Communication-Efficient Private Federated Reinforcement Learning with Post-Quantum Authentication for Vehicular Networks

Communication-Efficient Private Federated Reinforcement Learning with Post-Quantum Authentication for Vehicular Networks

arXiv:2610.41055v1 [cs.LG] 29 Oct 2026

Hojat Allah Salehi1,2 , Devrim Aras1,2 , Md Jueal Mia1,2 , M. Hadi Amini1,2 Imtiaz Karim3 , Mashrur Chowdhury4 , Bhavani Thuraisingham3 1

Knight Foundation School of Computing and Information Sciences, Florida International University, Miami, FL 33199, USA 2 Security, Optimization, and Learning for Interdependent Networks Lab (solid lab), Miami, FL 33199, USA 3 Department of Computer Science, The University of Texas at Dallas, Richardson, TX 75080, USA 4 Glenn Department of Civil Engineering, Clemson University, Clemson, SC 29634, USA hsalehi@fiu.edu, amini@cs.fiu.edu

Abstract Federated reinforcement learning supports cooperative vehicular routing without centralizing trajectory data, but exchanging model updates may reveal private information and incur substantial communication overhead over intermittent vehicle-to-infrastructure links, particularly when post-quantum authentication is required. We study correlated private quantization, which uses complementary shared randomness between paired vehicles to reduce aggregation mean squared error while preserving the marginal parameter-level local differential privacy guarantee and one-bit communication cost of independent quantization. A tunable extension mixes shared and independent randomness to bound privacy leakage under paired-output observations and shared-randomness side information. For this extension, Rényi differential privacy accounting establishes vector-level local differential privacy for one model upload even when pairings are revealed. Under matched vector-level privacy and identical local and global parameters, the extension yields 16.5% lower analytical aggregation mean squared error than independent quantization. We evaluate cooperative routing by coupling microscopic traffic simulation with packet-level simulation of post-quantum-authenticated vehicle-to-infrastructure communication. Compared with full-precision updates, one-bit uploads reduce authenticated uplink size by 92.4% and increase the mean number of verified updates aggregated per round from 19.6 to 26.5. Under mobility-constrained communication at a parameter-level privacy budget of 1, correlated private quantization reduces mean travel time by 14.3% relative to independent quantization at the same budget and communication cost. At a parameter-level privacy budget of 0.3, a vehicle-origin inference attack trained on independent simulations reaches 30% accuracy with correlated private quantization and 22% with independent quantization after 100 rounds, versus 91% without privacy and 10% for random guessing. Code: https://github.com/solidlabnetwork/cpq-vehicular-frl

1

Introduction

Connected and autonomous vehicles increasingly rely on sensing and vehicle-to-everything (V2X) communication to support cooperative transportation services. Mobility data are distributed across vehicles and roadside infrastructure, making federated learning (FL) a suitable approach for collaborative model training without This work has been submitted to the IEEE for possible publication. Copyright may be transferred without notice, after which this version may no longer be accessible.

1

centralizing raw sensor and trajectory data. However, repeated exchanges of model updates over bandwidthconstrained vehicular links impose substantial communication overhead. Federated reinforcement learning (FRL) extends FL to sequential decision-making, allowing distributed agents to learn policies through local interactions and periodically aggregate model updates (Fan et al., 2021; Gao et al., 2024; Jin et al., 2022; Yuan et al., 2023). In vehicular networks, FRL has been investigated for traffic signal control, emergency vehicle routing, travel-time minimization, and communication resource management (Bao et al., 2023; Ye et al., 2021; Su et al., 2023; Mamond et al., 2025; Zhao et al., 2024; Wang et al., 2026; Jing et al., 2025). These applications motivate examining how privacy, authentication, and communication constraints affect collaborative policy learning in vehicular networks. Although keeping raw data local limits direct data exposure, federated learning does not by itself prevent information leakage through transmitted model updates. Prior work has demonstrated that shared gradients and model parameters can reveal information about local training data through attacks such as membership inference and model inversion (Shokri et al., 2017; Nasr et al., 2019; Fredrikson et al., 2015). Differential privacy provides a principled approach for limiting such leakage by randomizing the information released during training (Dwork and Roth, 2014; Abadi et al., 2016; Sun et al., 2021). In vehicular FRL, however, privacy mechanisms must be considered together with the communication cost of repeatedly exchanging model updates over bandwidthconstrained wireless links. This motivates mechanisms that provide formal privacy guarantees while reducing the size of transmitted model updates. Model updates must also be authenticated before aggregation so that the server can verify their origin and integrity. Conventional public-key signature schemes based on integer factorization or discrete logarithms are vulnerable to sufficiently capable quantum computers through Shor’s algorithm (Shor, 1999), motivating the transition toward post-quantum authentication. NIST has standardized ML-DSA and SLH-DSA (National Institute of Standards and Technology, 2024b,c) and selected Falcon for standardization as an additional post-quantum signature scheme (Alagic et al., 2022). These schemes provide authentication and integrity protection for exchanged federated model updates, but differ in signature size and computational cost, which can affect packet fragmentation, retransmissions, and delivery latency over V2X links. Post-quantum authentication is therefore both a security and a communication-design consideration in vehicular FRL. This work investigates privacy-preserving and communication-efficient vehicular FRL with post-quantumauthenticated model exchange. We investigate correlated private quantization (CPQ) for cooperative routing and compare it with independent stochastic binary quantization (Sun et al., 2021) and full-precision Gaussian and Laplace mechanisms. We also introduce CPQ-λ, which combines shared and independent local randomness to establish privacy guarantees under stronger server observations, including a vector-level guarantee for one model upload. We first evaluate routing performance across privacy budgets under ideal model exchange. We then couple Simulation of Urban Mobility (SUMO) trajectories with packet-level ns-3 simulations of IEEE 802.11p vehicleto-infrastructure (V2I) communication (Riley and Henderson, 2010). The primary mobility-coupled evaluation uses ML-DSA-44 authentication, with successful model delivery and verification determining participation in federated aggregation. Additional experiments compare ML-DSA-44, Falcon-512, and SLH-DSA-SHA2-128f with full-precision and CPQ updates, supported by cryptographic microbenchmarks. We also evaluate whether an honest-but-curious roadside unit (RSU) can infer vehicles’ starting road segments from received model updates across multiple rounds. Figure 1 illustrates the integrated framework. Our main contributions are: • Mobility-Coupled Evaluation of Authenticated Vehicular FRL. We develop an integrated SUMO and ns-3 evaluation framework that couples cooperative vehicular FRL with post-quantum-authenticated IEEE 802.11p V2I communication. By incorporating model delivery and verification outcomes into federated aggregation, the framework enables joint evaluation of communication reliability, effective participation, and routing performance under intermittent connectivity. • Communication-Efficient Private Quantization and Privacy Guarantees. We characterize CPQ for vehicular FRL, demonstrating reduced aggregation mean squared error (MSE) while preserving one-bit communication and the same ϵp -PLDP guarantee as independent stochastic binary quantization. We further introduce CPQ-λ and establish privacy guarantees under stronger observation models, including (ϵv , δv ) 2

Traffic Simulation Environment (SUMO)

Vehicle Clients (FLDQN Agents) Vehicle 1

FLDQN Local Training (DQN Policy)

Vehicle 2

FLDQN Local Training

PQC Signing (ML-DSA / SLH-DSA / Falcon)

Gaussian / Laplace)

Privacy Mechanism

PQC Signing

(CPQ / CPQ-ϵ / LDP-FL

(ML-DSA / SLH-DSA / Falcon)

Gaussian / Laplace)

⋮

(DQN Policy)

Privacy Mechanism (CPQ / CPQ-ϵ / LDP-FL

Vehicle N Traffic Observation Reward Computation

FLDQN Local Training (DQN Policy)

RSU / Aggregation Server Communication

·· ·

PQC Signature Verification

· ·

Verify sender Ensure integrity Reject invalid updates

Parameter Reconstruction Unpack parameters

⋯ · ·

Restore tensor shapes

Federated Aggregation

Privacy Mechanism

PQC Signing

(CPQ / CPQ-ϵ / LDP-FL

(ML-DSA / SLH-DSA / Falcon)

Gaussian / Laplace)

Dynamic Vehicle Environment

Aggregate verified updates

Produce global model

Figure 1. Architecture of the proposed privacy-preserving and post-quantum-authenticated vehicular FRL framework. SUMO trajectories drive ns-3 V2I communication, with signed full-precision global-model downlinks and privacy-protected, signed model-update uplinks.

vector-level local differential privacy for one complete model upload. Under matched vector-level privacy, CPQ-λ also demonstrates a theoretical aggregation-MSE advantage over independent quantization. • Post-Quantum Authentication and V2I Communication Trade-Offs. We quantify how modelupdate representation and post-quantum signature selection affect authenticated V2I communication through cryptographic benchmarks and mobility-coupled IEEE 802.11p simulations. The results show that one-bit uploads reduce message size and transfer latency versus full-precision updates, while signature overhead influences delivery reliability when model payloads are highly compressed. • Vehicle-Origin Inference Attack Evaluation. We evaluate an inference attack in which an adversary attempts to identify vehicles’ starting road segments from observed model updates across federated rounds. Under two attack settings with mobility-constrained V2I communication, CPQ substantially reduces attack accuracy compared with unprotected model exchange. The paper is organized as follows. Section 2 reviews related work. Section 3 presents the private quantization mechanisms and their privacy and aggregation-error analyses. Section 4 describes the post-quantum signature schemes, while Section 5 introduces the vehicular FRL formulation. Section 6 details system design and authenticated model exchange. Section 7 presents the experimental results, and Section 8 concludes the paper.

2

Related Work

Communication-efficient and privacy-preserving FL. Prior research has investigated communication-efficient and privacy-aware mechanisms for distributed estimation and learning, including locally private estimation and telemetry collection (Duchi et al., 2018; Ding et al., 2017), binomial randomization with secure aggregation (Chen

3

et al., 2022), randomized quantization with configurable output levels (Youn et al., 2023), and minimum-variance unbiased mechanisms supporting different communication budgets (Chaudhuri et al., 2022). Related sign-based methods address private and Byzantine-resilient gradient compression (Xiang and Su, 2023) and communicationefficient federated averaging (Tang et al., 2024). LDP-FL (Sun et al., 2021) provides independent stochastic binary quantization with one bit per parameter and an ϵp -PLDP guarantee. CorBin-FL (Salehi et al., 2024) uses complementary shared randomness across clients to reduce aggregation error while preserving the same marginal PLDP guarantee. Privacy, security, and FRL in vehicular networks. Vehicular FL research has investigated privacy-aware knowledge trading using personalized differential privacy and contract theory (Zhang et al., 2024), personalized learning for autonomous driving using correlated differential privacy (Tian et al., 2025), and authenticated secure aggregation (Byun et al., 2024). For sequential decision-making, federated deep reinforcement learning has been studied for task offloading and resource allocation in vehicular edge computing (Zhao et al., 2024), while federated graph-based multi-agent reinforcement learning has been applied to age-of-information optimization (Wang et al., 2026). More directly related to cooperative routing, FLDQN (Mamond et al., 2025) combines federated deep Q-learning with SUMO-based traffic simulation to minimize vehicle travel time and provides the routing and learning foundation adopted in this study. Vehicular traffic and communication simulation. Prior vehicular studies have coupled microscopic traffic and wireless network simulations to capture mobility-dependent communication. Veins integrates SUMO and OMNeT++ for bidirectionally coupled traffic and network simulation (Sommer et al., 2011), while iTETRIS combines SUMO and ns-3 to evaluate cooperative intelligent transportation applications (Rondinone et al., 2013). Research gap and positioning. Prior studies have established important foundations for privacy-preserving quantization, secure vehicular FL, cooperative FRL routing, and mobility-aware traffic–network simulation. Building on these foundations, two complementary research directions motivate this work. The first concerns improving aggregation accuracy through correlated one-bit quantization in vehicular FRL while maintaining formal parameter-level privacy and low communication cost. An additional theoretical question is how such mechanisms can provide privacy guarantees under stronger server observations while retaining an aggregationaccuracy advantage under matched vector-level privacy. We investigate CPQ for the first objective and introduce CPQ-λ to extend the privacy analysis, including a vector-level guarantee for one complete model upload. The second direction concerns the interaction between privacy-preserving model exchange and post-quantum-authenticated V2I communication. Under intermittent connectivity, model-update size and authentication overhead influence successful communication and verified participation in federated aggregation, which can ultimately affect routing performance. We examine these interactions through mobility-coupled, packet-level evaluation of vehicular FRL and complement the formal privacy analysis with vehicle-origin inference attack experiments.

3

Differential Privacy for Federated Learning

This section presents the privacy mechanisms used for local model exchange in vehicular FRL and analyzes their privacy and aggregation-error properties. We first establish a common parameter-level local differential privacy (PLDP) formulation and describe the independent one-bit LDP-FL (Sun et al., 2021) and Gaussian and Laplace additive-noise baselines (Dwork and Roth, 2014). We then present CPQ and establish its privacy and aggregation-error properties. Finally, we introduce CPQ-λ and analyze its guarantees under stronger observation models, including vector-level privacy for one complete model upload and aggregation-MSE comparisons under matched vector-level privacy. Common setup. At a given communication round, client Ci holds a locally trained parameter vector θ i = (θi,j )j∈[m] ∈ Rm , where m is the number of model parameters and j indexes their coordinates. For each coordinate j, all clients use a common public clipping interval Ij = [cj − rj , cj + rj ], where cj and rj > 0 denote the clipping center and radius, respectively. Clipping θi,j to Ij yields wi,j , and wi = (wi,j )j∈[m] denotes the clipped parameter vector. In our implementation, cj corresponds to the current global-model parameter, and all coordinates share a common radius rj = r. For a clipped input w ∈ Ij , let W i,j (w) denote the randomized parameter output, after reconstruction where applicable. We use the following parameter-level local differential privacy definition to

4

characterize these randomized outputs. Definition 1 (Parameter-Level Local Differential Privacy (PLDP)) For ϵp > 0 and 0 ≤ δp < 1, a randomized parameter mechanism satisfies (ϵp , δp )-parameter-level local differential privacy (PLDP) if, for every client i, coordinate j, inputs w, w′ ∈ Ij , and measurable output set T ⊆ R,

(1) Pr W i,j (w) ∈ T ≤ eϵp Pr W i,j (w′ ) ∈ T + δp . Pure ϵp -PLDP corresponds to δp = 0.

3.1

Independent Stochastic Binary Quantization (LDP-FL)

LDP-FL (Sun et al., 2021) provides the independent one-bit quantization baseline for CPQ and satisfies pure ϵp -PLDP for each clipped parameter. To simplify the scalar quantization rule, we fix a client i and coordinate j and write (w, c, r) = (wi,j , cj , rj ). For ϵp > 0, define α(ϵp ) =

eϵ p + 1 , eϵ p − 1

q(w) =

w−c 1 + . 2 2r α(ϵp )

(2)

Using independent local randomness, the client draws B ∼ Bernoulli(q(w)) and transmits the resulting one-bit symbol. With U = 2B − 1 ∈ {−1, +1}, the server reconstructs  W = c + U r α(ϵp ), W ∈ c − rα(ϵp ), c + rα(ϵp ) . (3) The reconstruction is unbiased since E[W ] = w. For a fixed coordinate j, consider n clients with clipped parameters wi,j ∈ Ij and independent quantization randomness. Pn Let W i,j denote the reconstructed parameterPofn client i, and define the reconstructed aggregate W g,j = n1 i=1 W i,j and clipped-parameter mean w̄j = n1 i=1 wi,j . The aggregate is unbiased, and its mean squared error is n  rj2 α2 (ϵp )   1 X 2 2 rj α (ϵp ) − (wi,j − cj )2 ≤ . E (W g,j − w̄j )2 = 2 (4) n i=1 n The equality follows from the independence of client randomization, which eliminates cross-client error covariance. Moreover, among unbiased binary quantizers with input-independent reconstruction levels satisfying ϵp -PLDP on the clipping interval, LDP-FL minimizes scalar MSE for every admissible input (Salehi et al., 2024, Proposition 1). Thus, its aggregation-error bound provides the reference for evaluating the benefits of correlated quantization. Certain quantization and sign-based mechanisms admit one-bit scalar configurations with the same response distribution and reconstruction levels as LDP-FL. The corresponding parameter mappings and conditions for equivalent aggregation behavior are detailed in Appendix A.

3.2

Gaussian and Laplace Mechanisms

Gaussian and Laplace mechanisms provide additive-noise baselines for comparison with one-bit private quantization. Both perturb parameters after they have been clipped to the public intervals defined in the common setup. Gaussian mechanism. Each client adds independent Gaussian noise to its clipped parameters according to Zi,j ∼ N (0, σj2 ).

W i,j = wi,j + Zi,j ,

For coordinate j, the sensitivity is ∆j = 2rj . We calibrate σj using the analytic Gaussian mechanism (Balle and Wang, 2018), selecting the smallest positive value satisfying     ∆j ϵp σ j ∆j ϵp σj Φ − − e ϵp Φ − − ≤ δp , 2σj ∆j 2σj ∆j 5

where Φ denotes the standard normal cumulative distribution function. This calibration ensures (ϵp , δp )-PLDP for each parameter. Laplace mechanism. For pure ϵp -PLDP, each client adds independent Laplace noise with scale ∆j /ϵp , where ∆j = 2rj (Dwork and Roth, 2014). W i,j = wi,j + Lap(0, 2rj /ϵp ).

3.3

Correlated Private Quantizer (CPQ)

CPQ coordinates the one-bit quantization of paired vehicle clients using complementary shared randomness. It preserves the marginal quantization distribution of LDP-FL, maintaining unbiasedness and the same ϵp -PLDP guarantee for each client, while reducing pairwise aggregation mean squared error (MSE) when both members of a pair contribute. We first describe the pairing and quantization procedures, then analyze their privacy and aggregation-error properties at the pair and population levels. To realize this coupling, the vehicles establish a shared group secret and agree on an ordered participant list before training. For each coordinate j and communication round t, a secret-keyed permutation of this list determines the client pairs. Each pair derives a common pseudorandom value V , with one client using V and the other using 1 − V for quantization. Pair assignments and random values are refreshed across coordinates and rounds without exchanging pairing information during training. In the implemented protocol, the RSU does not possess the group secret or the pairing assignments. The theoretical analysis models the shared values as independent Uniform[0, 1] variables across pairs, while the group-establishment procedure and finite-precision implementation are detailed in Appendix K and Appendix E. For each clipped parameter wi,j , client Ci uses its assigned complementary random value Vi,j,t in communication w −cj round t. Using the same quantization probability as LDP-FL, qi,j = 12 + 2ri,j , the client generates the one-bit j α(ϵp ) output bi,j = 1{Vi,j,t <qi,j } ∈ {0, 1}. (5) The server reconstructs each parameter using the same two output levels as LDP-FL, cj ± rj α(ϵp ). For n client updates included in aggregation, indexed by i ∈ [n], the reconstructed mean is n

W g,j = cj +

rj α(ϵp ) X (2bi,j − 1). n i=1

(6)

This reconstruction requires only the received bits and public parameters (cj , rj , ϵp ), without revealing the pairing assignments. Algorithm 1 summarizes the procedure. The complementary coupling preserves each client’s quantization distribution while changing the dependence between paired outputs, which determines their aggregation error. Theorem 1 (PLDP, unbiasedness, and pairwise MSE optimality of CPQ) Let c ∈ R, r > 0, and 0 < ϵp < ∞. Consider two clipped inputs w1 , w2 ∈ [c − r, c + r] and their CPQ reconstructions Q1 , Q2 , obtained using complementary random values V and 1 − V , where V ∼ Uniform[0, 1]. Write α = α(ϵp ) and define b = (Q1 + Q2 )/2. xk = (wk − c)/(rα), A = (w1 + w2 )/2, and A (i) PLDP and unbiasedness. Each Qk follows the same output distribution as the LDP-FL quantizer b = A. Applied and satisfies pure ϵp -PLDP according to Definition 1. Moreover, E[Qk ] = wk , so E[A] coordinatewise, CPQ also provides an unbiased reconstructed aggregate for any fixed set of clients. (ii) Pairwise MSE optimality. Among all couplings of individually unbiased binary quantizers with reconstruction levels c ± rα satisfying ϵp -PLDP, CPQ minimizes the pair-average MSE for every admissible input pair, attaining   r 2 α2 (x1 + x2 )2 (7) m∗ (w1 , w2 ) = |x1 + x2 | − . 2 2 This MSE is strictly smaller than that of independent quantization with the same output distributions. 6

Algorithm 1 Correlated Private Quantizer (CPQ) ϵp

+1 Inputs: n participating clients, m model parameters, communication round t, privacy budget ϵp (α = eeϵp −1 ), (t)

clipping parameters (c, r), and global model Wglobal . Setup: Each vehicle holds (R, e, KG ), established before training using Algorithm K.1. 1: for each client Ci , in parallel do (t) 2: Receive Wglobal , c, r from the server 3: Perform local reinforcement learning to obtain θ i 4: for each coordinate j ∈ [m] do 5: wi,j ← min{cj + rj , max{cj − rj , θi,j }} wi,j −cj 6: qi,j ← 21 + 2r jα 7: Vi,j,t ← HiddenPairValue(KG , R, e, i, j, t) 8: bi,j ← 1{Vi,j,t <qi,j } 9: end for 10: Transmit bi = (bi,j )j∈[m] to the server 11: end for 12: Server aggregation 13: for each coordinate j ∈ [m] do n rj α X W g,j ← cj + 14: (2bi,j − 1) n i=1 15: end for Proof sketch. Since both V and 1 − V are uniformly distributed, each Qk follows the LDP-FL output distribution and therefore satisfies ϵp -PLDP. Furthermore, E[Qk ] = c + rα(2q(wk ) − 1) = wk , establishing unbiasedness. For the pairwise MSE, let Uk = (Qk − c)/(rα) ∈ {−1, +1}, with E[Uk ] = xk . Expanding the pair-average error gives 2 2  b − A)2 ] = r α 2 + 2E[U1 U2 ] − (x1 + x2 )2 . E[(A 4 The individual output distributions fix all terms except E[U1 U2 ]. For any coupling of these binary outputs, the Fréchet lower bound gives E[U1 U2 ] ≥ |x1 + x2 | − 1. The complementary random values used by CPQ attain this bound, yielding (7). Under independent quantization, E[U1 U2 ] = x1 x2 , giving mind − m∗ =

r 2 α2 [1 + x1 x2 − |x1 + x2 |] > 0. 2

The inequality is strict because |xk | ≤ 1/α < 1. The complete derivation is provided in Appendix B.

■

The pairwise MSE result extends to population-level aggregation when all included clients form complete pairs and distinct pairs use independent shared randomness. Under these conditions, the aggregation error can be bounded using the pairwise result. Corollary 1 (Population aggregation MSE of CPQ) For a fixed coordinate j, suppose the n client updates included in aggregation form n/2 complete pairs, with independent P shared randomness across distinct pairs. All n clients use the same public clipping parameters (cj , rj ). Let w̄j = n1 i=1 wi,j denote the mean clipped parameter. Then   rj2 E (W g,j − w̄j )2 ≤ κ(ϵp ), n ( (8) α2 (ϵp )/2, α(ϵp ) ≤ 2,
κ(ϵp ) = 2 α(ϵp ) − 1 , α(ϵp ) > 2.

7

For every finite ϵp > 0, κ(ϵp ) < α2 (ϵp ), yielding a strictly tighter aggregation-MSE bound than independent LDP-FL in (4). As ϵp → 0, the CPQ bound grows linearly in α(ϵp ), compared with quadratic growth for LDP-FL. Proof. Fix coordinate j and write c = cj , r = rj , and α = α(ϵp ). Let Sℓ and sℓ denote the reconstructed and clipped-parameter sums of pair ℓ, respectively. Since the pair-sum errors are unbiased and independent across distinct pairs, n/2    1 X  E (Sℓ − sℓ )2 . E (W g,j − w̄j )2 = 2 n ℓ=1

For tℓ = |sℓ − 2c| ∈ [0, 2r], the pair-sum MSE is four times the pair-average MSE in (7), giving   E (Sℓ − sℓ )2 = 2rαtℓ − t2ℓ . This concave expression is maximized over [0, 2r] at tℓ = min{rα, 2r}. The resulting upper bound is r2 α2 when α ≤ 2 and 4r2 (α − 1) otherwise. Summing over the n/2 pairs yields (8). Finally, κ(ϵp ) < α2 (ϵp ) for α(ϵp ) > 1, establishing the comparison with LDP-FL. ■ CPQ also supports partial participation, allowing each received update to contribute to aggregation even when its paired client’s update is unavailable. Complete pairs retain the pairwise MSE advantage of CPQ, while unmatched clients contribute the same quantization-error variance as independent LDP-FL. Consequently, for a fixed set of accepted clients selected independently of the quantization randomness, CPQ preserves unbiased aggregation and achieves MSE no greater than independent quantization of the same clients, with a strict improvement whenever at least one complete pair contributes. The population bound in (8) characterizes the complete-pair case.

3.4

CPQ-λ under Stronger Observations

CPQ-λ extends CPQ by combining complementary shared randomness with independent local randomness in the one-bit quantization process. The mixing probabilities control the dependence between paired outputs, allowing us to characterize aggregation-error behavior and privacy under stronger observation models, including access to both outputs of a pair or shared-randomness side information. The one-bit representation and server reconstruction rule remain unchanged. We first describe the mixing mechanism and then establish its privacy and aggregation-error properties. For a leader–follower pair and a fixed coordinate, let V ∼ Uniform[0, 1] denote the shared random value. Each client k ∈ {1, 2} independently draws a mixing indicator Ck ∼ Bernoulli(λk ) and a private random value Rk ∼ Uniform[0, 1], where λk ∈ [0, 1]. All these random variables are mutually independent. When Ck = 1, the client uses its assigned shared randomness, while Ck = 0 selects independent local randomness. The resulting quantization thresholds are T1 = C1 V + (1 − C1 )R1 ,

T2 = C2 (1 − V ) + (1 − C2 )R2 .

(9)

Using the quantization probability q(wk ) defined in (2), each client transmits bk = 1{Tk <q(wk )} . Since both thresholds are uniformly distributed, Pr(bk = 1) = q(wk ), and the reconstruction rule in (6) remains unchanged. Let µ = λ1 λ2 denote the probability that both clients select the shared-randomness branch. For fixed clipped inputs, the joint output distribution is Pλ = µPCPQ + (1 − µ)PIND ,

(10)

where PCPQ and PIND denote the joint distributions under complementary CPQ and independent LDP-FL quantization, respectively. When at least one client selects independent local randomness, the two outputs are independent. Thus, µ = 0 yields independent quantization, while λ1 = λ2 = 1 recovers CPQ. The dependence between paired outputs motivates two privacy criteria beyond the individual-output PLDP guarantee. The first considers an observer with access to both bits of a known pair, while the second allows additional side information about the shared randomness and paired client. 8

Definition 2 (Pair-view PLDP) For a fixed pair and coordinate, suppose an observer knows the pairing and observes (b1 , b2 ) ∈ {0, 1}2 . The mechanism satisfies ϵ-pair-view PLDP for client 1 if, for every w1 , w1′ , w2 ∈ [c − r, c + r] and every set T ⊆ {0, 1}2 , Pr((b1 , b2 ) ∈ T | w1 , w2 ) ≤ eϵ Pr((b1 , b2 ) ∈ T | w1′ , w2 ) .

(11)

The definition for client 2 is symmetric, with w1 held fixed. Definition 3 (PLDP under side information) For a fixed pair and coordinate, let Z denote side information generated without access to the protected input w1 and independently of client 1’s private random variables (C1 , R1 ). Non-protected inputs included in Z are held fixed in the privacy comparison. The mechanism satisfies ϵ-PLDP for client 1 conditioned on Z if, for every w1 , w1′ ∈ [c − r, c + r], every set T ⊆ {0, 1}, and almost every realization z of Z, Pr(b1 ∈ T | w1 , Z = z) ≤ eϵ Pr(b1 ∈ T | w1′ , Z = z). (12) The definition for client 2 is symmetric. For CPQ-λ, we consider the side information Z1 = (V, C2 , R2 , w2 ) for client 1, with the corresponding observation defined symmetrically for client 2. This observation includes the shared random value and the paired client’s input and local randomization, but excludes the protected client’s private randomness. We now characterize the privacy guarantees under these observation models and the associated aggregation-MSE properties. Theorem 2 (Privacy and aggregation MSE of CPQ-λ) Consider CPQ-λ with 0 < ϵp < ∞ and λ1 , λ2 ∈ [0, 1). For a fixed pair and coordinate, let w1 , w2 ∈ [c − r, c + r], set µ = λ1 λ2 , and write α = α(ϵp ). The following properties hold. (a) PLDP and unbiasedness. Each client’s one-bit output follows the LDP-FL distribution and satisfies pure ϵp -PLDP. The reconstructed parameters and their arithmetic mean are unbiased. (b) Privacy under stronger observations. Under the pair-view observation of Definition 2, CPQ-λ satisfies ϵS -pair-view PLDP, where  
µ ϵp ϵp −ϵp ϵS (ϵp , µ) = ln e + e −e . (13) 1−µ Under the side-information observation Z1 = (V, C2 , R2 , w2 ) of Definition 3, client 1 satisfies ϵC -PLDP, where  ϵp  e + λ1 ϵC (ϵp , λ1 ) = ln . (14) 1 − λ1 Both bounds are tight. The corresponding side-information bound for client 2 follows by symmetry. 2

2

(c) Pairwise MSE. Let xk = (wk − c)/(rα), and let mIND (w1 , w2 ) = r 4α (2 − x21 − x22 ) denote the pair-average MSE of independent LDP-FL quantization. With m∗ (w1 , w2 ) defined in (7), the CPQ-λ pair-average MSE is mµ (w1 , w2 ) = (1 − µ)mIND (w1 , w2 ) + µm∗ (w1 , w2 ).

(15)

For every µ > 0, this MSE is strictly smaller than that of independent quantization for all admissible input pairs. (d) Population MSE. For a fixed coordinate j, suppose the n updates included in aggregation form n/2 complete pairs, with independent randomness across distinct pairs. Let µℓ denote the mixing probability of pair ℓ, and Pn/2 define µ̄ = n2 ℓ=1 µℓ . Then   rj2   E (W g,j − w̄j )2 ≤ (1 − µ̄)α2 (ϵp ) + µ̄ κ(ϵp ) , n where κ is defined in (8). 9

(16)

Proof sketch. Write qk = q(wk ), q− = (1 + eϵp )−1 , and q+ = 1 − q− . Since each threshold Tk is uniformly distributed, the output bk follows the LDP-FL distribution, preserving ϵp -PLDP and unbiased reconstruction. For pair-view privacy, the finite output alphabet allows the privacy loss to be bounded through the likelihood ratios of the four possible bit pairs. Using the mixture in (10), the largest ratio is attained for the output (1, 1) when comparing q1 = q+ with q1′ = q− at q2 = q+ . This ratio equals eϵS in (13), establishing the bound and its tightness. For the side-information model, conditioning on Z1 = (V, C2 , R2 , w2 ) leaves the protected client’s private randomness (C1 , R1 ) undisclosed. Hence Pr(b1 = 1 | w1 , Z1 ) = λ1 1{V <q1 } + (1 − λ1 )q1 . Maximizing the conditional likelihood ratios over both possible bit values yields eϵC in (14). The bound is attained when V ∈ [q− , q+ ), proving tightness. The result for client 2 follows symmetrically. The mixture representation directly gives the pairwise MSE identity in (15). Its strict improvement for µ > 0 follows from the pairwise optimality result of Theorem 1. For population aggregation, the independent, zero-mean errors of complete pairs allow their MSE contributions to be summed. Applying the independent-quantization bound and Corollary 1 to each pair yields (16). Complete derivations are provided in Appendix C. ■

3.5

Vector-Level Privacy under Server Observation

We extend the privacy analysis of CPQ-λ to a complete model upload, complementing the parameter-level and Qm stronger-observation guarantees established above. For one communication round, let B = j=1 Ij denote the set of admissible clipped model vectors. We consider any two vectors wi , wi′ ∈ B for a target vehicle i, while holding the public round state and all other vehicles’ clipped inputs fixed. Definition 4 (Vector-Level Local Differential Privacy) For ϵv ≥ 0 and 0 ≤ δv < 1, a randomized observation mechanism Mobs satisfies (ϵv , δv ) vector-level local differential privacy if, for any target client i, any two clipped model vectors wi , wi′ ∈ B, and every measurable output set S, Pr(Mobs (wi ) ∈ S) ≤ eϵv Pr(Mobs (wi′ ) ∈ S) + δv .

(17)

The public round state and all other clients’ clipped inputs are held fixed in this comparison. We consider three observation models. An upload-only observer receives one client’s quantized model vector, while the RSU observer receives the quantized updates of all participating clients without knowing the secret pairing assignments or shared randomness. We further consider a stronger pairing-revealed observer that additionally knows the client pairings but not the shared random values. Establishing privacy under this stronger observation also provides a guarantee for the RSU when the pairing assignments remain hidden. To establish vector-level privacy for one complete CPQ-λ model upload, we use Rényi differential privacy (RDP) (Mironov, 2017). For an order ν > 1 and discrete distributions P and Q, the Rényi divergence is defined as Dν (P ∥Q) =

X 1 ln P (x)ν Q(x)1−ν . ν−1 x

(18)

A mechanism satisfies (ν, ρ)-RDP if this divergence is at most ρ for every admissible input comparison. We apply this criterion to the joint CPQ-λ output distributions at each coordinate. Under independent randomization across coordinates, the RDP bounds compose additively, yielding an (ϵv , δv ) vector-level privacy guarantee for any 0 < δv < 1, where ϵv = ρ + ln(1/δv )/(ν − 1). For symmetric CPQ-λ, define q− = (1 + eϵp )−1 , q+ = 1 − q− , and µ = λ2 . For a fixed coordinate, let Pu,z denote the joint distribution of the paired output bits (B1 , B2 ), with Pr(B1 = 1) = u and Pr(B2 = 1) = z, where u, z ∈ [q− , q+ ]. By (10), Pu,z (1, 1) = (1 − µ)uz + µ(u + z − 1)+ , where (x)+ = max{x, 0}. The remaining joint probabilities are determined by the two Bernoulli marginals. 10

Table 1: Analytical FedAvg MSE under matched vector-level privacy. Mechanism

Calibration

MSE formula

MSE ↓

Bits/ weight

LDP-FL CPQ-λ Gaussian Laplace

s0 = 0.001185 s = 0.001010 σ = 33.76 β = 33.75

A(s0 )2 /K (1 − λ2 )A(s)2 /K σ 2 /K 2β 2 /K

22.79 19.03 22.79 45.55

1 1 32 32

Theorem 3 (Vector-level privacy of CPQ-λ) Consider one model upload using symmetric CPQ-λ, with ϵp > 0 and 0 ≤ λ < 1. Assume independent ideal randomization across coordinates and distinct client pairs, with pair assignments independent of the protected inputs. The public round state and all other clients’ clipped inputs are held fixed. Under the pairing-revealed observation model, the observer sees all quantized uploads and knows the client pairings but not the shared random values. For any Rényi order ν > 1, the exact worst-case per-coordinate divergence is 1 ln max dν = ν − 1 (u,v)∈{(q− ,q+ ),(q+ ,q− )} z∈{q− ,q+ } (19) X Pu,z (x)ν Pv,z (x)1−ν . x∈{0,1}2

For a model with m parameters, CPQ-λ satisfies (ϵv , δv ) vector-level local differential privacy for one complete upload, where, for any 0 < δv < 1, an RDP-based privacy guarantee is obtained with   ln(1/δv ) ϵv = inf m dν + . (20) ν>1 ν−1 This guarantee holds with pairings revealed and therefore also applies to the RSU observation model in which pairings remain hidden. Proof sketch. For a fixed partner probability z, the partner’s output distribution is unchanged when the target input varies. Conditioning on the partner’s bit yields Bernoulli distributions whose success probabilities are nondecreasing in the target probability u. The largest Rényi divergence is therefore attained when the alternative target probabilities are q− and q+ , in either order. For these target endpoints, the joint output probabilities are affine in z. The joint convexity of the Rényi power sum for ν > 1 then places the maximum at z ∈ {q− , q+ }. This establishes the exact per-coordinate expression in (19). Under independent coordinate randomization, the joint observation distribution factorizes across the m model coordinates. Outputs of pairs not containing the target client have identical distributions under the two protected inputs and contribute zero divergence. Hence the total RDP divergence is bounded by m dν . Converting this bound to approximate differential privacy and optimizing over ν > 1 yields (20). Hiding the pairing assignments is a post-processing of the pairing-revealed observation and preserves the guarantee. The complete proof is provided in Appendix D. ■ We compare the analytical per-coordinate FedAvg MSE under a common vector-level privacy target of (ϵv , δv ) = (1, 10−5 ) for one complete model upload. All mechanisms are calibrated using the same RDP accounting framework, with m = 29,653 parameters, K = 50 vehicles, and clipping radius r = 0.02. To isolate the error introduced by privacy randomization, we consider identical local and global model parameters, such that wi,j = cj for all clients and coordinates. For binary quantization, define A(s) = r(es + 1)/(es − 1), where s denotes the mechanism-specific parameter-level privacy budget. CPQ-λ uses symmetric mixing with λ1 = λ2 = λ = 0.627 and is evaluated under the pairing-revealed observation model. As shown in Table 1, CPQ-λ achieves 16.5% lower aggregation MSE than independent LDP-FL at the same RDP-certified vector-level privacy target, while retaining one-bit communication. The analysis in Appendix D 11

further establishes an MSE advantage over LDP-FL for all admissible clipped inputs under the considered calibration. These comparisons use sufficient RDP-based privacy certificates and characterize theoretical aggregation error rather than routing performance under the stated vector-level privacy settings.

4

Post-Quantum Cryptography

In vehicular FRL, digital signatures authenticate global-model distributions and local-update uploads, allowing recipients to verify message origin and integrity (Twardokus et al., 2024). We consider post-quantum signatures to address long-term quantum security concerns while examining how their communication and computational overhead affects authenticated model exchange over mobility-constrained V2I links. We evaluate three post-quantum signature schemes with distinct cryptographic constructions and authentication overheads. ML-DSA, derived from CRYSTALS-Dilithium (Ducas et al., 2018), is a module-lattice-based scheme standardized under FIPS 204 (National Institute of Standards and Technology, 2024b), while SLH-DSA, derived from SPHINCS+ (Bernstein et al., 2019), is a stateless hash-based scheme standardized under FIPS 205 (National Institute of Standards and Technology, 2024c). Falcon is an NTRU-lattice-based signature scheme (Fouque et al., 2020) selected by NIST as the basis for FN-DSA (Alagic et al., 2022). The primary mobility-coupled V2I evaluation uses ML-DSA-44 to hold authentication constant, while controlled benchmarks and an additional signature-sensitivity experiment compare ML-DSA-44, Falcon-512, and SLH-DSA-SHA2-128f. The evaluated parameter sets differ substantially in authentication overhead. ML-DSA-44 produces fixed-size 2,420-byte signatures (National Institute of Standards and Technology, 2024b), while Falcon-512 generates compact, variable-length signatures averaging 655.1 bytes in our controlled microbenchmark (Fouque et al., 2020). In contrast, SLH-DSA-SHA2-128f produces 17,088-byte signatures (National Institute of Standards and Technology, 2024c). These differences are particularly relevant for bit-packed one-bit model updates, where authentication data can constitute a substantial fraction of the transmitted payload. Detailed measurements of public-key sizes, signature sizes, and cryptographic operation times are provided in Appendix H.

5

Federated Deep Q-Learning for Vehicular Routing

This section describes the adopted vehicular routing formulation, local DQN training, and federated model aggregation.

5.1

Vehicular Routing Formulation

We adopt FLDQN (Mamond et al., 2025), a federated routing framework based on deep Q-networks (DQNs) (Mnih et al., 2015). Each learning vehicle selects feasible outgoing road edges at successive intersections in response to evolving traffic conditions. In the SUMO-based simulation (Lopez et al., 2018), learning vehicles obtain network-wide traffic observations through the TraCI interface to construct their routing states, while background vehicles contribute to congestion without participating in federated training. For a road network with M directed edges, the state of a learning vehicle at decision step t is defined as St = [nt , v̄t , l, pt , pdest ] ,

(21)

where nt , v̄t , l ∈ RM represent the edgewise vehicle counts, mean speeds, and lengths, respectively. The vectors pt , pdest ∈ R2 specify the coordinates of the starting point of the vehicle’s current lane and its destination. The resulting state dimension is 3M + 4. At each routing decision, the DQN produces Q-values for a fixed set of action indices Amax , whose size corresponds to the maximum number of turning choices at any intersection. Since feasible turns vary by location, unavailable actions are masked during action selection, ensuring that each selected action corresponds to a reachable outgoing edge.

12

Routing rewards are based on the travel time experienced under the prevailing traffic conditions. Let ut denote the simulation time at which a vehicle enters the edge associated with routing decision t. Upon entering the subsequent edge, the base reward is rtbase = −(ut+1 − ut ). (22) To discourage cyclic routes, an additional penalty is imposed for repeated edge visits. Let Nt (et ) denote the number of visits to the selected edge et within the current trip, including the current visit. The complete reward is   Nt (et ) = 1, 0, rt = rtbase + −κ2 , (23) Nt (et ) = 2,   −κ3+ , Nt (et ) ≥ 3, where κ3+ > κ2 > 0 penalize the second and subsequent repeated visits. The reward thus favors shorter experienced travel times while discouraging repeated edge traversal. A vehicle’s trip ends when it reaches its destination, encounters a dead end, or exceeds the maximum trip duration Ttrip . Time-limit truncations are stored as nonterminal transitions in the local experience replay buffer, as detailed in Appendix G.

5.2

Local DQN Training and Federated Aggregation

Each vehicle maintains an online Q-network Q(s, a; θi ) and a target network Q(s, a; θi− ), whose parameters are periodically synchronized with the online network. The networks use fully connected layers with nonlinear hidden activations and a linear output layer. Each agent collects transitions in a local experience replay buffer Bi and trains its online network using sampled mini-batches. Routing decisions follow an ϵ-greedy exploration policy. For a sampled transition j, let Rj denote the observed reward. The Bellman target is yj = Rj + γ(1 − dj ) ′max Q(s′j , a′ ; θi− ), a ∈Amax

(24)

where γ is the discount factor and dj ∈ {0, 1} indicates whether the transition is terminal. The target maximization uses the full network output action set, whereas infeasible turns are masked during routing action selection. Defining the temporal-difference error as ej = yj − Q(sj , aj ; θi ), the online network minimizes the Huber loss B

1 X ℓδ (ej ), B j=1 H ( 1 2 e ,
ℓδH (e) = 2 δH |e| − δ2H ,

LHuber (θi ) =

(25) |e| ≤ δH , |e| > δH ,

where B is the mini-batch size and δH is the Huber-loss threshold. The network architecture, exploration schedule, and optimization parameters are specified in Appendix G. At federated round t, each vehicle performs E local training episodes using its available model. Vehicles that (t) successfully receive the authenticated current-round global model Wglobal are eligible to upload their locally trained online-network parameters after privacy processing. Target networks and experience replay buffers remain local. Let Vt denote the set of clients whose current-round uploads are successfully delivered and verified. For each (t+1) i ∈ Vt , let wi denote the model parameters reconstructed at the RSU using the selected privacy mechanism. The global model is updated through uniform federated averaging 1 X (t+1) (t+1) Wglobal = wi , (26) |Vt | i∈Vt

when Vt ̸= ∅. Otherwise, the global model remains unchanged. The authenticated, contact-dependent modelexchange procedure is detailed in Section 6. 13

6

System Design and Implementation

The implementation couples a shared SUMO traffic environment with ns-3 through synchronized vehicle mobility updates. Learning vehicles train local DQN policies using SUMO traffic observations, while a roadside unit (RSU) coordinates post-quantum-authenticated model exchange over simulated IEEE 802.11p V2I links. Global models are distributed in full precision, whereas eligible vehicles return privacy-protected updates. Mobility-dependent delivery and authentication determine which updates are accepted for federated aggregation. Figure 1 illustrates the integrated architecture.

6.1

Privacy-Protected and Authenticated Model Exchange

Before privacy processing, each eligible vehicle clips its locally trained model parameters relative to the authenticated (t) current-round global model Wglobal . For coordinate j, the clipping center is the corresponding global parameter (t)

Wglobal,j , with a common radius r > 0 across all coordinates. The clipped parameter is   (t+1) (t) (t+1) (t) wi,j = Wglobal,j + clip θi,j − Wglobal,j , −r, r , (t+1)

where θi,j

(27)

denotes the locally trained online-network parameter. This instantiates the public clipping parameters (t)

of Section 3 as cj = Wglobal,j and rj = r, which are also used for server-side quantized-parameter reconstruction. For CPQ and CPQ-λ, vehicles establish a shared group secret and agree on an ordered participant list R before federated training. Secret-derived ChaCha20 streams (Nir and Langley, 2018) determine coordinate- and rounddependent pair assignments and complementary pseudorandom values for paired clients. These values are generated locally without exchanging pairing information during training. The RSU relays authenticated setup messages but does not obtain the group secret or pairing assignments, which are not required for model reconstruction. Pairings are formed over the entire group R, independently of successful wireless delivery. Consequently, a received update remains usable when its partner’s update is unavailable, although the corresponding pairwise error cancellation is not realized. The complete setup and randomness-derivation procedures are provided in Appendix K. CPQ, CPQ-λ, and LDP-FL represent each model parameter with one bit. The binary outputs are packed separately for each parameter tensor using numpy.packbits, with the original tensor shapes stored as metadata. The packed arrays and metadata are serialized into compressed NPZ payloads. At the RSU, padding bits are removed according to the original tensor sizes, and the binary values are restored to their tensor shapes before parameter reconstruction. In contrast, Gaussian and Laplace updates retain float32 representations, as do globalmodel downlinks. These payloads are subsequently authenticated and transmitted through the V2I communication framework. Before federated training, the RSU and learning vehicles generate post-quantum signing key pairs and register their public keys through an assumed authenticated bootstrap channel, which may be supported by V2X credentialmanagement infrastructure (Twardokus et al., 2024). The primary mobility-coupled evaluation uses ML-DSA-44, while the signature-sensitivity experiment considers Falcon-512 and SLH-DSA-SHA2-128f. In each configuration, the selected signature scheme authenticates global-model downlinks, local-update uplinks, and CPQ/CPQ-λ group-establishment messages. For CPQ and CPQ-λ, vehicles use ML-KEM-512 key pairs to establish a shared group secret through authenticated, ML-KEM-protected messages relayed by the RSU (National Institute of Standards and Technology, 2024a). The RSU does not obtain the group secret, and the establishment protocol is provided in Appendix K. Each authenticated model object contains a compressed NPZ payload P , a serialized JSON header Hbytes , and a post-quantum signature σ, with length fields delimiting the header and signature. The header identifies the sender, vehicle, federated round, transmission direction, and signature scheme, together with payload metadata. For both uplink and downlink exchanges, the sender signs the serialized header and payload jointly σ = SignA (sk sender , Hbytes ∥ P ) ,

(28)

where A denotes the selected signature scheme. After complete SR-ARQ reassembly, the receiver verifies the signature using the sender’s registered public key and validates the signed sender, vehicle, round, and direction 14

against the expected transfer context. These checks bind the model content to its authenticated communication context. Only verified current-round downlinks establish uplink eligibility, while only successfully delivered and verified uplinks contribute to aggregation.

6.2

Mobility-Coupled V2I Communication

We use ns-3 (Riley and Henderson, 2010) to model IEEE 802.11p V2I communication between learning vehicles and a single RSU located at junction J3 of the SUMO road network. The wireless channel combines log-distance path loss, Nakagami-m fading, and constant-speed propagation delay, with fixed-rate OFDM transmission and an 802.11p ad hoc MAC. The evaluated road-network topology is shown in Appendix F, while the radio and communication parameters are detailed in Appendix G. At each SUMO simulation step ∆t, the positions and velocities of active learning vehicles are supplied to ns-3, which advances synchronously with the SUMO simulation clock. Between updates, vehicle positions evolve according to a constant-velocity mobility model. Only the K learning vehicles are represented as wireless nodes, while background traffic affects vehicle mobility without generating wireless interference. Vehicles that have not departed or are no longer active are kept outside communication range. Transfer outcomes and delays are measured in simulation time, independently of training execution time. The RSU periodically broadcasts discovery beacons over the simulated IEEE 802.11p channel. A vehicle becomes eligible for model exchange after successfully receiving at least Nbeacon beacons within a sliding observation window of duration Tobs . This reception-based criterion accounts for wireless channel conditions rather than relying solely on geometric proximity. Contact eligibility, however, does not guarantee successful delivery of a complete model object. Pending transfers from eligible vehicles are managed through a first-come, first-served (FCFS) queue, with only one active uplink or downlink transfer permitted at a time. The RSU periodically updates contact eligibility and schedules the next eligible request after processing completed attempts. Waiting vehicles that lose contact are removed from the queue, while unfinished transfers may be retried during subsequent contact opportunities before the communication phase ends. Requests with additional transfer work rejoin at the end of the queue after each completed attempt. Packet-level reliability is handled separately by the SR-ARQ mechanism described below. The beacon and scheduling parameters are reported in Appendix G. Authenticated model objects may exceed the payload capacity of a single IEEE 802.11p frame. We therefore use a custom Selective Repeat ARQ (SR-ARQ) layer over UDP to fragment each object into indexed chunks and reassemble it at the receiver. Each chunk carries message identification, sequencing, and CRC-32 integrity metadata. The receiver acknowledges valid chunks, while the sender retransmits unacknowledged chunks using a sliding window and a bounded retry count. An attempt fails when a chunk exhausts its retransmission limit, after which the RSU may schedule another attempt during a subsequent contact opportunity before the communication drive ends. Complete objects undergo signature and context verification after reassembly. The transport configuration and chunk-header format are detailed in Appendix G (Table G.2). A persistent TCP control connection coordinates the Python co-simulation driver and the ns-3 process. It supports mobility updates, contact queries, asynchronous transfer requests, and synchronized simulation advancement, while reporting transfer outcomes and completion times. Model data is transmitted through the simulated UDP/IEEE 802.11p wireless channel rather than the TCP control connection. The end of each communication drive defines the deadline for pending model exchanges. The communication mechanisms described above are integrated into the contact-dependent federated round summarized in Algorithm 2. Let C denote the learning vehicles, Et ⊆ C those that successfully receive and authenticate the round-t global model, and Vt ⊆ Et those whose current-round updates are delivered and verified. Downlink and uplink exchanges occur in separate SUMO communication drives, during which vehicles follow their routing policies without learning. Between these drives, all vehicles train in a shared SUMO environment using either the authenticated current-round model or their previously held model. Only vehicles in Et are eligible to upload for aggregation.

15

Algorithm 2 One contact-dependent federated round (t)

Input: Global model Wglobal , clients C, local episodes E, privacy mechanism M, signature scheme A, network model N (t+1) Output: Updated global model Wglobal 1: Authenticated downlink (t) 2: Et ← AuthenticatedDLA,N (Wglobal , C, t) 3: Local training 4: for each i ∈ C do (t) 5: Wistart ← SelectModel(i, Et , Wglobal ) 6: end for (t+1) 7: {θ i } ← TrainSharedSUMO({Wistart }, E) 8: Protected uplink preparation 9: for each i ∈ Et do (t+1) (t) 10: wi ← Clip(θ i ; Wglobal , r) 11: Pi ← EncodeM (M(wi )) 12: Ui ← SignObjectA (i, t, UL, Pi ) 13: end for 14: Contact-dependent uplink 15: PtUL ← UplinkDriveN ({Ui }i∈Et ) 16: Verified aggregation 17: Vt ← ∅ 18: for each complete Ui ∈ PtUL do 19: if i ∈ Et and VerifyContextA (Ui , i, t, UL) then (t+1) (t) wi ← ReconstructM (Pi ; Wglobal , r) 20: 21: Vt ← Vt ∪ {i} 22: end if 23: end for 24: if Vt ̸= ∅ then (t+1) 25: Update Wglobal using (26) 26: else (t+1) (t) 27: Wglobal ← Wglobal 28: end if

7

Experimental Results

7.1

Experimental Setup and Evaluation Protocol

The primary experiments use SUMO 1.26 on a road network with 30 directed edges, 50 learning vehicles distributed equally across five starting edges, and a common destination. Background traffic follows randomly generated trips with an average departure interval of 1.75 s. After a 200 s simulation warm-up, learning vehicles depart over a 100 s window, with individual trips limited to 600 s. The road topology and detailed traffic configuration are provided in Appendix F and Appendix G. The primary ideal-communication and mobility-coupled evaluations run for T = 100 federated rounds with E = 10 local training episodes per round. Under ideal communication, all learning vehicles receive the current global model and contribute to aggregation in every round. In the mobility-coupled setting, participation depends on successful authenticated model delivery over the simulated V2I links, following Algorithm 2. We compare CPQ, CPQ-λ (λ = 0.75), LDP-FL, Gaussian, and Laplace mechanisms, using full-precision FLDQN without privacy perturbation as a reference. The ideal-communication experiments consider ϵp ∈ {0.3, 0.5, 1, 2, 5}, while the primary mobility-coupled evaluation uses ϵp = 1. All private mechanisms use a clipping radius of r = 0.02. The privacy budgets apply to individual model parameters within one communication round. CPQ, CPQ-λ, 16

Mean trip duration (s) [lower is better]

CPQ

(a) εp = 0.3

CPQ-λ

(b) εp = 0.5

LDP-FL

Gaussian

Laplace

(c) εp = 1

No privacy

(d) εp = 2

(e) εp = 5

400 300 200 100 0

50

100 0

50

100 0

50

100 0

50

100 0

50

100

Federated aggregation round

Figure 2: Evolution of mean evaluation travel time across privacy budgets during federated training.

LDP-FL, and Laplace satisfy pure ϵp -PLDP, whereas Gaussian is calibrated to (ϵp , δp )-PLDP with δp = 10−5 . After each federated round, the global model is evaluated using greedy routing without exploration, further training, or model exchange. The primary evaluations use three fixed SUMO traffic scenarios with 50 learning vehicles each. Routing performance is measured by mean travel time over all evaluated trips, including elapsed time until termination for unsuccessful trips, and arrival rate, defined as the percentage of vehicles reaching their destinations within the trip limit. Late-round results are averaged over rounds 91–100 for each of five independent seeds. We report the mean and sample standard deviation across these run-level averages, using identical evaluation scenarios across the compared mechanisms and runs.

7.2

Privacy–Utility Under Ideal Communication

Figure 2 shows the evolution of routing performance across the evaluated privacy budgets. Mean travel times are computed over nonoverlapping 10-round intervals and averaged across five independent runs, with full-precision FLDQN shown as a no-privacy reference. Under tighter privacy constraints, CPQ achieves lower late-round travel times than the other private mechanisms, while Gaussian perturbation exhibits particularly poor performance at ϵp = 0.3. Performance differences generally narrow as ϵp increases, although the learning trajectories remain variable and do not follow a consistent ordering across rounds. To avoid selecting favorable training checkpoints, Table 2 reports results over the fixed rounds 91–100. CPQ achieves lower mean travel time than independent LDP-FL at all five evaluated privacy budgets and ranks first among the private mechanisms at four of them. It also attains the highest mean arrival rate at three budgets, while CPQ-λ (λ = 0.75) leads at ϵp = 1; at ϵp = 5, Laplace has the lowest travel time and LDP-FL the highest arrival rate. These results indicate favorable average routing utility for CPQ, particularly under tighter privacy constraints. However, the observed differences vary across seeds. The seed-paired analysis in Appendix J finds that the nominal 95% confidence interval for the CPQ–LDP-FL travel-time difference excludes zero at ϵp = 1, but not at the other evaluated budgets. We evaluate symmetric CPQ-λ under ideal communication at ϵp = 1, with λ ∈ {0.25, 0.5, 0.75, 0.9, 1} and independent LDP-FL. The fully correlated CPQ mechanism corresponds to λ = 1. Empirical aggregation MSE is computed each round as the mean squared difference, across model parameters, between the reconstructed FedAvg model and the average of the clients’ clipped models, excluding clipping error. Table 3 reports MSE averaged over 100 rounds, together with routing metrics averaged over rounds 91–100 and ten seeds. Reported uncertainties are 95% Student-t confidence half-widths. The stronger-observation privacy bounds follow (13) and (14). Empirical aggregation MSE decreases monotonically with λ, consistent with the correlation-mixture relationship in (15). At λ = 0.75, CPQ-λ reduces aggregation MSE by 54.0% relative to independent LDP-FL while retaining finite pair-view and shared-randomness side-information privacy bounds of ϵS = 1.75 and ϵC = 2.63. All

17

Table 2: Privacy–utility performance of federated routing across privacy budgets.

Mechanism

ϵp = 0.3

ϵp = 0.5

ϵp = 1

ϵp = 2

ϵp = 5

118.6 ± 23.1 141.1 ± 41.7 126.7 ± 45.5 186.1 ± 30.9 148.4 ± 15.9

125.7 ± 24.5 127.8 ± 11.9 138.3 ± 38.3 164.6 ± 43.1 121.5 ± 20.0

92.1 ± 6.7 90.3 ± 5.0 91.9 ± 8.7 78.5 ± 5.1 83.6 ± 5.4

87.8 ± 10.6 90.1 ± 7.5 90.8 ± 8.2 82.4 ± 9.5 89.2 ± 6.5

A. Mean evaluation travel time (s) ↓ CPQ CPQ-λ (λ = 0.75) LDP-FL Gaussian Laplace

165.3 ± 21.4 191.0 ± 36.4 206.6 ± 33.2 412.8 ± 30.5 257.1 ± 19.7

137.9 ± 59.7 178.8 ± 42.7 199.5 ± 21.8 323.8 ± 56.4 215.1 ± 19.6

144.7 ± 26.5 152.8 ± 17.5 187.7 ± 25.3 226.2 ± 41.8 196.9 ± 37.8 111.8 ± 36.7

No privacy

B. Arrival rate (%) ↑ CPQ CPQ-λ (λ = 0.75) LDP-FL Gaussian Laplace

78.7 ± 8.9 75.1 ± 7.3 71.1 ± 4.7 22.8 ± 7.1 60.7 ± 6.3

84.9 ± 16.1 82.5 ± 7.8 71.3 ± 8.0 45.7 ± 13.6 68.0 ± 4.5

87.1 ± 8.5 89.0 ± 8.1 78.3 ± 6.6 67.3 ± 10.8 74.8 ± 10.5 89.8 ± 9.4

No privacy

Table 3: CPQ-λ ablation at ϵp = 1.

λ

ϵS

ϵC

MSE (10−5 )

Travel time (s)

Arrival (%)

LDP-FL 0.25 0.50 0.75 0.90 1

1.00 1.06 1.25 1.75 2.54 ∞

1.00 1.38 1.86 2.63 3.59 ∞

3.717 ± 0.003 3.497 ± 0.002 2.825 ± 0.005 1.708 ± 0.007 0.828 ± 0.011 0.145 ± 0.015

184 ± 27 149 ± 28 145 ± 28 142 ± 16 153 ± 19 138 ± 21

79 ± 6 87 ± 6 87 ± 5 90 ± 5 84 ± 5 89 ± 6

intermediate mixing settings achieve lower mean travel times than LDP-FL, although routing performance does not vary monotonically with λ. The λ = 0.75 configuration provides routing performance close to fully correlated CPQ, with variability across seeds limiting finer comparisons. We further examine sensitivity to the learning-vehicle population by comparing CPQ and LDP-FL at ϵp = 1 for K ∈ {10, 25, 50} under ideal communication. CPQ achieves positive mean travel-time and arrival-rate gains at all three population sizes, with lower travel times in all five matched seeds at K = 25 and K = 50. The travel-time confidence intervals exclude zero for these two populations, while greater variability is observed at K = 10. Because the learning vehicles share the SUMO environment, varying K also changes traffic demand. Detailed results are provided in Appendix J.

7.3

Authenticated V2I Communication

We evaluate the impact of model-update representation on authenticated IEEE 802.11p V2I communication under mobility-dependent connectivity. All mechanisms receive full-precision global-model downlinks and use ML-DSA-44 authentication. CPQ, CPQ-λ, and LDP-FL transmit bit-packed one-bit updates, whereas Gaussian, Laplace, and the no-privacy baseline use full-precision uplinks. Figure 3 compares transmitted traffic, uplink

18

□ downlink

● uplink

10 5 2 1 0.5

CPQ

LDP-FL

(b) Uplink attempt success

Gaussian

Laplace

100

Delivered attempts (%)

Traffic per round (MB)

20

No privacy

0.2

75 50 25 0

y ac

riv

p No

Q

CP

50

ce FL ssian pla u La Ga

P-

LD

(c) Transfer latency

Delivered uplink latency (s)

(a) Wireless traffic

100

150

Distance at transfer start (m)

○ median

5

▲ p90

2 1 0.5 0.2

200

y

ac

riv

p No

L Q ce an CP DP-F ussi apla L L Ga

Figure 3. Authenticated V2I communication under mobility-dependent connectivity using ML-DSA-44. Panels show wireless traffic, distance-dependent uplink attempt success, and successful-uplink latency. Table 4: Signature-scheme sensitivity of V2I uplinks. FP denotes full-precision model updates.

Scheme

Update

UL size (KB)

Attempt success (%)

UL delivery (%)

ML-DSA-44

FP CPQ

113.60 8.65

32.2 97.0

74.7 99.8

Falcon-512

FP CPQ

111.90 6.89

33.3 99.4

78.1 99.8

SLH-DSA-SHA2-128f

FP CPQ

128.40 23.34

29.9 48.2

74.8 93.1

transfer success, and delivery latency. As shown in Fig. 3, one-bit quantization reduces authenticated uplink size from 113.76 to 8.65 KB, a 92.4% reduction. Including retransmissions and unsuccessful attempts, mean uplink traffic decreases by 96.5%, while the use of full-precision global-model downlinks limits the overall traffic reduction to approximately 34%. Compact updates also improve delivery under intermittent contact. CPQ and LDP-FL achieve 96.3% uplink transfer-attempt success, compared with 32.5% for the full-precision baseline, while median successful-uplink latency decreases from 2.54 to 0.25 s. The distance-dependent results further demonstrate the reliability advantage of shorter model transfers as vehicles move away from the RSU. To examine the effect of post-quantum signature selection on authenticated V2I communication, we compare ML-DSA-44, Falcon-512, and SLH-DSA-SHA2-128f with full-precision no-privacy and one-bit CPQ updates at ϵp = 1. The experiment uses the same mobility-coupled IEEE 802.11p framework over 30 federated rounds, with one simulation seed per configuration. Table 4 reports authenticated uplink size, transfer-attempt success, and overall delivery of initiated uplinks across all rounds. The effect of signature selection is most pronounced for compact CPQ updates. Falcon-512 produces the smallest authenticated uplink at 6.89 KB, achieving 99.4% transfer-attempt success and 99.8% overall delivery. In contrast, SLH-DSA-SHA2-128f increases the CPQ uplink to 23.34 KB, with corresponding rates of 48.2% and 93.1%. For full-precision uploads, attempt success remains near 30% across all three schemes, indicating that the larger model payload dominates transmission requirements. These results illustrate the growing importance of authentication overhead when model updates are highly compressed. Additional distance-dependent results are provided in Appendix I.

19

CPQ-λ

Mean travel time (s) ↓

400

Final 10 rounds

350 300 250 200 150 100 10

30

50

70

90

100

Federated round

LDP-FL

Gaussian

Laplace

CPQ

(b) Effective model contributions 40

Final 10 rounds

30

20

10

30

50

70

90

No privacy

80 60 40 20 0

0 10

LDP-FL

100

Origin inference accuracy (%)

CPQ

Updates aggregated per round (of 50) ↑

No privacy

(a) Greedy routing evaluation

100

Federated round

Figure 4. Routing performance and verified aggregation under mobilityconstrained V2I communication.

Chance (10%)

1

2

5

10

20

50

100

Federated rounds observed (log scale)

Figure 5. Shadow-run origin inference at ϵp = 0.3.

Table 5: Routing performance and participation under mobility-constrained V2I communication.

Method No privacy CPQ CPQ-λ (λ = 0.75) LDP-FL Gaussian Laplace

Travel (s) ↓

Arrival (%) ↑

DL reach (%) ↑

UL delivery (%) ↑

Updates per round ↑

∆T (s)

152.6 ± 20.2 167.0 ± 33.5 177.2 ± 41.5 194.9 ± 53.0 290.3 ± 28.3 218.4 ± 33.3

80.4 ± 8.1 79.8 ± 8.8 75.8 ± 9.2 72.8 ± 11.0 51.8 ± 6.9 66.4 ± 9.0

51.8 ± 2.0 53.3 ± 1.1 52.4 ± 0.3 53.4 ± 1.2 55.6 ± 1.8 53.8 ± 2.2

75.7 ± 1.3 99.4 ± 0.2 99.5 ± 0.3 99.4 ± 0.3 74.0 ± 1.1 75.9 ± 2.3

19.6 ± 0.9 26.5 ± 0.6 26.1 ± 0.2 26.5 ± 0.5 20.6 ± 0.9 20.4 ± 1.4

+40.8 ± 56.4 +22.4 ± 35.8 +24.4 ± 54.9 +7.2 ± 64.7 +64.1 ± 48.7 +21.5 ± 50.1

Notes: UL delivery is conditioned on initiated uploads. ∆T is the seed-paired V2I minus ideal-communication travel time, with positive values indicating an increase.

7.4

Mobility-Constrained Federated Learning

We next examine how authenticated, mobility-dependent V2I communication affects federated participation and routing performance at ϵp = 1. Unlike ideal communication, only vehicles receiving the authenticated current-round global model can contribute updates, and aggregation includes only successfully delivered and verified uploads. Table 5 compares the six mechanisms across matched simulation seeds. Routing metrics are averaged over rounds 91–100, while communication and participation metrics cover all 100 rounds. Values are reported as mean ± sample standard deviation across five seeds. Mobility-dependent connectivity substantially restricts federated participation, with authenticated downlink reach remaining between 51.8% and 55.6% across the evaluated methods. Among initiated uplinks, CPQ, CPQ-λ (λ = 0.75), and LDP-FL achieve 99.4–99.5% delivery, compared with 75.7% for the full-precision no-privacy baseline. Consequently, the one-bit mechanisms contribute 26.1–26.5 verified updates per round, approximately 33–35% more than the baseline’s 19.6. Figure 4(b) shows that this participation advantage persists throughout training. These results demonstrate the practical importance of compact uplinks, although full-precision downlink delivery continues to limit aggregation participation. The resulting routing performance is shown in Fig. 4(a). Despite nearly identical communication characteristics and aggregation participation, CPQ achieves a 14.3% lower mean travel time than independent LDP-FL (167.0 versus 194.9 s) and a higher arrival rate (79.8% versus 72.8%). CPQ-λ (λ = 0.75) achieves intermediate mean travel time (177.2 s) and arrival rate (75.8%) while retaining finite stronger-observation privacy bounds. This favorable mean routing trend is consistent with the aggregation-accuracy benefits of correlated quantization, although variability across seeds limits conclusions about the magnitude of the utility improvement. The seedpaired comparisons with ideal communication further show variable increases in travel time across mechanisms, highlighting the combined influence of wireless delivery constraints and privacy perturbation on federated routing.

20

7.5

Empirical Vehicle-Origin Inference

We evaluate vehicle-origin inference by an honest-but-curious RSU under mobility-constrained communication. The experiment uses 50 learning vehicles distributed across ten possible starting edges, giving a random-guessing accuracy of 10%. At ϵp = 0.3, the attacker observes successfully received model updates, which can be associated with the same vehicle across rounds, but does not know private trajectories or the CPQ group secret. We consider a known-origin attacker with one labeled vehicle from each class and a shadow-run attacker trained on independent simulations without labeled vehicles in the target deployment. Both attacks accumulate evidence across federated rounds and are evaluated using three independent seeds. Implementation details are provided in Appendix L. As shown in Fig. 5, shadow-run inference accuracy reaches 91% after 100 rounds without privacy, compared with 30% for CPQ and 22% for LDP-FL. In the known-origin setting, the corresponding accuracies are 69%, 13%, and 12%. Both private mechanisms substantially reduce the effectiveness of the evaluated attacks, although the shadow-run results remain above chance after prolonged observation. These findings provide application-level evidence of reduced vehicle-origin leakage and complement the single-upload privacy guarantees established in Section 3.

8

Conclusion

This paper presented a privacy-preserving and post-quantum-authenticated framework for vehicular federated reinforcement learning under mobility-constrained V2I communication. CPQ reduces one-bit aggregation error through correlated randomness while preserving parameter-level local differential privacy, and CPQ-λ extends the framework with stronger-observation and vector-level privacy guarantees. Theoretical analysis and experiments demonstrate the aggregation-accuracy benefits of controlled correlation, while mobility-coupled evaluations show that compact authenticated updates improve reliable delivery and federated participation while supporting favorable routing performance. Vehicle-origin inference experiments further demonstrate reduced empirical privacy leakage. These findings highlight the importance of jointly considering privacy, authentication, and communication efficiency in vehicular learning. Future work will explore more efficient global-model distribution and coordination across multiple RSUs.

Code and Data Availability The source code is publicly available at https://github.com/solidlabnetwork/cpq-vehicular-frl. The experimental data are archived on Zenodo at https://doi.org/10.5281/zenodo.23693204.

Acknowledgments This work is based upon the work partly supported by the National Center for Transportation Cybersecurity and Resiliency (TraCR) (a U.S. Department of Transportation National University Transportation Center) headquartered at Clemson University, Clemson, South Carolina, USA. Any opinions, findings, conclusions, and recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of TraCR, and the U.S. Government assumes no liability for the contents or use thereof.

References Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pages 308–318, 2016. 2 Gorjan Alagic, Daniel Apon, David Cooper, Quynh Dang, Thinh Dang, John Kelsey, Jacob Lichtinger, Yi-Kai Liu, Carl Miller, Dustin Moody, Rene Peralta, Ray Perlner, Angela Robinson, and Daniel Smith-Tone. Status 21

report on the third round of the NIST post-quantum cryptography standardization process. NIST IR 8413-upd1, National Institute of Standards and Technology, September 2022. 2, 12 Borja Balle and Yu-Xiang Wang. Improving the Gaussian mechanism for differential privacy: Analytical calibration and optimal denoising. In Proceedings of the 35th International Conference on Machine Learning, volume 80 of Proceedings of Machine Learning Research, pages 394–403. PMLR, 2018. 5 Jingjing Bao, Celimuge Wu, Yangfei Lin, Lei Zhong, Xianfu Chen, and Rui Yin. A scalable approach to optimize traffic signal control with federated reinforcement learning. Scientific Reports, 13(1):19184, 2023. doi: 10.1038/s41598-023-46074-3. 2 Daniel J. Bernstein, Andreas Hülsing, Stefan Kölbl, Ruben Niederhagen, Joost Rijneveld, and Peter Schwabe. The SPHINCS+ signature framework. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 2129–2146, 2019. doi: 10.1145/3319535.3363229. 12 Sanghyun Byun, Arijet Sarker, Sang-Yoon Chang, and Jugal Kalita. Secure aggregation for privacy-preserving federated learning in vehicular networks. ACM Journal on Autonomous Transportation Systems, 1(3):1–25, 2024. doi: 10.1145/3657644. 4 Kamalika Chaudhuri, Chuan Guo, and Mike Rabbat. Privacy-aware compression for federated data analysis. In Proc. Conf. Uncertainty Artif. Intell. (UAI), volume 180 of PMLR, pages 296–306, 2022. 4, 25, 27 Wei-Ning Chen, Ayfer Özgür, and Peter Kairouz. The Poisson binomial mechanism for unbiased federated learning with secure aggregation. In Proc. Int. Conf. Mach. Learn. (ICML), volume 162 of PMLR, pages 3490–3506, 2022. 3, 25, 26 Bolin Ding, Janardhan Kulkarni, and Sergey Yekhanin. Collecting telemetry data privately. In Advances in Neural Information Processing Systems, volume 30, pages 3571–3580, 2017. 3, 25, 26 Léo Ducas, Eike Kiltz, Tancrède Lepoint, Vadim Lyubashevsky, Peter Schwabe, Gregor Seiler, and Damien Stehlé. CRYSTALS-Dilithium: A lattice-based digital signature scheme. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2018(1):238–268, 2018. doi: 10.13154/tches.v2018.i1.238-268. 12 John C. Duchi, Michael I. Jordan, and Martin J. Wainwright. Minimax optimal procedures for locally private estimation. Journal of the American Statistical Association, 113(521):182–201, 2018. 3, 25, 26 Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. Foundations and Trends® in Theoretical Computer Science, 9(3–4):211–407, 2014. doi: 10.1561/0400000042. 2, 4, 6 Xiaofeng Fan, Yining Ma, Zhongxiang Dai, Wei Jing, Cheston Tan, and Bryan Kian Hsiang Low. Fault-tolerant federated reinforcement learning with theoretical guarantee. Advances in Neural Information Processing Systems, 34:1007–1021, 2021. 2 Pierre-Alain Fouque, Jeffrey Hoffstein, Paul Kirchner, Vadim Lyubashevsky, Thomas Pornin, Thomas Prest, Thomas Ricosset, Gregor Seiler, William Whyte, and Zhenfei Zhang. Falcon: Fast-Fourier lattice-based compact signatures over NTRU – specification v1.2. Submission to the NIST Post-Quantum Cryptography Standardization Process, Round 3, 2020. URL https://falcon-sign.info. 12 Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, pages 1322–1333, 2015. 2 Yunfei Gao, Mingliu Liu, Xiaopeng Yuan, Yulin Hu, Peng Sun, and Anke Schmeink. Federated deep reinforcement learning based trajectory design for UAV-assisted networks with mobile ground devices. Scientific Reports, 14 (1):22753, 2024. doi: 10.1038/s41598-024-72654-y. 2

22

Hao Jin, Yang Peng, Wenhao Yang, Shusen Wang, and Zhihua Zhang. Federated reinforcement learning with environment heterogeneity. In Proceedings of the 25th International Conference on Artificial Intelligence and Statistics, volume 151 of Proceedings of Machine Learning Research, pages 18–37. PMLR, 2022. URL https://proceedings.mlr.press/v151/jin22a.html. 2 Yao Jing, Bin Guo, Nuo Li, Ruonan Xu, and Zhiwen Yu. Federated multi-agent reinforcement learning: A comprehensive survey of methods, applications and challenges. Expert Systems with Applications, 293:128729, 2025. doi: 10.1016/j.eswa.2025.128729. 2 Pablo Alvarez Lopez, Michael Behrisch, Laura Bieker-Walz, Jakob Erdmann, Yun-Pang Flötteröd, Robert Hilbrich, Leonhard Lücken, Johannes Rummel, Peter Wagner, and Evamarie Wießner. Microscopic traffic simulation using SUMO. In 2018 21st International Conference on Intelligent Transportation Systems (ITSC), pages 2575–2582. IEEE, 2018. 12 Abdul Wahab Mamond, Majid Kundroo, Seong-eun Yoo, Seonghoon Kim, and Taehong Kim. FLDQN: Cooperative multi-agent federated reinforcement learning for solving travel time minimization problems in dynamic environments using SUMO simulation. Sensors, 25(3):911, 2025. doi: 10.3390/s25030911. 2, 4, 12 Ilya Mironov. Rényi differential privacy. In 2017 IEEE 30th Computer Security Foundations Symposium (CSF), pages 263–275, 2017. doi: 10.1109/CSF.2017.11. 10 Volodymyr Mnih, Koray Kavukcuoglu, David Silver, Andrei A Rusu, Joel Veness, Marc G Bellemare, Alex Graves, Martin Riedmiller, Andreas K Fidjeland, Georg Ostrovski, et al. Human-level control through deep reinforcement learning. Nature, 518(7540):529–533, 2015. 12 Milad Nasr, Reza Shokri, and Amir Houmansadr. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In 2019 IEEE Symposium on Security and Privacy (SP), pages 739–753. IEEE, 2019. 2 National Institute of Standards and Technology. Module-lattice-based key-encapsulation mechanism standard. Technical Report FIPS PUB 203, U.S. Department of Commerce, 2024a. 14 National Institute of Standards and Technology. Module-lattice-based digital signature standard. Technical Report FIPS PUB 204, National Institute of Standards and Technology, August 2024b. 2, 12 National Institute of Standards and Technology. Stateless hash-based digital signature standard. Technical Report FIPS PUB 205, National Institute of Standards and Technology, August 2024c. 2, 12 Y. Nir and A. Langley. ChaCha20 and Poly1305 for IETF protocols. RFC 8439, RFC Editor, June 2018. URL https://www.rfc-editor.org/rfc/rfc8439.txt. 14 George F. Riley and Thomas R. Henderson. The ns-3 network simulator. In Klaus Wehrle, Mesut Güneş, and James Gross, editors, Modeling and Tools for Network Simulation, pages 15–34. Springer Berlin Heidelberg, Berlin, Heidelberg, 2010. doi: 10.1007/978-3-642-12331-3 2. 2, 15 Michele Rondinone, Julen Maneros, Daniel Krajzewicz, Ramon Bauza, Pasquale Cataldi, Fatma Hrizi, Javier Gozalvez, Vineet Kumar, Matthias Röckl, Lan Lin, et al. iTETRIS: A modular simulation platform for the large scale evaluation of cooperative ITS applications. Simulation Modelling Practice and Theory, 34:99–125, 2013. 4 Hojat Allah Salehi, Md Jueal Mia, S Sandeep Pradhan, M Hadi Amini, and Farhad Shirani. CorBin-FL: A differentially private federated learning mechanism using common randomness. arXiv preprint arXiv:2409.13133, 2024. 4, 5, 25 Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE Symposium on Security and Privacy (SP), pages 3–18. IEEE, 2017. 2

23

Peter W Shor. Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer. SIAM Review, 41(2):303–332, 1999. 2 Christoph Sommer, Reinhard German, and Falko Dressler. Bidirectionally coupled network and road traffic simulation for improved IVC analysis. IEEE Transactions on Mobile Computing, 10(1):3–15, 2011. doi: 10.1109/TMC.2010.133. 4 Haoran Su, Yaofeng D Zhong, Joseph YJ Chow, Biswadip Dey, and Li Jin. EMVLight: A multi-agent reinforcement learning framework for an emergency vehicle decentralized routing and traffic signal control system. Transportation Research Part C: Emerging Technologies, 146:103955, 2023. 2 Lichao Sun, Jianwei Qian, and Xun Chen. LDP-FL: Practical private aggregation in federated learning with local differential privacy. In Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence (IJCAI-21), pages 1571–1578. International Joint Conferences on Artificial Intelligence Organization, 2021. doi: 10.24963/ijcai.2021/217. 2, 4, 5, 28 Zhiwei Tang, Yanmeng Wang, and Tsung-Hui Chang. z-SignFedAvg: A unified stochastic sign-based compression for federated learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 15301–15309, 2024. doi: 10.1609/aaai.v38i14.29454. 4, 25, 27 Yuan Tian, Yanfeng Shi, Yue Zhang, and Qikun Tian. Personalized federated learning scheme for autonomous driving based on correlated differential privacy. Sensors, 25(1):178, 2025. doi: 10.3390/s25010178. 4 Geoff Twardokus, Nina Bindel, Hanif Rahbari, and Sarah McCarthy. When cryptography needs a hand: Practical post-quantum authentication for V2V communications. In Proceedings of the Network and Distributed System Security Symposium (NDSS), 2024. URL https://www.ndss-symposium.org/ndss-paper/when-cryptogra phy-needs-a-hand-practical-post-quantum-authentication-for-v2v-communications/. 12, 14 Wenhua Wang, Qiong Wu, Pingyi Fan, Nan Cheng, Wen Chen, Jiangzhou Wang, and Khaled B. Letaief. Optimizing age of information in vehicular edge computing with federated graph neural network multi-agent reinforcement learning. IEEE Transactions on Wireless Communications, 25:23017–23032, 2026. doi: 10.1109/TWC.2026.372 9785. 2, 4 Ming Xiang and Lili Su. Distributed non-convex optimization with one-bit compressors on heterogeneous data: Efficient and resilient algorithms. arXiv preprint arXiv:2210.00665, 2023. 4, 25, 27 Yutong Ye, Wupan Zhao, Tongquan Wei, Shiyan Hu, and Mingsong Chen. FedLight: Federated reinforcement learning for autonomous multi-intersection traffic signal control. In 2021 58th ACM/IEEE Design Automation Conference (DAC), pages 847–852. IEEE, 2021. 2 Yeojoon Youn, Zihao Hu, Juba Ziani, and Jacob Abernethy. Randomized quantization is all you need for differential privacy in federated learning. arXiv preprint arXiv:2306.11913, 2023. 4, 25, 27 Zhenyuan Yuan, Siyuan Xu, and Minghui Zhu. Federated reinforcement learning for generalizable motion planning. In 2023 American Control Conference (ACC), pages 78–83. IEEE, 2023. doi: 10.23919/ACC55779.2023.10156236. 2 Jiancong Zhang, Changhao Wang, and Shining Li. Differential private knowledge trading in vehicular federated learning using contract theory. Knowledge-Based Systems, 285:111356, 2024. 4 Xu Zhao, Yichuan Wu, Tianhao Zhao, Feiyu Wang, and Maozhen Li. Federated deep reinforcement learning for task offloading and resource allocation in mobile edge computing-assisted vehicular networks. Journal of Network and Computer Applications, 229:103941, 2024. doi: 10.1016/j.jnca.2024.103941. 2, 4

24

Appendices A

One-Bit Specializations of Related Quantization Mechanisms

This appendix examines the relationship between LDP-FL and several established one-bit randomization mechanisms. We identify the conditions under which these mechanisms induce the same scalar output distribution and reconstruction levels as LDP-FL, and distinguish these cases from mechanisms that share only the transmitted bit distribution or employ different randomization rules. Consider a scalar parameter w ∈ [c − r, c + r], with public clipping center c and radius r > 0. Let x = w − c ∈ [−r, r] denote the centered input, and define αp = α(ϵp ) as in (2). For mechanisms originally defined on a zero-centered interval, we apply the input transformation x = w − c and shift the reconstructed output by c. The reference LDP-FL quantizer generates B ∈ {0, 1} according to Pr(B = 1 | w) =

1 x + , 2 2rαp

(A.1)

and reconstructs W = c + rαp (2B − 1). Two mechanisms are estimator-equivalent when, after the corresponding input transformation, they have the same binary response probabilities and reconstruction levels for every admissible input. Channel equivalence requires only the same conditional distribution of transmitted bits. Table A.1 summarizes the conditions under which established one-bit mechanisms coincide with LDP-FL and identifies related mechanisms that are not generally estimator-equivalent. Fixed-level binary characterization. The following result recalls the scalar optimality property used in Section 3.1 and makes the assumptions needed for the equivalence mappings explicit; see also (Salehi et al., 2024, Proposition 1). Proposition 1 (Unbiased fixed-level one-bit quantization) Let w ∈ [c − r, c + r], r > 0, and ϵp > 0. Consider a binary mechanism with B ∈ {0, 1} and fixed public reconstruction levels a0 = c − R0 and a1 = c + R1 , where a0 < a1 . If E[aB | w] = w for every admissible w, then Pr(B = 1 | w) =

w − c + R0 . R0 + R 1

(A.2)

Table A.1: One-bit mechanisms equivalent to LDP-FL under specified configurations.

Mechanism Duchi et al. (2018) 1BitMean (Ding et al., 2017) PBM (Chen et al., 2022) RQM (Youn et al., 2023) MVU (Chaudhuri et al., 2022) β-StoSign (Xiang and Su, 2023) z-SignFedAvg (Tang et al., 2024)

One-bit configuration and equivalence conditions Scalar case d = 1, with the input mapped to the common clipping interval [c − r, c + r]. Counter range [0, m], with m = 2r and input mapping u = x + r. One Bernoulli trial (m = 1), C = r, and θ = 12 tanh(ϵp /2). The original constraint θ ≤ 1/4 requires ϵp ≤ ln 3. Two output levels (m = 2), C = r, and ∆ = 2r/(eϵp − 1), using exact localprivacy calibration. One output bit, pure-ϵp -LDP, hard unbiasedness, and exact optimization on a grid containing the clipping endpoints. The unique optimum yields the LDP-FL reconstruction levels. Centered input x = w−c, clipping bound r, and β = 2r/(eϵp −1). Reconstruction uses c ± (r + β), followed by arithmetic-mean aggregation. Uniform-noise limit z → ∞, centered input x = w − c, noise half-width σ = rα(ϵp ), and reconstruction c ± σ.

25

This mechanism satisfies pure ϵp -PLDP if and only if R0 , R1 ≥ rα(ϵp ). Its mean squared error is

E[(aB − w)2 | w] = R0 + w − c R1 − w + c .

(A.3)

The unique pointwise MSE-minimizing choice is R0 = R1 = rα(ϵp ), which yields the LDP-FL response and reconstruction levels in (2)–(3). Proof. Writing p(w) = Pr(B = 1 | w), unbiasedness gives c − R0 + (R0 + R1 )p(w) = w, establishing (A.2). Since p(w) ∈ [0, 1] over the clipping interval, R0 , R1 ≥ r. The probability is affine and increasing, so the two binary-output privacy constraints attain their extreme ratios at the clipping endpoints:   R0 + r R1 + r ϵM = max log , log . (A.4) R0 − r R1 − r For finite ϵp , the denominators are positive. The requirement ϵM ≤ ϵp is equivalent to R0 , R1 ≥ r(eϵp + 1)/(eϵp − 1). As the estimator is unbiased, its MSE equals its variance, (R0 + R1 )2 p(w)(1 − p(w)), which simplifies to (A.3). For x = w − c ∈ [−r, r], this expression is (R0 + x)(R1 − x). Both factors are strictly positive and strictly increasing in their respective reconstruction distances throughout the feasible set. Its unique minimum is therefore at R0 = R1 = rα(ϵp ), giving the LDP-FL channel and levels. ■ Mechanism-specific equivalences. We now verify the rows of Table A.1. In each case let x = w − c ∈ [−r, r], E = eϵp , and αp = (E + 1)/(E − 1). An equivalent scalar estimator must satisfy Pr(B = 1 | x) =

1 x + , 2 2rαp

aB = c + rαp (2B − 1).

(A.5)

All matching statements below refer to these conditional output distributions; aggregation equivalence additionally assumes independent client randomization and identical arithmetic-mean reconstruction. 1) Duchi et al. In the scalar d = 1 case, first stochastically round x to S ∈ {0, 1} with Pr(S = 1) = (x + r)/(2r), then apply binary randomized response, retaining S with probability E/(E + 1). Thus Pr(B = 1 | x) =

1 E−1x+r 1 x + = + . E + 1 E + 1 2r 2 2rαp

(A.6)

The scalar output levels c ± rαp establish estimator equivalence (Duchi et al., 2018). 2) 1BitMean. For the telemetry interval [0, m], set m = 2r and u = x + r. Its response probability is Pr(B = 1 | u) =

1 u E−1 1 x + = + . E+1 mE+1 2 2rαp

(A.7)

Shifting its decoded estimate by c − r gives c − r + 2r((E + 1)B − 1)/(E − 1) = c + rαp (2B − 1), proving estimator equivalence (Ding et al., 2017). 3) PBM. For a single Bernoulli trial (m = 1), clipping bound C = r, and θ = 12 tanh(ϵp /2) = 1/(2αp ), PBM produces 1 θx 1 x Pr(B = 1 | x) = + = + . (A.8) 2 r 2 2rαp The reconstructed value c + (r/θ)(B − 1/2) equals c + rαp (2B − 1). Under the original constraint θ ≤ 1/4, this calibration is admissible for ϵp ≤ log 3. This identity concerns the one-trial scalar randomizer observed locally; the original PBM also studies secure aggregation (Chen et al., 2022). 4) RQM. With two quantization levels (m = 2), the range-extension parameter ∆ = 2r/(E − 1) gives Xmax = r + ∆ = rαp . The upper-level probability and decoded value satisfy Pr(B = 1 | x) =

x + Xmax 1 x = + , 2Xmax 2 2rαp

aB = c + Xmax (2B − 1). 26

(A.9)

Thus two-level RQM with this exact local-privacy calibration is estimator-equivalent to LDP-FL (Youn et al., 2023). 5) MVU. Consider the exactly solved one-bit MVU optimization with pure ϵp -LDP and hard unbiasedness constraints on an input grid containing both clipping endpoints. Since there are only two fixed output levels, unbiasedness forces the affine probabilities in (A.2) at every grid point. The privacy constraints on the grid are tightest at its endpoints, so Proposition 1 applies. Every grid-point MSE is uniquely minimized at R0 = R1 = rαp , which is also the unique optimizer of their sum. Unbiased stochastic interpolation between grid points preserves the affine response, establishing the scalar LDP-FL estimator over the full interval (Chaudhuri et al., 2022). 6) β-StoSign. For centered input x, clipping bound r, and β = 2r/(E − 1), the probability of a positive sign is Pr(S = +1 | x) =

1 x r+β+x = + , 2(r + β) 2 2rαp

(A.10)

because r + β = rαp . With matched scalar decoding aS = c + (r + β)S and arithmetic-mean aggregation, this yields the LDP-FL estimator. The original sign-based aggregation rule is a separate algorithmic choice (Xiang and Su, 2023). 7) Uniform-noise sign quantization. In the uniform-noise limit of z-SignFedAvg, let U ∼ Uniform[−1, 1] be locally generated and set σ = rαp . Since |x| ≤ r < σ, Pr(B = 1 | x) = Pr(x + σU > 0) =

1 x 1 x + = + . 2 2σ 2 2rαp

(A.11)

Reconstruction as aB = c + σ(2B − 1) gives precisely the LDP-FL scalar estimator (Tang et al., 2024). Implication for the independent baseline. For any fixed collection of clipped client values, the seven specified scalar configurations generate the same conditional distribution of reconstructed values as LDP-FL. If all clients use independent private randomness and the same arithmetic-mean aggregation, their aggregate estimators have the same conditional distribution and MSE as (4). The CPQ comparison therefore extends to these matched independent one-bit scalar configurations. This conclusion uses the stated scalar channel, decoding, clipping, and aggregation assumptions.

B

Proof of Theorem 1

(i) PLDP. Since 1 − V ∼ Uniform[0, 1], both Qk satisfy P (Qk = c + rα) = q(wk ), matching the LDP-FL output distribution. The PLDP ratio for the upper output is 1 1 q(w) q(c + r) α+1 2 + 2α ≤ = = = eϵp . 1 1 ′ q(w ) q(c − r) α − 1 − 2 2α

By symmetry, the same bound holds for the lower (complementary) output: 1 1 1 − q(c − r) α+1 1 − q(w) 2 + 2α ≤ = = = eϵp . 1 1 ′ 1 − q(w ) 1 − q(c + r) α − 1 − 2 2α

Since the output alphabet is binary, bounding the ratio at both atoms bounds it for every measurable output set T ⊆ R, establishing ϵp -PLDP. P r α P 1 (i) Unbiasedness. E[Qk (wk , V )] = c + rα(2q(wk ) − 1) = wk , so E[W g,j ] = cj + jn i (2q(wi,j ) − 1) = n i wi,j . (ii) Pairwise MSE optimality. Let Uk = (Qk − c)/(rα) ∈ {−1, +1} and xk = (wk − c)/(rα). Expanding the 2 2 MSE of the pair-average estimator 12 (Q1 + Q2 ) (hence the factor r 4α ), m(Q1 , Q2 , w1 , w2 ) =

 r 2 α2  (1 − x21 ) + (1 − x22 ) + 2(E[U1 U2 ] − x1 x2 ) . 4 27

(B.1)

The terms (1 − x2k ) are fixed by the marginals, so minimizing (B.1) is equivalent to minimising E[U1 U2 ]. Fréchet–Hoeffding lower bound. For binary Uk ∈ {−1, +1} with P (Uk = +1) = qk = (1 + xk )/2, E[U1 U2 ] = 1 − 2P (U1 ̸= U2 ). Maximizing P (U1 ̸= U2 ) over all couplings gives P ∗ (U1 ̸= U2 ) = min(q1 , 1 − q2 ) + min(1 − q1 , q2 ) = 1 − |q1 + q2 − 1|, so the minimum cross-term is Emin [U1 U2 ] = 2|q1 + q2 − 1| − 1 = |x1 + x2 | − 1. CPQ achieves this bound. Under CPQ, U1 = 2 · 1[V <q1 ] − 1 and U2 = 2 · 1[1−V <q2 ] − 1. Computing the joint probabilities: P (U1 = +1, U2 = +1) = P (V < q1 , V > 1 − q2 ) = max(q1 + q2 − 1, 0), P (U1 = −1, U2 = −1) = P (V ≥ q1 , V ≤ 1 − q2 ) = max(1 − q1 − q2 , 0). Therefore P (U1 ̸= U2 ) = 1 − |q1 + q2 − 1|, so E[U1 U2 ] = |x1 + x2 | − 1, exactly matching the Fréchet lower bound. Substituting into (B.1),    r 2 α2 r 2 α2  (x1 + x2 )2 m∗ = 2 − x21 − x22 + 2(|x1 + x2 | − 1) − 2x1 x2 = |x1 + x2 | − , 4 2 2 which is (7). Comparison with LDP-FL. For independent quantizers, E[U1 U2 ] = x1 x2 , so mLDP − m∗ =

r 2 α2 1 + x1 x2 − |x1 + x2 | ≥ 0, 2

where the inequality follows from 1+x1 x2 −|x1 +x2 | = (1−x1 )(1−x2 ) ≥ 0 when x1 +x2 ≥ 0 and = (1+x1 )(1+x2 ) ≥ 0 when x1 + x2 < 0. Equality therefore holds if and only if one marginal is deterministic (x1 ∈ {−1, +1} or x2 ∈ {−1, +1}). Since |xk | = |wk − c|/(rα) ≤ 1/α < 1 for every wk ∈ [c − r, c + r], this never occurs, so the improvement is strict for all clipped weights. This establishes the strict MSE advantage over independent
2 2 quantization. Finally, writing s = x1 + x2 , (7) gives m∗ = r 2α |s| 1 − |s| 2 , which is zero if and only if s = 0, since 0 < |s| ≤ 2 makes both factors positive. Hence the paired noises cancel exactly precisely when w1 + w2 = 2c. □

C

Proof of Theorem 2

Write qk = q(wk ), p2 = 1 − q2 , α = α(ϵp ), and µ = λ1 λ2 . Define the endpoint probabilities q− =

1 , eϵ p + 1

q+ =

eϵp . eϵp + 1

Then q(w) ∈ [q− , q+ ], q− + q+ = 1, and q+ /q− = eϵp . (a) Marginal PLDP and unbiasedness. The mixture representation in (10) follows by conditioning on the independent mixing coins (C1 , C2 ). Both mixture components have the same marginals Pr(bk = 1) = qk . Hence each bit has exactly the LDP-FL output law, which satisfies ϵp -PLDP (Sun et al., 2021). The reconstruction expectation is therefore unchanged: E[W g,j ] = cj +

rj α X 1X (2q(wi,j ) − 1) = wi,j . n i n i

(b) Pair-view privacy. The output alphabet is finite, so it is sufficient to bound the likelihood ratio at each atom. From the mixture representation in (10), P11 (q1 , q2 ) = µ max(q1 + q2 − 1, 0) + (1 − µ)q1 q2 ,

(C.1)

P10 (q1 , q2 ) = µ min(q1 , 1 − q2 ) + (1 − µ)q1 (1 − q2 ).

(C.2)

28

The remaining atoms follow from complementation. In particular, with the reflection R(q1 , q2 ) = (1 − q1 , 1 − q2 ), P00 = P11 ◦ R,

P01 = P10 ◦ R.

Since q− + q+ = 1, R maps [q− , q+ ]2 onto itself. Therefore the worst ratios for (0, 0) and (0, 1) equal those for (1, 1) and (1, 0), respectively. For (1, 1), P11 is nondecreasing in q1 and is strictly increasing because 1 − µ > 0. Thus the largest ratio over q1 , q1′ is obtained at q1 = q+ and q1′ = q− . Since q− + q2 − 1 ≤ 0 and q+ + q2 − 1 = q2 − q− ≥ 0,   µ(q2 − q− ) + (1 − µ)q+ q2 µ 1 1 P11 (q+ , q2 ) = = eϵp + − . P11 (q− , q2 ) (1 − µ)q− q2 1 − µ q− q2 The right-hand side is increasing in q2 , hence it is maximized at q2 = q+ . Using 1 1 − = (eϵp + 1)(1 − e−ϵp ) = eϵp − e−ϵp , q− q+ the maximum equals eϵS in (13). For (1, 0), P10 is also nondecreasing in q1 . Since p2 ∈ [q− , q+ ], min(q+ , p2 ) = p2 and min(q− , p2 ) = q− . Therefore P10 (q+ , q2 ) p2 [µ + (1 − µ)q+ ] = . P10 (q− , q2 ) q− [µ + (1 − µ)p2 ] The map p 7→ p/[µ+(1−µ)p] is increasing, so the ratio is maximized at p2 = q+ , where it equals q+ /q− = eϵp ≤ eϵS . Reflection handles the other two atoms. Hence every atom, and therefore every output set, satisfies (11). The (1, 1) bound is attained at (q1 , q1′ , q2 ) = (q+ , q− , q+ ), proving tightness. (b, continued) Privacy under side information. Condition on Z1 = (V, C2 , R2 , w2 ). The only remaining randomness in b1 is (C1 , R1 ), which is independent of Z1 . For q = q(w1 ), gV (q) := Pr(b1 = 1 | w1 , Z1 ) = λ1 1{V <q} + (1 − λ1 )q.

(C.3)

The function is nondecreasing in q, so the largest ratio for the output b1 = 1 is gV (q+ )/gV (q− ). If V ∈ [q− , q+ ), the indicator is zero at q− and one at q+ , giving λ1 + (1 − λ1 )q+ gV (q+ ) eϵp + λ1 = = . gV (q− ) (1 − λ1 )q− 1 − λ1 When V < q− or V ≥ q+ the ratio is no larger. For the output b1 = 0, the probability 1 − gV (q) is nonincreasing in q, and the corresponding endpoint ratio is maximized over the same interval V ∈ [q− , q+ ), producing the identical value. Since q+ − q− > 0, this event has positive probability, so the bound is tight. The follower result follows by replacing V with 1 − V . (c) Pairwise MSE. For fixed inputs, squared pair-average error is a deterministic function of the output pair. Taking expectation under the mixture (10) therefore gives mµ = (1 − µ)mIND + µm∗ . Using the independent cross-term E[U1 U2 ] = x1 x2 in (B.1) gives mIND =

r 2 α2 (2 − x21 − x22 ). 4

The difference derived in Appendix B is mIND − m∗ =

r 2 α2 (1 + x1 x2 − |x1 + x2 |) . 2 29

Substitution establishes (15). As shown in the proof of Theorem 1, the bracket is strictly positive for all admissible clipped inputs because |xk | ≤ 1/α < 1. Hence every µ > 0 yields a strict improvement over independent quantization. (d) Population MSE. Let Sℓ − sℓ denote the pair-sum error for pair ℓ. Pair errors are unbiased and independent across distinct pairs, so n/2 1 X E[(W g,j − w̄j )2 ] = 2 E[(Sℓ − sℓ )2 ]. n ℓ=1

By part (c), the pair-sum error is the mixture of the independent and CPQ pair-sum errors. The former satisfies eIND = rj2 α2 (2 − x21 − x22 ) ≤ 2rj2 α2 , while Corollary 1 gives eCPQ ≤ 2rj2 κ. Hence n/2

 rj2   2rj2 X  E[(W g,j − w̄j ) ] ≤ 2 (1 − µℓ )α2 + µℓ κ = (1 − µ̄)α2 + µ̄κ , n n 2

ℓ=1

which proves (16).

D

□

Proof of Theorem 3

Joint output distribution. Consider one coordinate of a CPQ-λ pair, with target and partner bit-one probabilities u, z ∈ [q− , q+ ], respectively, where q− =

1 , 1 + eϵp

q+ = 1 − q− ,

µ = λ2 .

With probability µ, both clients use complementary shared randomness. Otherwise, their quantization outputs are independent. The joint distribution is therefore Pu,z (1, 1) = (1 − µ)uz + µ(u + z − 1)+ , Pu,z (1, 0) = u − Pu,z (1, 1), Pu,z (0, 1) = z − Pu,z (1, 1), Pu,z (0, 0) = 1 − u − z + Pu,z (1, 1),

(D.1)

where (x)+ = max{x, 0}. Worst-case Rényi divergence. For a Rényi order ν > 1, define X Hν (P, Q) = P (x)ν Q(x)1−ν , x

so that

ln Hν (P, Q) . ν−1 We maximize this divergence over alternative target probabilities u, v ∈ [q− , q+ ], while keeping the partner probability z fixed. The partner bit follows Bernoulli(z) under both target inputs. Conditional on the partner’s bit, the target bit is Bernoulli with success probabilities Pu,z (1, 1) p1 (u) = , z (D.2) Pu,z (1, 0) p0 (u) = . 1−z Dν (P ∥Q) =

30

Both probabilities are nondecreasing in u, as follows from (D.1). For Bernoulli distributions with success probabilities p ≤ q, the Rényi power sum hν (p, q) = pν q 1−ν + (1 − p)ν (1 − q)1−ν is nonincreasing in p and nondecreasing in q. Therefore, increasing the separation between the alternative target probabilities cannot decrease the corresponding divergence. Since the partner-bit distribution remains unchanged, the maximum over u and v is attained at (u, v) ∈ {(q− , q+ ), (q+ , q− )}. For either endpoint ordering, the joint probabilities in (D.1) are affine functions of z ∈ [q− , q+ ]. In particular, (q− + z − 1)+ = 0,

(q+ + z − 1)+ = z − q− .

The Rényi power sum Hν (P, Q) is jointly convex in its distribution arguments for ν > 1. Consequently, its maximum over the resulting affine interval occurs at z ∈ {q− , q+ }. Thus, sup Dν (Pu,z ∥Pv,z ) = max Dν (Pu,z ∥Pv,z ), (u,v)∈{(q− ,q+ ),(q+ ,q− )} (D.3) u,v,z∈[q− ,q+ ] z∈{q− ,q+ }

which establishes the exact worst-case per-coordinate divergence in (19). Vector-level composition. Fix the public round state and all other clients’ clipped inputs. Under independent ideal randomization across coordinates, the joint observation distributions factorize over the m model coordinates. Outputs of pairs not containing the target client have identical distributions under the two alternative target inputs and contribute zero Rényi divergence. Therefore, Dν (Mobs (wi )∥Mobs (wi′ )) ≤ m dν .

(D.4)

The conversion from (ν, ρ)-RDP to approximate differential privacy gives the sufficient vector-level privacy certificate   ln(1/δv ) ϵv = inf m dν + , ν>1 ν−1 which establishes (20). Because the pairing assignments are independent of the protected inputs, hiding them is a post-processing of the stronger pairing-revealed observation. The same privacy guarantee therefore applies to the RSU observer when the pairings remain hidden. □ Calibration of comparison mechanisms. For the matched vector-level privacy comparison in Table 1, we use the exact per-coordinate Rényi divergences of the independent baseline mechanisms. For LDP-FL with parameter-level privacy budget s, dLDP (s) = ν

1 eνs + e(1−ν)s ln . ν−1 1 + es

(D.5)

For coordinatewise Laplace noise with scale β, let t = 2r/β. The corresponding divergence is dLap ν (t) =

1 ln ν−1



νe(ν−1)t + (ν − 1)e−νt 2ν − 1

 .

(D.6)

For independent Gaussian noise with standard deviation σ, dGau = ν

ν(2r)2 . 2σ 2

31

(D.7)

Each per-coordinate divergence is composed across the m coordinates and converted to an (ϵv , δv ) guarantee using the same RDP accounting procedure as in (20). The mechanisms are calibrated to the common target (ϵv , δv ) = (1, 10−5 ). Aggregation-MSE comparison. Define the binary reconstruction scale es + 1 A(s) = r s , e −1 and consider an even number K of learning vehicles forming independent pairs. At centered clipped inputs wi,j = cj , each binary output has probability 1/2. For CPQ-λ, the covariance between the reconstructed parameters of a pair is −µA(s)2 . Consequently, the per-coordinate FedAvg MSEs are (1 − µ)A(s)2 , K A(s0 )2 , MLDP = K σ2 MGau = , K 2β 2 MLap = , K

MCPQ-λ =

(D.8)

where s and s0 are the respective RDP-calibrated parameter-level privacy budgets of CPQ-λ and LDP-FL. The MSE advantage can also be bounded for arbitrary admissible clipped inputs. Writing q− (s) =

1 , 1 + es

the CPQ-λ pair-average MSE satisfies CPQ-λ Mpair ≤

A(s)2 2 1 − 4µq− (s) , 2

while the independent LDP-FL pair-average MSE satisfies LDP Mpair ≥

A(s0 )2 − r2 . 2

Since the errors of distinct pairs are independent, these inequalities imply
2 A(s)2 1 − 4µq− (s) MCPQ-λ ≤ . MLDP A(s0 )2 − r2

(D.9)

For the matched-privacy configuration in Table 1, the right-hand side is approximately 0.836 at λ = 0.627. Thus, the considered CPQ-λ configuration achieves lower theoretical aggregation MSE than the independent LDP-FL baseline throughout the admissible clipping range. The comparison applies a common RDP-based privacy certification procedure. Tighter mechanism-specific approximate-DP accounting may be available for independent LDP-FL and Gaussian mechanisms and could permit lower aggregation error at the same privacy target. These results concern one model upload under ideal independent randomization and do not establish multi-round or trajectory-level privacy.

E

Finite-Precision Analysis

To analyze finite-precision effects, consider a d-bit integer K uniformly distributed over {0, . . . , 2d − 1}. The leader uses K1 = K and the follower uses K2 = 2d − 1 − K, providing a discrete counterpart of V and 1 − V . With 32

qk = q(wk ) and kk = ⌊2d qk ⌋, client k ∈ {1, 2} transmits   Kk < kk , 1, bk = 0, Kk > kk , 
 Bernoulli 2d qk − kk , Kk = kk ,

(E.1)

where the Bernoulli draw uses local randomness and is needed only when Kk falls in the cell containing qk . As is standard for local randomized response, this local draw is modeled as exact; only the shared randomness must be finite, since both clients must reproduce it identically. Proposition 2 (Finite-precision CPQ) For every d ∈ N, the pair (b1 , b2 ) generated by (E.1) satisfies: (a) P (bk = 1) = q(wk ) exactly for k ∈ {1, 2}; hence part (i) of Theorem 1 holds exactly. (b) The pairwise MSE md (w1 , w2 ) satisfies 0 ≤ md (w1 , w2 ) − m∗ (w1 , w2 ) ≤ r2 α2 (ϵp )/2d−2 . Proof. (a) Since qk < 1, kk ≤ 2d − 1. Both K1 and K2 are uniform on {0, . . . , 2d − 1}, so P (bk = 1) = P (Kk < kk ) + P (Kk = kk ) (2d qk − kk ) =

kk 2d qk − kk + = qk . d 2 2d

This output distribution preserves both unbiasedness and ϵp -PLDP, so the arguments of part (i) of Theorem 1 apply unchanged. (b) Let W1 , W2 be i.i.d. Uniform[0, 1), independent of K, and set Vk = (Kk +Wk )/2d . Conditional on Kk , the bit 1{Vk < qk } has the same law as bk : if Kk < kk then Vk < (Kk + 1)/2d ≤ qk ; if Kk > kk then Vk ≥ (kk + 1)/2d > qk ; and if Kk = kk then P (Vk < qk ) = P (Wk < 2d qk − kk ) = 2d qk − kk . Hence we may take bk = 1{Vk < qk }. Here V1 is uniform on [0, 1), and the idealized follower of Theorem 1 uses 1 − V1 = (K2 + 1 − W1 )/2d ; denote its bit by b◦2 , so that (b1 , b◦2 ) is the idealized CPQ pair with MSE m∗ . The bits b2 and b◦2 are both determined by K2 unless K2 = k2 , so they differ only on an event of probability 2−d . The pair-average error satisfies |e| ≤ rα + r ≤ 2rα, so e2 ∈ [0, 4r2 α2 ], and therefore md − m∗ ≤ 4r2 α2 · 2−d = r2 α2 /2d−2 . Finally, md ≥ m∗ since, by (a), the pair has the prescribed marginals, and the Fréchet–Hoeffding bound in the proof of Theorem 1 applies to every coupling with these marginals. ■ Proposition 3 (Finite-precision stronger-view privacy of CPQ-λ) Let the shared branch of CPQ-λ use the d-bit rule in (E.1), while the private branch uses local randomness. Then the marginal PLDP and unbiasedness result of Theorem 2(a) holds exactly, and the side-information bound ϵC in (14) remains valid without a finite(d) precision correction. For 0 < µ < 1, define ϵS as the pair-view privacy parameter of the finite-precision mechanism. If 1 2−d ≤ , (E.2) 4µ(eϵp + 1)2 then (d)

eϵS ≤ eϵS +

4µeϵp (eϵp + 1)2 −d 2 . 1−µ

(E.3)

(d)

For µ = 0, the mechanism is the independent LDP-FL coupling and ϵS = ϵp exactly. Proof. Part (a) of Proposition 2 gives the exact marginal probabilities, so marginal PLDP and unbiasedness are unchanged. Conditional on a revealed d-bit shared value, the shared-branch probability of b1 = 1 is a nondecreasing function hd (q) ∈ [0, 1]. Hence Pr(b1 = 1 | q, Z) = λ1 hd (q) + (1 − λ1 )q. The largest possible endpoint ratio is obtained by the extreme values hd (q− ) = 0 and hd (q+ ) = 1, which gives exactly the upper bound in (14); the same argument applied to the complementary output handles b1 = 0. Thus 33

no additional correction is needed for ϵC (although exact attainment of the continuous bound need not occur on a very coarse grid). For the pair view, use the coupling constructed in the proof of Proposition 2. The finite-precision CPQ pair and the ideal continuous CPQ pair differ only when the follower lies in its boundary cell, an event of probability at most δd = 2−d . Therefore, for every output atom a ∈ {0, 1}2 , (d)

PCPQ (a) − PCPQ (a) ≤ δd ,

(E.4)

and the CPQ-λ mixture differs from its continuous counterpart at any atom by at most x = µδd . Consider first the concordant atom (1, 1) and the extremal change q1 : q− → q+ . For q1 = q− , the ideal CPQ contribution to this atom is zero; the finite CPQ contribution is nonnegative. Hence the finite denominator is at least the continuous denominator D = (1 − µ)q− q2 , while the numerator increases by at most x. Using the continuous bound N/D ≤ eϵS gives x Nd ≤ eϵS + 2 . Dd (1 − µ)q− This additive term is no larger than the correction in (E.3). For the discordant atom (1, 0), let N, D denote the continuous probabilities at q+ and q− , respectively. The continuous proof gives N/D ≤ eϵp . Moreover 2 D = q− [µ + (1 − µ)p2 ] ≥ q− . 2 Condition (E.2) implies x ≤ q− /4 ≤ D/4, so

Nd N +x x(eϵp + 1) ≤ eϵp + ≤ eϵp + 2µδd (eϵp + 1)3 . ≤ Dd D−x D−x Because eϵp > 1 and 0 < µ < 1, 4µeϵp (eϵp + 1)2 , 1−µ and eϵp ≤ eϵS . Reflection gives the same bounds for (0, 0) and (0, 1). Taking the largest atom-wise ratio proves (E.3). ■ PRG-generated randomness. Proposition 2 assumes K is uniformly random. When K is produced by a cryptographically secure PRG, each transmitted bit is a polynomial-time function of the PRG output and local randomness, so any efficient adversary that distinguishes the PRG-based outputs from those of the truly random mechanism would also distinguish the PRG from uniform. The guarantees therefore hold against computationally bounded adversaries, up to a negligible loss. With d = 32, the MSE gap in (b) is below 10−9 r2 α2 (ϵp ). The experimental implementation uses ChaCha20-derived 53-bit floating-point values with direct threshold comparisons. The boundary-randomized construction analyzed above provides an idealized finite-precision model with exact marginal guarantees; the direct comparison used in the experiments is a numerically close approximation. 2µ(eϵp + 1)3 ≤

F

SUMO Network Topology Characteristics

The simulated environment represents a custom 10-junction road network mapped out over a 723 m × 200 m coordinate plane (see Figure F.1). The topology consists of primary arterial roads connecting major junctions (J0 through J12). To simulate diverse urban driving conditions, the edges have distinct speed constraints. The majority of the 30 directional edges permit a maximum velocity of 15.00 m/s (≈ 54 km/h). However, the central connecting route between junctions J3 and J5 (edges E7 and -E7) enforces a stricter speed limit of 10.00 m/s (≈ 36 km/h), acting as a systematic bottleneck designed to force the RL agents to balance spatial distance against congestion and speed constraints. For the privacy–utility evaluation, the road network contains M = 30 directed edges. Accordingly, the state representation defined in (21) has dimension 3M + 4 = 94. The maximum number of turning actions is |Amax | = 3, with unavailable turns excluded through action masking. 34

G

Experimental Configuration

This appendix consolidates the training and communication parameters used in the experimental evaluation. The FLDQN configuration specifies the learning architecture J10 J2 E11 and training schedule, while the SR-ARQ configuration documents the fragmentation and retransmission settings used in ns-3. E6 E12 E4 FLDQN training configuration. The FLDQN agents use the network architecture and training procedure deE1 J3 J12 J6 J5 E15 E9 E7 scribed in Section 5.2 of the main manuscript. Table G.1 summarizes the corresponding hyperparameters, includE2 ing optimization, exploration, episode termination, and E5 E14 E8 federated training settings. SUMO traffic configuration. The privacy–utility experiment uses SUMO 1.26 and the road network described E13 E0 E3 J4 J11 J1 in Appendix F. Background traffic is generated using J0 randomTrips.py, with an average departure interval of 1.75 s. A warm-up period of 200 s precedes the departure Figure F.1. Topology of the synthetic road netof the learning vehicles. work implemented in the SUMO environment. The network comprises 10 junctions (J0–J6 and J10–J12) The K = 50 learning vehicles are distributed equally and 30 directed edges (15 bidirectional corridors) across starting edges E0, E1, E3, E11, and E8, with a covering a total distance of 5.37 km. common destination at edge E15. Their departures are sampled uniformly within a 100 s window following the warm-up period and regenerated for each training episode. Individual trips are subject to a maximum duration of Ttrip = 600 s, measured from the scheduled departure. Vehicles that exceed this limit are classified as not arrived. Such time-limit terminations are stored as non-terminal transitions in the local replay buffers. For evaluation, three fixed traffic scenarios are used, with background traffic seeds 1000, 1001, and 1002, and corresponding departure seeds 5000, 5001, and 5002. The same evaluation scenarios are used for all privacy mechanisms, privacy budgets, and training seeds. Privacy clipping configuration. For privacy-preserving model exchange, each locally trained parameter is clipped around the corresponding parameter of the current global model using a fixed radius r = 0.02 across all parameter tensors. The resulting coordinate-wise interval is shared by clients trained from the same global model and is used for privacy calibration and parameter reconstruction. Agent–SUMO interaction. The Python training process interacts with a shared SUMO simulation through TraCI. Each learning vehicle maintains an individual DQN policy and experience buffer while observing traffic conditions within the common environment. At routing decision points, the vehicle obtains the traffic and positional information required to construct the state in (21). The base reward is determined from the elapsed SUMO simulation time between consecutive edge-entry events, as defined in (22), with repeated-edge penalties applied according to (23). Individual trip termination follows the conditions described in Section 5.1. ns-3 channel and radio configuration. The V2I simulation uses ns-3 version 3.46, a 5.9 GHz carrier frequency, and a 10 MHz channel. The RSU is located at junction J3, (300, 100, 0) m, of the SUMO road network. Both data and control transmissions use OfdmRate6MbpsBW10MHz through ConstantRateWifiManager, with transmission power set to 20 dBm. Propagation is modeled using Log-Distance path loss with exponent n = 2.7 and reference loss L0 = 46.68 dB, followed by Nakagami-m fading and constant-speed propagation delay. The MAC uses AdhocWifiMac without QoS extensions. The receiver noise figure is 7 dB, the CCA energy-detection threshold is −85 dBm, the minimum preamble-detection RSSI is −82 dBm, and the receiver sensitivity is −101 dBm.

35

Network address resolution. The ns-3 implemenTable G.1. FLDQN configuration for the privacy– tation prepopulates ARP caches for vehicle–RSU comutility experiment. munication to prevent address-resolution state from Parameter Symbol Value introducing prolonged delivery failures when vehicles State dimension 3M + 4 94 temporarily leave radio coverage. Action space size |Amax | 3 Beacon-based contact configuration. The RSU Network architecture — 94–150–100–3 transmits discovery beacons of size Lb = 100 B at inter- Optimizer — Adam vals of Tb = 0.1 s over the same simulated IEEE 802.11p Learning rate η 10−3 γ 0.99 channel used for model transfers. Contact eligibil- Discount factor Replay capacity |Bi | 20 000 ity is evaluated over a sliding observation window of Mini-batch size B 32 Tobs = 0.5 s, requiring at least Nbeacon = 3 successful Training start Nstart 200 transitions beacon receptions. This corresponds to the nominal Target update period Ctarget 1 000 steps three-of-five beacon reception criterion used in the ex- Huber loss threshold δH 1.0 periments. Exploration start ϵstart 1.0 RSU transfer scheduling configuration. The RSU Exploration minimum ϵend 0.05 Exploration decay — Exp., 80 rounds evaluates the transfer queue at intervals of ∆tsched = Second-visit penalty κ2 10 0.1 s of simulation time. At each scheduling step, the κ3+ 50 controller processes completed transfers, updates vehi- Subsequent-visit penalty Local episodes per round E 10 cle contact eligibility using the beacon-reception criteParticipating vehicles K 50 rion, and starts the next queued transfer when no other Federated rounds T 100 transfer is active. Waiting vehicles that lose contact are removed from the queue. Following an unsuccessful transfer, the corresponding model object remains pending and may be scheduled for another attempt when the vehicle is eligible again. Completed attempts are placed at the end of the queue when additional transfer work remains. No new attempts are initiated after the end of the corresponding communication drive. Communication-drive configuration. Each downlink or uplink communication phase is executed during a non-learning SUMO drive. Following a 200 s traffic warm-up, learning vehicles depart at randomized times within a 100 s departure window and follow their current routing policies greedily. Individual trips terminate upon arrival, route failure, or a maximum trip duration of 600 s. The RSU schedules transfers during the available vehicle contacts, with the end of the drive serving as the deadline for outstanding requests. Each federated round includes separate downlink and uplink drives, followed by global-model evaluation on three fixed scenarios without additional V2I model communication. SUMO-ns-3 control interface. The Python co-simulation driver maintains one persistent TCP connection to a control endpoint in the ns-3 process. Supported operations include updating vehicle positions and velocities, moving inactive vehicles outside communication range, querying beacon-reception status, initiating uplink and downlink transfers, advancing the ns-3 simulation clock, and resetting the simulation state. Transfer initiation is asynchronous. When the driver advances ns-3 to a specified simulation time, the interface reports transfers completed during the elapsed interval, including their delivery outcomes, simulated completion times, and received bytes. Successfully delivered objects are then passed to the corresponding receiving endpoint for signature and communication-context verification. Model traffic itself is carried through the simulated UDP/IEEE 802.11p data plane rather than the TCP control connection. SR-ARQ transport configuration. The ns-3 communication model employs a custom Selective Repeat ARQ layer for packet fragmentation, retransmission, and reassembly. Table G.2 summarizes its transport parameters, including chunk sizes, window limits, retransmission settings, and UDP port assignments. Each SR-ARQ chunk additionally carries a 44-byte binary header containing message identification, sequencing, transmission timing, and integrity metadata. The header layout is specified as follows: Header = |{z} u8 |{z} u8 |{z} u16 |{z} u64 |{z} u32 |{z} u16 |{z} u16 |{z} u16 |{z} u16 |{z} u64 |{z} u32 |{z} u32 |{z} u32 type rsv flags msg id round veh

idx total wnd tx ns tot len chk len crc32

(G.1) | {z }

payload

The flags field identifies the transmission direction, while idx and total specify the chunk index and the 36

Table G.3: Software components and reported versions. Component

Tool

Version

Traffic simulator Network simulator DQN training Privacy processing FL coordination PQC signatures and ML-KEM Classical signature benchmark Payload serialization CRC integrity Python integration

SUMO ns-3 TensorFlow (Keras) NumPy Flower (flwr) liboqs / liboqs-python cryptography/OpenSSL NumPy (savez compressed) zlib Python

1.26 3.46 2.x 1.x 1.x 0.15.0 / 0.14.1 46.0.7 1.x system 3.10.20

total number of chunks in the message. The crc32 field contains the CRC-32 checksum used to validate the chunk payload. Software and execution environment. The experimental framework integrates SUMO, ns-3, Table G.2: SR-ARQ transport parameters used in ns-3. and the Python-based learning process. SUMO Parameter Symbol Value communicates with the training process through Chunk payload size Lchunk 1200 B TraCI, while ns-3 operates as a separate process Chunk header size 44 B and advances in lockstep with the SUMO simInitial window W0 32 chunks ulation clock. Local DQN training uses TensorMaximum window Wmax 128 chunks Flow/Keras, whereas privacy processing and model Retransmission timeout τrto 120 ms serialization use NumPy. Per-chunk retry cap Rmax 8 Inter-chunk pacing ∆pace 200 µs Federated aggregation is coordinated within Window increase (ACK) +1 (additive) the Python training process using Flower’s stratUplink UDP port 40000 egy classes, without its client–server gRPC transDownlink UDP base port 41000 + veh index port. Post-quantum signature operations and MLACK UDP port 40001 KEM-512 key establishment use liboqs through its Python oqs interface. The CPQ group setup additionally employs ChaCha20, ChaCha20-Poly1305, HKDF-SHA256, and HMAC-SHA256 through the cryptography package. Table G.3 summarizes the software components and their versions. Execution hardware. The controlled cryptographic microbenchmarks were performed on an x86 64 Linux workstation equipped with an Intel Core i7-8700 CPU at 3.20 GHz, 12 logical CPUs, and 15.42 GiB of RAM. The software environment used Linux 5.4 and Python 3.10.20. Signature timing measurements were CPU-based. PQC key persistence. Signing key pairs are generated through the Python oqs interface to liboqs during system initialization. The resulting keys are stored as {identity} {scheme}.pk/.sk files and reloaded when available to maintain consistency across restarts within a training run.

H

Controlled Signature Microbenchmark

This section presents a controlled microbenchmark of the digital signature schemes considered in this study. Table H.1 compares public-key sizes, signature sizes, and the computational costs of key generation, signing, and verification across four post-quantum configurations and two classical reference schemes. These measurements isolate cryptographic operations from model serialization and network transmission, providing a reference for interpreting the integrated V2X communication results in Section 7.3. Measurement protocol. The microbenchmark was conducted on the evaluation workstation described in Appendix G. Post-quantum signature operations were evaluated using liboqs 0.15.0 through liboqs-python 0.14.1. The classical RSA and ECDSA reference schemes were evaluated using the cryptography 46.0.7 package with its OpenSSL backend. 37

Table H.1. Controlled signature microbenchmark on the evaluation workstation. Timing values are mean ± standard deviation in milliseconds over N = 200 measured trials using 4096-byte messages. Algorithm

Basis

PK (B)

Sig. (B)

Keygen (ms)

Sign (ms)

Verify (ms)

ML-DSA-44 Falcon-512 SLH-DSA-SHA2-128f SLH-DSA-SHA2-128s

MLWE/MSIS NTRU/SIS Hash Hash

1312 897 32 32

2420 655.1 17088 7856

0.037 ± 0.009 5.771 ± 1.285 0.989 ± 0.086 61.707 ± 2.624

0.105 ± 0.063 0.210 ± 0.027 23.078 ± 1.377 469.949 ± 4.877

0.045 ± 0.009 0.059 ± 0.012 1.412 ± 0.110 0.491 ± 0.030

RSA-2048-PSS-SHA256 ECDSA-P256-SHA256

IFP ECDLP

256 65

256 71.0

38.741 ± 24.430 0.022 ± 0.004

0.799 ± 0.025 0.053 ± 0.006

0.048 ± 0.003 0.084 ± 0.008

For each signature scheme, five warm-up trials were executed and excluded from measurement, followed by N = 200 recorded trials. Each recorded trial generated a fresh key pair, signed a 4096-byte message, and verified the resulting signature. Key generation, signing, and verification were timed independently using a monotonic high-resolution clock. Because Falcon-512 and ECDSA P-256 produce variable-length signatures, Table H.1 reports their mean signature sizes across the measured trials. For Falcon-512, signature sizes ranged from 648 to 661 bytes, with a mean of 655.1 bytes. ECDSA P-256 signatures ranged from 69 to 72 bytes, with a mean of 71.0 bytes. The evaluated Falcon-512 implementation supports a maximum signature size of 752 bytes, which is distinct from the sizes observed during the 200 trials. The microbenchmark includes both SLH-DSA-SHA2-128f and SLH-DSA-SHA2-128s to characterize the tradeoffs between hash-based signature parameter sets. The primary mobility-coupled vehicular evaluation employs ML-DSA-44 for authenticated model exchange, while the additional signature-sensitivity experiment evaluates ML-DSA-44, Falcon-512, and SLH-DSA-SHA2-128f under mobility-coupled V2I communication. RSA-2048PSS-SHA256 and ECDSA-P256-SHA256 are included as conventional reference baselines for computational comparison. These classical signature schemes are not quantum-resistant and are not used in the integrated vehicular experiments. For the notation in Table H.1, PK refers to the raw public-key representation used for comparison. The underlying mathematical bases are identified using IFP for the Integer Factorization Problem, ECDLP for the Elliptic Curve Discrete Logarithm Problem, MLWE for Module Learning With Errors, and MSIS for Module Short Integer Solution.

I

Signature-Scheme Sensitivity Under Mobility-Coupled V2I Communication

This appendix provides an additional analysis of the signature-sensitivity experiment presented in Section 7.3. We examine how the different authenticated message sizes influence uplink transfer reliability as vehicle-to-RSU distance increases. The comparison includes ML-DSA-44, Falcon-512, and SLH-DSA-SHA2-128f, each evaluated with full-precision and one-bit CPQ model updates under the same IEEE 802.11p communication framework. Distance-dependent uplink reliability. Figure I.1 reports the uplink transfer-attempt success rates across vehicle-to-RSU distance intervals. With full-precision updates, all three signature schemes exhibit a similar decline in transfer reliability as the vehicle moves farther from the RSU. At distances of 125–150 m, the attempt success rates are 3%, 4%, and 3% for ML-DSA-44, Falcon-512, and SLH-DSA-SHA2-128f, respectively. In contrast, CPQ substantially improves distance-dependent communication reliability by reducing the authenticated uplink size. At 125–150 m, CPQ achieves 100% transfer-attempt success with ML-DSA-44 and Falcon-512, compared with 25% for SLH-DSA-SHA2-128f. At 150–175 m, the corresponding success rates are 77%, 94%, and 0%. These results illustrate how signature size becomes increasingly influential when the model-update payload is highly compressed and wireless connectivity is constrained by vehicle mobility. The overall uplink delivery rate remains distinct from the per-attempt success rate, since the communication protocol can retransmit unsuccessful transfers. For CPQ, the overall uplink delivery rates are 99.8% with ML-

38

ML-DSA-44

Falcon-512

SLH-DSA-128f

Successful uplink attempts (%)

(a) Full-precision uplink

(b) One-bit CPQ uplink

100 75 50 25 0 75–100

100–125

125–150

150–175

Distance at transfer start (m)

75–100

100–125

125–150

150–175

Distance at transfer start (m)

Figure I.1. Distance-dependent uplink transfer-attempt success under IEEE 802.11p communication for three post-quantum signature schemes: (a) full-precision updates and (b) one-bit CPQ updates. Each point represents the percentage of successful uplink transfer attempts within the corresponding vehicle-to-RSU distance interval at transfer initiation (ϵp = 1).

DSA-44, 99.8% with Falcon-512, and 93.1% with SLH-DSA-SHA2-128f. Thus, retransmissions support eventual delivery, but larger authenticated messages impose additional wireless communication costs.

J

Detailed Privacy–Utility Experimental Results

This appendix provides additional analyses of the privacy–utility results presented in Section 7.2. We examine seed-paired differences between CPQ and LDP-FL, the effect of CPQ-λ correlation mixing, run-to-run variability, and secondary traffic-delay measures. The primary comparisons consider privacy budgets ϵp ∈ {0.3, 0.5, 1, 2, 5}, while the CPQ-λ analysis is conducted at a fixed ϵp = 1.

J.1

Paired Comparison with Independent Quantization

To isolate the empirical effect of correlated quantization, Fig. J.1 compares CPQ with LDP-FL at identical privacy budgets using matched random seeds. Both mechanisms employ the same one-bit representation and clipping configuration, differing in the correlation of their quantization randomness. For each seed, performance is summarized over rounds 91–100 before computing the paired difference between the two mechanisms. The travel-time benefit is defined as the LDP-FL travel time minus the corresponding CPQ travel time, while the arrival-rate benefit is defined as the CPQ arrival rate minus that of LDP-FL. Positive values therefore favor CPQ in both metrics. The figure reports the individual seed-paired differences, their mean, and the corresponding 95% Student-t confidence intervals across five seeds. CPQ exhibits a positive mean travel-time benefit at all five evaluated privacy budgets, ranging from 8.2 to 61.7 s. However, the uncertainty varies considerably across configurations. The nominal 95% confidence interval excludes zero at ϵp = 1, where the mean paired benefit is 43.1 ± 26.5 s, but includes zero at the other evaluated privacy budgets. For arrival rate, the mean paired differences are generally smaller, and all corresponding confidence intervals include zero. These observations support a favorable average routing-efficiency trend for CPQ relative to independent quantization, particularly at tighter privacy budgets. Nevertheless, the variability across seeds indicates that the observed benefit is not uniformly established across all settings.

J.2

Learning-Vehicle Population Sensitivity

We further examine the effect of the learning-vehicle population under ideal communication, comparing CPQ and LDP-FL at ϵp = 1 with K ∈ {10, 25, 50}. Each configuration uses 100 federated rounds, 10 local training episodes 39

Dots: five seed-paired differences | Open circle: mean | Whiskers: 95% t CI

(a) Trip-duration benefit

(b) Arrival-rate benefit CPQ better →

CPQ better →

Privacy budget εp

0.3 0.5 1 2 5 −100

−50

0

50

100

−40

LDP-FL − CPQ (seconds)

−20

0

20

40

CPQ − LDP-FL (percentage points)

Figure J.1: Seed-paired routing-performance differences between CPQ and LDP-FL.

per round, and five matched seeds. Results are averaged over rounds 91–100 before computing the seed-paired differences. The K = 50 results are taken from the primary privacy–utility evaluation. For K = 25, CPQ forms 12 pairs per coordinate, with the remaining vehicle using independent quantization. Table J.1 reports travel-time gains, defined as LDP-FL minus CPQ, and arrival-rate gains, defined as CPQ minus LDP-FL. Positive values favor CPQ in both metrics. Results are reported as paired means with 95% Student-t confidence half-widths, while the final column indicates the number of seeds in which CPQ achieves lower travel time. CPQ achieves positive mean travel-time and arrivalTable J.1: Population sensitivity at ϵp = 1. rate gains across all three populations. The travel-time Travel-time gain Arrival-rate gain Faster confidence intervals exclude zero at K = 25 and K = 50, K (s) ↑ (pp) ↑ seeds whereas the K = 10 results show substantially greater variability. The gains do not increase monotonically 10 42.0 ± 142.0 8.6 ± 31.1 3/5 with K. Since all learning vehicles share the SUMO en- 25 61.8 ± 43.5 10.8 ± 10.0 5/5 vironment, changing the population also changes traffic 50 43.1 ± 26.5 8.8 ± 12.4 5/5 demand, rather than isolating the effect of aggregation population size.

J.3

Correlation Mixing and Seed-Paired Analysis

The CPQ-λ ablation in Table 3 includes empirical aggregation-MSE measurements and seed-paired routing comparisons. For each round, aggregation MSE is measured across all model coordinates relative to the average of the clients’ clipped models, excluding clipping error. The measurements are averaged over 100 rounds within each run and then across ten seeds. The observed MSE decreases monotonically with λ, consistent with the theoretical correlation-mixture relationship. To examine routing variability, Fig. J.2 reports seed-paired travel-time differences relative to independent LDP-FL and fully correlated CPQ. For each of ten matched seeds, travel time is first averaged over rounds 91–100 before computing the paired difference. The figure shows individual differences and their mean with 95% Student-t confidence intervals. Negative values indicate lower travel time than the reference mechanism. Relative to LDP-FL, the intermediate mixing configurations exhibit mean travel-time differences ranging from −41.3 to −30.7 s, with only the confidence interval for λ = 0.75 excluding zero. Fully correlated CPQ yields a paired difference of −45.8 ± 38.0 s. Relative to fully correlated CPQ, all intermediate configurations have confidence intervals containing zero. These results indicate favorable average routing performance with partial correlation but do not establish a consistent ranking among the mixing configurations.

40

CPQ

LDP-FL

Gaussian

Laplace

(a) Final trip duration

No privacy

(b) Successful arrivals

400 80

Arrival rate (%)

Mean trip duration (s)

100

300

200

100

60

40

20

0.3

0.5

1

2

5

0.3

0.5

Privacy budget εp

1

2

5

Privacy budget εp

Open markers: mean ± sample SD | Small dots: individual seed summaries | Gray band: no-privacy mean ± SD

Figure J.3: Seed-level variability of late-round travel time and arrival rate across privacy budgets.

J.4

Run-to-Run Variability

Figure J.3 provides a seed-level view of the late-round routing performance reported in Table 2. Each individual marker represents the mean evaluation result over rounds 91–100 for one independent seed. The larger markers and error bars indicate the across-seed mean and sample standard deviation, respectively. The no-privacy FLDQN reference is shown separately using a dashed line and a shaded standarddeviation band.

Individual seeds

Mean and 95% CI

(a) Relative to LDP-FL (λ = 0)

λ 0.25 0.5 0.75 0.9

J.5

1

Secondary Routing Delay Measures

To complement the travel-time and arrival-rate results, Fig. J.4 reports two additional SUMO metrics: time loss and waiting time. Time loss represents the difference between experienced travel time and free-flow travel time along the driven route, whereas waiting time measures the accumulated duration during which vehicle speed falls below 0.1 m/s. Both metrics are summarized over rounds 91–100 and averaged across five independent runs. At ϵp = 0.3, CPQ achieves a mean time loss of 51.4 s and waiting time of 20.2 s, compared with 86.7 s and 42.2 s for LDP-FL, respectively. The Laplace and Gaussian mechanisms exhibit higher values for both metrics under the same privacy budget. As the privacy budget increases, the differences among the mechanisms generally become smaller, although their relative ordering is not uniform. At ϵp = 5, Laplace achieves slightly lower time loss and waiting time than CPQ. These results provide additional context for the routing-efficiency differences observed in the main evaluation.

41

-120

-60

0

60

120

0

60

120

(b) Relative to CPQ (λ = 1)

λ 0.25 0.5 0.75 0.9

-120

-60

Paired travel-time difference (s)

Figure J.2. Seed-paired travel-time differences for CPQ-λ.

(a) SUMO time loss (s)

(b) SUMO waiting time (s) 160

250

CPQ

51.4

45.4

52.9

44.1

44.0

CPQ

20.2

18.7

23.8

19.6

18.6

200

LDP-FL

86.7

75.3

70.5

47.7

56.5

Gaussian

251.9

176.6

104.0

79.1

56.5

Laplace

126.4

83.9

79.9

50.3

42.7

140 120

LDP-FL

42.2

34.7

32.7

21.8

26.6

100 Gaussian

159.9

103.9

54.7

38.7

23.5

68.5

39.2

37.4

21.1

17.9

0.3

0.5

1

2

5

150

100 80

0.3

0.5

1

2

5

60 40

50

Laplace 0

Privacy budget εp

20 0

Privacy budget εp

Cells show means over five seeds, rounds 91–100. Smaller values are better.

Figure J.4: Secondary routing-delay measures across privacy mechanisms and privacy budgets.

K

Server-Hidden Pairing for CPQ and CPQ-λ

This appendix details the authenticated group establishment and server-hidden pairing procedures underlying CPQ and CPQ-λ. An agreed vehicle group establishes a shared secret before federated training and subsequently derives coordinate- and round-dependent pair assignments and complementary pseudorandom values without exchanging pairing information during training. We first describe group establishment over the simulated V2I channel, followed by the local pairing construction and its security assumptions. Setup and trust assumptions. Before federated training, the vehicles establish an agreed ordered participant list R and a group epoch identifier e. The first vehicle in R serves as the designated group coordinator D. Each vehicle possesses registered post-quantum signing and ML-KEM-512 public keys, established through an authenticated bootstrap channel. The coordinator distributes a group secret KG to the other vehicles using authenticated, ML-KEM-protected messages relayed by the RSU. The RSU acts as a store-and-forward intermediary and does not require access to the group secret or the vehicles’ KEM private keys. Each recipient verifies the sender, intended recipient, group epoch, and ordered participant list before accepting the setup information. Training begins only after the required group confirmations have completed successfully. The server-hidden pairing model assumes an honest-but-curious RSU without access to KG or the information required to derive it. Participating vehicles are assumed not to disclose the group secret to the RSU; compromised or colluding group members fall outside this secrecy assumption. Group membership remains fixed within an epoch, and a changed participant group requires a new group setup. Authenticated group establishment. The coordinator D executes a three-stage protocol using signed messages delivered through the RSU: 1. KEY. For each other participant u ∈ R, the coordinator encapsulates a shared secret using the recipient’s ML-KEM-512 public key. A key derived from the encapsulated secret through HKDF-SHA256 protects KG using ChaCha20-Poly1305. The authenticated context binds the recipient, epoch, and hash of the ordered participant list. 2. CONFIRM. After verifying and recovering KG , each recipient returns a signed key-confirmation message containing an HMAC-SHA256 tag derived from Kcheck and bound to its identity, the epoch, and the participant-list hash. 3. SETUP OK. Once all required confirmations have been validated, the coordinator sends a signed completion message to the group. Any failed authentication, decryption, context validation, or incomplete confirmation prevents successful completion of the group setup.

42

43

Abort limit

Vehicles completing setup (of 49)

Because the vehicles may contact the RSU at different times, setup messages are stored and forwarded as recipients become available. They traverse the same beacon-controlled, RSU-scheduled, SR-ARQ V2I communication system used for model exchange, during dedicated setup drives preceding federated training. No additional pairing messages are transmitted during subsequent training rounds. Group-establishment overhead. In the primary ML-DSA-44 mobility-coupled evaluation, authenticated ML-DSA-44: 9 Falcon-512: 7 group establishment completed in 3–9 dedicated setup SLH-DSA-128f: 19 drives across five independent CPQ runs, generating 714.6–717.2 KB of total wire traffic per run. The pro49 tocol required 246–247 transfer attempts, including 40 retransmissions when necessary. The signature-sensitivity experiment further char30 acterizes the communication cost of CPQ initialization under three post-quantum authentication schemes. All 20 three configurations successfully completed group estab10 lishment for the same 49 recipient vehicles. Falcon-512 completed setup in 7 drives with 246 successful transfers 0 and 280.4 KB of total wire traffic. ML-DSA-44 com0 4 8 12 16 20 pleted setup in 9 drives with 246 successful transfers Communication drives before training and 714.6 KB of traffic. In comparison, SLH-DSASHA2-128f required 19 setup drives and 426 transfer Figure K.1. Authenticated CPQ group-establishment attempts to complete the same 246 successful message progress across post-quantum signature schemes. All 49 recipients verified SETUP OK after 7 (Falcon-512), 9 deliveries, generating 7,462.2 KB of wire traffic. (ML-DSA-44), or 19 (SLH-DSA-SHA2-128f) commuFigure K.1 illustrates the progression of groupnication drives. The vertical line marks the 20-drive establishment completion across the dedicated setup setup limit. drives. The shorter Falcon-512 signatures permit more compact authenticated setup messages, while the larger SLH-DSA signatures increase wireless transmission and retransmission costs. Consequently, signature selection influences both the communication overhead of model exchange and the time required to establish CPQ’s shared randomness under intermittent V2I connectivity. Group establishment is performed once per participant-group epoch, before federated training. Its communication cost is therefore distinct from the per-round uplink and downlink traffic reported in the main evaluation. Key and randomness derivation. The group secret KG is expanded using HKDF-SHA256 into three purposeseparated, 32-byte keys: Kpair for pair assignment, Kcoin for shared-value generation, and Kcheck for group confirmation. The derivation incorporates the group epoch e and the SHA-256 hash of the consistently encoded ordered participant list R. For each round t, ChaCha20 streams indexed by vehicle identity generate the sorting values for all model coordinates, while separate streams indexed by pair position generate the corresponding shared values. At each coordinate, the vehicles sort the entire agreed group by the derived keys, using original list positions to break ties. Adjacent sorted vehicles form pairs and use complementary values V and 1 − V . No pairing assignments or shared random values are transmitted during training. Quantization properties and partial participation. Under the ideal model of independent, continuous uniform shared values across distinct pairs, the construction realizes the complementary coupling analyzed in Theorem 1. The population MSE bound in Corollary 1 additionally assumes that the aggregate contains complete pairs. In the contact-dependent implementation, pair assignments are determined over R, regardless of which vehicles successfully deliver their updates. If only one member of a pair is included, the pairwise error cancellation is not realized. Consequently, the complete-pair population bound does not directly apply to arbitrary accepted-client sets. The finite-precision implementation requires separate consideration, as discussed in Appendix E.

Algorithm K.1 Authenticated setup and server-hidden CPQ shared-randomness generation 1: Group setup (once per epoch) 2: Agree on ordered group R and epoch e; let D be the first vehicle. 3: hR ← SHA256(Encode(R)) 4: D obtains KG and distributes signed, ML-KEM-protected KEY messages through the RSU. 5: Recipients authenticate and recover KG . 6: Derive Kpair , Kcoin , and Kcheck using HKDF-SHA256 with purpose labels, e, and hR . 7: Recipients return signed CONFIRM messages using Kcheck . 8: D verifies all confirmations and distributes signed SETUP OK; abort on incomplete or invalid setup. 9: 10: Local procedure 11: HiddenPairValue (KG , R, e, i, j, t): 12: Use the epoch keys Kpair and Kcoin derived during setup. 13: for each u ∈ R do 14: su ← ChaCha20Stream(Kpair ; t, u)[j] 15: end for 16: Sort R by increasing su , breaking ties by original list position. 17: Let k be the zero-based position of vehicle i in the sorted list. 18: if |R| is odd and k = |R| − 1 then 19: return a private uniform value. 20: end if 21: ℓ ← ⌊k/2⌋ 22: V ← Float53(ChaCha20Stream(Kcoin ; t, ℓ)[j]) 23: if k mod 2 = 0 then 24: return V 25: else 26: return 1 − V 27: end if

L

Vehicle-Origin Inference Attack: Design and Evaluation

Experimental configuration. To complement the empirical privacy evaluation in Section 7.5, we investigate vehicle-origin inference using the mobility-coupled SUMO and ns-3 framework. The road network contains 30 directed edges, with 50 learning vehicles distributed equally across 10 possible starting edges: E0, E1, E3, E11, E8, -E1, -E11, -E8, -E13, and E14. Each vehicle retains its assigned origin throughout training, while all vehicles share the publicly known destination E15. The DQN architecture consists of 94 state inputs, two hidden layers with 150 and 100 neurons, and three output actions, resulting in 29,653 trainable parameters. Training proceeds for 100 federated rounds with 10 local episodes per round. The learning rate is 10−3 , the mini-batch size is 32, and the exploration rate decreases from 1.0 to 0.05 over 80 rounds. Three independent random seeds are evaluated for each method. The communication environment employs IEEE 802.11p at 6 Mb/s over a 10 MHz channel, with 20 dBm transmission power, log-distance path loss (exponent 2.7), and Nakagami fading. The RSU is located at junction J3. Vehicles discover the RSU through beacon transmissions and upload their updates only during available communication opportunities. The origins are selected such that their shortest routes pass the RSU at comparable distances of 120–143 m, reducing differences in nominal RSU proximity across origin classes. Background traffic is generated at an average interval of 1.75 s following a 200 s warm-up, while learning-vehicle departures are randomized within a 100 s window in each episode. Model uploads are authenticated using ML-DSA-44, and the CPQ group secret is established using ML-KEM. The evaluation compares full-precision model exchange without privacy against CPQ and independent LDP-FL quantization at ϵp = 0.3. Both private mechanisms clip local model updates relative to the global model using

44

r = 0.02 and encode each parameter with one bit. The server retains only successfully received and authenticated uploads. Adversary and observation model. We consider an honest-but-curious RSU that follows the communication and aggregation protocol while attempting to infer each vehicle’s private starting edge from received model updates. The attacker knows the road network, learning architecture, privacy mechanism, privacy budget, clipping radius, and global model at each round. It also observes individual successfully received uploads and can associate observations belonging to the same pseudonymous vehicle across rounds. The attacker does not observe private vehicle trajectories or possess the CPQ group secret. Vehicle identifiers carry no origin information, and vehicle order is randomized before evaluating each attack. The attack objective is to identify one of 10 possible origins for each target vehicle, corresponding to a random-guessing accuracy of 10%. The attacker uses only the updates actually available at the RSU and does not assume complete federated participation. Attack feature construction. The attacker extracts information from received updates by evaluating their influence on the learned Q-function. Specifically, 60 fixed probe states are constructed from the public road network, covering each of the 30 directed edges under two traffic conditions representing empty and busy traffic. These states do not depend on the private trajectories of target vehicles. For each received update, the attacker evaluates the difference between the uploaded model’s Q-values and those of the corresponding global model at every probe state: (t)

(t)

∆Qi (s, a) = Qi (s, a) − Q(t) g (s, a), (t)

(L.1)

(t)

where Qi and Qg denote the Q-functions associated with the received client model and the global model at round t, respectively. With 60 probe states and three actions, each update produces a 180-dimensional feature vector. This representation captures the changes in routing decisions induced by local training while providing comparable features across training runs. Alternative representations, including selected first-layer weights and principal-component features of complete updates, are also evaluated. Temporal evidence accumulation. Because each vehicle retains the same origin throughout training, the attacker combines evidence across multiple federated rounds. We evaluate two inference strategies. In the first strategy, an L2-regularized logistic regression classifier estimates the probability of each origin from the features of an individual received update. Log-probabilities are accumulated over the observed rounds, and the origin with the largest cumulative score is selected: X (k) (t) (L.2) ôi = arg max log P (o | xi ), o∈O

t∈Ti (k)

(t) where O denotes the set of candidate origins, xi is the feature vector extracted from vehicle i at round t, and

Ti (k) contains the rounds up to k in which the RSU successfully received an update from that vehicle. In the second strategy, the received updates of each vehicle are averaged across the observation window, and a classifier trained on averaged updates predicts its origin. Both strategies account for missing uploads by using only successfully received observations. Vehicles without any received updates in the observation window are assigned random guesses. Attack accuracy is evaluated after k ∈ {1, 2, 5, 10, 20, 50, 100} observed rounds. Attack 1: Known-origin vehicles. In the first scenario, the RSU knows the starting edge of one vehicle from each origin class, corresponding to 10 known vehicles among the 50 participants. These vehicles are ordinary honest clients, and their cryptographic secrets are not available to the attacker. The attacker trains on the labeled updates from these vehicles and evaluates origin inference on the remaining 40 vehicles. It uses the Q-function probe features and the per-round probability accumulation strategy in (L.2). The classifier employs L2-regularized logistic regression with C = 0.1, fixed using separate pilot experiments. Five random selections of the known-origin vehicles are evaluated for each simulation run.

45

Attack 2: Shadow-run inference. In the second scenario, the RSU has no labeled vehicles in the target deployment. Instead, it generates independent simulations of the same road network and learning configuration, using their known origin labels to train an inference classifier. We employ leave-one-seed-out evaluation. For each method, two simulation seeds are used for attacker training, while the third seed is held out for evaluation. This process is repeated with each seed serving as the target once. Feature representation, classifier regularization, and temporal aggregation strategy are selected using only training-seed data. The target seed is never used for classifier training or model selection. The attacker then predicts the origins of all 50 vehicles in the held-out deployment, providing an evaluation without labeled vehicles in the target run. Evaluation and validation. Attack effectiveness is measured as the percentage of target vehicles whose origins are correctly identified after observing k federated rounds. The evaluation includes three independent simulation seeds for each privacy method. In addition to reporting seed-level variability, 95% confidence intervals are estimated through a cluster bootstrap that resamples simulation seeds and vehicles. Shuffled-label controls are also evaluated, using five random permutations of origin labels to verify that the attack does not exploit artificial label associations. To verify consistency between the attack observations and federated training, the server records its global model and all successfully received individual uploads. Reconstructing and aggregating these logged updates reproduces the server’s next global model with a maximum difference below 10−6 across all nine runs. The shuffled-label controls achieve approximately 8–11% accuracy, consistent with random guessing. The mean percentages of vehicle-round updates successfully received by the RSU are 47% for the no-privacy baseline, 61% for CPQ, and 62% for LDP-FL. Thus, the attack results reflect the actual observations available under mobility-dependent communication. Origin inference results. Table L.1 summarizes the inference accuracy of the two attacks at three representative observation windows. Values are reported as mean ± sample standard deviation across three seeds, consistent with the reporting convention used in the main paper. The statistics are computed from the reported rounded seed-level accuracies. The known-origin attack reaches 68.7% mean accuracy after 100 rounds without privacy, comTable L.1. Vehicle-origin inference accuracy (mean ± SD). pared with 13.0% for CPQ and 12.0% for LDP-FL. No privacy CPQ LDP-FL Both private mechanisms substantially reduce in- Rounds ference accuracy across the evaluated observation A. Known-origin attack windows. 33.7 ± 4.5 11.3 ± 0.6 9.3 ± 2.5 Under the shadow-run attack, which requires no 10 63.7 ± 4.5 11.7 ± 1.5 10.0 ± 1.0 known-origin vehicles in the target deployment, the 50 68.7 ± 6.8 13.0 ± 2.6 12.0 ± 3.5 no-privacy baseline reaches 91.3% mean accuracy 100 after 100 rounds. In comparison, CPQ and LDPB. Shadow-run attack FL achieve 30.0% and 22.0%, respectively. The 46.0 ± 7.2 13.3 ± 4.2 11.3 ± 2.3 stronger late-round inference results for the private 10 mechanisms arise from the strategy that averages 50 76.7 ± 6.1 14.7 ± 4.2 10.7 ± 5.0 received updates across rounds. 100 91.3 ± 1.2 30.0 ± 10.6 22.0 ± 4.0 These findings show that the unprotected federated updates contain information that can be exploited to infer private vehicle origins. Both CPQ and LDP-FL substantially reduce the effectiveness of the evaluated attacks, providing application-level empirical evidence that complements the theoretical privacy analysis. Together with the routing and communication evaluations, the results further characterize the privacy–utility– communication trade-offs of private quantization in vehicular federated learning. Ethical Considerations: The origin-inference attacks were conducted entirely within a simulated vehicular environment using synthetically generated mobility and federated learning data. No real driver information, personal mobility records, or operational vehicular infrastructure were involved. The attacks were implemented solely to evaluate potential privacy vulnerabilities and assess the effectiveness of the proposed privacy-preserving mechanism.

46

Related documents

• PQSF: post-quantum secure privacy-preserving federated learning#1502222
• Optimal quantum locally differentially private mechanisms in the high-privacy regime#927326
• Scalar Federated Learning for Linear Quadratic Regulator#1186439
• Quantum key distribution through quantum machine learning: a research review#1368447
• CARM: Cancellation-Aware Response Masking for LLM Reinforcement Learning#1161044