arXiv CSopen access

Automated Byzantine-Resilient Clustered Decentralized Federated Learning for Battery Intelligence in Connected EVs

1

Automated Byzantine-Resilient Clustered Decentralized Federated Learning for Battery Intelligence in Connected EVs

arXiv:2605.21115v1 [cs.DC] 20 May 2026

Mouhamed Amine Bouchiha, Member, IEEE, Abdelaziz Amara Korba, Member, IEEE, Yacine Ghamri-Doudane, Senior Member, IEEE

Abstract—Federated learning (FL) has emerged as a promising paradigm for managing electric vehicle (EV) battery data in intelligent transportation systems (ITS), enabling privacypreserving tasks such as anomaly detection and capacity estimation. However, most existing frameworks rely on centralized aggregation schemes, which pose critical limitations in terms of security and trust. To address these challenges, we propose ABCDFL, an automated Byzantine-resilient clustered decentralized federated learning (C-DFL) framework for connected EVs. The proposed incentive-driven C-DFL system replaces the central server with an open-permissioned blockchain, featuring a new dynamic Quorum Byzantine Fault Tolerance (QBFT) protocol and an oracle-based aggregation layer, to enhance trust, security, and automation. At the core of ABC-DFL lies FLECA (Filtered Layered Enhanced Clustering Aggregation), a robust hierarchical aggregation protocol that mitigates Byzantine attacks by having each EV filter malicious updates using an adaptive threshold based on deviations from its reference model update. Oracle nodes, responsible for inter-group aggregation, employ robust clustering to isolate and aggregate model updates from trustworthy EV groups. Comprehensive experimental evaluations demonstrate that FLECA matches FedProx convergence under benign conditions and significantly outperforms existing defenses with attack impact scores below 0.10 in adaptive adversarial scenarios. Furthermore, several learning experiments with multitask models confirm the effectiveness and fairness of the incentive mechanism. Finally, on-chain and off-chain benchmarks validate the practicality of ABC-DFL. Index Terms—ITS, Connected EVs, Decentralized Federated Learning, Robust Aggregation, Automation, Scalability.

I. I NTRODUCTION MART battery management plays a critical role in optimizing electric vehicle (EV) performance within intelligent transportation systems. State-of-the-art approaches leverage advanced data analytics and machine learning to improve battery diagnostics and capacity estimation, thereby enhancing safety and operational efficiency [1]. Accurate diagnostics and capacity estimation allow continuous monitoring of battery health, enabling the detection of faults such as overvoltage, overheating, and cell imbalance, while evaluating state-of-charge (SoC) and state-of-health (SoH) to maximize energy utilization and extend battery lifespan [2], [3]. These

S

Mouhamed Amine Bouchiha is with SAMOVAR, Télécom SudParis, Paris, France; Abdelaziz Amara Korba is with the Department of Computer Science, German University of Technology in Oman (GUtech), Muscat, Oman. , and Yacine Ghamri-Doudane is with L3i, La Rochelle University, La Rochelle, France. E-mail: {[email protected], [email protected]; [email protected].}

capabilities are essential for robust integration of EVs into ITS infrastructure, supporting applications such as smart charging and vehicle-to-grid (V2G) systems [4]. However, current EV battery intelligence approaches typically use centralized computing, sending Battery Management System (BMS) data to cloud servers due to limited onboard processing power [5]. This creates high latency and privacy risks (i.e., driving behavior, usage patterns, and degradation profiles) [6]–[8], despite enabling comprehensive pattern modeling. Federated Learning (FL) [9] has been adopted as a semidecentralized paradigm in Intelligent Transportation Systems (ITS) [4], [5] and, specifically for EV battery intelligence, to enable collaborative model training while preserving data privacy [6], [10]. However, traditional FL frameworks are vulnerable to single points of failure and lack transparency and verifiability in aggregation [11], [12]. To overcome these limitations, recent research has shifted towards Fully Decentralized Federated Learning (DFL). In DFL, EVs communicate directly in a peer-to-peer (P2P) manner, eliminating the central server and allowing EV to perform aggregation through direct model update exchange [4], [13], [14]. Despite its advantages, DFL faces significant challenges, including susceptibility to poisoning attacks, where malicious participants corrupt local training data [15], [16] or models [17]. Existing Byzantine robust aggregations, designed primarily for server-assisted FL, are less effective in fully decentralized settings, where the absence of a central trusted aggregator complicates detection of malicious updates. Additionally, DFL suffers from high communication overhead and slower convergence due to inconsistent updates and varying battery data distributions across clients [18]. To address these limitations, we propose a novel Clustered DFL (CDFL) framework for battery intelligence in connected EVs. Our framework improves scalability, Byzantine resilience, and automation by introducing a trustless, hierarchical communication architecture. Our key contributions are: 1 • ABC-DFL : A Byzantine-resilient clustered decentralized federated multi-task learning framework built on a scalable open-permissioned blockchain, complemented by an oracle network and off-chain storage. The blockchain enforces trust and security through integrated reward and reputation mechanisms, while oracles and off-chain storage nodes offload computation and storage 1 https://github.com/mohaminemed/ABC-DFL

2

to enhance scalability and automation beyond classical blockchain-based FL. • Dynamic Reputation-Based QBFT Protocol: A novel blockchain protocol that introduces dynamic, reputationweighted committee rotation and leader election via Verifiable Random Functions (VRFs). This directly addresses the static committee vulnerability and predictable leadership of standard QBFT, which are susceptible to targeted attacks, thereby ensuring fairness, liveness, and Byzantine robustness while preventing adversarial capture. • FLECA (Filtered Layered Enhanced Clustering Aggregation): A novel two-stage robust aggregation protocol that uniquely combines EV-side reference filtering with oracle-side robust clustering. FLECA fills the critical gap in decentralized settings by enabling Byzantineresilient aggregation without any trusted aggregator, mitigating both isolated and colluding poisoning attacks. The remainder of the paper is organized as follows. §II reviews related work. §III defines the problem. §IV presents the proposed ABC-DFL framework. §V presents the integrated lightweight dynamic QBFT consensus protocol, while §VI describes the proposed FLECA protocol. §VII provides theoretical analysis, and §VIII reports the performance evaluation and experimental results. Finally, §IX concludes the paper. II. R ELATED W ORK Existing research on EV battery intelligence primarily relies on centralized machine learning for state-of-charge (SoC), state-of-health (SoH) estimation, and anomaly detection [19]– [21]. While these approaches achieve high predictive accuracy, they inherently assume full data centralization, leading to privacy leakage risks, single points of failure, and significant communication overhead. Federated learning (FL) [9] has been proposed to alleviate these concerns by keeping raw battery data local to EVs. Ensemble-based and personalized FL methods [1], [22] improve learning performance under data heterogeneity but rely on a trusted central server for aggregation. Similarly, semidecentralized and secure aggregation schemes [8], [23]–[25] introduce encryption or adaptive mechanisms, yet still assume honest aggregators and do not consider Byzantine participants. Fully peer-to-peer FL [13] removes the central server but sacrifices scalability and provides only limited robustness guarantees. Crucially, across these works, adversarial behavior is either absent from the threat model or limited to passive privacy leakage. Beyond battery analytics, FL has been applied to intelligent transportation systems (ITS) and vehicular edge computing (VEC) to enable privacy-preserving learning [5], [26] with cooperative participants and trusted infrastructure. Furthermore, Blockchain has been explored as a trust anchor for FL in ITS [27], [28]. Liu et al. [27] integrate blockchain and digital twins to secure IoV communications, while Abdel-Basset et al. [28] propose miner-validated FL for intrusion detection. Although these systems enhance auditability and trust, they focus on centralized or single-layer aggregation and do not address scalability, hierarchical adversaries, or Byzantine behavior at multiple levels.

In contrast to prior work, ABC-DFL introduces a fundamentally different design point. Rather than relying on a trusted server or flat peer-to-peer topology, ABC-DFL adopts a clustered fully decentralized federated learning architecture for large-scale EV environments. The framework explicitly models and mitigates Byzantine behavior at both the intra (EVlevel) and inter-cluster (group-level) aggregation stages. Distinctively, ABC-DFL combines four key innovations that fill specific gaps in prior work: (i) A C-DFL trustless verification based on blockchain and oracles eliminates reliance on any trusted aggregator while solving the scalability limitation of pure on-chain aggregation [29]. (ii) Dynamic QBFT consensus with reputation-proportional committee rotation using VRFs, addressing the static committee vulnerability and predictable leadership of standard QBFT [30]; (iii) FLECA provides a novel two-stage filtering protocol that couples EVside reference checks with oracle-side clustering, solving the core decentralization challenge: enabling Byzantine detection when no trusted aggregator with global perspective exists; (iv) Incentive-aware participation employs a Gompertz-based reputation mechanism with asymmetric reward-penalty, mitigating free-riding and subtle manipulation unaddressed by averaging-based incentives. To the best of our knowledge, no existing FL framework for EV battery intelligence jointly addresses Byzantine robustness, full decentralization, and trustless aggregation under an explicit Byzantine threat model. Table I summarizes this separation by contrasting threat assumptions, trust models, architectural choices, and scalability guarantees across prior art and ABC-DFL. III. P ROBLEM D EFINITION This work addresses the fundamental challenge of designing a federated learning framework for EV battery intelligence that is simultaneously fully decentralized, scalable, Byzantineresilient, and incorporates verifiable trust and incentive. The transition to fully decentralized federated learning (DFL), while essential for eliminating the single point of failure and trust dependency of a central server, introduces three critical and interconnected research challenges that remain unaddressed in the existing literature. Foremost among these is a fundamental mismatch between existing Byzantine defenses and the decentralized environment. Robust aggregation rules are designed for a central aggregator with a complete global view of all updates. In a fully decentralized peer-to-peer setting, no single entity possesses this comprehensive perspective. Applying these rules locally at each EV is not only computationally expensive but also less effective due to the limited local view. The absence of a trusted authority to execute filtering is the core of this problem. Furthermore, there is an inherent tension between decentralization and practical scalability. A purely peer-to-peer DFL system [13] generates communication overhead that becomes prohibitive for large-scale EV fleets. This naive approach is unsuitable for the envisioned scale of future intelligent transportation systems, necessitating a novel design that reduces communication load while preserving the benefits of decentralization.

3

TABLE I: Comparison of ABC-DFL with representative FL frameworks for EV battery intelligence. Reference

Byzantine Threats

Privacy Protection

Scalability

Aggregation Levels

Trust Model

Abbaraju et al. [1] Han et al. [8] Wang et al. [13] Wang et al. [22] Wong et al. [23] Lopez et al. [24] Zhong et al. [25]

None None (domain shift) None None None Model inversion only None

Local training GMM abstraction Local training Local training Local training HE scheme Local training

Centralized bottleneck Centralized FTL Flat P2P DFL Centralized bottleneck Semi-centralized FL HE overhead Centralized FL

Single Single Single Single Single Single Single

Trusted server Trusted server Peer trust Trusted server Trusted coordinator Trusted server Trusted aggregator

ABC-DFL (ours)

Byzantine EVs + Groups

Differential Privacy + Regularization

Hierarchical Clustered-DFL

Two-level (EV/Group)

Trustless (BC + Oracles)

Abbrev.: FEL = Federated Ensemble Learning; FTL = Federated Transfer Learning; GMM = Gaussian Mixture Model; HE = Homomorphic encryption. Byzantine threats refer to malicious EVs and/or aggregators performing model poisoning or collusion.

TABLE II: Summary of key symbols and notations. Notation

Description

ABC ASC M SC CID V RF E k V IMst GM t rs Rs T Dsi ∆wsi C1 , C2 , ..., Cp β κ λ(t) = Tt m ρ

Automated Byzantine-robust Clustered Access smart contract Model smart contract Content IDentifier Verifiable Random Function Per-task EVs count Per-task EV group size Dynamic QBFT committee size Intermediate model of group s at round t Global model at round t reward earned by group s CSs reputation score Total number of communication rounds Local dataset of EV EVi at CSs Local model update from EV EVi at CSs p clusters of updates formed by FLECA Tolerance to statistical dispersion Temporal tightening factor Monotonically increasing scheduling Number of malicious EVs per group Churn rate (fraction of EVs leaving/joining)

Consequently, the core research problem we address is: How can we design a fully decentralized federated learning framework for EV networks that provides verifiable Byzantine resilience without a trusted central entity, while ensuring practical scalability and fair incentivization? This work proposes a Clustered DFL (C-DFL) architecture that organizes participants into hierarchical groups. While this design inherently improves scalability by localizing most communication within clusters, it also introduces new challenges: enabling Byzantine-robust aggregation within each group in the absence of a trusted leader, coordinating robust aggregation across groups without a central server, and guaranteeing auditability and accountability throughout the learning process.

IV. ABC-DFL F RAMEWORK This section presents the ABC-DFL framework, which integrates decentralized learning with hierarchical Byzantineresilient aggregation. The framework ensures robustness, scalability, and communication efficiency for battery data management across CSs where EVs are parked. Table II summarizes the key symbols and notations used throughout the paper.

A. System Model The ABC-DFL framework operates under a partially synchronous network model [31] with five core entities: Model Publishers (MP). initiate FL tasks (i.e., SoC estimation) and publish them on-chain to recruit charging stations. Training Agents (TA). EVs train local models LM on private battery data and share updates within their groups. Intermediate Aggregators (IA). CSs aggregate local models from EVs, producing intermediate models IM validated through a group consensus before on-chain recording. Committee Members (CM). (Validators) ensure transaction integrity using the dynamic QBFT protocol (§V), maintaining ledger security and consistency. Global Aggregators (GA). (Oracles) perform robust global aggregation of {IMs } to produce a global model GM , and automate reward/reputation updates via off-chain evaluation. Both intra- and inter-group communications operate with partial synchrony [31]. This means that message delays are bounded by ∆ in the long term, to ensure safety and liveness. B. Threat Model We consider an adaptive, colluding, and computationally bounded adversary that may corrupt EVs, MPs, TAs, IAs, and GAs at arbitrary training rounds. The adversary is aware of the aggregation, clustering, and incentive mechanisms and may attempt coordinated attacks across multiple groups. As in standard Byzantine fault-tolerant consensus and robust federated learning, ABC-DFL operates under the minimal honest-majority conditions required for correctness (i.e., indistinguishability between honest and malicious updates). Specifically, within each CS group, fewer than half of EVs are Byzantine, and globally fewer than half of CS groups are malicious. Importantly, ABC-DFL does not assume perfect detection of malicious behavior within each group. When local honestmajority conditions are violated, the framework degrades gracefully by isolating affected groups via inter-group clustering and incentive mechanisms, preventing global model corruption. For the blockchain and oracle layers, we adopt the standard partial synchrony [31] Byzantine fault-tolerant (BFT) assumption: the system can tolerate up to f faulty nodes out of a total of n, requiring n ≥ 3f + 1 to guarantee both safety and liveness [32]. This assumption is orthogonal to

4

Off-chain Storage

Oracle Network 4.3. Global Agg.: (GMt+1)

4.2. Get {IMt+1}

IPFS

4.4.1 Store GMt+1

3.6.1 Store IMst+1 3.1 Get GM0

5.1. Evaluate {IMt+1}

Group-s 3.2. Local Train.: (LMsit+1)

Private EV data

4.4.2 Save CIDGMt+1

...

3.3. Local Agg.: TA1 (IMsi*t+1)

TA2 TAi

3.4. Intermediate Agg.: (IMst+1) 3.5. T-Signτ(IMst+1)

5.2 {IMt+1} scores

4.1. Aggregate

CSs

1.1 Store GM0+Info

2.1 Join Training Pool 3.6.2 Save CIDst+1 GM0

Model Publisher

C. System Architecture The layered architecture of ABC-DFL, illustrated in Fig. 1, orchestrates the interactions between the entities defined in §IV-A across a secure and scalable workflow. 1) Application Layer: Model Publishers (MPs) initiate the process by creating and distributing learning tasks (i.e., anomaly detection, SoC estimation). CSs discover and subscribe to tasks matching their capabilities and interests. 2) Federated Learning Layer: Within each group s, EVs (a.k.a TAs) train local models on private data. Crucially, to ensure trustless collaboration within each group, EVs and CS run a threshold signature scheme [33] to validate and agree upon a common intermediate model IMs before submission. 3) Blockchain & Off-Chain Storage Layer: An openpermissioned blockchain [32], operated by a governing consortium (i.e., a committee of transportation and renewable energy administrations), provides the trust anchor. Authorized CSs participate in a Dynamic QBFT consensus [30] (f < n/3), ensuring instant finality and Byzantine tolerance. To maintain scalability, model weights are stored off-chain in IPFS; only their content identifiers (CIDs) and transaction data are recorded on-chain [34]. 4) Oracle Layer: A Decentralized Oracle Network (DON) [35], operated by the same consortium, bridges the blockchain and off-chain storage. Oracles (GAs) fetch intermediate models from IPFS, perform robust global aggregation, and evaluate contributions—offloading complex computations from the blockchain while preserving security. D. Design Workflow The workflow of ABC-DFL consists of the following phases, as depicted in Fig.2:

1.2. Publish CIDG0 2.1 Group/CS Selection

Fig. 1: An overview of ABC-DFL framework.

the learning layer and is necessary to ensure consistency under partial synchrony. Under this model, ABC-DFL mitigates the spectrum of threats discussed in §VII-C.

6. Distribute Reward & Update Reputation

Open Permissioned Blockchain

Fig. 2: ABC-DFL workflow: Comprises six phases: (1) model publishing by the MP via MSC, (2) CSs selection based on EVs data, deposits and reputation, (3–5) decentralized training through FLECA, where at each round t EVs contribute to an intermediate model secured with threshold signing and differential privacy, followed by robust global aggregation via clustering with automated contribution evaluation at Oracles, and (6) on-chain reward distribution and reputation update.

1) Publish the Initial Model: (Steps 1.1-1.2) An MP shares a single or multitask FL model, detailing the learning tasks, required number of CSs, and targeted performance / maximum number of rounds. The model details are stored off-chain on IPFS, and the resulting CID is recorded on the blockchain for transparency and reference. 2) Select Charging Stations: (Steps 2.1-2.2) CSs/Groups can request to join a training pool of any shared model. Selection is executed on-chain either manually (by MP choice) or automatically (based on deposits and reputation scores [34]). Reputation and deposits are managed by the model smart contract (MSC) to ensure transparency and resistance to sybil or malicious participation. 3) Train and Submit Intermediate Models: (Steps 3.1-3.5) Each selected CS retrieves the model architecture from IPFS and shares it with nearby EVs. EVs perform local training, exchange local models, and produce an intermediate model IMs (§VI). A threshold signature scheme ensures only jointly validated IMs values are accepted. Differential privacy [36] with clipping is applied at the EV level, adding noise to weights (w ′ = w +ϵ) to protect against data leakage (§VII-C). Validated IMs are uploaded to IPFS, and their CIDs are submitted on-chain via submitIM. The decentralized training and aggregation process, which ensures the secure recording of an IM, is detailed in Algo.1. 4) Global Aggregation: (Steps 4.1-4.4) Upon collecting submissions, the MSC triggers aggregation (i.e., send

5

AGGREGATE event). Intermediate models are filtered using robust clustering [37] to isolate outliers and poisoned updates. The largest cluster is then aggregated via FedAvg [9] to produce the global model (GM ), which is stored on IPFS and referenced on-chain. Both intermediate and global aggregation are detailed in §VI. 5) Evaluate Contributions: (Steps 5.1-5.2). Each IM is scored based on cluster membership. Models in the largest cluster receive positive updates, while divergent ones are penalized. Let C1 , C2 , ..., Cp denote the p clusters obtained via the clustering algorithm, and let |Ci | represent the number of models in cluster Ci . The largest cluster is identified as:

Algorithm 1: Secure Decentralized IM Sharing Data: Round t, Threshold τ , Number of EVs k, modelID Result: On-chain TS verification and CID(IM t+1 ) submission ▷ At t = 0: EVs collaboratively generate key shares Upon receipt of KEY G ENERATION R EQUEST(k, EVs) do 3 All k EVs generate shared public key P K and private key shares {SKi }ki=1 4 Agree on threshold τ for signature generation

1 2

▷ Each EV trains locally and aggregates intermediate models for each EVi do 7 Train local model LMit+1 using local data 8 Share LMit+1 with neighbors 9 Perform local aggregation to produce IMi∗t+1

5 6

▷ EVs agree on global intermediate model IM t+1 for each EV i do 12 Generate partial signature sigi on IM t+1 // Appendix A : Alg.1

10 11

Cmax = arg max |Ci | i

Let Sst

be the current score of CSs that submitted IMs . The score is updated based on IMs ’s cluster assignment, as follows: ( Sst + ∆Ss if IMs ∈ Cmax t+1 (1) Ss = / Cmax Sst − ∆Ss if IMs ∈ Here, ∆Ss denotes the magnitude of the reward/penalty, which is statically defined and dynamically scaled according to the contribution of the model. Intermediate models outside of Cmax are considered divergent and receive a score penalty. To capture both consensus strength and model quality, we define the score update of IMs as: |Ci | · exp (−α · d(IMs , µCmax )) , ∆Ss = η · Pp j=1 |Cj |

(2)

where |Ci | is the size of the cluster Ci to which IMs belongs, µCmax is the centroid of the majority cluster, d(IMs , µCmax ) is a distance metric (i.e., Euclidean or cosine distance), η is the maximum score update, α controls the sensitivity to distancebased penalization. Eq.(2) ensures that model updates in large, tightly grouped clusters are rewarded more, while models in small or incoherent clusters are penalized based on both rarity and deviation. 6) Reward Distribution: (Step 6) Reward allocation and reputation updates are performed on-chain to ensure transparency and accountability. Rewards are allocated proportionally to CSs according to how often their IMs were within the majority cluster. Let ri denote the reward assigned to CSs , and ns represent the number of times the model IMs was selected in the largest cluster. The total reward for s is proportional to ns . The reward function is formulated as rs = b · ns , where b is a reward multiplier. CSs whose models appear more frequently in the largest cluster will receive higher rewards. The total reward for all CSs in a round is normalized to ensure the total rewards remain within a specific budget: rs rsnormalized = P|S|

s=1 rs

· Rewardtotal

(3)

Where Rewardtotal is the total reward budget (deposits locked by MP + CSs) and |S| is the number of CSs. Finally,

13

if at least τ EVs provide partial signatures then Aggregate partial signatures {sigi }τi=1 to form Sig // Appendix A : Alg.1

14 15 16

▷ Submit the verified intermediate model on-chain Call MSC.submitIM (Sig, CID(IM t+1 ), modelID, t) // On-chain verification in Appendix A: Alg.2

CSs’ reputation scores are updated using the model’s final trust score Ss (Eq.1). We define the Gompertz transform G(x) = exp (−b exp(−cx)). Then, the reputation update with forgetting factor α ∈ (0, 1) is Rsnew = (1 − a) Rsold + a G(Ss ).

(4)

Eq.3 and Eq.4 ensure fairness in reward distribution and reputation update (see §VII-D). CSs with persistently low rewards or reputations are de-prioritized in future selections and may be subject to slashing. V. DYNAMIC QBFT WITH R EPUTATION -BASED C OMMITTEE AND L EADER ROTATION The blockchain layer of ABC-DFL requires a consensus protocol that is not only Byzantine fault-tolerant but also fair, efficient, and aligned with the framework’s incentive model. The standard QBFT protocol [30], while robust, operates with a static validator set and deterministic leader rotation, making it vulnerable to targeted attacks and unable to leverage the reputation system built within ABC-DFL. This section introduces our dynamic reputation-based extension to QBFT, a core contribution that enhances the security, fairness, and decentralization of the entire system. A. Background: Standard QBFT Protocol The Quorum-based Byzantine Fault Tolerance (QBFT) protocol [30] enables a fixed set of n validators to reach consensus on a block chain. In each round, a designated leader proposes a block. The other validators (replicas) then exchange prepare and commit messages. A block is finalized once a supermajority quorum of 2f + 1 out of 3f + 1 validators (where f is the maximum number of Byzantine nodes) commits to it. Leader election typically follows a simple round-robin schedule among the static committee. While this design ensures simplicity and safety, it has critical limitations:

6

Static Committee: It cannot incorporate new reputable participants or remove misbehaving ones, leading to potential centralization and reducing Sybil resistance. • Predictable Leadership: Deterministic leader rotation makes it easy for adversaries to anticipate and target the next leader, compromising liveness. • Decoupled from Application Incentives: The consensus process is agnostic to the performance and reputation of participants within the federated learning tasks. We address these limitations by introducing a dynamic reputation-proportional, verifiably random committee and leader rotation. •

Algorithm 2: Dynamic Committee Selection Data: Reputation weights {rw1 , . . . , rwn } for n candidates, committee size V, last finalized block B∗ . Result: Selection of V committee members with proof π. 1 begin 2 Compute seed from last finalized block: seed ← Hash(B∗ ); 3 Compute VRF output and proof: (r1 , π) ← VRFsk (seed); 4 Initialize R ← {r1 }; 5 for i ← 2 to V do 6 ri ← Hash(ri−1 ); 7 Add ri to R; P 8 Compute total reputation RW = n j=1 rwj ; Pj

14 15

return (C, π);

10 11

B. Dynamic Randomized Committee Formation At the beginning of each epoch (a fixed interval of p rounds), a new committee is formed. This process, detailed in Algorithm 2, ensures fairness, verifiability, and resistance to manipulation. It consists of the following steps: 1) Seed generation. The leader derives a seed from the hash of the last finalized block B ∗ , ensuring resistance against manipulation of the randomness source. 2) Randomness via VRF. Using a long-term key pair of a verifiable random function [38], the leader computes a verifiable random value r1 and proof π with (r1 , π) ← VRFsk (seed). Both r1 and π are published, enabling all participants to verify correctness of the VRF output. 3) Randomness extension. A sequence of m − 1 additional random values is generated iteratively by hashing: ri+1 = Hash(ri ). This yields R = {r1 , . . . , rm }. 4) Reputation-proportional selection. Each random value ri is normalized into a uniform variable ui ∈ [0, 1], then mapped to one validator using the inverse cumulative distribution function (CDF) over the reputation weights {rwj } of all candidates. Concretely, let cumulative weights be Pj n X rwt , RW = rwj , Fj = t=1 RW j=1 where n is the number of candidates. The selected validator is the unique index j with Fj−1 ≤ ui < Fj . 5) Committee output. The set of V selected validators, together with proof π, defines the next committee. This design guarantees that committee selection is (i) fair, being proportional to reputation, (ii) verifiable, since the VRF proof is publicly checkable, and (iii) resistant to leader bias, as the seed derives from a finalized block and cannot be manipulated by grinding.

rw

t Construct cumulative distribution Fj = t=1 for RW j = 1, . . . , n; Initialize committee C ← ∅; foreach ri ∈ R do Normalize: ui ← ri /2b // b = bit length of VRF output Select validator v with smallest index j such that Fj > ui ; Add v to C;

9

12 13

For round t, the randomness rt (derived either from the epoch VRF output or the round hash) is mapped to the cumulative distribution of committee reputation scores. Specifically, let each committee Pm member cj hold a reputation weight rwj , and let RW = j=1 rwj . A leader is selected by computing: Idx = rt mod RW , and choosing the first node cj such that j X

rwu > Idx.

u=1

This mechanism balances fairness and efficiency: honest and well-performing CSs are incentivized with higher leader probability, while randomness prevents leader predictability and reduces the risk of targeted attacks. VI. F ILTERED L AYERED E NHANCED C LUSTERING AGGREGATION This section presents the proposed Filtered Layered Enhanced Clustering Aggregation (FLECA) protocol, a Byzantine-resilient aggregation mechanism designed for our C-DFL system. The protocol employs two-stage filtering strategy to mitigate poisoning threats: the first stage operates at EV level (detecting and excluding malicious EVs), while the second is executed by Oracles (detecting and filtering adversarially manipulated groups). This layered design enhances robustness against both isolated and colluding adversaries.

C. Dynamic Randomized Leader Election Once the committee C is formed, a leader is elected for each round. Instead of deterministic round-robin, our protocol employs a reputation-weighted random election to further strengthen Sybil resistance and to reward trustworthy CSs with higher leader frequency.

A. Protocol Setup The FLECA protocol engages four ABC-DFL entities (§IV)—TAs, IAs, CMs, and GAs—operating across three peer-to-peer overlays: (i) the group network, (ii) the oracle committee, and (iii) the open-permissioned blockchain. The

7

interactions between these entities provide a secure and verifiable model training with robust aggregation. The associated optimization problem is defined as: 1 X w∗ = arg min F (w) = f (w, ζ), (5) w∈Θ |D| ζ∈D

d

where Θ ⊂ R denotes the model parameter space of dimension d. The population risk F (w) is approximated from distributed datasets D, and f (w, ζ) denotes the empirical loss on a sample ζ under model w.

Algorithm 3: Majority voting Require: {∆wi , IDi }i∈Es EV updates at station s. Ensure: Final aggregated model wt 1: Count the occurrences of each model ID across all EVs. 2: Identify strict majority IDs: count > |Es |/2; 3: if no strict majority exists then Select IDs with the maximum occurrence as a fallback. ; 4: Retrieve the models corresponding to the selected IDs. 5: Aggregate the selected models using averaging. 6: return aggregated intermediate model IMst+1

B. Two-Stage Filtering and Aggregation Poisoning adversaries may manipulate model updates to bias the global model. At the first stage, EV-level filtering discards locally inconsistent models. At the second stage, Oracles detect and exclude poisoned group-level updates. This layered defense is designed to counter both independent and colluding adversaries. 1) Stage I: EV-Level Filtering and Aggregation: Consider a CSs coordinating EVs Es = {EVs1 , . . . , EVsk }. Each new round t, each EV EVsi ∈ Es trains a local model: t+1 t+1 LMsi = wsi = arg min f (w, ζsi ), w∈Θ

ζsi ∈ Dsi ,

(6)

where Dsi is the dataset of EV i. Next, each EV EVsi shares t+1 t+1 its model updates ∆wsi = wsi − wt with its neighbors. Each EV performs adaptive similarity filtering by comparing received neighboring updates against its own reference update using a relative ℓ2 -norm distance computed on task-specific t+1 output layers. For each neighboring update ∆wsk , the EV computes stk = max ℓ∈L

t+1 t+1 ∆wsk,ℓ − ∆wsi,ℓ t+1 ∆wsi,ℓ

2

,

(7)

+ε 2

t+1 where ∆wsi

denotes the EV’s reference update, L is the set of monitored output layers (classification and regression heads), and ε is a small constant for numerical stability. To robustly distinguish benign from malicious updates under data heterogeneity, the EV derives an adaptive acceptance threshold based on the median absolute deviation (MAD) of the similarity scores: θt =

median(st ) + β · MAD(st ) , 1 + κ · λ(t)

(8)

where β controls tolerance to statistical dispersion, κ regulates temporal tightening, λ(t) = Tt is a monotonically increasing scheduling function with t the current communication round. A neighboring update is accepted if stk ≤ θt . If no update satisfies this condition, the EV falls back to its own reference model. Accepted updates are then aggregated using FedAvg.   X 1 ∗t+1 t+1 t+1 IMsi = ∆ws∗t+1 = t+1 ∆wsi + ∆wsj , |Si |+1 t+1 j∈Si

(9) with Sit+1 the accepted set. Two variants are proposed for deriving the group-level update:

Variant V1 (Majority Voting). ∗t+1 IMst+1 = ∆wst+1 = MajorityVote{IMsi ; i ∈ Es }.

(10)

In this variant, each EV contributes a set of accepted model IDs. The majority voting procedure counts the occurrences of each model ID across EVs. If a strict majority exists (i.e., an ID appears in more than half of the EVs), it is selected. If no strict majority exists, a robust fallback selects the ID(s) with the maximum occurrence. The selected models are then aggregated via averaging to produce the station’s intermediate model. This ensures that aggregation is driven by the most widely supported updates. Variant V2 (Robust Clustering Filtering). ∗t+1 IMst+1 = ∆wst+1 = ClusFedAvg{IMsi ; i ∈ Es }.

(11)

Variant V2 is specifically designed for deployment scenarios in which local EV configurations of the adaptive filtering mechanism (8) are heterogeneous. To address this, each EV’s update is flattened into a task-specific vector representation. A density-based clustering method (HDBSCAN) is applied using a precomputed distance matrix between EV updates. The largest non-noise cluster, representing the most mutually consistent updates, is selected, and its members are averaged to obtain the station’s intermediate model. This approach mitigates the influence of outliers and adversarial updates while preserving the dominant patterns in the EV updates. In both cases, CSs finalizes the intermediate model via a threshold signing scheme (Algo. 1). 2) Stage II: Oracle-Level Filtering and Aggregation: Oracles retrieve intermediate models {wst+1 } from IPFS and perform clustering-based outlier filtering. Poisoned CS-level models are often coherent but deviate collectively from benign updates. Detecting these requires density-based clustering methods robust to arbitrary shapes and adversarial noise. The filtering algorithm uses robust HDBSCAN for adaptive filtering under heterogeneous conditions. Let S denotes the set of CSs, the final global update is then: GM t+1 = ClusFedAvg{∆wst+1 ; s ∈ S},

(12)

Unlike DBSCAN, which requires fixed parameters (ϵ, minP ts) and is hard to tune under heterogeneous data, HDBSCAN builds a density hierarchy, removing the need for a global ϵ and providing greater robustness to adversarially skewed updates, making it better suited for dynamic, nonstationary environments. We discuss HDBSCAN sensitivity to minP ts in §VIII-B9.

8

Algorithm 4: Robust Clustering-based Filtering Require: Model updates {∆w1t , . . . , ∆wnt } Ensure: Final aggregated model wt 1: if |Es |≤ 1 then return all updates ; 2: Flatten task-specific weights of each EV into vector Vi 3: Compute pairwise distance matrix D between {Vi } 4: Apply HDBSCAN clustering on D 5: Identify the largest non-noise cluster Cmax P 6: Compute clustered FedAvg: V̄ = |C 1 | Vi ∈Cmax Vi max t 7: Convert V̄ back to parameter form ∆w 8: return aggregated intermediate model update ∆w t

VII. T HEORETICAL A NALYSIS This section analyzes ABC-DFL’s complexity and F LECA’s convergence and security guarantees.

B. FLECA Convergence Guarantees We provide a non-convex convergence guarantee for FLECA that accounts for hierarchical robust aggregation (§VI) and a bounded Byzantine fraction (§IV-B). Assumptions. We adopt the following standard conditions. 1) Each local loss fi (·) is L-smooth. 2) Honest stochastic gradients have bounded variance: E∥gi (x) − ∇F (x)∥2 ≤ σ 2 . 3) All client updates are clipped to norm C. 4) At both EV and CS aggregation layers, strictly fewer than half of contributors are Byzantine. Under Assumption 4, the hierarchical filtering mechanism of FLECA guarantees bounded aggregation bias. Specifically, Proposition 1 in Appendix C shows that the global update at round t admits the decomposition wt = ∇F (xt ) + ξt + bt , where E[ξt | xt ] = 0, E∥ξt ∥2 ≤ σ 2 , and

A. Complexity Analysis We report per-round costs (computation and communication). Each round in C-DFL with FLECA proceeds in the following pipeline: (A) local EV–EV exchange and filtering, (B) EV → CS upload of accepted local updates, (C) CS-level aggregation (majority or clustering), (D) CS → Oracles/IPFS commit and oracle-level clustering, and (E) global commit. Let S be the number ofPCSs, Es the number of EVs served by station s, and E = s Es the total number of EVs. Let d be the model parameter dimension, k the average neighbordegree used in EV-to-EV exchanges (gossip radius), and O the number of oracle nodes. We measure communication in messages and bytes (model size is O(d) floats); computation is measured in elementary vector operations (cost ∝ to d). 1) Communication across DFL systems: In fully blockchain-based FL [39], each round requires Θ(E 2 ) messages and Θ(E 2 d) bytes. Graph-based P2P DFL [40] reduces message complexity to Θ(Ek) and byte complexity to Θ(Ekd) per iteration, but repeated neighbor averaging increases bandwidth consumption and slows convergence due to the lack of global aggregation. In contrast, our Clustered-DFL organizes clients into clusters of size k and applies hierarchical compression, which bounds long-range communication to Θ(Sd), achieving linear scaling with cluster size while maintaining efficiency and convergence. 2) Computation across aggregation methods: At the EV level, centralized filtering at a trusted CS incurs O(Es2 d) for M-Krum [41], O(Es d) for Trimmed-Mean [42], and O(Es2 d) for FLAME [43] with HDBSCAN clustering and norm clipping/noise injection. Distributed filtering at EVs has O(k 2 d) for local Multi-Krum and O(kd log k) for distributed Trimmed-Mean. UBAR [40] applies a two-stage local filter (distance O(kd) + loss pruning O(k)) within EV groups and adds O(kd) inference per EV, assuming knowledge of the malicious fraction. FLECA further improves efficiency with O(kd) per EV and CS-level majority voting or HDBSCAN clustering averaging O(Es log Es ). For global aggregation, the complexity of each method is similar, with Es replaced by S; e.g., FLECA O(S log S), M-Krum O(S 2 d).

∥bt ∥≤ B := r + ϕC, with ϕ < 1/2 the Byzantine fraction and r the maximal dispersion of honest updates [41], [42]. Proof sketch. The global model evolves as xt+1 = xt − ηwt . Using L-smoothness of F , a standard descent lemma gives Lη 2 t 2 ∥w ∥ . 2 Substituting the above decomposition of wt , taking conditional expectation, and bounding cross terms via Young’s inequality yields a descent inequality consisting of three components: a negative term proportional to ∥∇F (xt )∥2 , a stochastic variance term proportional to Lησ 2 , and an additive term proportional to the squared aggregation bias B 2 . Choosing a constant step-size η ≤ 1/(4L) ensures that the descent term dominates higher-order smoothness contributions. Summing over t = 0, . . . , T − 1 and telescoping objective values gives F (xt+1 ) ≤ F (xt ) − η⟨∇F (xt ), wt ⟩ +

T −1

1 X 2(F (x0 ) − F ⋆ ) 5 E∥∇F (xt )∥2 ≤ + Lησ 2 + B 2 . T t=0 ηT 2 The complete derivation and explicit constants provided in Appendix C show that FLECA converges to a neighborhood of stationary points whose radius scales as O(B 2 ). Since B = r + ϕC, the asymptotic error is explicitly controlled by the Byzantine fraction and clipping threshold. When honest updates are concentrated and ϕ is small, FLECA recovers the standard stochastic convergence behavior while providing strong Byzantine resilience via hierarchical filtering. C. System-wide Security Analysis Below, we discuss security threats and the corresponding defenses present in ABC-DFL. Sybil attacks. Our system mitigates this by enforcing strict identity verification, with designated admins (i.e., consortium members) exclusively authorized to add or remove users under consortium oversight. This is achieved through onchain governance with a majority voting scheme, while the

9

open-permissioned design enforces one update per CS per round (submitIM) via on-chain access control and pertask registration (joinCSModel). Consequently, Sybil-based amplification is effectively prevented unless an attacker compromises the consortium or the underlying blockchain layer (see Appendix A). Poisoning and model manipulation. FLECA provides layered defense against coordinated poisoning: 1) EV-level adaptive filtering. Each EV rejects incoming models whose distance from its local model exceeds an adaptive threshold (Eq. 8). The monotonically decreasing schedule forces adversaries to craft updates increasingly close to benign gradients, limiting effective perturbation. 2) CS-level robust aggregation. At each CS, EV updates are filtered via either majority-based connected components (v1) or clustering-based outlier removal (v2). Under the standard honest-majority condition (< 50% Byzantine EVs), this selects a benign-dominated subset, yielding bounded bias (Lemma C.1 and Proposition C.1). 3) Inter-group clustering. Oracles apply an additional clustering step across CS-level aggregates, isolating coordinated malicious groups. When fewer than half of CSs are Byzantine, hierarchical robustness composes, ensuring that the global update deviates from the true gradient by at most a bounded bias term B = r + ϕC (Theorem C.1). 4) Threshold signatures and content addressing. EVs individually sign local updates; a CS cannot produce a valid intermediate model unless at least τ EV signatures are collected. Aggregated models are stored off-chain (IPFS) and referenced on-chain via content hashes. Oracles verify both signature sets and hashes prior to acceptance, preventing model forgery, replay, or substitution. Together, these mechanisms guarantee that poisoning attacks cannot arbitrarily bias the global model unless honest-majority assumptions are violated. As shown in Theorem C.1, the resulting learning dynamics reduce to biased stochastic gradient descent with explicitly bounded bias, yielding convergence to a neighborhood of stationary points whose radius scales as O((r + ϕC)2 ). Free-riding and incentive manipulation. Rewards are distributed at the end of each task according to the intermediate models’ cluster membership (Eq.3). Reputations are updated with a Gompertz transform G(x) = exp(−b exp(−cSs )) and forgetting factor a ∈ (0, 1) (Eq.4) where Ss is a moving weighted score (Eq.1) that combines cluster membership with distance-based penalization; and b, c > 0 control the shape of the Gompertz curve. Reputation update ensures that models in large, coherent clusters are rewarded, while those in small inconsistent clusters are penalized. CSs with low rewards and reputations are de-prioritized in future tasks or may be subject to slashing, effectively mitigating free-riding. Regularization and privacy leakage. Benign EVs apply a weak Gaussian differential-privacy (DP) mechanism on clipped updates. Each EV clips its local update to ∥∆w∥2 ≤ C ˜ = ∆w + N (0, σ 2 I). Using the standard and releases ∆w Gaussian mechanism, for target (ε, δ)-DP the noise scale must

satisfy p

2 log(1.25/δ) . (13) ε This provides composable privacy guarantees; in practice one chooses C, ε, δ to trade utility and privacy (see §VIII-B9). Importantly, DP is applied primarily as a client-side regularization mechanism. This ensures that the added noise does not interfere with outlier detection. σ≥

C

D. Incentive Compatibility and Strategic Robustness We model the reward–reputation mechanism as a repeated game among a finite set of CSs (EV groups). Each CS chooses at every round whether to submit an honest intermediate model (IM), incurring a higher computation cost, or a deviating IM (i.e., free-riding or manipulated), incurring lower cost. Rewards are allocated proportionally to the frequency with which a CS’s IM appears in the majority cluster (Eq. 3), while reputation is updated via a Gompertz-based transform with temporal smoothing (Eq. 4). Reputation directly influences future selection probability and expected rewards. Under standard assumptions on robust clustering (i.e., honest IMs form the majority cluster with high probability if the fraction of deviating CSs is below a threshold), honest behavior strictly dominates deviation in expected long-term utility. In particular, the expected gain from reduced computation costs under deviation is outweighed by (i) lower probability of reward allocation, (ii) accelerated reputation decay, and (iii) economic slashing. To discourage strategic manipulation (e.g., reputation farming or slow free-riding), we further employ an asymmetric reputation update, in which reputation increases slowly following honest behavior but decays rapidly upon low trust scores. A formal game-theoretic analysis and proof sketch establishing honest participation as a Nash equilibrium in the repeated game are provided in Appendix D. VIII. E VALUATION AND R ESULTS This section presents a comprehensive evaluation of the ABC-DFL framework, assessing its performance across multiple dimensions including learning efficiency, robustness against poisoning attacks, incentive effectiveness, and overall scalability. We implemented a proof-of-concept of the system, with the source code for the FLECA protocol, smart contracts, and benchmarking tools available on GitHub2 . A. Experimental Setup 1) Datasets and models: FLECA robustness is evaluated using the EV battery diagnostics “EVBattery” dataset [44] , which addresses two critical operational needs: health anomaly detection to prevent catastrophic failures (e.g., fire), and capacity estimation for accurate range prediction and battery management. This comprehensive dataset includes time-series data collected during fixed-duration charging sessions, along with associated meta-information for each recording. Each timeseries snippet consists of 128 time-steps, capturing the detailed 2 https://github.com/mohaminemed/ABC-DFL

10

dynamics of the battery’s behavior throughout the charging process. The dataset records eight key features, including voltage, temperature, state-of-charge (SoC), and timestamps. In addition to the time-series data, the dataset provides metainformation such as a unique vehicle identifier, mileage at the time of data collection, snippet index, and labels for battery health and capacity. The health label is binary, with a value of 1 indicating anomalies (i.e., lithium plating or thermal runaway) and 0 representing normal operation. The capacity label, expressed in ampere-hours (Ah), indicates the remaining battery capacity, ranging from 28.28 Ah to 46.23 Ah. To simulate realistic non-IID distributions across EVs, the data is partitioned per EV using a Dirichlet distribution with concentration parameter α, and all partitions are generated using fixed global random seeds (42, 70, 84) to ensure reproducibility. This setup allows controlled heterogeneity in both feature distributions and label proportions, reflecting operational variability encountered in real-world EV deployments. We evaluated several multitask models for joint anomaly detection (binary classification) and capacity estimation (regression): • MultiTaskLSTM: LSTM encoder with dual output heads. • MultiTaskbiLSTM: Bidirectional LSTM with classification and regression heads. • MultiTaskCNN: Stacked 1D CNN layers with dual heads. • MultiTaskGRU: GRU-based encoder with dual heads. 2) Simulated attacks: We examine multiple poisoning attacks, consisting of data poisoning attacks (Label Flipping [15], Feature [16]) and model poisoning attacks: (Gauss [41], Krum, Trim [45]), Adaptive [17], and Backdoor attacks (Badnets [46], Scaling [47], Neurotoxin [48]). The details of each attack are presented in Appendix E. 3) Evaluation metrics: We assess battery health anomaly detection using: TP P +T N Accuracy = T P +TTN +F P +F N ; Precision = T P +F P ; TP Precision ×Recall Recall = T P +F N ; F1-Score = 2 × Precision+Recall For the battery capacity estimation task, we use the mean absolute error (MAE), the mean squared error (MSE), and the root mean squared error (RMSE): PN PN MAE = N1 i=1 |yi√− ŷi | ; MSE = N1 i=1 (yi − ŷi )2 ; and RMSE = MSE We define the Attack Impact Score (AIS) to measure of the impact of a poisoning attack on both anomaly detection and capacity prediction. It consists of: 1. Anomaly degradation: Measures the reduction in anomaly detection performance (e.g., Accuracy, F1-Score): anomalybenign − anomalyattack AISA = (14) anomalybenign 2. Capacity degradation: Captures the increase in system errors (e.g., MAE, MSE, RMSE): capacityattack − capacitybenign AISC = (15) capacitybenign 3. Global AIS combines both metrics: AIS = min( max (0, AISA + AISC ), 1 )

(16)

A higher AIS indicates a stronger attack impact. An AIS of 0 denotes negligible effect, while AIS=1 corresponds to a worstcase degradation. Finally, for backdoor attacks, we the Attack Success Rate (ASR), which measures the proportion of backdoored samples misclassified due to the attack: P ASR =

i∈backdoored indices I(ypred [i] ̸= ytrue [i])

|backdoored indices|

(17)

where, ytrue [i] is the original label of the i-th backdoored sample and ypred [i] is its predicted label of the i. I(·) is the indicator function, which returns 1 if the condition is true (i.e., the prediction differs from the true label) and 0 otherwise. backdoored indices refers to the indices of the backdoored samples in the test dataset. |backdoored indices| is the total number of backdoored test samples that normalize the metric. 4) Comparison with C-DFL methods: The prior works on FL for EV battery management, summarized in Table I rely on trusted servers or aggregators and primarily employ weighted variants of FedAvg. While such schemes can slightly improve convergence in benign settings, they remain vulnerable to poisoning attacks and lack robust Byzantine defenses. To provide a fair and comprehensive evaluation, we therefore define a set of baselines drawn from the general FL literature—covering both centralized and decentralized Byzantine-robust aggregation methods—and adapt them to the C-DFL setting. Specifically, we compare FLECA against the following: FedAvg [9], FedProx [49], Multi-Krum [41], Norm Clipping and Weak-DP [50], FLAME [43], UBAR [40]. The details of each method and their adaptation to C-DFL setting are provided in Appendix F. 5) Parameter settings: We evaluate multiple C-DFL multitask models under a range of P configurations by varying the total number of EVs E = s Es and the group size k = Es . Specifically, we consider E ∈ {42, 70, 84, 126, 245} and k ∈ {7, 10, 14, 21}. Unless stated otherwise, the default configuration is denoted as Net-(42,7). The adversarial setup is kept identical across all methods, attacks, and configurations: 1 3 of the groups are fully malicious, and within the remaining groups, 13 of the EVs are Byzantine. For all experiments, we set the DP parameters to σ = 0.005 and C = 4.0, and the aggregation parameters to β ∈ [0.1, 0.3], κ = 1.0, and minP ts ∈ [2, 3]. The default training parameters are summarized in Table III. A detailed ablation study analyzing sensitivity to these parameters is provided in §VIII-B9. 6) Training configuration: All experiments are conducted on three NVIDIA A6000 GPUs. Each experiment is repeated at least three times using different global random seeds (42, 70, and 84), and we report the mean and standard deviation (Std) of the results. The blockchain benchmarks are conducted on a cluster of two HPE ProLiant XL225n Gen10 Plus servers. Each server has two AMD EPYC 7713 64-Core 2GHz processors and 2x256 GB RAM. B. Experimental Results 1) Benign performance: We first evaluate FLECA in fully benign settings, where all EVs and groups behave correctly. As

11

1.4

Value

Number of rounds Dirichlet α Local epochs Batch size Learning rate Proximal regularization Dropout Early stopping

50 and 100 0.8 20 32 0.001 µ = 0.2 0.3 Enabled (Patience: 10 rounds)

Loss

1.2

Parameter

1.0

IID

Metric FLECA

FLECAv1 FLECAv2 FedAvg FedProx

1.4 1.2 1.0

0.8

0.8 0

20

40

60

Rounds

80

100

0

20

(a) IID

TABLE IV: Performance comparison across anomaly and capacity tasks under benign settings using MultiTaskbiLSTM. Task

FLECAv1 FLECAv2 FedAvg FedProx

Loss

TABLE III: Training Configuration.

Non-IID

FedProx

FedAvg

FLECA

FedProx

FedAvg

0.965±0.005 0.925±0.010 0.980±0.010 0.952±0.005

0.965±0.005 0.927±0.010 0.977±0.005 0.951±0.005

0.964±0.010 0.945±0.010 0.957±0.020 0.951±0.010

0.965±0.010 0.921±0.010 0.983±0.020 0.951±0.010

0.968±0.010 0.928±0.010 0.984±0.020 0.955±0.010

Accuracy Recall Anomaly Precision F1-Score

0.967±0.005 0.930±0.010 0.980±0.010 0.954±0.005

MAE Capacity MSE RMSE

0.458±0.005 0.457±0.005 0.456±0.005 0.465±0.010 0.459±0.010 0.462±0.010 0.665±0.005 0.669±0.005 0.671±0.005 0.672±0.010 0.670±0.010 0.669±0.010 0.815±0.005 0.818±0.005 0.819±0.005 0.820±0.010 0.819±0.010 0.817±0.010

40

60

Rounds

80

100

(b) Non-IID

Fig. 3: Global loss (both tasks) evolution under normal conditions. TABLE V: Comparison of C-DFL (FLECA) with various FL systems under benign settings using biLSTM models. Model

Accuracy

F1-Score

MAE

RMSE

ST-FL (FedProx) MT-FL (FedProx) SMT-FL (FedProx) MT-DFL (FedProx) MT-C-DFL (FLECAv1) MT-C-DFL (FLECAv2)

0.963±0.001 0.965±0.000 0.968±0.001 0.940±0.002 0.967±0.005 0.964±0.005

0.949±0.001 0.952±0.000 0.959±0.000 0.912±0.003 0.956±0.005 0.954±0.002

0.465±0.010 0.458±0.001 0.445±0.001 0.492±0.003 0.459±0.002 0.461±0.005

0.821±0.010 0.814±0.000 0.790±0.001 0.842±0.002 0.816±0.005 0.819±0.000

Abbrev. ST: Single Task, MT: Multi-Task, SMT: Split Multi-Task.

shown in Table IV and Fig. 3, FLECA achieves performance on par with standard FL baselines (FedAvg, FedProx) across both anomaly detection and capacity estimation tasks, under IID and Non-IID data distributions and multiple architectures (see Appendix G). For instance, under IID anomaly detection, FLECA attains an accuracy of 0.967, slightly exceeding FedAvg and FedProx (0.965). Moreover, Table V shows that FLECA matches or outperforms a broad range of single-task and multi-task FL baselines. In particular, it achieves an F1-score of 0.951, comparable to ST-FL, MT-FL, and Split MT-FL, while outperforming graph-based MT-DFL methods that suffer from neighborhoodlevel convergence limitations. Overall, these results confirm that FLECA’s filtering mechanisms do not degrade benign performance and can even provide mild regularization benefits. 2) Robustness to poisoning attacks: We evaluate robustness under poisoning attacks with a strong adversarial setting: onethird of the groups are fully malicious, and one-third of EVs are adversarial within the remaining groups. Results are reported for IID and Non-IID (Dirichlet α = 0.8) data. Tables VI and VII report Max.AIS. Across all attacks and distributions, FLECA consistently achieves among the lowest AIS values, indicating strong preservation of both tasks. IID setting. Under IID data, FLECA maintains near-zero Max.AIS for most poisoning attacks, including Gauss, Krum, Trim, Feature, and Adaptive. In these cases, anomaly F1-scores remain close to the benign FedProx baseline (≈ 0.94) and capacity RMSE stays around 0.84. In contrast, FedAvg, FedProx, and Trimmed Mean frequently collapse (Max.AIS = 1). While Multi-Krum and FLAME perform well in some IID scenarios, FLECA matches or exceeds their robustness with lower variance and more stable convergence. Notably, under Label-Flipping and Adaptive attacks—where most baselines fail—FLECA reduces AIS to ≈ 0.01 and restores anomaly F1-scores above 0.93. Non-IID setting. Under Non-IID data, all methods experience degraded performance; nevertheless, FLECA remains consistently among the best defenses. For Gauss and Krum

attacks, FLECA maintains AIS below 0.05, outperforming classical baselines and remaining competitive with MultiKrum and FLAME. For harder attacks such as Adaptive and L-Flip, FLECA still outperforms UBAR (e.g., Max.AIS 0.093 vs. 0.176), despite not relying on local evaluation signals (i.e., local loss in UBAR). This demonstrates FLECA’s robustness to the combined effects of adversarial behavior and statistical heterogeneity. 3) Backdoor robustness: Table VIII reports Max.ASR under representative backdoor attacks. Across IID and Non-IID settings, FLECA consistently achieves low ASR, comparable to or better than UBAR and significantly outperforming smoothing defenses (Norm-Clip, Weak-DP) and robust aggregators (Multi-Krum, Trimmed Mean). Specifically, FLECA limits ASR to approximately 0.11–0.12 under IID and 0.09– 0.18 under Non-IID data, confirming strong resistance to backdoor injection even under heterogeneous distributions. 4) Impact of malicious group ratio: Fig. 4 analyzes robustness as the proportion of malicious groups increases. FLECA remains effective even when more than 47% of groups are malicious, while most baselines degrade rapidly. Among competitors, UBAR is the strongest baseline but relies on costly local evaluation signals. Smoothing defenses and lightweight robust aggregators fail under high adversarial ratios or adaptive attacks, whereas FLECA consistently suppresses poisoning and maintains Max.ASR below 0.2 across all settings. 5) Impact of data heterogeneity: Fig. 5 shows that FLECA remains robust under increasing Non-IIDness, successfully separating benign and malicious updates even for highly skewed data (α = 0.5). This confirms that the proposed filtering mechanism is resilient to strong statistical heterogeneity. 6) Incentive effectiveness: We evaluate the hybrid incentive mechanism over ten training tasks involving seven CSs with heterogeneous behaviors. As shown in Fig. 6, reliable CSs exhibit steadily increasing reputations and receive the highest cumulative rewards, while intermittent contributors earn moderate rewards. Malicious CSs experience continuous

12

Trimmed-Mean

1.0 0.8 0.6 0.4 0.2 0.0 33

47

Attack: ADAPTIVE

Max.AIS

Max.AIS

1.0 0.8 0.6 0.4 0.2 0.0 33

40

Malicious Groups (%)

40

47

Malicious Groups (%)

40

47

Malicious Groups (%)

1.0 0.8 0.6 0.4 0.2 0.0 33

UBAR FLECA Attack: FEATURE

40

47

Malicious Groups (%)

Attack: SCALING

1.0 0.8 0.6 0.4 0.2 0.0 33

40

47

Malicious Groups (%)

Attack: NEUROTOXIN

1.0 0.8 0.6 0.4 0.2 0.0 33

Max.ASR

47

Attack: L-FLIP

Flame

Max.ASR

40

Malicious Groups (%)

Multi-Krum Attack: TRIM

1.0 0.8 0.6 0.4 0.2 0.0 33

Max.AIS

Weak-DP Attack: KRUM

Max.AIS

Max.AIS

Norm-Clip 1.0 0.8 0.6 0.4 0.2 0.0 33

Max.AIS

FedAvg FedProx Attack: GAUSS

1.0 0.8 0.6 0.4 0.2 0.0 33

40

47

Malicious Groups (%)

40

47

Malicious Groups (%)

Fig. 4: Impact of the proportion of malicious groups with Non-IID (α = 0.8): AIS = f (F1-Score, RMSE).

64.1

Max.AIS

60

0.5

0.0 0.50.8

5.0

Dirichlet

0.0 0.50.8

Attack: TRIM

Attack: FEATURE

0.5

Max.AIS

1.0

Max.AIS

1.0

5.0

Dirichlet

0.5

0.0 0.50.8

5.0

Dirichlet

0.0 0.50.8

Attack: L-FLIP

0.5

0.5

5.0

Dirichlet

Attack: SCALING

Max.ASR

1.0

0.0 0.50.8 1.0

0.5

5.0

Dirichlet

Attack: NEUROTOXIN

Max.ASR

0.0 0.50.8

61.8 58.1

62.2

61.2 56.8

4.0

56.3 51.4 51.4 47.5

50.8 47.0

50.3 46.5

3.5

40

3.0

30

29.5 29.5 27.0

2.5

20 10 terMP regis

8.1

terEV regis

VMod joinE

8.2

8.2

el

itIM subm

7.0

itGM

subm

l

ward lishMode cores uteRe pub distrib

teEVS

upda

2.0

7.1

Fig. 7: Throughput and Latency of ABC-DFL with a workload of 10000 EVs (group size k=10).

0.5

0.0 0.50.8

5.0

Dirichlet

0.0 0.50.8

5.0

Dirichlet

Fig. 5: Impact of Non-IIDness under attacks with 13 of malicious groups and 13 of malicious EVs within the remaining groups: AIS = f (F1-Score, RMSE).

Reputation CS 0 CS 4 CS 1 CS 5 CS 2 CS 6 CS 3

0.8

Reputation

0.6

Reward CS 0 CS 1 CS 2 CS 3

250 CS 4 CS 5 CS 6

200

Cumulative Reward

1.0

150

0.4

100

0.2

50

0.0

64.1

57.3

50

0

Max.AIS

1.0

Max.AIS

1.0

5.0

Dirichlet

Attack: ADAPTIVE

Max Throughput (tx/s)

0.5

ABC-DFL Normal ABC-DFL Byzantine Pure On-Chain DFL Normal ABC-DFL Latency ABC-DFL Byzantine Latency

FLECA Attack: KRUM

1.0

Max.AIS

1.0

UBAR

Max Latency (s)

Flame Attack: GAUSS

0

20

40

Tasks

60

80

100 0

Fig. 6: Changes in CSs reputation R and cumulative rewards r (bars) over 10 training tasks. Reputation is updated using : −0.5Ss Rnew = (1 − 0.1) Rold + 0.1 e−5.0e

reputation decay and receive no rewards, as their poisoned updates are consistently filtered. These results demonstrate effective alignment between contribution quality, trust, and incentives.

7) On-chain performance: We evaluate the on-chain performance of ABC-DFL using Hyperledger Caliper3 on a local EVM-based network powered by Hyperledger Besu4 with Dynamic QBFT consensus. The transaction sending rate varies from 10 to 500 tx/s under a fixed configuration (block time = 1s, V = 18, 1000 CSs). Gas costs are reported in Table IX, while average latency and throughput under normal and Byzantine (3 validators) conditions are shown in Fig. 7. Under normal operation, lightweight functions such as registerMP and submitGM achieve the highest throughput (64.1 and 62.2 tx/s), whereas more computationheavy functions (publishModel, updateCSScores, distributeReward) exhibit lower throughput. Latency remains bounded across all functions (1.65–3.54s). Byzantine conditions induce a moderate throughput degradation and increased latency due to additional validation steps; however, the system sustains an average throughput of ≈ 50 tx/s. Compared to a pure BFL design (Table IX) where each EV commits local updates on-chain, ABC-DFL aggregates updates at the CS level and stores only compact artifacts (hashes and aggregated signatures). This reduces the number of blockchain transactions by approximately a factor of k, substantially reducing gas costs and improving scalability. Fi3 https://github.com/hyperledger/caliper-benchmarks 4 https://besu.hyperledger.org

13

TABLE VI: AIS evaluation under poisoning attacks and IID setting (mean ± std across 3 runs). Lower AIS is better. The benign FedProx baseline achieves an anomaly F1-score of 0.943 ± 0.001 and a capacity RMSE of 0.845 ± 0.001. Attack

Method

Max.AIS

AISA

AISC

Anom. F1

Cap. RMSE

Gauss

FedAvg FedProx Norm-Clip Weak-DP Trimmed-Mean Multi-Krum FLAME UBAR FLECA

1.000 1.000 0.100 0.314 1.000 0.000 0.029 0.000 0.000

0.345 0.387 0.082 0.223 0.324 0.000 0.026 0.000 0.000

1.000 0.906 0.018 0.091 1.000 0.000 0.003 0.000 0.000

0.617 ± 0.089 0.578 ± 0.076 0.865 ± 0.020 0.732 ± 0.078 0.637 ± 0.048 0.946 ± 0.003 0.918 ± 0.003 0.943 ± 0.001 0.943 ± 0.003

2.189 ± 0.268 1.610 ± 0.206 0.859 ± 0.001 0.921 ± 0.027 2.355 ± 0.807 0.839 ± 0.001 0.847 ± 0.002 0.836 ± 0.001 0.838 ± 0.002

Krum

FedAvg FedProx Norm-Clip Weak-DP Trimmed-Mean Multi-Krum FLAME UBAR FLECA

1.000 1.000 1.000 1.000 1.000 0.001 0.004 0.023 0.010

0.426 0.426 0.385 0.401 0.426 0.001 0.004 0.018 0.010

1.000 1.000 1.000 1.000 1.000 0.000 0.000 0.005 0.000

0.541 ± 0.000 0.541 ± 0.000 0.580 ± 0.003 0.565 ± 0.001 0.541 ± 0.000 0.941 ± 0.000 0.939 ± 0.008 0.926 ± 0.002 0.933 ± 0.009

10.000 ± 10.000 10.000 ± 10.000 10.000 ± 0.642 10.000 ± 2.350 10.000 ± 10.000 0.843 ± 0.001 0.836 ± 0.001 0.849 ± 0.001 0.837 ± 0.002

Trim

FedAvg FedProx Norm-Clip Weak-DP Trimmed-Mean Multi-Krum FLAME UBAR FLECA

0.848 0.586 0.213 0.194 0.556 0.000 0.012 0.046 0.004

0.696 0.425 0.152 0.135 0.399 0.000 0.009 0.046 0.003

0.152 0.161 0.061 0.059 0.158 0.000 0.003 0.000 0.002

0.286 ± 0.265 0.542 ± 0.002 0.799 ± 0.017 0.801 ± 0.096 0.567 ± 0.016 0.943 ± 0.001 0.934 ± 0.003 0.899 ± 0.002 0.940 ± 0.004

0.973 ± 0.007 0.981 ± 0.010 0.896 ± 0.002 0.891 ± 0.008 0.978 ± 0.004 0.844 ± 0.001 0.847 ± 0.001 0.841 ± 0.001 0.846 ± 0.001

L-Flip

FedAvg FedProx Norm-Clip Weak-DP Trimmed-Mean Multi-Krum FLAME UBAR FLECA

0.399 0.406 0.378 0.372 0.406 0.426 0.301 0.014 0.012

0.399 0.406 0.378 0.376 0.406 0.426 0.301 0.014 0.012

0.000 0.000 0.000 0.000 0.000 0.000 0.000 0.000 0.000

0.567 ± 0.001 0.560 ± 0.000 0.587 ± 0.001 0.588 ± 0.002 0.560 ± 0.000 0.541 ± 0.000 0.658 ± 0.133 0.929 ± 0.003 0.931 ± 0.007

0.832 ± 0.001 0.838 ± 0.001 0.842 ± 0.001 0.840 ± 0.003 0.838 ± 0.001 0.833 ± 0.001 0.843 ± 0.002 0.840 ± 0.001 0.840 ± 0.002

Feature

FedAvg FedProx Norm-Clip Weak-DP Trimmed-Mean Multi-Krum FLAME UBAR FLECA

0.807 1.000 1.000 1.000 1.000 0.000 0.018 0.010 0.010

0.037 0.043 0.033 0.028 0.044 0.000 0.018 0.010 0.010

0.770 1.000 1.000 1.000 1.000 0.000 0.000 0.000 0.000

0.908 ± 0.001 0.902 ± 0.003 0.911 ± 0.003 0.918 ± 0.008 0.901 ± 0.003 0.952 ± 0.001 0.925 ± 0.003 0.933 ± 0.001 0.933 ± 0.002

1.495 ± 0.034 1.691 ± 0.073 2.705 ± 0.049 2.526 ± 0.053 1.692 ± 0.078 0.837 ± 0.001 0.839 ± 0.001 0.834 ± 0.001 0.837 ± 0.002

Adaptive

FedAvg FedProx Norm-Clip Weak-DP Trimmed-Mean Multi-Krum FLAME UBAR FLECA

1.000 1.000 1.000 1.000 1.000 0.006 0.008 0.008 0.013

0.032 0.032 0.385 0.401 0.020 0.006 0.008 0.008 0.013

1.000 1.000 1.000 1.000 1.000 0.000 0.000 0.000 0.000

0.912 ± 0.008 0.912 ± 0.008 0.580 ± 0.003 0.565 ± 0.001 0.924 ± 0.005 0.937 ± 0.002 0.935 ± 0.001 0.935 ± 0.001 0.930 ± 0.003

8.850 ± 2.968 8.850 ± 2.968 10.000 ± 0.642 10.000 ± 2.350 5.714 ± 1.680 0.835 ± 0.001 0.837 ± 0.002 0.838 ± 0.004 0.838 ± 0.001

Note. UBAR relies on a reference model and a local evaluation set for loss filtering, and can only be applied as a per-EV filtering mechanism. For a fair comparison, it additionally incorporates two components from FLECA: majority voting and inter-group robust clustering.

nally, since ABC-DFL is EVM-compatible, Layer-2 solutions (e.g., zk-Rollups) can further reduce gas costs by an order of magnitude and scale throughput beyond 1000 tx/s [34]. 8) E2E overhead: We quantify the end-to-end (E2E) latency overhead introduced by blockchain consensus and oracle layers in ABC-DFL under realistic vehicular conditions. Detailed measurements are provided in Appendix H. Consensus. Dynamic QBFT consistently outperforms PBFT and static QBFT, achieving low latency (0.9–3.2s) and stable liveness under intermittent connectivity and validator churn. Oracle. A consortium-operated edge oracle incurs 1.1– 3.0s per global round for aggregation, evaluation, and callbacks—significantly lower than public oracle deployments and compatible with vehicular FL dynamics. E2E rounds. Combining local training, EV exchanges, oracle execution, and on-chain processing, a full ABC-DFL

TABLE VII: AIS evaluation under poisoning attacks in the Non-IID setting (mean ± std over 3 runs). Lower AIS is better. The benign FedProx baseline achieves an anomaly F1-score of 0.92 ± 0.001 and a capacity RMSE of 0.837 ± 0.001. Attack

Method

Max.AIS

AISA

AISC

Anom. F1

Cap. RMSE

Gauss

FedAvg FedProx Norm-Clip Weak-DP Trimmed-Mean Multi-Krum FLAME UBAR FLECA

1.000 1.000 0.104 0.028 1.000 0.043 0.069 0.142 0.047

0.356 0.334 0.066 0.027 0.324 0.027 0.040 0.087 0.029

0.705 1.000 0.037 0.001 1.000 0.016 0.028 0.055 0.018

0.596 ± 0.070 0.616 ± 0.060 0.864 ± 0.006 0.901 ± 0.004 0.626 ± 0.031 0.901 ± 0.005 0.888 ± 0.027 0.846 ± 0.003 0.899 ± 0.012

1.426 ± 0.078 2.322 ± 0.543 0.868 ± 0.003 0.837 ± 0.001 2.116 ± 0.406 0.850 ± 0.001 0.860 ± 0.008 0.883 ± 0.001 0.852 ± 0.007

Krum

FedAvg FedProx Norm-Clip Weak-DP Trimmed-Mean Multi-Krum FLAME UBAR FLECA

1.000 1.000 1.000 1.000 1.000 0.050 0.030 0.106 0.050

0.416 0.416 0.380 0.379 0.416 0.035 0.022 0.058 0.022

1.000 1.000 1.000 1.000 1.000 0.015 0.009 0.048 0.028

0.541 ± 0.000 0.541 ± 0.000 0.574 ± 0.001 0.575 ± 0.001 0.541 ± 0.000 0.894 ± 0.003 0.906 ± 0.012 0.872 ± 0.003 0.906 ± 0.012

10.000 ± 10.000 10.000 ± 10.000 10.000 ± 1.037 10.000 ± 8.961 10.000 ± 10.000 0.849 ± 0.001 0.844 ± 0.006 0.877 ± 0.002 0.860 ± 0.007

Trim

FedAvg FedProx Norm-Clip Weak-DP Trimmed-Mean Multi-Krum FLAME UBAR FLECA

0.536 0.456 0.282 0.377 0.404 0.096 0.142 0.097 0.108

0.368 0.267 0.185 0.231 0.238 0.051 0.078 0.057 0.082

0.168 0.190 0.098 0.145 0.165 0.045 0.065 0.040 0.027

0.585 ± 0.019 0.679 ± 0.028 0.755 ± 0.017 0.712 ± 0.023 0.705 ± 0.013 0.878 ± 0.008 0.854 ± 0.020 0.873 ± 0.002 0.850 ± 0.005

0.978 ± 0.003 0.995 ± 0.006 0.918 ± 0.001 0.958 ± 0.018 0.975 ± 0.001 0.874 ± 0.003 0.891 ± 0.010 0.870 ± 0.001 0.859 ± 0.001

L-Flip

FedAvg FedProx Norm-Clip Weak-DP Trimmed-Mean Multi-Krum FLAME UBAR FLECA

0.403 0.382 0.388 0.382 0.382 0.431 0.397 0.176 0.093

0.395 0.373 0.370 0.366 0.374 0.415 0.362 0.100 0.059

0.008 0.008 0.017 0.016 0.008 0.015 0.035 0.076 0.034

0.560 ± 0.001 0.580 ± 0.000 0.583 ± 0.000 0.587 ± 0.004 0.580 ± 0.000 0.541 ± 0.000 0.590 ± 0.104 0.833 ± 0.011 0.871 ± 0.002

0.843 ± 0.001 0.844 ± 0.001 0.851 ± 0.001 0.850 ± 0.006 0.844 ± 0.001 0.850 ± 0.001 0.866 ± 0.004 0.900 ± 0.001 0.865 ± 0.001

Feature

FedAvg FedProx Norm-Clip Weak-DP Trimmed-Mean Multi-Krum FLAME UBAR FLECA

1.000 0.701 1.000 1.000 0.699 0.075 0.199 0.093 0.080

0.055 0.044 0.108 0.110 0.043 0.040 0.124 0.063 0.046

1.000 0.657 1.000 1.000 0.656 0.035 0.076 0.030 0.034

0.875 ± 0.003 0.885 ± 0.003 0.825 ± 0.005 0.822 ± 0.007 0.886 ± 0.003 0.888 ± 0.003 0.811 ± 0.012 0.868 ± 0.004 0.883 ± 0.006

1.715 ± 0.203 1.386 ± 0.045 2.800 ± 0.048 2.805 ± 0.076 1.385 ± 0.046 0.866 ± 0.003 0.900 ± 0.005 0.862 ± 0.001 0.865 ± 0.001

Adaptive

FedAvg FedProx Norm-Clip Weak-DP Trimmed-Mean Multi-Krum FLAME UBAR FLECA

1.000 1.000 1.000 1.000 1.000 0.431 0.397 0.015 0.019

0.042 0.042 0.380 0.379 0.022 0.002 0.109 0.014 0.005

1.000 1.000 1.000 1.000 1.000 0.415 0.363 0.010 0.014

0.887 ± 0.007 0.887 ± 0.007 0.574 ± 0.001 0.575 ± 0.001 0.906 ± 0.006 0.850 ± 0.001 0.866 ± 0.004 0.917 ± 0.009 0.913 ± 0.004

8.365 ± 2.747 8.365 ± 2.747 10.000 ± 1.037 10.000 ± 8.961 5.095 ± 1.520 0.541 ± 0.000 0.590 ± 0.104 0.841 ± 0.005 0.842 ± 0.001

round completes in 4.70–8.60s, compared to 2.90–5.20s for centralized FL. While decentralization introduces bounded coordination overhead, it provides auditability, accountability, and fault tolerance. 9) Ablation study: This ablation study analyzes the sensitivity of FLECA and its underlying C-DFL framework to key scalability, robustness, and privacy parameters. Unless stated otherwise, experiments assume one-third malicious groups and one-third Byzantine EVs per benign group. a) Impact of per-task scaling: Fig. 8 evaluates scalability with respect to group size k and EV count E. Increasing k proportionally increases both benign and adversarial EVs, smoothing convergence without diluting adversarial influence. Increasing E while keeping the global dataset size fixed reduces local data per EV, increasing gradient variance and final loss (from 0.83 at E = 42 to 1.09 at E = 245). Despite extreme data fragmentation, FLECA remains stable. b) Impact of FLECA components: Fig. 9 presents a component-wise ablation. Removing intra-group filtering or

14

Group size k Impact (E = 84)

Max.ASR (Non-IID)

BadNets

FedAvg FedProx Norm-Clip Weak-DP Trimmed-Mean Multi-Krum FLAME UBAR FLECA

0.2719 0.2719 0.2719 0.3418 0.2727 0.4113 0.3794 0.1177 0.1235

0.2976 0.2976 0.2960 0.3708 0.3054 0.4256 0.3442 0.1609 0.1762

Scaling

FedAvg FedProx Norm-Clip Weak-DP Trimmed-Mean Multi-Krum FLAME UBAR FLECA

0.7167 0.7167 0.3238 0.3765 0.7011 0.1190 0.1026 0.1177 0.1112

0.8136 0.8111 0.4105 0.1590 0.8029 0.1337 0.1128 0.1611 0.0981

FedAvg FedProx Norm-Clip Weak-DP Trimmed-Mean Multi-Krum FLAME UBAR FLECA

0.7469 0.7469 0.3213 0.3921 0.6321 0.1190 0.1026 0.1177 0.1094

0.9305 0.9256 0.4571 0.4456 0.7584 0.2657 0.8115 0.0904 0.0948

Neurotoxin

TABLE IX: Deployment, invocation, and E2E gas costs for a 100-round learning task. Contract/Function

Gas used

E2E Gas Pure BFL

E2E Gas ABC-DFL

ASC MSC registerMP publishModel register[CS/EV] join[CS/EV]Model submitIM submitGM update[CS/EV]Scores distributeReward

803,599 5,898,853 92,267 197,677 114,462 97,523 107,788 102,753 124,501 119,295

803,599 5,898,853 92,267 19.77 M 114.5 B 97.5 B 107.8 B 10.28 M 124.5 B 119.3 B

803,599 5,898,853 92,267 19.77 M 11.45 B 9.75 B 10.78 B 10.28 M 12.45 B 11.93 B

majority voting severely degrades performance (F1 down to 0.59, RMSE up to 1.69), while disabling inter-group clustering also harms convergence. Full clustering slightly improves F1 at the expense of RMSE, confirming that all components are critical, with intra-group filtering being the most influential. c) Impact of DP parameters: Figs. 10 analyze the privacy–utility trade-off. Moderate noise levels (σ = 0.005–0.01) preserve stability, while excessive noise degrades convergence, especially under attack. For clipping, small norms over-restrict updates, whereas C = 4.0 yields the best performance in IID settings and competitive results under Non-IID data, indicating that FLECA benefits from sufficient gradient magnitude while remaining noise-resilient. d) Impact of EV churn and Byzantine rates: Fig. 11 shows that FLECA tolerates churn rates up to ρ = 0.3 with minimal impact. Higher churn slows convergence due to reduced update availability. The system remains stable with up to m = 3 Byzantine EVs per benign group, while exceeding the assumed threat model leads to instability, clearly delineating robustness limits.

1.0

1.2 1.0

0.8

0

10

20

30

Training Rounds

40

50

0.8

0

10

20

30

Training Rounds

40

50

Fig. 8: Impact of C-DFL per-task scaling with respect to group size k and per-task EV count E. FLECA (full)

full clustering

no intra filtering

Anomaly Detection

1.00

no inter clustering

Capacity Estimation

2.5

0.75

2.0

0.50

1.5

0.25 0.00 0

no intra majority

RMSE

Max.ASR (IID)

F1-Score

Method

E=42 E=84 E=126 E=245

1.4

Global Loss

1.4 1.2

Attack

Total EVs E Impact (k = 7)

k=7 k=10 k=14 k=21

Global Loss

TABLE VIII: Maximum Attack Success Rate (Max.ASR) under backdoor attacks in IID and Non-IID settings. Lower ASR indicates stronger backdoor robustness.

1.0 10

20

30

Training Rounds

40

50

0

10

20

30

Training Rounds

40

50

Fig. 9: Impact of FLECA filtering components on the multitask model convergence.

e) Impact of β and κ: Fig. 12 studies adaptive filtering sensitivity. Moderate β ∈ {0.1, 0.5, 1.0} and κ ∈ [0.5, 2.0] yield stable performance, with an optimum around κ = 1.0. Larger values overly relax or tighten thresholds, degrading both tasks and increasing variance, revealing a well-defined operating region. f) Impact of minPts in HDBSCAN: Fig. 13 shows that moderate density thresholds (minPts ≈ 3) for both intra- and inter-group clustering achieve the best trade-off. Larger values over-label benign updates or restrict inter-group exchange, degrading both anomaly detection and capacity estimation. C. Discussion Based on our experimental and ablation studies, we provide key insights into the behavior of FLECA and practical deployment of the underlying ABC-DFL framework: • Governance and identity management: The system assumes an open yet permissioned model for CSs and MPs registration to Sybil and reputation reset attacks. • Task-level scalability: Only a subset of EVs participates per task, reducing network and computational load. • Known failure modes: Exceeding the tolerated Byzantine rates or extreme EV churn can destabilize convergence. • Parameter recommendations: Reasonable defaults are k ∈ [7, 28] and E ∈ [42, 126], intra- and inter-group minPts ≈ 3, β ∈ [0.1, 0.3] κ ∈ [0.5, 1.0], DP clipping C = 4.0, and σ ∈ [0.005, 0.01]. FLECA currently operates on explicit update exchanges with controlled noise to enable filtering and verification, secure robust aggregation is a potential future research direction to strengthen data privacy. IX. C ONCLUSION In this paper, we presented ABC-DFL, A byzantineresilient clustered decentralized federated learning (C-DFL)

15

FLECA, =0.01

FLECA, =0.04

FedAvg, =0.04

Anomaly F1

DP Noise Impact (Gauss Attack)

Impact of ( = 1.0)

1.2 1.0 0

10

20

30

Training Rounds

40

50

F1-score

1.4

0.8

0.90

Global Loss

Global Loss

1.6

0

10

20

30

40

Training Rounds

1.1

0.85 0.80

1.0

0.75 0.65

Impact of ( = 0.1)

0.90

0.9

0.70

50

Capacity RMSE

0.1

0.5

1.0

2.0

0.80

1.0

0.75

0.9

0.70 0.65

3.0

1.1

0.85

RMSE

FLECA, =0.005

DP Noise Impact (Benign Runs)

RMSE F1-score

FLECA, =0.0

0.1

0.5

1.0

2.0

3.0

(a) Std σ under IID and C = 4.0 FLECA, =0.01

FedAvg, =0.04

Fig. 12: Impact of the adaptive filtering parameters β and κ on the multitask model performance under FLECA.

DP Noise Impact (Gauss Attack)

Global Loss

1.2 1.0 0

10

20

30

Training Rounds

40

50

Anomaly F1

Impact of minPtsintra (minPtsinter = 3.0) 0

10

20

30

Training Rounds

40

50

(b) Std σ under Non-IID and C = 4.0 FLECA, C=1.0 DP Norm C Impact (IID)

FLECA, C=4.0 DP Norm C Impact (Non-IID)

1.2 1.0 0

10

20

30

Training Rounds

40

50

0

10

20

30

Training Rounds

40

0.90

1.1

1.0

0.88

1.0

0.86

0.9

Churn Rate Impact (m = 2, k = 7)

Byzantine Rate m Impact ( = 0.3, k = 7) m=0 m=1 m=2 m=3 m=4

= 0.0 = 0.2 = 0.3 = 0.4 = 0.5

1.4 1.2 1.0 0.8 0

10

20

30

Training Rounds

40

50

3.0

4.0 minPtsintra

5.0

0.86

0.9

0.84 2.0

3.0

4.0 minPtsinter

5.0

50

Fig. 10: Impact of DP parameters (noise Std σ and clipping norm C) on the multitask model convergence under FLECA.

Global Loss

1.1

0.88

Fig. 13: Impact of HDBSCAN minP ts (intra and inter group) on the multitask model performance under FLECA.

(c) Norm C under IID/Non-IID and Std= 0.01

1.6

Impact of minPtsinter (minPtsintra = 3.0)

0.90

2.0

1.4

Capacity RMSE 0.92

0.84

Global Loss

Global Loss

1.6

FLECA, C=2.0

0.92

F1-score

Global Loss

1.4

FLECA, =0.04

RMSE

FLECA, =0.005

DP Noise Impact (Benign Runs)

RMSE F1-score

FLECA, =0.0

0

10

20

30

Training Rounds

40

50

Fig. 11: Impact of EV Churn and Byzantine rate on the multitask model convergence under FLECA. framework for battery intelligence in connected EVs and EVpowered ITS. By introducing a novel robust aggregation protocol, FLECA, built on top of an open-permissioned blockchain and a decentralized oracle network, we effectively mitigate the vulnerabilities associated with centralized aggregation protocols, ensuring security and efficiency. The proposed FLECA demonstrated strong resilience against poisoning attacks, with performance comparable to state-of-the-art methods in nonByzantine environments. Extensive experiments validated the efficiency and robustness of ABC-DFL, positioning it as a practical, secure, and efficient solution for next-generation EV data management systems. Finally, this work also paves the way for further advancements in Clustred-DFL for critical applications in the transportation and energy sectors. ACKNOWLEDGMENTS This work is supported by the OPEVA project that has received funding within the Chips Joint Undertaking (Chips JU) from the EU’s Horizon Europe Programme and the National Authorities (France, Czechia, Italy, Portugal, Turkey,

Switzerland), under grant agreement 101097267. BPI funds the project in France under the France 2030 program on “Embedded AI”. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the EU or Chips JU. Neither the EU nor the granting authority can be held responsible for them. R EFERENCES [1] P. Abbaraju and S. K. Kundu, “A novel federated & ensembled learningbased battery state-of-health estimation for connected electric vehicles,” IEEE Open Journal of Intelligent Transportation Systems, 2024. [2] J. Bokstaller, J. Schneider, S. Lux, and J. vom Brocke, “Battery health index: Combination of physical and ml-based soh for continuous health tracking,” IEEE Internet of Things Journal, 2024. [3] O. Demirci, S. Taskin, E. Schaltz, and B. A. Demirci, “Review of battery state estimation methods for electric vehicles-part i: Soc estimation,” Journal of Energy Storage, vol. 87, p. 111435, 2024. [4] R. Zhang, J. Mao, H. Wang, B. Li, X. Cheng, and L. Yang, “A survey on federated learning in intelligent transportation systems,” IEEE Transactions on Intelligent Vehicles, 2024. [5] Y. Li, X. Tao, X. Zhang, J. Liu, and J. Xu, “Privacy-preserved federated learning for autonomous driving,” IEEE Trans. on Intelligent Transportation Systems, vol. 23, no. 7, pp. 8423–8434, 2021. [6] T. Wang, Z. Zhang, Y. Tao, and Z. Y. Dong, “Robust state of health estimation for heterogeneous batteries with privacy preserving,” IEEE Trans. on Vehicular Technology, vol. 74, no. 6, pp. 8921–8937, 2025. [7] V. S. Naresh, V. S. Sriram, V. J. Krishna, V. D. Chandini, R. N. Sri, K. J. Durga, and V. Poojitha, “Privacy-preserving state of health prediction for electric vehicle batteries: A comprehensive review,” Computers and Electrical Engineering, vol. 118, p. 109416, 2024. [8] T. Han, S. Yue, P. Yang, R. Zhou, and J. Yu, “Source-Free Dynamic Weighted Federated Transfer Learning for State-of-Health Estimation of Lithium-Ion Batteries with Data Privacy,” IEEE Trans. on Power Electronics, vol. 39, no. 11, pp. 15 085–15 100, 2024. [9] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y. Arcas, “Communication-Efficient Learning of Deep Networks from Decentralized Data,” in Proceedings of the 20th International Conference on Artificial Intelligence and Statistics. PMLR, 2017, pp. 1273–1282. [10] A. A. Korba, M. A. Bouchiha, and Y. Ghamri-Doudane, “Split multi-task federated learning for battery health and capacity estimation in electric vehicles,” IEEE Transactions on Consumer Electronics, pp. 1–1, 2026. [11] W. Huang, M. Ye, Z. Shi, G. Wan, H. Li, B. Du, and Q. Yang, “Federated Learning for Generalization, Robustness, Fairness: A Survey and Benchmark,” IEEE Trans. on Pattern Analysis and Machine Intelligence, pp. 1–20, 2024.

16

[12] H. Hu, X. Zhang, Z. Salcic, L. Sun, K.-K. R. Choo, and G. Dobbie, “Source inference attacks: Beyond membership inference attacks in federated learning,” IEEE Trans. on Dependable and Secure Computing, vol. 21, no. 4, pp. 3012–3029, 2024. [13] T. Wang and Z. Dong, “Peer-to-Peer Personalized Federated Transfer Learning for Battery State of Health Estimation of Vehicles,” IEEE Trans. on Intelligent Vehicles, pp. 1–12, 2024. [14] S. M. Danish, A. Hameed, A. Ranjha, G. Srivastava, and K. Zhang, “Block-fedl: Electric vehicle charging load forecasting using federated learning and blockchain,” IEEE Trans. on Vehicular Technology, vol. 74, no. 2, pp. 2048–2056, 2025. [15] V. Shejwalkar, A. Houmansadr, P. Kairouz, and D. Ramage, “Back to the drawing board: A critical evaluation of poisoning attacks on production federated learning,” in IEEE Symposium on Security and Privacy, 2022, pp. 1354–1371. [16] Z. Wang, H. Guo, Z. Zhang, W. Liu, Z. Qin, and K. Ren, “Feature importance-aware transferable adversarial attacks,” in IEEE/CVF international conference on computer vision, 2021, pp. 7639–7648. [17] V. Shejwalkar and A. Houmansadr, “Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning,” in NDSS, 2021. [18] L. Yuan, Z. Wang, L. Sun, S. Y. Philip, and C. G. Brinton, “Decentralized federated learning: A survey and perspective,” IEEE Internet of Things Journal, vol. 11, no. 21, pp. 34 617–34 638, 2024. [19] Y. A. Sultan, A. A. Eladl, M. A. Hassan, and S. A. Gamel, “Enhancing electric vehicle battery lifespan: integrating active balancing and machine learning for precise rul estimation,” Scientific Reports, vol. 15, no. 1, p. 777, 2025. [20] K. Das, R. Kumar, and A. Krishna, “Analyzing electric vehicle battery health performance using supervised machine learning,” Renewable and Sustainable Energy Reviews, vol. 189, p. 113967, 2024. [21] K. Kumari, P. Rieger, H. Fereidooni, M. Jadliwala, and A.-R. Sadeghi, “Baybfed: Bayesian backdoor defense for federated learning,” in IEEE Symposium on Security and Privacy (SP). IEEE, 2023, pp. 737–754. [22] T. Wang, Z. Y. Dong et al., “Adaptive Multi-Personalized Federated Learning for State of Health Estimation of Multiple Batteries,” IEEE Internet of Things Journal, vol. 11, no. 24, pp. 39 994–40 008, 2024. [23] K. L. Wong, R. Tse, S.-K. Tang, and G. Pau, “Decentralized Deep Learning Approach for Lithium-Ion Batteries State of Health Forecasting Using Federated Learning,” IEEE Trans. on Transportation Electrification, vol. 10, no. 4, pp. 8199–8212, 2024. [24] V. López, O. Fontenla-Romero, E. Hernández-Pereira, B. GuijarroBerdiñas, C. Blanco-Seijo, and S. Fernandez-Paz, “RUL Prediction of Lithium-ion Batteries using a Federated and Homomorphically Encrypted Learning Method,” in Proceedings of the 39th ACM/SIGAPP Symposium on Applied Computing, 2024, pp. 565–571. [25] R. Zhong, B. Hu, Y. Feng, S. Lou, Z. Hong, F. Wang, G. Li, and J. Tan, “Lithium-ion battery remaining useful life prediction: a federated learning-based approach,” Energy, Ecology and Environment, vol. 9, no. 5, pp. 549–562, 2024. [26] L. Liu, Z. Xi, K. Zhu, R. Wang, and E. Hossain, “Mobile charging station placements in internet of electric vehicles: A federated learning approach,” IEEE Transactions on Intelligent Transportation Systems, vol. 23, no. 12, pp. 24 561–24 577, 2022. [27] J. Liu, L. Zhang, C. Li, J. Bai, H. Lv, and Z. Lv, “Blockchain-based secure communication of intelligent transportation digital twins system,” IEEE transactions on intelligent transportation systems, vol. 23, no. 11, pp. 22 630–22 640, 2022. [28] M. Abdel-Basset, N. Moustafa, H. Hawash, I. Razzak, K. M. Sallam, and O. M. Elkomy, “Federated intrusion detection in blockchain-based smart transportation systems,” IEEE Transactions on Intelligent Transportation Systems, vol. 23, no. 3, pp. 2523–2537, 2021. [29] A. A. Korba, A. Boualouache, and Y. Ghamri-Doudane, “Zero-x: A blockchain-enabled open-set federated learning framework for zero-day attack detection in iov,” IEEE Trans. on Vehicular Technology, vol. 73, no. 9, pp. 12 399–12 414, 2024. [30] J. M. Chase, “Quorum white paper: A permissioned implementation of ethereum.” 2019. [Online]. Available: https://github.com/ConsenSys/ quorum/blob/master/docs/Quorum%20Whitepaper%20v0.2.pdf [31] C. Dwork, N. Lynch, and L. Stockmeyer, “Consensus in the presence of partial synchrony,” Journal of the ACM (JACM), vol. 35, no. 2, pp. 288–323, 1988. [32] A. Miller, Y. Xia, K. Croman, E. Shi, and D. Song, “The honey badger of bft protocols,” in Proceedings of the 2016 ACM SIGSAC conference on computer and communications security (CCS), 2016, pp. 31–42.

[33] S. Garg, A. Jain, P. Mukherjee, R. Sinha et al., “hints: Threshold signatures with silent setup,” in 2024 IEEE Symposium on Security and Privacy (S&P), San Francisco, CA, USA. IEEE, 2024, pp. 3034–3052. [34] M. M. Dif, M. A. Bouchiha, M. Rabah, and Y. Ghamri-Doudane, “AutoDFL: A Scalable and Automated Reputation-Aware Decentralized Federated Learning,” in IEEE/IFIP Network Operations and Management Symposium (NOMS), 2025, pp. 1–9. [35] L. Breidenbach, C. Cachin, B. Chan, A. Coventry et al., “Chainlink 2.0: Next steps in the evolution of decentralized oracle networks,” Chainlink Labs, White paper, vol. 1, 2021. [Online]. Available: https://research.chain.link/whitepaper-v2.pdf [36] X. Xiong, S. Liu, D. Li, Z. Cai, and X. Niu, “A comprehensive survey on local differential privacy,” Security and Communication Networks, vol. 2020, no. 1, p. 8829523, 2020. [37] M. Ester, H. Kriegel, J. Sander, and X. Xu, “A density-based algorithm for discovering clusters in large spatial databases with noise,” in Proceedings of the Second International Conference on Knowledge Discovery and Data Mining (KDD-96), 1996, pp. 226–231. [38] S. Micali, M. Rabin, and S. Vadhan, “Verifiable random functions,” in 40th annual symposium on foundations of computer science (cat. No. 99CB37039). IEEE, 1999, pp. 120–130. [39] A. A. Bellachia, M. A. Bouchiha, Y. Ghamri-Doudane, and M. Rabah, “Verifbfl: Leveraging zk-snarks for a verifiable blockchained federated learning,” arXiv preprint arXiv:2501.04319, 2025. [40] S. Guo, T. Zhang, H. Yu, X. Xie, L. Ma, T. Xiang, and Y. Liu, “Byzantine-resilient decentralized stochastic gradient descent,” IEEE Trans. on Circuits and Systems for Video Technology, vol. 32, no. 6, pp. 4096–4106, 2021. [41] P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” Advances in neural information processing systems, vol. 30, 2017. [42] D. Yin, Y. Chen, R. Kannan, and P. Bartlett, “Byzantine-robust distributed learning: Towards optimal statistical rates,” in International conference on machine learning. Pmlr, 2018, pp. 5650–5659. [43] T. D. Nguyen, P. Rieger, H. Chen, H. Yalame, H. Möllering et al., “FLAME: Taming backdoors in federated learning,” in 31st USENIX Security Symposium (USENIX Security). USENIX Association, Aug. 2022, pp. 1415–1432. [44] H. He, J. Zhang, Y. Wang, B. Jiang, S. Huang, C. Wang, Y. Zhang, G. Xiong, X. Han, D. Guo et al., “EVBattery: A Large-Scale Electric Vehicle Dataset for Battery Health and Capacity Estimation,” arXiv preprint arXiv:2201.12358, 2022. [45] M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to {Byzantine-Robust} federated learning,” in 29th USENIX security symposium (USENIX Security 20), 2020, pp. 1605–1622. [46] T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg, “Badnets: Evaluating backdooring attacks on deep neural networks,” Ieee Access, vol. 7, pp. 47 230–47 244, 2019. [47] E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov, “How to backdoor federated learning,” in 23rd International Conference on Artificial Intelligence and Statistics, 2020, pp. 2938–2948. [48] Z. Zhang, A. Panda, L. Song, Y. Yang, M. Mahoney et al., “Neurotoxin: Durable backdoors in federated learning,” in 39th International Conference on Machine Learning. PMLR, 2022, pp. 26 429–26 446. [49] J. Wang, Z. Charles, Z. Xu, G. Joshi et al., “A field guide to federated optimization,” arXiv preprint arXiv:2107.06917, 2021. [50] Z. Sun, P. Kairouz, A. T. Suresh, and H. B. McMahan, “Can you really backdoor federated learning?” arXiv preprint arXiv:1911.07963, 2019.