all parameters as given in the paper. AR-NDA defines no reputation model and assumes that reputations are available; here they are the global trust values of the common substrate. AR-NDA always reaches a firm decision when at least one report is available. Group 3: ablation of the substrate updates. CREST is compared with two variants that each undo one substrate update: CREST with the plain median consensus of IPEK (−weighted median) and CREST with the round-count revocation rule with Nr rounds (−time rule). Sensitivity analyses. • Decision geometry: the ring ratio and relaying are varied in a 2 × 2 design, {β, βL } × {0, hmax } hops, for CREST, the forced binary rule, HTEMD and TCEMD. • Camouflage margin: δ − and δ + in addition to the main value δ, for CREST. • AR-NDA vote threshold: two values of n0 below the published one, since the number of reports per decision in the present scenario differs from that of the original evaluation. • Plausibility check: CREST with the optional check of Section 4.3 under the two spoofing attacks. 24

6.3. Mapping of the competing systems The competing systems were designed for different geometries and partly leave behaviour unspecified. Each was mapped onto the common framework with the following rules, applied identically to all systems. • Common geometry. All systems use the same impact radius R, decision ring, acceptance distance Dacc and report-age limit; the zone radii of the original papers are replaced by this geometry. The decision instant follows each paper: HTEMD and TCEMD decide once on entering the decision area with the reports collected until then, and decide on the first report if none was available at entry. • Common evidence. Where a paper derives trust from communication success (HTEMD), which carries no information under an ideal channel, the agreement of a reported state with the judge’s own perception is used instead, which is the evidence used by IPEK and TCEMD. • No roles. All vehicles are equal. Authority classes (TCEMD) and government nodes (AR-NDA) are not modelled. All vehicles start from the same initial trust within each system: GT 0 in CREST and TCEMD, which equals the medium-authority value of TCEMD, and the prescribed value GTH0 in HTEMD. This removes an advantage that both systems have in their own designs; since no other system receives role information, the comparison remains symmetric. • Time scales. Update periods and revocation windows longer than the simulated time are mapped onto it: TCEMD updates trust every round ∆ instead of with its own, longer period, and its negative-reporter count is accumulated over the whole run. • Randomised thresholds. HTEMD draws its decision threshold at random; a fixed threshold τH equal to the mean of that distribution is used so that runs remain paired across systems. The relaying threshold Tp of TCEMD, drawn once per vehicle, is kept, since it matters only in the relaying sensitivity analysis. A complete list of the mapping decisions for each system, together with the reasons, is provided in the supplementary material (Sections S1–S4).

25

6.4. Fairness protocol Parameters that a paper specifies are used as specified. Parameters that a paper leaves unspecified were tuned for every system with the same procedure: tuning seeds 10–19, the reference cell D-Sev at 25% attackers, a criterion fixed in advance, extension of the grid whenever the optimum lies on its boundary, and a tie rule that prefers the published or default values. The selected values were frozen before any reporting seed was run. The procedure was applied as follows. • HTEMD: the three unspecified trust parameters αH , λH and kH were tuned for the open-loop separation of attackers and honest vehicles. With the initial guesses (Table 4) the separation on the tuning seeds was considerably lower than with the tuned values (AUC 0.627 against 0.848). • IPEK: three parameters, matched in number and role to those of HTEMD, were tuned with the same criterion: κ, d0 and ρ (Section 3.2). • CREST: the detection threshold θ was selected for the closed-loop F1 on the tuning seeds, and the consensus variant was selected under a protection rule that forbids losses at the two lowest attacker ratios of A3 . • TCEMD and AR-NDA: all numerical parameters are given in the papers, so no tuning was required. Tuning the unspecified parameters of the competitors works in their favour; with the initial guesses HTEMD performs worse than reported here. The reporting seeds, 20–39 for the base scenario and 20–29 for the open-loop, dense and geometry experiments, were not used in any earlier stage. Discrepancy with the HTEMD paper. In the HTEMD paper the trust of malicious vehicles falls to about the revocation threshold θH . In the present implementation, which follows the published equations, the trust of attackers does not fall that far, and with the published threshold HTEMD revokes practically no attacker while revoking honest vehicles (Section 7). The behaviour of the implementation is reported as measured, and the discrepancy is noted here rather than corrected by changing the published threshold.

26

6.5. Metrics Metrics are defined at three levels. • Trust level. The open-loop runs disable revocation and score each vehicle by si = mink max(GTi (k), . . . , GTi (k + Nr − 1)) over its rounds; the AUC is the probability that an attacker scores lower than an honest vehicle. In the closed-loop runs revocation is active. A true positive is a revoked vehicle that has attacked at least once, a false positive a revoked honest vehicle. The F1 score combines precision and recall over the vehicles that have attacked; the honest false-revocation rate is the share of honest vehicles revoked; the detection delay is the time from an attacker’s first attack to its revocation. • Decision level. Every passage of a vehicle through the decision ring of an event activation is an encounter. The decision error is the share of firm false alarms and firm missed events among informed encounters, i.e. firm and unsure ones; uninformed encounters are excluded, since no decision rule can act without reports. The unsure rate is the share of unsure encounters among informed ones. • Application level. A firm active decision triggers a reroute. The missed-reroute rate is the share of encounters with an active event that did not lead to a reroute, including unsure and uninformed encounters; the unnecessary-reroute rate is the share of encounters with an inactive event that led to a reroute. For CREST+T and CREST+I, unsure encounters are resolved by the respective policy; for systems without abstention the policies coincide with the plain rates. The decision lead is the distance d − R of the vehicle from the impact radius at a firm active decision. The decision error alone favours abstention, because an unsure encounter is not counted as an error. For this reason it is reported together with the unsure rate and the application-level rates, which count the cost of abstention. 6.6. Experimental design and statistics A cell is a combination of attack and attacker ratio. The base-scenario closed-loop comparison of Group 1 covers the fourteen attacks at every ratio of A and an attack-free control, i.e. 71 cells with 20 seeds each. Groups 2 and 3 use the ratios of A3 and the control (43 cells, 20 seeds). The open-loop 27

comparison uses the 71 cells and the dense scenario the 43 cells, both with 10 seeds. The geometry analysis uses six attacks (D-Sev, R-Sev, D-OnOff, Fab, Spoof, Camo-D) at the ratios of A3 and the control (19 cells, 10 seeds). Every comparison is between CREST and one other arm on the same seeds. In each cell, the paired two-sided Wilcoxon signed-rank test is applied, and the Holm correction is applied within each family of one arm pair and one metric across the cells, at the 5% significance level. Results are reported as the number of cells in which CREST is significantly better, not significantly different, or significantly worse, together with the cell means. With 10 seeds the smallest attainable two-sided p value of the exact test is 0.002, and after Holm correction over 43 or more cells no cell can reach significance. This limitation of the registered protocol was identified after the runs. For the 10-seed experiments two additional tests are therefore reported and labelled as not pre-registered: a seed-level test, which averages each seed over the cells and applies one Wilcoxon test to the ten paired means, and a cell-level sign test on the cell means. The 20-seed experiments are not affected. 7. Results All values are means over seeds and then over cells. Counts of the form b/e/w give the number of cells in which CREST is significantly better (b), not significantly different (e) or significantly worse (w) than the compared arm (Section 6.6). 7.1. Comparison of complete systems Table 5 summarises the comparison of CREST with HTEMD and TCEMD in the base scenario. Trust level. CREST separates attackers from honest vehicles better than both competitors in every attack cell, in the open loop (AUC 0.983 against 0.905 and 0.788) and in the closed loop. With its published revocation threshold θH , HTEMD revokes practically no attacker (F1 at most 0.003 in every cell). Its honest false revocations are confined to the attacks with a feedback channel: they are zero in the control and under every report-only attack, but reach 18–95% at 25% attackers and 80–100% at 40% attackers under D-Sev, D-Loc, D-OnOff and D-Cont. This pattern is consistent with the trust update of HTEMD, which replaces the trust of a target by the mean of the 28

Table 5: Complete systems, base scenario (closed loop: 71 cells including the control, 20 seeds; open loop: 70 attack cells, 10 seeds). Rates are fractions of encounters; Missed and Unnecessary denote the missed-reroute and unnecessary-reroute rates under the stated policy; the honest false-revocation rate is in percent. Metric

CREST HTEMD TCEMD vs HTEMD vs TCEMD

Trust level AUC, open loop∗ F1, closed loop Honest false revocation (%) Detection delay (s)

0.983 0.875 1.3 288

0.905 0.000 18.3 –∗∗

0.788 0.346 7.8 624

70/0/0 70/0/0 24/47/0 –

70/0/0 70/0/0 71/0/0 68/2/0

Decision level Decision error Unsure rate

0.051 0.057

0.162 0

0.106 0

71/0/0 –

70/1/0 –

Application level Missed, no action Missed, CREST+T Unnecessary, CREST+T Missed, CREST+I Unnecessary, CREST+I

0.142 0.100 0.083 0.088 0.126

0.210 0.210 0.107 0.210 0.107

0.135 0.135 0.133 0.135 0.133

47/7/17 69/2/0 48/20/3 71/0/0 5/29/37

8/18/45 55/11/5 69/1/1 63/6/2 28/35/8

∗

10 seeds; counts from the cell-level sign test, seed-level p = 0.002 against both (not pre-registered). ∗∗ HTEMD revokes practically no attacker; the delay is undefined.

feedback that passes the outlier filter, without history: colluding feedback that forms a local majority passes the filter and drives honest targets below the threshold. TCEMD revokes some attackers (F1 0.346) but also 7.8% of the honest vehicles on average, including 5.5% in the attack-free control; its global trust is recomputed in every round without history, so that a single round of negative feedback can push an honest vehicle below the threshold. CREST revokes 1.3% of the honest vehicles on average and 0.3% in the control; its highest false-revocation rate, 20.7%, occurs under D-Cont at 40% attackers, where it is still lower than that of HTEMD (100%) and TCEMD (47.8%). Decision level. The decision error of CREST is one third of that of HTEMD and one half of that of TCEMD (0.051 against 0.162 and 0.106) and lower in 71 and 70 of the 71 cells. The advantage grows with the attacker ratio (Fig. 3): under D-Cont, for example, the decision error of CREST rises from 0.043 at 25% to 0.142 at 40% attackers, that of TCEMD from 0.145 to 0.482 and that of HTEMD from 0.413 to 0.715. In the control, where no vehicle 29

Decision error

CREST

HTEMD

TCEMD

D-Sev

D-Cont

R-Sev

Spoof

10

10

10

10

0.6 0.4 0.2 0.0 25 40 Attackers (%)

25 40 Attackers (%)

25 40 Attackers (%)

25 40 Attackers (%)

Figure 3: Decision error as a function of the attacker ratio for four attacks (base scenario, 20 seeds; attacker ratios of A). Plotted directly from the simulation results with a script prepared with the assistance of an AI tool (see the declaration of generative AI use).

lies, CREST still halves the error (0.019 against 0.038 and 0.039). Here the only source of wrong reports is the perception error, which grows with the distance of the witness from the event; the proximity weight discounts exactly these reports, and the abstention threshold defers decisions that rest on them. CREST is unsure in 5.7% of the informed encounters; HTEMD and TCEMD never abstain. Application level. The application-level rates show what abstention costs and what it buys. If unsure vehicles take no action, CREST produces the fewest unnecessary reroutes (0.067) but misses more hazards than TCEMD (0.142 against 0.135, worse in 45 cells): a vehicle that is still unsure at the event and keeps its route misses the event whenever it is active. Resolving the unsure encounters removes this cost. With the best-guess policy CREST+T, CREST misses fewer hazards than both competitors (0.100 against 0.210 and 0.135) and also produces fewer unnecessary reroutes (0.083 against 0.107 and 0.133); against TCEMD it is better in 55 cells and worse in 5 for missed reroutes and better in 69 cells for unnecessary ones. The cautious policy CREST+I lowers the missed-reroute rate further, to 0.088, at the price of more unnecessary reroutes (0.126); this is the expected trade-off of a policy that treats every unresolved hazard as present. Attack families. Table 6 breaks the comparison down by attack at 25% attackers. Three families deserve attention. • Position spoofing is the only family in which CREST+T misses more 30

hazards than TCEMD in some cells (Spoof at 25%: 0.127 against 0.116; Spoof-OnOff at 25%: 0.157 against 0.135). Spoofed reports claim the most reliable position and therefore receive a high proximity weight in CREST, whereas TCEMD does not use proximity at all. The decision error of CREST nevertheless remains lower than that of TCEMD in both attacks, significantly so for Spoof. The optional plausibility check addresses exactly this weakness (Section 7.5). • Fabrication produces the highest unnecessary-reroute rates of all attacks, for every system (CREST+T 0.148, HTEMD 0.251, TCEMD 0.253 at 25%). Its on-off variant is also the hardest to detect for CREST (F1 0.530), because the attacker fabricates only during half of the time and only on passive events. • Trust-gated camouflage lowers the F1 of CREST from 0.951 (DSev) to 0.560 (Camo-D) and from 0.964 (R-Sev) to 0.618 (Camo-R) at 25% attackers: an attacker that knows the threshold and attacks only while its trust is high enough is revoked less often. The decision layer, however, is not deceived in the same way. The decision error under camouflage (0.032–0.036) is no higher than under the corresponding non-camouflaged attacks, since an attacker that keeps its trust above the threshold has to behave honestly most of the time. 7.2. Decision rules on a common trust substrate Table 7 compares the decision rules on the trust substrate of CREST. Since the trust layer, the revocation rule and the threshold are identical in all arms, the trust-level results coincide and only decision and application metrics are reported. The abstaining evidential rule has the lowest decision error of all rules. Against the forced binary rule, which uses the same fusion but never abstains, it is better in all 43 cells, both in decision error (0.047 against 0.072) and, with the CREST+T policy, in both application rates: fewer missed reroutes (0.095 against 0.106) and fewer unnecessary ones (0.080 against 0.097). Since the forced rule differs from CREST only by τ = 0, this comparison isolates the effect of abstention: deferring a weak decision and acting on the evidence available later is better on both error types than acting on the evidence available at once. Pooled over all encounters, the forced rule misses 100.1 31

Table 6: Per-attack results at 25% attackers (base scenario, 20 seeds). HTEMD has F1 ≤ 0.003 in every attack and is omitted from the F1 columns. FPR: honest false-revocation rate in percent. F1

FPR (%)

Decision error

Attack

CREST TCEMD

D-Sev D-Loc D-OnOff D-Cont R-Sev R-Loc R-OnOff R-Cont Fab Fab-OnOff Spoof Spoof-OnOff Camo-R Camo-D

0.951 0.979 0.964 0.979 0.964 0.986 0.975 0.996 0.912 0.530 0.990 0.996 0.618 0.560

0.163 0.177 0.182 0.245 0.376 0.492 0.380 0.808 0.454 0.237 0.425 0.538 0.353 0.157

0.5 0.6 0.9 1.6 0.3 0.3 0.3 0.3 0.3 0.3 0.2 0.3 0.3 0.6

23.3 33.9 18.0 95.2 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 22.5

9.2 10.4 9.3 13.5 5.4 5.1 5.5 3.3 4.6 5.6 5.3 4.8 5.4 9.2

0.037 0.035 0.037 0.043 0.034 0.033 0.034 0.040 0.032 0.027 0.075 0.097 0.032 0.036

0.115 0.141 0.115 0.413 0.098 0.115 0.102 0.173 0.068 0.052 0.129 0.161 0.098 0.114

0.086 0.099 0.087 0.145 0.070 0.075 0.074 0.086 0.065 0.053 0.089 0.104 0.070 0.085

–

–

0.3

0.0

5.5

0.019

0.038

0.039

Control

CREST HTEMD TCEMD

CREST HTEMD TCEMD

and unnecessarily reroutes 94.8 per 1000 encounters, CREST+T 96.1 and 81.0 (Fig. 4). The majority rule reroutes unnecessarily far more often than CREST+T (0.133 against 0.080, all 43 cells), but misses slightly fewer hazards (0.088 against 0.095). An unweighted vote counts every report equally, so near-ties are rare and the majority rule decides firmly more often; it ignores, however, which reporters are trusted and near the event. The unweighted variant of the CREST rule, which keeps the fusion and abstention but drops the weights, has a higher error (0.057) and more unnecessary reroutes (0.100) than CREST; the weights matter in addition to abstention. AR-NDA has the highest decision error (0.119) and the highest missed-reroute rate (0.160). Over all its decisions, 52% were taken directly from the belief difference, 41% by the final weighted comparison of the inference stage and 7% by the single-report rule; the vote-count step was never reached. Lowering the vote threshold n0 does not change this (Section 7.5). Like the forced rule, ARNDA always commits to a decision once a report is available and cannot defer a decision that rests on thin evidence. The decision lead of CREST is about 1 m shorter than that of the forced rules: a deferring vehicle decides slightly later, i.e. closer to the event. Relative to the width of the decision ring, (β − 1)R, this cost is small. 32

Table 7: Decision rules on the CREST trust substrate (base scenario, 43 cells, 20 seeds). Missed and Unnecessary: missed-reroute and unnecessary-reroute rates under the stated policy, which affects only abstaining rules. Counts: CREST better / not different / worse. Metric

CREST Majority Forced Unweighted AR-NDA

Decision error

0.047

Unsure rate Missed, CREST+T

0.055 0.095

Unnecessary, CREST+T

0.080

Missed, CREST+I

0.084

Unnecessary, CREST+I

0.121

Decision lead (m)

59.2

0.062 37/2/4 0.014 0.088 4/14/25 0.133 43/0/0 0.088 18/18/7 0.136 18/23/2 59.8

0.072 43/0/0 0 0.106 43/0/0 0.097 43/0/0 0.106 43/0/0 0.097 0/0/43 60.2

0.057 37/0/6 0.033 0.094 12/23/8 0.100 13/30/0 0.094 37/0/6 0.100 4/2/37 58.7

0.119 43/0/0 0 0.160 43/0/0 0.102 39/1/3 0.160 43/0/0 0.102 0/31/12 60.8

Fig. 4 shows the trade-off between the three policies. No action minimises unnecessary reroutes (65.9 per 1000 encounters in the base scenario) and pays for it with missed hazards: 136.9 per 1000 encounters, i.e. 36.8 more than the forced rule. CREST+T removes this cost and is the only policy that improves on the forced rule on both axes (96.1 and 81.0 against 100.1 and 94.8). CREST+I misses the fewest hazards (84.5) at the highest rate of unnecessary reroutes (123.2) and is the choice when missed hazards are much more costly than detours. The trade-off is milder in dense traffic, where abstention is rarer (1.8% against 5.4% unsure encounters) and the cost of no action shrinks to 6.0 missed hazards per 1000 encounters, as predicted by Proposition 3. 7.3. Ablation of the substrate updates Replacing the credibility-weighted median by the plain median of IPEK lowers the mean F1 from 0.874 to 0.837 and raises the honest false-revocation rate from 1.4% to 4.4% (43 cells, 20 seeds). The difference is concentrated in the dual-channel attacks at 40% attackers, where local attacker majorities occur: under D-OnOff the F1 falls from 0.922 to 0.475, under D-Cont from 0.857 to 0.359. CREST is significantly better in 5 cells for F1 and 7 cells for decision error and never significantly worse. This is the breakdown predicted by Proposition 5: the plain median fails once attackers form a local majority, and the credibility weighting moves the breakdown point beyond it. 33

Base (150 vehicles)

Dense (300 vehicles)

Unnecessary reroutes per 1000 encounters

70 120

CREST+I

CREST+I Forced binary

65 100

80

60

Forced binary

60

CREST+T

55 CREST, no action

50

80 100 120 140 Missed reroutes per 1000 encounters

CREST+T CREST, no action

50 55 60 65 70 Missed reroutes per 1000 encounters

75

Figure 4: Application outcome of the three CREST policies and of the forced binary rule, pooled over all cells and seeds. The three CREST policies share all firm decisions and differ only in the treatment of unsure encounters. The shaded area marks outcomes that are better than the forced rule on both axes. Plotted directly from the simulation results with a script prepared with the assistance of an AI tool (see the declaration of generative AI use).

Replacing the time rule by the round rule with Nr rounds yields identical results in every run, as predicted by Proposition 4 for W = (Nr − 1)∆. The time rule therefore does not change the behaviour at the operating point; its benefit is the independence of the revocation delay from the update tempo, which a fixed-tempo evaluation cannot show. 7.4. Dense scenario Table 8 repeats the main comparison with 300 vehicles, with all parameters and thresholds transferred unchanged from the base scenario. All conclusions of the base scenario hold in dense traffic. CREST has the lowest decision error and, with CREST+T, the lowest rates of both missed and unnecessary reroutes. Against the forced binary rule it has lower cell means in all 43 cells on both application rates (seed-level p = 0.002), which supports the pre-registered hypothesis that the benefit of abstention persists when evidence is abundant. As explained in Section 6.6, the registered cellwise test cannot reach significance with 10 seeds, and this support rests on the additional tests. More reports per decision reduce the decision error of every system, and the gap between CREST and the forced rule narrows (0.034 against 0.047), since abstention is needed less often. The honest falserevocation rate of CREST is lower than that of HTEMD on average (0.8% 34

Table 8: Dense scenario (300 vehicles; 43 cells, 10 seeds). Counts: cells in which the CREST mean is better / worse (sign test); seed-level p = 0.002 for every count shown (not pre-registered). Metric

CREST

HTEMD

TCEMD

Forced

AR-NDA

AUC, open loop

0.983

–

0.889 0.8 0.034

Missed, CREST+T

0.058

Unnecessary, CREST+T

0.057

0.803 42/0 0.351 14.7 0.069 40/3 0.084 37/6 0.104 42/1

–

F1, closed loop Honest false revocation (%) Decision error

0.933 42/0 0.000 10.5 0.099 43/0 0.123 43/0 0.090 42/1

0.889 0.8 0.047 43/0 0.067 43/0 0.066 43/0

0.889 0.8 0.075 43/0 0.098 42/1 0.076 41/2

against 10.5%), but not in every cell: as in the base scenario, HTEMD revokes no honest vehicle under report-only attacks, so that its cell mean is lower in 28 of the 43 cells, while its losses under the dual-channel attacks dominate the average. 7.5. Sensitivity analyses Decision geometry. Table 9 varies the decision ring and relaying. Enlarging the ring ratio from β to βL lets vehicles decide about three times earlier (decision lead 168–184 m instead of 59–60 m) but with less evidence, which raises the decision error and the missed-reroute rate of every system. Twohop relaying reduces missed reroutes, because fewer vehicles remain uninformed, and increases unnecessary reroutes, because false reports are relayed as well. Relaying over hmax hops in the enlarged ring, for example, lowers the missed-reroute rate of CREST+T from 0.120 to 0.091 and raises its unnecessary-reroute rate from 0.095 to 0.134. The ranking of the systems does not depend on the geometry. In all four configurations CREST has the lowest decision error in all 19 cells against every arm, and lower missed and unnecessary reroute rates than the forced rule in all 19 cells. Against HTEMD and TCEMD the application rates of CREST are significantly lower in 9 to 19 cells, depending on configuration and metric, and not significantly different in the others; the only cells in which CREST is significantly worse are one cell of the missed-reroute rate against TCEMD in each configuration with the main ring ratio. 35

Table 9: Decision geometry (19 cells, 10 seeds). β, βL : main and enlarged ring ratio; h: relaying hops (Table 3). Application rates with the CREST+T policy for CREST. Geometry

Metric

CREST

Forced

HTEMD

TCEMD

β, h = 0

Decision error Missed reroutes Unnecessary reroutes Decision lead (m)

0.044 0.086 0.084 59

0.066 0.096 0.099 60

0.114 0.146 0.125 60

0.086 0.107 0.143 60

βL , h = 0

Decision error Missed reroutes Unnecessary reroutes Decision lead (m)

0.065 0.120 0.095 168

0.096 0.140 0.121 176

0.158 0.207 0.122 176

0.124 0.164 0.141 177

βL , h = hmax

Decision error Missed reroutes Unnecessary reroutes Decision lead (m)

0.066 0.091 0.134 180

0.094 0.108 0.170 184

0.153 0.173 0.186 184

0.121 0.130 0.216 184

β, h = hmax

Decision error Missed reroutes Unnecessary reroutes Decision lead (m)

0.045 0.077 0.105 59

0.065 0.085 0.124 60

0.118 0.131 0.200 60

0.095 0.095 0.229 60

Camouflage margin. A larger margin makes the camouflaged attacker more cautious. With the smaller margin δ − the F1 of CREST is 0.705 (Camo-R) and 0.644 (Camo-D) at 25% attackers; with the larger margin δ + it falls to 0.427 and 0.365. The decision error stays between 0.029 and 0.036 for all margins: the more cautious the attacker, the more it behaves honestly and the less it harms the decision. AR-NDA vote threshold. With the two lowered values of n0 (Table 4) the decision error of AR-NDA under D-Sev, R-Sev and Spoof at 25% attackers is identical to that with the published value (0.110, 0.107 and 0.129). The weak performance of AR-NDA in the present scenario is therefore not caused by the choice of n0 . Plausibility check. Under the two spoofing attacks, the optional plausibility check lowers the decision error of CREST from 0.087 to 0.082, with a significant reduction in all six cells, and leaves the F1 practically unchanged (0.989 against 0.986).

36

8. Discussion and limitations 8.1. What abstention buys and what it costs The comparison with the forced binary rule, which uses the same fusion and differs only by the abstention threshold, isolates the effect of abstention. Its benefit does not come from refusing to act at the end: a vehicle that stays unsure and takes no action misses more hazards than a forced rule (Fig. 4). The benefit comes from deferring. A vehicle that waits for more evidence takes a firm decision later and on more reports, and this decision is more often correct; once the remaining unsure encounters are resolved by the bestguess policy, CREST+T is better than the forced rule on both error types in every cell. Abstention should therefore be understood as a waiting state with a resolution policy, not as a third answer. Two consequences follow for the interpretation of the metrics. The decision error counts only firm false alarms and firm misses, so it favours any rule that abstains; it has to be read together with the unsure rate and the application-level rates, which count unsure encounters as missed hazards or as detours. The application policies make the remaining trade-off explicit: no action minimises detours, the cautious policy minimises missed hazards, and the best-guess policy dominates the forced rule. The choice among them depends on the relative cost of a missed hazard and a detour in the application, which the framework leaves to the application instead of fixing it implicitly. Finally, the cost of abstention depends on the evidence available. In dense traffic vehicles hold more reports and abstain less often, so that the cost of the no-action policy shrinks considerably (Section 7.2), as predicted by Proposition 3. 8.2. Remaining attack surface Trust-gated camouflage. An attacker that knows the detection threshold and attacks only while its trust remains above it is revoked much less often, and the effect grows with the margin it keeps (Section 7.5). This is a limit of any threshold-based revocation and is not specific to CREST. The decision layer is affected less: to stay above the threshold, the attacker has to behave honestly most of the time, and the decision error under camouflage is no higher than under the corresponding non-camouflaged attacks. Detection and decision quality can therefore diverge, which is a further reason to evaluate both.

37

Position spoofing. Spoofed reports exploit the proximity weight of the decision rule. Position spoofing is the only attack family in which CREST+T misses more hazards than TCEMD in some cells, since TCEMD ignores proximity. The optional plausibility check reduces the decision error under spoofing in every cell, but the reduction is small, and forwarded reports cannot be checked because the receiver has no signal from the original sender. A reliable defence requires position verification that is independent of the reporter, for example by neighbouring vehicles or by the infrastructure [20]. Local attacker majorities. The credibility-weighted consensus moves the breakdown point of the credibility test beyond one half of the reporters (Proposition 5) but cannot remove it. The highest honest false-revocation rate of CREST occurs under continuous dual-channel attacks at the highest attacker ratio, where attackers dominate the feedback about many targets; it remains well below that of the competing systems, but it marks the regime in which the substrate, and with it the decision layer, loses its protection. 8.3. Negative results Several mechanisms were designed, registered and tested in the development stage, on seeds disjoint from the reporting seeds of Section 6.4, and were not adopted. They are reported because they delimit what the framework can achieve. • Adaptive update tempo. Shortening the round length when the threat level rises lowered the mean F1 from 0.939 to 0.905, raised the honest false-revocation rate from 4.2% to 6.8% and multiplied the number of rounds by 2.5. Faster rounds add noise to the global trust, and slower rounds delay its convergence; Proposition 4 makes the revocation rule tempo-independent but not the trust update itself. A variant that only slows down when the threat level is low did not pass its registered protection test at any tempo bound. • Vehicle-side conflict signal. The conflict between the active and the inactive evidence in the decisions of a round separated rounds under attack from rounds without attack (AUC 0.851), but less well than the threat score already available at the CA (0.907), and combining the two did not improve on the threat score. The signal was therefore dropped.

38

• Distribution-aware threshold. A detection threshold computed in every round as a robust lower quantile of the global trust distribution collapsed at high attacker ratios: the attackers shift the median and inflate the dispersion of the distribution they are measured against, so that the threshold fell below the attackers’ trust (mean threshold 0.115 and F1 0.077 in the worst cell, against 0.716 for the fixed threshold). The calibration is self-referential; its failure follows analytically once the attacker share exceeds a value that decreases with the spread of the honest trust values. • Penalising plausibility check. A plausibility check that also penalised the sender of every rejected report reduced the decision error under spoofing, but noise-induced rejections of honest reports lowered honest trust and caused false revocations; it failed its registered protection test. The reject-only variant of Section 4.3 was designed after this result and is labelled as such. • Trust-weighted consensus. Weighting the consensus by credibility multiplied by global trust, instead of credibility alone, performed worse and lost up to 0.145 AUC under continuous dual-channel attacks at the highest attacker ratio. At high attacker shares the global trust is itself inverted, attackers being more trusted than honest vehicles, while the credibility still separates them; the product carries the inverted trust into the consensus. 8.4. Limitations The evaluation has the following limitations. • Channel and infrastructure. The channel is ideal, and one CA with full coverage distributes the trust values. Packet loss, delay and partial RSU coverage would reduce the evidence available to a decider and would increase abstention; the size of this effect is not quantified here. • Scenarios. One urban grid is evaluated at two densities with one event model. Highway scenarios, other event distributions and real traces remain to be tested. • Trust substrate. CREST requires only a scalar trust per reporter, but it was evaluated on IPEK only. Its behaviour on other trust substrates 39

has not been measured, and the analysis of Section 5 suggests that the robustness of the decision depends on how well the substrate keeps the attackers’ trust low. • Competing systems. HTEMD and TCEMD were mapped onto a common geometry and evidence model, and their unspecified parameters were tuned; all mapping decisions are documented in the supplementary material. The present HTEMD implementation does not reproduce the low attacker trust reported in its paper (Section 6.4). • Statistics. For the 10-seed experiments the registered cell-wise test cannot reach significance; the reported significance relies on additional tests that were not pre-registered (Section 6.6). • Fixed parameters. The abstention threshold is the same for all events. A threshold that grows with the criticality of the location is a natural extension but was not evaluated. • Threat model. Sybil identities, external attackers and attacks on the infrastructure are out of scope, and the attackers’ positions can only be checked for directly received reports. 9. Conclusion Trust management in vehicular networks has produced many ways of scoring vehicles and messages, while the decision that a driver actually needs, whether a reported hazard is there, has received far less attention, and the schemes that make this decision force it into two outcomes. This paper has presented CREST, a vehicle-side event-decision framework that weights the reports held by a vehicle by the trust, proximity and freshness of their senders, fuses them with Yager’s rule, and decides only when the fused evidence is strong enough. Abstention is treated as a waiting state, and vehicles that remain unsure are resolved by explicit application policies. The analysis shows that a single report changes the decision margin by at most its weight, which ties the robustness of the decision to the trust that the substrate assigns to the attackers, and two updates of the IPEK substrate, a credibility-weighted median consensus and a time-based revocation rule, follow from this link.

40

Compared with the complete HTEMD and TCEMD systems under fourteen attacks, CREST has the lowest decision error (0.051 against 0.162 and 0.106), significantly lower than both systems in 70 of the 71 cells of the base scenario. With the best-guess policy, it also misses fewer hazards (0.100 against 0.210 and 0.135) and causes fewer unnecessary reroutes (0.083 against 0.107 and 0.133). On a common trust substrate, the abstaining rule is better than the forced binary rule on both error types in every cell, which shows that the benefit comes from deferring weak decisions rather than from refusing to act. The ranking of the systems holds in dense traffic and for all four decision geometries. The weaknesses that remain are explicit: trust-gated camouflage reduces detection, and position spoofing exploits the proximity weight, which the optional plausibility check only partly offsets. Future work includes the evaluation of CREST on other trust substrates and with realistic channel models, a criticality-dependent abstention threshold, cost-based selection of the application policy, and position verification that does not rely on the reporters, so that the proximity weight can also be used safely for forwarded reports. CRediT authorship contribution statement Ipek Abasıkeleş-Turgut: Conceptualization, Methodology, Software, Validation, Formal analysis, Investigation, Data curation, Writing – original draft, Writing – review and editing, Visualization, Project administration, Funding acquisition. Declaration of competing interest The author declares no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper. Funding This work was supported by the Scientific and Technological Research Council of Türkiye (TÜBİTAK) [grant number 124E017]. The funding source had no involvement in the study design, in the collection, analysis and interpretation of data, in the writing of the report, or in the decision to submit the article for publication. 41

Data availability The simulation code, the configuration files, the analysis scripts and the processed results supporting the findings of this study are available from the corresponding author upon reasonable request. The raw simulation output is not deposited in a public repository because of its volume. Declaration of generative AI and AI-assisted technologies in the manuscript preparation process During the preparation of this work the author used Claude (Anthropic) to draft and edit the manuscript text, to write the analysis and plotting scripts and the code of the schematic figures, and to check the consistency between the text, the code and the results. After using this tool, the author reviewed and edited the content as needed and takes full responsibility for the content of the published article. References [1] A. K. Fabi, S. M. Thampi, A trust management framework using forest fire model to propagate emergency messages in the Internet of Vehicles (IoV), Veh. Commun. 33 (2022) 100404. doi:10.1016/j.vehcom.2021. 100404. [2] J.-f. Tian, R. Ni, An identity authentication and key agreement protocol for the internet of vehicles based on trusted cloud-edge-terminal architecture, Veh. Commun. 49 (2024) 100825. doi:10.1016/j.vehcom.2024. 100825. [3] S. Zhang, Y. Liu, Y. Xiao, R. He, A trust based adaptive privacy preserving authentication scheme for VANETs, Veh. Commun. 37 (2022) 100516. doi:10.1016/j.vehcom.2022.100516. [4] A. Ghani, S. U. Jan, S. A. Chaudhry, R. Ahmad, A. K. Das, D. H. Kim, Enhancing security and trust using efficient privacy-preserving authentication in vehicular edge computing networks, Veh. Commun. 54 (2025) 100921. doi:10.1016/j.vehcom.2025.100921.

42

[5] S. V. Sawant, B. Rudra, QSSNET: A quantum-safe distributed trust network architecture for V2X authentication and secure communication, Veh. Commun. 61 (2026) 101062. doi:10.1016/j.vehcom.2026. 101062. [6] M. Aslan, S. Sen, A dynamic trust management model for vehicular ad hoc networks, Veh. Commun. 41 (2023) 100608. doi:10.1016/j. vehcom.2023.100608. [7] Z. Shen, Y. Wang, H. Wang, P. Liu, K. Liu, M. Liu, Privacy-protecting predictive cache method based on blockchain and machine learning in Internet of Vehicles, Veh. Commun. 47 (2024) 100771. doi:10.1016/j. vehcom.2024.100771. [8] T. Peng, R. Zhang, X. Cheng, L. Yang, Reputation-based collaborative decision-making in hierarchical blockchain-enabled vehicular networks, in: Proc. IEEE International Conference on Communications (ICC), 2024, pp. 3610–3615. doi:10.1109/ICC51166.2024.10622660. [9] H. Han, M. Zhang, Z. Xu, X. Dong, Z. Wang, Decentralized trust management and incentive mechanisms for secure information sharing in VANET, IEEE Access 12 (2024) 124414–124427. doi:10.1109/ACCESS. 2024.3453368. [10] S. Sharma, R. Thakur, A trust-centric contract incentive mechanism for collaborative parked computing vehicle framework, Veh. Commun. 59 (2026) 101012. doi:10.1016/j.vehcom.2026.101012. [11] A. Bhargava, S. Verma, DUEL: Dempster uncertainty-based enhancedtrust level scheme for VANET, IEEE Trans. Intell. Transp. Syst. 23 (9) (2022) 15079–15090. doi:10.1109/TITS.2021.3136548. [12] İ. Abasıkeleş Turgut, IPEK: Event-criticality-aware evidential trust management against strategic insider attacks in vehicular ad hoc networks, arXiv preprint arXiv:2604.07532v3 [cs.NI] (2026). doi:10. 48550/arXiv.2604.07532. [13] S. K. Gupta, A. Banerjee, Energy and experimental trust-based task offloading in the domain of connected autonomous vehicles, Veh. Commun. 55 (2025) 100954. doi:10.1016/j.vehcom.2025.100954. 43

[14] Z. Liu, J. Weng, J. Ma, J. Guo, B. Feng, Z. Jiang, K. Wei, TCEMD: A trust cascading-based emergency message dissemination model in VANETs, IEEE Internet Things J. 7 (5) (2020) 4028–4048. doi: 10.1109/JIOT.2019.2957520. [15] J. Qi, N. Zheng, M. Xu, P. Chen, W. Li, A hybrid-trust-based emergency message dissemination model for vehicular ad hoc networks, J. Inf. Secur. Appl. 81 (2024) 103699. doi:10.1016/j.jisa.2024.103699. [16] R. J. Atwa, P. Flocchini, A. Nayak, RTEAM: Risk-based trust evaluation advanced model for VANETs, IEEE Access 9 (2021) 117772–117783. doi:10.1109/ACCESS.2021.3107467. [17] H. Li, Y. Liu, Z. Shang, Q. Cheng, M. Zhang, D. Liao, AR-NDA: An attack-resistant and node density-adaptive event validation scheme for securing VANETs, IEEE Syst. J. 20 (3) (2026) 759–770. doi:10.1109/ JSYST.2026.3701360. [18] S. Zhang, R. Li, Z. Liu, Z. Yang, Z. Liu, A multi-dimensional fusionbased trust decision model for event messages in VANETs, IEEE Trans. Dependable Secure Comput.Early access; not yet assigned to an issue (2026). doi:10.1109/TDSC.2026.3720420. [19] C. K. Chow, On optimum recognition error and reject tradeoff, IEEE Trans. Inf. Theory 16 (1) (1970) 41–46. doi:10.1109/TIT.1970. 1054406. [20] R. W. van der Heijden, S. Dietzel, T. Leinmüller, F. Kargl, Survey on misbehavior detection in cooperative intelligent transportation systems, IEEE Commun. Surv. Tutor. 21 (1) (2019) 779–811. doi:10.1109/ COMST.2018.2873088. [21] P. J. Huber, E. M. Ronchetti, Robust Statistics, 2nd Edition, Wiley, Hoboken, NJ, 2009. [22] R. R. Yager, On the Dempster–Shafer framework and new combination rules, Inf. Sci. 41 (2) (1987) 93–137. doi:10.1016/0020-0255(87) 90007-7. [23] G. Shafer, A Mathematical Theory of Evidence, Princeton University Press, Princeton, NJ, 1976. 44

[24] OpenSim Ltd., OMNeT++ discrete event simulator, version 5.6.2 [software], https://omnetpp.org, accessed 17 October 2026 (2020). [25] A. Varga, R. Hornig, An overview of the OMNeT++ simulation environment, in: Proc. 1st International Conference on Simulation Tools and Techniques for Communications, Networks and Systems & Workshops (SIMUTools), Marseille, France, 2008, pp. 60:1–60:10. doi: 10.4108/ICST.SIMUTOOLS2008.3027. [26] C. Sommer, et al., Veins: The open source vehicular network simulation framework, version 5.2 [software], https://veins.car2x.org, accessed 17 October 2026 (n.d.). [27] C. Sommer, R. German, F. Dressler, Bidirectionally coupled network and road traffic simulation for improved IVC analysis, IEEE Trans. Mob. Comput. 10 (1) (2011) 3–15. doi:10.1109/TMC.2010.133. [28] German Aerospace Center (DLR) and others, Eclipse SUMO – simulation of urban mobility, version 1.8.0 [software], https://eclipse.dev/ sumo, accessed 17 October 2026 (n.d.). [29] P. A. Lopez, M. Behrisch, L. Bieker-Walz, J. Erdmann, Y.-P. Flötteröd, R. Hilbrich, L. Lücken, J. Rummel, P. Wagner, E. Wießner, Microscopic traffic simulation using SUMO, in: Proc. 21st IEEE International Conference on Intelligent Transportation Systems (ITSC), 2018, pp. 2575– 2582. doi:10.1109/ITSC.2018.8569938.

45

Related documents

• From Trust Scores to Driver Decisions: An Abstaining Evidential Decision Layer for Event Validation in VANETs#1389756
• Evidential Decision Theory and the Ostrich#96110
• Latency aware trust weighted federated intrusion detection for secure 6G vehicular IoT#406901
• Ev-YOLO: Uncertainty-Aware Object Detection via a Unified Evidential Formulation#1051074
• FoggyTrust: Robust Federated Learning with Hierarchical Trust Networks#319650