Pith. sign in

REVIEW 3 major objections 4 minor 56 references

Sarus claims that multi-vendor perception fusion can be done without revealing any vendor's detections, by encoding each detection as a Gaussian moment vector and letting a server add the encrypted summaries.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 13:18 UTC pith:SDF2XAGA

load-bearing objection Sarus's fusion math and experiments are solid, but its privacy guarantee is undone by plaintext per-vendor confidence/count metadata in Eq. (5). the 3 major comments →

arxiv 2607.19146 v1 pith:SDF2XAGA submitted 2026-07-21 cs.CR cs.CV

Sarus: Privacy-Preserving Multi-Vendor Perception Fusion via Homomorphic Encryption

Munawar Hasan , Apostol Vassilev This is my paper
classification cs.CR cs.CV
keywords homomorphic encryptioncooperative perceptionprivacy-preserving fusionCKKSGaussian moment vectorsspatial binningautonomous vehiclesmulti-vendor perception
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper presents Sarus, a framework that makes cooperative perception privacy-preserving at inference time: each vendor converts its detections into compact Gaussian moment vectors over a shared spatial grid, encrypts them with the CKKS homomorphic scheme, and sends only those ciphertexts to a fusion server. The server aggregates the encrypted vectors by addition—revealing nothing—and an authorized party decrypts and inverts the moments to rebuild fused detections. The authors show that encrypted fusion reproduces plaintext fusion almost exactly (average IoU above 0.99997), that runtime scales linearly with occupied bins and vendor count, and that on a camera-LiDAR autonomous driving benchmark the method improves scene coverage by combining complementary detections, most clearly where LiDAR alone degrades. The upshot is that the main obstacle to multi-vendor perception fusion is not computation but the binding assumption that all vendors share a common spatial frame with bounded misalignment.

Core claim

Sarus's central claim is that perception fusion can be reduced to linear summation of sufficient statistics, and therefore can be executed entirely inside homomorphic encryption without any party seeing another vendor's detections. Each bounding box is replaced by a Gaussian splat whose center is the box center and whose variance encodes localization uncertainty; the splat's seven moments (weight, weighted positions, weighted squared positions, weighted variances) are accumulated per spatial bin with bilinear soft assignment, so each detection contributes to at most four bins. A vendor encrypts one aggregated moment vector per occupied bin, the server adds ciphertexts by class-bin key, and t

What carries the argument

The moment-vector representation over Gaussian splats, combined with class-specific spatial binning and bilinear soft assignment. Because every operation on a detection is a weighted sum, fusion collapses to component-wise ciphertext addition under CKKS; the spatial grid keeps only spatially consistent detections together and compresses many detections into few encrypted payloads.

Load-bearing premise

The whole pipeline depends on all vendors agreeing on a shared spatial frame with alignment error smaller than roughly one bin stride; if calibration or localization error exceeds that, the same object smears across non-adjacent bins or different objects fuse together, and the encrypted moment sums can no longer be inverted into a correct detection.

What would settle it

Feed synchronized multi-vehicle detections with known ground-truth positions into Sarus, then artificially shift one vendor's coordinates by an offset larger than one bin stride; if the fused detections remain correct, the spatial consistency assumption holds, but if objects split or merge incorrectly, the assumption is falsified. The paper reports no experiment varying this offset, so this test would settle the scheme's practical limit.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Any party that can decrypt the fused output—say, a coalition member or infrastructure operator—can obtain the same fused scene without seeing individual vendor detections, protecting both environment privacy and proprietary models.
  • Because server work is O(BV) in occupied bins and vendors, adding more vendors does not multiply detection counts; the cost is predictable from scene sparsity.
  • The near-equality of encrypted and plaintext fusion (IoU > 0.99997) means downstream planners can be validated once on plaintext and then deployed unchanged with Sarus.
  • Coverage gains on the camera-LiDAR benchmark, especially at distances where LiDAR points thin out, suggest privacy-preserving fusion can recover real missed detections, not just average them.
  • The bounded constant-factor HE overhead makes real-time deployment plausible if vendors aggregate locally and encryption is batched or hardware-accelerated.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Extending beyond the paper: the same moment framework could feed object tracking filters without decryption, since the first moments and variances are exactly what a Kalman-style tracker needs; the paper does not explore that.
  • The scheme's security stops at the honest-but-curious server; a determined adversary who knows the public grid and the final output could still infer aggregate scene activity, and threshold or multi-key decryption would be needed for stronger guarantees.
  • A practical deployment would need a calibration error budget: the paper never quantifies the maximum epsilon allowed relative to bin stride, and a test that varies vendor alignment error would reveal when fusion breaks.
  • The method should transfer to radar or infrastructure sensors, and to streaming settings, but the paper only evaluates camera and LiDAR, so generalization is unverified.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes Sarus, a framework for privacy-preserving multi-vendor perception fusion. Each vendor encodes detections as Gaussian moment vectors over a class-wise spatial lattice, encrypts the aggregated per-bin moment vectors with CKKS, and sends them to a fusion server together with plaintext per-bin confidence masses and counts. The server homomorphically adds the encrypted moment vectors, then an authorized party decrypts, inverts the moments, and reconstructs detections via class-wise graph-based bin merging. The paper derives linear vendor and server complexity, reports KITTI experiments showing near-perfect numerical equivalence between homomorphic and plaintext fusion, and demonstrates improved distance-stratified coverage when camera and LiDAR detections are fused. The paper also states several limitations, including reliance on an unquantified spatial consistency assumption and dependence on reconstruction parameters.

Significance. If the privacy claim held, Sarus would be a useful contribution: the moment-based representation is simple, the algebraic core (Lemma 1) is correct, the complexity analysis is coherent, and the HE-vs-plaintext equivalence experiment (IoU > 0.99997, sub-pixel deviations) is strong evidence that the encrypted path preserves the plaintext fusion logic. The open-source availability of demonstration code and data is a further strength. However, the central privacy claim is undermined by the plaintext metadata in Eq. (5), so the contribution as stated is not yet demonstrated. The evaluation also depends on many undisclosed parameters and an unquantified alignment assumption, which limits reproducibility and confidence in the situational-awareness results.

major comments (3)
  1. [§4.2, Eq. (5); Algorithm 2; Algorithm 3] The payload P_v includes M_{v,key} and C_{v,key} as plaintext values, and Algorithm 3 (lines 28-33) sums these per-vendor values on the server. The server therefore learns, for every occupied class-bin key, each vendor's aggregated confidence mass and count. In a sparse key containing a single detection, M_{v,key}/C_{v,key} equals that detection's confidence p_{v,k}, and the key reveals its quantized spatial location. Even in dense bins, the server obtains per-vendor confidence heatmaps and occupancy counts, directly contradicting the §3.3 security goal and the abstract's claim that aggregation is performed 'without revealing individual vendor outputs.' No leakage analysis is provided, and the assertion that the server's view is computationally indistinguishable from an observer with only encrypted data is false because the server's view includes these plaintext statistics. The authors s
  2. [Definition 2 and §4.1.1] The Spatial Consistency Assumption posits a bounded alignment error epsilon, but epsilon is never quantified and no experiment varies calibration or localization error. If the true alignment error exceeds the bin stride s_c, soft assignment will spread the same object across non-adjacent bins (or merge distinct objects), and the encrypted moment sums can no longer be inverted into a correct fused detection. The paper claims robustness to 'minor spatial misalignment' without evidence. Please quantify epsilon relative to the bin stride and add sensitivity experiments over epsilon/s_c; otherwise the utility claim is not yet established.
  3. [§5.3 and Figure 11] The situational-awareness evaluation depends on many free reconstruction and merging parameters: lambda, kappa, gamma_x, gamma_y, tau_high, tau_min, tau_m, and the class-specific spatial anchors S_c and strides s_c. None of these values are reported, making the coverage results non-reproducible and preventing assessment of how sensitive the conclusions are to these choices. The paper only reports coverage at IoU=0.3 and states that higher thresholds reduce apparent coverage 'due to reconstruction effects,' but shows no numbers at higher thresholds. Please report all parameter values, provide sensitivity analyses, and present coverage at multiple IoU thresholds so readers can judge whether the reported gains are robust.
minor comments (4)
  1. [Throughout] Typos and inconsistent notation: 'spacial' for 'spatial,' 'recieving' for 'receiving,' 'DETR101' vs 'DETR-101,' and inconsistent use of 'S' for spatial anchor vs 's' for stride. Figures 2 and 3 appear to be from the VTTI dataset while Figure 1 is KITTI; this should be clarified in captions.
  2. [Algorithm 4, line 6] The threshold s[0] <= epsilon is used to skip bins, but epsilon was already introduced as the numerical-stability constant in moment inversion. These are different uses and should use distinct symbols; the threshold value is never specified.
  3. [Eq. (1) and Algorithm 4, lines 35] The symbol kappa is used both for the Gaussian spread scaling parameter in Eq. (1) and for the variance/area inflation factors in the cluster-splitting condition. This overloaded notation is confusing and should be disambiguated.
  4. [References] Reference [50] ('Calibrating uncertainties in object localization task') and [13] appear incomplete; [50] lacks authors, title, venue, and year.

Circularity Check

0 steps flagged

No significant circularity: the moment-fusion derivation is self-contained; main issues are reproducibility and a privacy-correctness flaw, not circularity.

full rationale

The paper's derived quantities are algebraic identities, not fitted predictions. Equations (3)-(4) define moment vectors as weighted sums, and Lemma 1's inversion formulas follow by substitution from those definitions, so the fusion math is self-contained and not circular. The HE/plaintext equivalence experiment compares two executions of the same pipeline and is a correctness check, not an independent prediction. The KITTI coverage study is empirical: the values of κ, λ, γx, γy, τ_high, τ_min, and τ_m are not disclosed, and evaluation is on the KITTI training split, making the reported gains hard to reproduce. That is a validation/reproducibility concern, but no text shows these constants were fitted to the coverage metric, so it is not a demonstrated 'fitted input called prediction.' The self-citations (Hermes Seal [20]; the perception-sensitivity paper [52]) appear only in suggested admission mechanisms and experimental setup, and are not load-bearing for the moment-fusion, complexity, or reconstruction derivations. The plaintext transmission of M_{v,key} and C_{v,key} in Eq. (5) contradicts the threat-model claim that the server sees only ciphertexts; this is a potentially severe privacy-correctness flaw, and the paper itself defers a leakage analysis, but it is a security flaw rather than a circularity of the derivation chain.

Axiom & Free-Parameter Ledger

7 free parameters · 4 axioms · 0 invented entities

The technical core rests on standard moment statistics plus a series of hand-set parameters, most of which are not given values in the text, so the reader cannot tell how much of the coverage gain comes from tuning. The main domain assumption is spatial consistency across vendors; the paper explicitly outsources admission control. No new physical entities are introduced.

free parameters (7)
  • kappa = not reported
    Gaussian splat spread scaling in Eq. (1); controls sigma and hence reconstructed box sizes and merging behavior.
  • lambda = not reported
    Bounding-box reconstruction coverage in Section 4.4; directly affects IoU and the reported coverage metric.
  • gamma_x, gamma_y = not reported
    Center-distance gating constants in Eq. (7); control which neighboring bins are merged.
  • tau_high, tau_min, tau_m = not reported
    IoU and Mahalanobis merge thresholds in Eq. (7) and Algorithm 4; control the final fused detections.
  • alpha_v = not reported
    Vendor trust weight in Section 4.1 and Algorithm 2; affects confidence normalization and fused confidence.
  • class-specific spatial anchor S_c and stride s_c = not reported in evaluation; example values in Figure 5 (stop sign S=80, s=40; person S=96, s=48; car S=160, s=80)
    Determine grid layout and soft-assignment matching; values affect communication cost and reconstruction fidelity.
  • epsilon = not reported
    Numerical variance floor in Section 4.4 and S_w threshold in Algorithm 4; affects inversion stability.
axioms (4)
  • domain assumption Spatial Consistency Assumption (Definition 2): observations of the same object from different vendors lie within a bounded alignment error epsilon in the common spatial frame.
    Load-bearing for bin-based soft assignment: if epsilon exceeds the bin stride, the same object's contributions split across non-adjacent bins and moment inversion cannot reconstruct it. The paper does not quantify epsilon.
  • domain assumption Uniform spatial uncertainty prior within each bounding box (Section 4.1).
    Justifies the Gaussian spread derived from box dimensions; the paper calls it a local non-informative prior, not a claim about real object distributions.
  • domain assumption CKKS provides correct approximate additive homomorphism and the claimed confidentiality.
    Used to aggregate encrypted moment vectors in Section 4.3. Approximate-CKKS security and noise behavior are asserted, not proven here.
  • domain assumption All vendor payloads pass an external admission/compliance check and follow the shared schema.
    The paper explicitly states admission control is out of scope (Section 3.2 and Limitations). Without it, malicious payloads can corrupt the fused output or leak data.

pith-pipeline@v1.3.0-alltime-deepseek · 24728 in / 15915 out tokens · 151046 ms · 2026-08-01T13:18:18.664908+00:00 · methodology

0 comments
read the original abstract

Cooperative perception enables autonomous vehicles (AVs) to improve situational awareness by aggregating detection outputs from multiple agents and sensing platforms, often via a shared fusion service in multi-vendor deployments. However, sharing such outputs at inference time exposes proprietary model behavior and sensitive environmental information, creating significant privacy and security concerns. In this paper, we present Sarus, a privacy-preserving framework for multi-vendor perception fusion via homomorphic encryption (HE), enabling aggregation without revealing individual vendor outputs. Each vendor encodes detections as compact Gaussian moment vectors over a shared spatial lattice and transmits encrypted payloads to a fusion server, which aggregates them directly in the encrypted domain. The fused result is then decrypted and reconstructed into final detections through class-wise bin merging. We analyze the computational complexity, showing linear scaling for vendor payload construction and $O(BV)$ server-side fusion with the number of occupied bins $B$ and vendors $V$, while postprocessing scales as $O(B + \sum_{c\in \mathcal{C}} B_c^2)$, where $\mathcal{C}$ denotes the set of object classes and $B_c$ is the number of occupied bins for class $c$. Experiments demonstrate linear scaling in practice with only a bounded constant-factor overhead from HE, with decryption dominating postprocessing cost. Experiments on the KITTI dataset using camera (YOLOv8) and LiDAR (PointPillars, PV-RCNN) detectors show that Sarus improves scene-level coverage by effectively aggregating complementary detections, particularly in distance-dependent regimes where individual modalities degrade. These results indicate that privacy-preserving multi-vendor perception fusion is feasible for real-time deployment when statistical compression and spatial sparsity are jointly exploited.

Figures

Figures reproduced from arXiv: 2607.19146 by Apostol Vassilev, Munawar Hasan.

Figure 1
Figure 1. Figure 1: Complementarity of heterogeneous perception outputs on KITTI (Karlsruhe Institute of Technology and [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: RT-DETR detection. (a) Stop sign undetected 59.46m, pedestrian detected 47.07m. (b) Gaussian Splat for the detection [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: DETR101 detection. Note, when κ = √ 1 3 , equation (1) matches the variance induced by the uniform spatial uncertainty of the bounding box. Under this representation, each detection is approximated by the Gaussian distribution: N [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Illustration of vendor-side moment aggregation in [PITH_FULL_IMAGE:figures/full_fig_p010_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Bin centers using spatial anchors for image with width: [PITH_FULL_IMAGE:figures/full_fig_p010_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Cross-bin hypothesis merging. Neighboring bins produce Gaussian hypotheses that may correspond to the [PITH_FULL_IMAGE:figures/full_fig_p015_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: HE Fusion: RT-DETR and DETR101. 1. Per-Detection Processing: For each detection, Sarus performs (i) Gaussian parameter computation, (ii) moment vector construction, and (iii) soft assignment to at most four neighboring bins. Each operation takes constant time, yielding: Tpreprocess = O(N). 2. Per-Key Aggregation: Each detection contributes to at most four keys, and the corresponding moment vectors are accu… view at source ↗
Figure 8
Figure 8. Figure 8: Vendor-side payload construction performance. [PITH_FULL_IMAGE:figures/full_fig_p022_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Server-side fusion performance. 5.2.2 Server-Side Encrypted Fusion Figures 9a and 9b show that server-side HE fusion runtime scales linearly with the number of occupied class-bin keys B. Comparing V = 2 and V = 5, the slope increases with the number of vendors, confirming that the fusion cost grows proportionally with both B and V . Figure 9c provides a stage-wise breakdown, showing that the dominant cost … view at source ↗
Figure 10
Figure 10. Figure 10: Vendor-side postprocessing performance. Homomorphic processing introduces significant computational [PITH_FULL_IMAGE:figures/full_fig_p024_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Distance-based coverage analysis (IoU = 0.3). Coverage is reported across three distance ranges: [0, 20) m, [20, 40) m, and ≥ 40 m. Sarus improves situational awareness by aggregating complementary detections from camera and LiDAR modalities. Gains are most pronounced when detectors operate in challenging regimes, such as long-range perception and LiDAR performance degrades due to sparsity. achieves highe… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

56 extracted references · 6 canonical work pages · 2 internal anchors

  1. [1]

    Cooper: Cooperative Perception for Connected Autonomous Vehicles Based on 3D Point Clouds

    Qi Chen, Sihai Tang, Qing Yang, and Song Fu. Cooper: Cooperative Perception for Connected Autonomous Vehicles Based on 3D Point Clouds. In2019 IEEE 39th International Conference on Distributed Computing Systems (ICDCS), pages 514–524, 2019.https://doi.org/doi:10.1109/ICDCS.2019.00058

    arXiv 2019

  2. [2]

    V2VNet: Vehicle-to-Vehicle Communication for Joint Perception and Prediction

    Tsun-Hsuan Wang, Sivabalan Manivasagam, Ming Liang, Bin Yang, Wenyuan Zeng, and Raquel Urtasun. V2VNet: Vehicle-to-vehicle Communication for Joint Perception and Prediction. InEuropean conference on computer vision, pages 605–621. Springer, 2020.https://doi.org/10.48550/arXiv.2008.07519

    work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.2008.07519 2020

  3. [3]

    OPV2V: An Open Benchmark Dataset and Fusion Pipeline for Perception with Vehicle-to-Vehicle Communication

    Runsheng Xu, Hao Xiang, Xin Xia, Xu Han, Jinlong Li, and Jiaqi Ma. OPV2V: An Open Benchmark Dataset and Fusion Pipeline for Perception with Vehicle-to-Vehicle Communication. In2022 International Conference on Robotics and Automation (ICRA), pages 2583–2589, 2022. https://doi.org/doi:10.1109/ICRA46639. 2022.9812038

    arXiv 2022

  4. [4]

    Chao Xiang, Chen Feng, Xiaopo Xie, Botian Shi, Hao Lu, Yisheng Lv, Mingchuan Yang, and Zhendong Niu. Multi- Sensor Fusion and Cooperative Perception for Autonomous Driving: A Review.IEEE Intelligent Transportation Systems Magazine, 15(5):36–58, 2023.https://doi.org/doi:10.1109/MITS.2023.3283864

    arXiv 2023

  5. [5]

    Ang, Emilio Frazzoli, and Daniela Rus

    Seong-Woo Kim, Baoxing Qin, Zhuang Jie Chong, Xiaotong Shen, Wei Liu, Marcelo H. Ang, Emilio Frazzoli, and Daniela Rus. Multivehicle cooperative driving using cooperative perception: Design and experimental validation. IEEE Transactions on Intelligent Transportation Systems, 16(2):663–680, 2015. https://doi.org/doi: 10.1109/TITS.2014.2337316. 26 Sarus: Pr...

    arXiv 2015

  6. [6]

    Hybrid sensing data fusion of cooperative perception for autonomous driving with augmented vehicular reality.IEEE Systems Journal, 15(1):1413–1422, 2021

    Bin Dai, Fanglin Xu, Yuanyuan Cao, and Yang Xu. Hybrid sensing data fusion of cooperative perception for autonomous driving with augmented vehicular reality.IEEE Systems Journal, 15(1):1413–1422, 2021. https://doi.org/doi:10.1109/JSYST.2020.3007202

    arXiv 2021

  7. [7]

    TalkyCars: A Distributed Software Platform for Cooperative Perception

    Martin Boehme, Marco Stang, Ferdin Muetsch, and Eric Sax. TalkyCars: A Distributed Software Platform for Cooperative Perception. In2020 IEEE Intelligent Vehicles Symposium (IV), pages 701–707, 2020. https: //doi.org/doi:10.1109/IV47402.2020.9304630

    arXiv 2020

  8. [8]

    Smart intersection project

    University of Michigan Transportation Research Institute. Smart intersection project. https://sip.umtri. umich.edu/, 2023. Accessed: 2026

    2023

  9. [9]

    KITTI Vision Benchmark Suite

    KITTI. KITTI Vision Benchmark Suite. https://www.cvlibs.net/datasets/kitti/, 2012. Accessed: 2026

    2012

  10. [10]

    You Only Look Once: Unified, Real-Time Object Detection

    Joseph Redmon, Santosh Divvala, Ross Girshick, and Ali Farhadi. You Only Look Once: Unified, Real-Time Object Detection. In2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 779–788, 2016.https://doi.org/10.1109/CVPR.2016.91

    doi:10.1109/cvpr.2016.91 2016

  11. [11]

    PV-RCNN: Point-V oxel Feature Set Abstraction for 3D Object Detection

    Shaoshuai Shi, Chaoxu Guo, Li Jiang, Zhe Wang, Jianping Shi, Xiaogang Wang, and Hongsheng Li. PV-RCNN: Point-V oxel Feature Set Abstraction for 3D Object Detection. 2021. https://doi.org/10.48550/arXiv. 1912.13192

    Pith/arXiv arXiv doi:10.48550/arxiv.1912.13192 2021

  12. [12]

    Adver- sarial machine learning: A taxonomy and terminology of attacks and mitigations, 2025

    Apostol Vassilev, Alina Oprea, Alice Fordyce, Hyrum Anderson, Xander Davies, and Maia Hamin. Adver- sarial machine learning: A taxonomy and terminology of attacks and mitigations, 2025. National Institute of Standards and Technology Gaithersburg, MD, NIST Trustworthy and Responsible AI, NIST AI 100-2e2025 https://doi.org/10.6028/NIST.AI.100-2e2025

    doi:10.6028/nist.ai.100-2e2025 2025

  13. [13]

    Improved Techniques for Model Inversion Attacks

    Si Chen, Ruoxi Jia, and Guo-Jun Qi. Improved Techniques for Model Inversion Attacks . 2020

    2020

  14. [14]

    A Methodology for Formalizing Model- Inversion Attacks

    Xi Wu, Matthew Fredrikson, Somesh Jha, and Jeffrey F Naughton. A Methodology for Formalizing Model- Inversion Attacks. In2016 IEEE 29th computer security foundations symposium (CSF), pages 355–370. IEEE, 2016.https://doi.org/doi:10.1109/CSF.2016.32

    work page doi:10.1109/csf.2016.32 2016

  15. [15]

    Sok: Model inversion attack landscape: Taxonomy, challenges, and future roadmap

    Sayanton V Dibbo. Sok: Model inversion attack landscape: Taxonomy, challenges, and future roadmap. In 2023 IEEE 36th Computer Security Foundations Symposium (CSF), pages 439–456. IEEE, 2023. https: //doi.org/doi:10.1109/CSF57540.2023.00027

    arXiv 2023

  16. [16]

    Wiz Discovers Flaws in GenAI Models Enabling Customer Data Theft

    Wiz. Wiz Discovers Flaws in GenAI Models Enabling Customer Data Theft. https://www. infosecurity-magazine.com/news/wiz-discovers-flaws-generative-ai/, 2024. Accessed: 2026

    2024

  17. [17]

    Homomorphic encryption for arithmetic of approximate numbers

    Jung Hee Cheon, Andrey Kim, Miran Kim, and Yongsoo Song. Homomorphic encryption for arithmetic of approximate numbers. InInternational conference on the theory and application of cryptology and information security, pages 409–437. Springer, 2017

    2017

  18. [18]

    Proof-carrying data and hearsay arguments from signature cards

    Alessandro Chiesa and Eran Tromer. Proof-carrying data and hearsay arguments from signature cards. In Innovations in Computer Science (ICS), 2010

    2010

  19. [19]

    IEEE Standard for Wireless Access in Vehicular Environments—Security Services for Application and Manage- ment Messages, 2022

    2022

  20. [20]

    Hermes Seal: Zero-Knowledge Assurance for Autonomous Vehicle Communications.arXiv preprint arXiv:2603.26343, 2026

    Munawar Hasan, Apostol Vassilev, Edward Griffor, and Thoshitha Gamage. Hermes Seal: Zero-Knowledge Assurance for Autonomous Vehicle Communications.arXiv preprint arXiv:2603.26343, 2026. https://doi. org/10.48550/arXiv.2603.26343

    doi:10.48550/arxiv.2603.26343 2026

  21. [21]

    A robust strategy for roadside cooperative perception based on multi-sensor fusion

    Shaowu Zheng, Chong Xie, Shanhu Yu, Ming Ye, Ruyi Huang, and Weihua Li. A robust strategy for roadside cooperative perception based on multi-sensor fusion. In2022 International Conference on Sensing, Measurement & Data Analytics in the era of Artificial Intelligence (ICSMD), pages 1–6. IEEE, 2022. https://doi.org/10. 1109/ICSMD57530.2022.10058282

    arXiv 2022

  22. [22]

    Eduardo Arnold, Mehrdad Dianati, Robert de Temple, and Saber Fallah. Cooperative perception for 3d object detection in driving scenarios using infrastructure sensors.IEEE Transactions on Intelligent Transportation Systems, 23(3):1852–1864, 2022.https://doi.org/10.1109/TITS.2020.3028424

    arXiv 2022

  23. [23]

    V2X-ViT: Vehicle-to- Everything Cooperative Perception with Vision Transformer

    Runsheng Xu, Hao Xiang, Zhengzhong Tu, Xin Xia, Ming-Hsuan Yang, and Jiaqi Ma. V2X-ViT: Vehicle-to- Everything Cooperative Perception with Vision Transformer. In Shai Avidan, Gabriel Brostow, Moustapha Cissé, Giovanni Maria Farinella, and Tal Hassner, editors,Computer Vision – ECCV 2022, pages 107–124, Cham, 2022. Springer Nature Switzerland.https://doi.o...

    Pith/arXiv arXiv doi:10.48550/arxiv.2203.10638 2022

  24. [24]

    MACP: Efficient Model Adaptation for Cooperative Perception

    Yunsheng Ma, Juanwu Lu, Can Cui, Sicheng Zhao, Xu Cao, Wenqian Ye, and Ziran Wang. MACP: Efficient model adaptation for cooperative perception. InProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 3373–3382, 2024.https://doi.org/10.48550/arXiv.2310.16870. 27 Sarus: Privacy-Preserving Multi-Vendor Perception Fusion via ...

    work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.2310.16870 2024

  25. [25]

    Car2X-based perception in a high-level fusion architecture for cooperative perception systems

    Andreas Rauch, Felix Klanner, Ralph Rasshofer, and Klaus Dietmayer. Car2X-based perception in a high-level fusion architecture for cooperative perception systems. In2012 IEEE Intelligent Vehicles Symposium, pages 270–275, 2012.https://doi.org/10.1109/IVS.2012.6232130

    arXiv 2012

  26. [26]

    Jinlong Li, Runsheng Xu, Xinyu Liu, Jin Ma, Zicheng Chi, Jiaqi Ma, and Hongkai Yu. Learning for Vehicle- to-Vehicle Cooperative Perception Under Lossy Communication.IEEE Transactions on Intelligent Vehicles, 8(4):2650–2660, 2023.https://doi.org/10.1109/TIV.2023.3260040

    arXiv 2023

  27. [27]

    Chuheng Wei, Guoyuan Wu, and Matthew J. Barth. Cooperative Perception for Automated Driving: A Survey of Algorithms, Applications, and Future Directions.Proceedings of the IEEE, pages 1–27, 2025. https: //doi.org/10.1109/JPROC.2025.3608874

    arXiv 2025

  28. [28]

    Collaborative Multimodal Fusion Network for Multiagent Perception.IEEE Transactions on Cybernetics, 55(1):486–498, 2025

    Lei Zhang, Binglu Wang, Yongqiang Zhao, Yuan Yuan, Tianfei Zhou, and Zhijun Li. Collaborative Multimodal Fusion Network for Multiagent Perception.IEEE Transactions on Cybernetics, 55(1):486–498, 2025. https: //doi.org/10.1109/TCYB.2024.3491756

    arXiv 2025

  29. [29]

    ViT-FuseNet: Multimodal Fusion of Vision Transformer for Vehicle-Infrastructure Cooperative Perception.IEEE Access, 12:31640–31651, 2024.https://doi.org/10.1109/ACCESS.2024.3368404

    Yang Zhou, Cai Yang, Ping Wang, Chao Wang, Xinhong Wang, and Nguyen Ngoc Van. ViT-FuseNet: Multimodal Fusion of Vision Transformer for Vehicle-Infrastructure Cooperative Perception.IEEE Access, 12:31640–31651, 2024.https://doi.org/10.1109/ACCESS.2024.3368404

    arXiv 2024

  30. [30]

    Junyang He, Xiaoheng Deng, Jinsong Gui, Tao Zhang, and Xiangjian He. MDNet: Multimodal Cooperative Perception via Spatial Alignment of Modal Decision-Making.IEEE Internet of Things Journal, 12(11):16142– 16154, 2025.https://doi.org/10.1109/JIOT.2025.3531145

    arXiv 2025

  31. [31]

    V2VFormer++: Multi-Modal Vehicle-to-Vehicle Cooperative Perception via Global-Local Transformer.IEEE Transactions on Intelligent Transportation Systems, 25(2):2153–2166, 2024

    Hongbo Yin, Daxin Tian, Chunmian Lin, Xuting Duan, Jianshan Zhou, Dezong Zhao, and Dongpu Cao. V2VFormer++: Multi-Modal Vehicle-to-Vehicle Cooperative Perception via Global-Local Transformer.IEEE Transactions on Intelligent Transportation Systems, 25(2):2153–2166, 2024. https://doi.org/10.1109/ TITS.2023.3314919

    arXiv 2024

  32. [32]

    Multi-Modal Virtual-Real Fusion based Transformer for Collaborative Perception

    Hui Zhang, Guiyang Luo, Yuanzhouhan Cao, Yi Jin, and Yidong Li. Multi-Modal Virtual-Real Fusion based Transformer for Collaborative Perception. In2022 IEEE 13th International Symposium on Parallel Architec- tures, Algorithms and Programming (PAAP), pages 1–6, 2022.https://doi.org/10.1109/PAAP56126.2022. 10010640

    arXiv 2022

  33. [33]

    RG-Attn: Radian Glue Attention for Multi-modal Multi-agent Cooperative Perception

    Lantao Li, Kang Yang, Wenqi Zhang, Xiaoxue Wang, and Chen Sun. RG-Attn: Radian Glue Attention for Multi-modal Multi-agent Cooperative Perception. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 1763–1772, 2025.https://doi.org/10.48550/arXiv.2501.1680

    work page doi:10.48550/arxiv.2501.1680 2025

  34. [34]

    Privacy- Preserving V2X Collaborative Perception Integrating Unknown Collaborators

    Bin Lu, Xinyu Xiao, Changzhou Zhang, Yang Zhou, Zhiyu Xiang, Hangguan Shan, and Eryun Liu. Privacy- Preserving V2X Collaborative Perception Integrating Unknown Collaborators. InProceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 5802–5810, 2025

    2025

  35. [35]

    A Multimodal Collaborative Perception Framework in Challenging Environments

    Hanwen Jiang, Shijun Zhou, Konglin Zhu, Artur Andrzejak, and Yi Gong. A Multimodal Collaborative Perception Framework in Challenging Environments. In2025 9th IEEE International Conference on Network Intelligence and Digital Content (IC-NIDC), pages 62–66, 2025. https://doi.org/10.1109/IC-NIDC67200.2025. 11390536

    arXiv 2025

  36. [36]

    Communication- Efficient Learning of Deep Networks from Decentralized Data

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication- Efficient Learning of Deep Networks from Decentralized Data. InArtificial intelligence and statistics, pages 1273–1282. Pmlr, 2017.https://doi.org/10.48550/arXiv.1602.05629

    Pith/arXiv arXiv doi:10.48550/arxiv.1602.05629 2017

  37. [37]

    Advances and Open Problems in Federated Learning.Foundations and trends in machine learning, 14(1-2):1–210, 2021.https://doi.org/10.48550/arXiv.1912.04977

    Peter Kairouz and H Brendan McMahan. Advances and Open Problems in Federated Learning.Foundations and trends in machine learning, 14(1-2):1–210, 2021.https://doi.org/10.48550/arXiv.1912.04977

    Pith/arXiv arXiv doi:10.48550/arxiv.1912.04977 2021

  38. [38]

    SCAFFOLD: Stochastic Controlled Averaging for Federated Learning

    Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian Stich, and Ananda Theertha Suresh. SCAFFOLD: Stochastic Controlled Averaging for Federated Learning. InInternational conference on machine learning, pages 5132–5143. PMLR, 2020.https://doi.org/10.48550/arXiv.1910.06378

    Pith/arXiv arXiv doi:10.48550/arxiv.1910.06378 2020

  39. [39]

    Federated Learning: Opportunities and Challenges.arXiv preprint arXiv:2101.05428, 2021.https://doi.org/10.48550/arXiv.2101.05428

    Priyanka Mary Mammen. Federated Learning: Opportunities and Challenges.arXiv preprint arXiv:2101.05428, 2021.https://doi.org/10.48550/arXiv.2101.05428

    Pith/arXiv arXiv doi:10.48550/arxiv.2101.05428 2021

  40. [40]

    On the Federated Learning Framework for Cooperative Perception.IEEE Robotics and Automation Letters, 9(11):9423– 9430, 2024.https://doi.org/10.1109/LRA.2024.3457374

    Zhenrong Zhang, Jianan Liu, Xi Zhou, Tao Huang, Qing-Long Han, Jingxin Liu, and Hongbin Liu. On the Federated Learning Framework for Cooperative Perception.IEEE Robotics and Automation Letters, 9(11):9423– 9430, 2024.https://doi.org/10.1109/LRA.2024.3457374

    arXiv 2024

  41. [41]

    Abdel-Aziz, Cristina Perfecto, Sumudu Samarakoon, Mehdi Bennis, and Walid Saad

    Mohamed K. Abdel-Aziz, Cristina Perfecto, Sumudu Samarakoon, Mehdi Bennis, and Walid Saad. Vehicular Cooperative Perception Through Action Branching and Federated Reinforcement Learning.IEEE Transactions on Communications, 70(2):891–903, 2022.https://doi.org/10.1109/TCOMM.2021.3126650

    arXiv 2022

  42. [42]

    CryptoDL: Deep Neural Networks over Encrypted Data

    Ehsan Hesamifard, Hassan Takabi, and Mehdi Ghasemi. CryptoDL: Deep Neural Networks over Encrypted Data. arXiv preprint arXiv:1711.05189, 2017.https://doi.org/10.48550/arXiv.1711.05189. 28 Sarus: Privacy-Preserving Multi-Vendor Perception Fusion via Homomorphic Encryption

    Pith/arXiv arXiv doi:10.48550/arxiv.1711.05189 2017

  43. [43]

    Joshi, and Chao Li

    Runhua Xu, James B.D. Joshi, and Chao Li. Cryptonn: Training neural networks over encrypted data. In 2019 IEEE 39th International Conference on Distributed Computing Systems (ICDCS), pages 1199–1209, 2019. https://doi.org/10.1109/ICDCS.2019.00121

    arXiv 2019

  44. [44]

    Machine Learning Classification over Encrypted Data

    Raphael Bost, Raluca Ada Popa, Stephen Tu, and Shafi Goldwasser. Machine Learning Classification over Encrypted Data. Cryptology ePrint Archive, Paper 2014/331, 2014. https://doi.org/10.14722/ndss.2015. 23241

    work page doi:10.14722/ndss.2015 2014

  45. [45]

    THOR: Secure Transformer Inference with Homo- morphic Encryption

    Jungho Moon, Dongwoo Yoo, Xiaoqian Jiang, and Miran Kim. THOR: Secure Transformer Inference with Homo- morphic Encryption. InProceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, pages 3765–3779, 2025.https://doi.org/10.1145/3719027.3765150

    arXiv 2025

  46. [46]

    Optimized Privacy-Preserving CNN Inference With Fully Homomorphic Encryption.IEEE Transactions on Information Forensics and Security, 18:2175–2187, 2023

    Dongwoo Kim and Cyril Guyot. Optimized Privacy-Preserving CNN Inference With Fully Homomorphic Encryption.IEEE Transactions on Information Forensics and Security, 18:2175–2187, 2023. https://doi. org/110.1109/TIFS.2023.3263631

    arXiv 2023

  47. [47]

    Probabilistic encryption.Journal of Computer and System Sciences, 28(2):270–299, 1984

    Shafi Goldwasser and Silvio Micali. Probabilistic encryption.Journal of Computer and System Sciences, 28(2):270–299, 1984

    1984

  48. [48]

    CRC Press, 3 edition, 2020

    Jonathan Katz and Yehuda Lindell.Introduction to Modern Cryptography. CRC Press, 3 edition, 2020

    2020

  49. [49]

    Using occupancy grids for mobile robot perception and navigation.Computer, 22(6):46–57, 1989

    Alberto Elfes. Using occupancy grids for mobile robot perception and navigation.Computer, 22(6):46–57, 1989

    1989

  50. [50]

    Calibrating uncertainties in object localization task

  51. [51]

    Inferring Spatial Uncertainty in Object Detection.arXiv preprint arXiv:2003.03644, 2020

    Zining Wang, Di Feng, Yiyang Zhou, Lars Rosenbaum, Fabian Timm, Klaus Dietmayer, Masayoshi Tomizuka, and Wei Zhan. Inferring Spatial Uncertainty in Object Detection.arXiv preprint arXiv:2003.03644, 2020

    Pith/arXiv arXiv 2003

  52. [52]

    On the Assessment of Sensitivity of Autonomous Vehicle Perception.arXiv preprint arXiv:2602.00314, 2026.https://doi.org/10.48550/arXiv.2602.00314

    Apostol Vassilev, Munawar Hasan, Edward Griffor, Honglan Jin, Pavel Piliptchak, Mahima Arora, and Thoshitha Gamage. On the Assessment of Sensitivity of Autonomous Vehicle Perception.arXiv preprint arXiv:2602.00314, 2026.https://doi.org/10.48550/arXiv.2602.00314

    work page doi:10.48550/arxiv.2602.00314 2026

  53. [53]

    Virginia Tech Transportation Institute

    VTTI. Virginia Tech Transportation Institute

  54. [54]

    Ultralytics YOLO

    Ultralytics. Ultralytics YOLO. Accessed: 2026

    2026

  55. [55]

    Lang, Sourabh V ora, Holger Caesar, Lubing Zhou, Jiong Yang, and Oscar Beijbom

    Alex H. Lang, Sourabh V ora, Holger Caesar, Lubing Zhou, Jiong Yang, and Oscar Beijbom. PointPillars: Fast Encoders for Object Detection from Point Clouds. 2019.https://doi.org/10.48550/arXiv.1812.05784

    Pith/arXiv arXiv doi:10.48550/arxiv.1812.05784 2019

  56. [56]

    OpenPCDet: An Open-source Toolbox for 3D Object Detection from Point Clouds.https://github.com/open-mmlab/OpenPCDet, 2020

    OpenPCDet Development Team. OpenPCDet: An Open-source Toolbox for 3D Object Detection from Point Clouds.https://github.com/open-mmlab/OpenPCDet, 2020. Accessed: 2026. 29

    2020