Distributed Federated Learning for Vehicular Network Security: Anomaly Detection Benefits and Multi-Domain Attack Threats

Hossein Jafari; Mengran Xue; Sastry Kompella; Tugba Erpek; Utku Demir; Yalin E. Sagduyu

REVIEW 3 major objections 5 minor 15 references

Distributed Federated Learning for Vehicular Network Security: Anomaly Detection Benefits and Multi-Domain Attack Threats

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Distributed federated learning, in which vehicles exchange model weights with one-hop neighbors and propagate them over multiple hops, improves every vehicle's accuracy at classifying malicious safety messages compared with local-only…

desk verdict Plausible and timely DFL anomaly-detection study whose headline 'every node improves' claim needs statistical support before it can be relied on. read the letter →

arxiv 2505.23706 v1 pith:QXWQ6XA4 submitted 2025-05-29 cs.NI cs.AIcs.DCcs.ITeess.SPmath.IT

Utku Demir , Yalin E. Sagduyu , Tugba Erpek , Hossein Jafari , Sastry Kompella , Mengran Xue This is my paper

classification cs.NIcs.AIcs.DCcs.ITeess.SPmath.IT

keywords distributedfederatedlearningvehicularnetworksanomalydetectionmisbehaviorjammingattacksdatapoisoningVeReMiExtensiondatasetdeep

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether connected vehicles can detect malicious or anomalous safety messages better when they train collaboratively, without a central server, than when each vehicle learns from its own data alone. Using the VeReMi Extension dataset of basic safety messages, it argues yes: distributed federated learning (DFL), where vehicles exchange model weights with one-hop neighbors and propagate aggregated models over multiple hops, raised the average classification accuracy of a large DNN from 0.6811 to 0.8004 and the worst vehicle's accuracy from 0.4720 to 0.7040 on the DoS detection task. It also claims the benefit is uneven: vehicles with little data or weak connectivity gain the most, and node accuracy correlates with training data size, node degree, connected-component size, and connection time. The same mechanism, however, creates attack surfaces: jamming can cut DFL back to local learning, label-flipping poisoning propagates across hops and can push accuracy near random guessing, and the two attacks can partially cancel each other. The paper thus argues that DFL is a promising privacy-preserving replacement for centralized federated learning in vehicular networks, but one that needs explicit defenses.

What carries the argument

The load-bearing object is distributed federated learning (DFL): each vehicle trains a deep neural network on its own collected basic safety messages, exchanges model weights only with vehicles in one-hop range, aggregates the received weights into its local model by federated averaging, and passes the updated model onward so knowledge propagates over multiple hops with no central aggregator. Two DNN architectures—a small 22-16-8-2 network and a large 22-128-32-2 network—classify each message as benign or malicious, and the VeReMi Extension dataset supplies 64,779 messages from the morning-peak DoS scenario across 100 vehicles (94 with data). The attack analysis is carried by the same exchange mechanism: jamming severs incoming links so isolated vehicles fall back to local training, while label-flipping poisons the local data of selected vehicles and rides the multi-hop propagation to contaminate the aggregate model.

What would settle it

A faithful re-implementation of the VeReMi DFL setup with a documented aggregation schedule (round count, local epochs, learning rate) and per-node test sets of at least a few hundred samples either reproduces the reported average and minimum accuracy gains or the claim is refuted.

Watch

Extended reading notes

Core claim

The paper's central claim is that, for vehicular safety-message classification, distributed federated learning outperforms strictly local training and provides a privacy-preserving path to lift weak vehicles. In the VeReMi Extension morning-peak DoS scenario, the authors report that DFL improves every node's classification accuracy relative to local-only training, raising average accuracy from 0.6625 to 0.7592 for the small DNN and from 0.6811 to 0.8004 for the large DNN, while minimum accuracy rises from 0.4490 to 0.6750 and from 0.4720 to 0.7040 respectively and standard deviation falls by 44–62%. The paper further claims that DFL accuracy is more strongly correlated with network properties—node degree, average connected-component size, and connected-time ratio—than local accuracy is, and that these correlations let an attacker pick high-impact victims. Finally, it claims that jamming and poisoning attacks degrade DFL significantly; label-flipping poisoning spreads over multiple hops and can drive average accuracy to 0.5314 with minimum 0.3149, while jamming eventually reduces DFL to local learning.

Load-bearing premise

The paper assumes that the simulated rule—vehicles exchange and average model weights whenever they are within one-hop range—captures how a real deployment would coordinate training, and it leaves the training schedule unspecified, so the exact size of DFL's advantage is not pinned down.

Editorial extensions

If this is right

If DFL delivers these gains, vehicles with little local data or poor connectivity can be brought close to the network average without sending raw location or message data to a central server.
Network connectivity becomes a first-order performance factor: deployment or routing choices that increase one-hop neighbor counts and connected component sizes should directly improve anomaly detection accuracy.
An attacker who can observe network topology or training-data volume can target high-degree or high-accuracy vehicles to maximize damage, so topology-aware defenses are needed alongside data-level defenses.
Because jamming and poisoning partially cancel, a defender may need to treat attack domains jointly rather than independently when evaluating robustness.
The propagation of poisoning over multiple hops means even a small set of compromised vehicles can corrupt models far from the attack origin.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper does not run a controlled ablation with documented aggregation rounds, local epochs, and learning rate; a natural test would quantify how much of the DFL gain comes from averaging versus from additional local training between exchanges.
If the observed correlation between DFL accuracy and connected-component size holds outside this dataset, traffic density and platooning patterns could serve as cheap predictors of when decentralized learning will succeed.
The tables suggest that jamming and poisoning can cancel each other's damage; that non-monotone interaction is an inference from the reported numbers, not a claim the paper states.
The larger variance reduction under the large DNN hints that the benefit may grow with model capacity, which could be tested by sweeping width and depth.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Two things to know. First, this is a real empirical study, not a toy: they use the VeReMi Extension dataset, a public benchmark, and they test DFL against local-only training on 94 vehicles with mobility-induced connectivity. Second, the central quantitative claim—that DFL improves every node's accuracy and lifts the minimum—is not statistically established by the numbers in the paper. The stress-test note is right: per-node test sets of 3–114 samples make the minimum-accuracy figures fragile, and a one-sample change can move a node's accuracy by a third.

What is genuinely new is the specific combination: DFL applied to the VeReMi Extension dataset, a correlation analysis linking DFL accuracy to training data size and network connectivity, and a joint jamming-plus-poisoning attack evaluation. The attack section is more thoughtful than most in this area. They acknowledge that choosing the top performers to attack is an oracle, then supplement it with attacks based on observable network properties (degree, connected component size, connected time ratio), which is a credible attempt to model a realistic adversary.

The soft spots are real but addressable. The paper gives no training protocol: no aggregation rounds, no local epochs, no learning rate, no optimizer. It claims DFL "significantly" raises accuracy but reports no significance tests, no error bars, and no repeated runs with different seeds. For a node with three test samples, accuracy can only be 0, 1/3, 2/3, or 1; the minimum-accuracy gain from 0.472 to 0.704 could rest on a handful of corrected predictions. The "every node" wording in Section 3 is not supported by the aggregate statistics. That said, the direction of the effect is consistent across both model sizes and the improvements are large enough that the qualitative conclusion—DFL helps, especially for weak nodes—is probably right. The joint-attack tables also show sensible monotonic trends, which is reassuring.

Who this is for: people working on decentralized FL for vehicular networks will find the attack taxonomy and the correlation with connectivity metrics useful. It deserves a serious referee because the topic is timely, the dataset is public, and the flaws are fixable. I would not cite it in its current form for any quantitative claim, but I would read a revised version.

Recommendation: send to peer review with a major-revision request. Require a complete training protocol, repeated runs with seeds, per-node accuracy distributions or confidence intervals, and a rewording of the universal-improvement claim to match what the data can support.

Referee Report

3 major / 5 minor

Summary. Demir et al. study Distributed Federated Learning (DFL) for detecting DoS attacks in vehicular safety messages using the VeReMi Extension dataset. Vehicles train local DNNs, exchange model weights with one-hop neighbors, and propagate aggregated models over multiple hops; this is compared with local-only training. The paper reports accuracy averages, minima, maxima, and standard deviations over 94 vehicles for two DNN sizes, a correlation analysis linking DFL accuracy to training data size and connectivity, and attack experiments (jamming, label poisoning, and joint attacks) in which victim sets are chosen by DFL/local accuracy or by network properties.

Significance. The potential contribution is real: if DFL reliably lifts the worst-performing vehicles while preserving privacy, it would be useful for decentralized vehicular anomaly detection. The paper uses a public benchmark, considers two model sizes, and covers both performance and multi-domain attacks. However, the central empirical claim is currently under-supported because per-node test sets are extremely small, no uncertainty quantification is provided, and the training protocol is underspecified. With added per-node confidence intervals, seed variation, and protocol details, the findings could become a solid empirical study; as written, the quantitative claims exceed the evidence.

major comments (3)

[Section 3, Table 2] The claim that 'DFL improves every node's classification accuracy' is not established by the reported evidence. Test sets per node contain only 3 to 114 samples (average 36), so per-node accuracy is a proportion with huge binomial uncertainty; for a node with 3 test samples, accuracy can only take values 0, 1/3, 2/3, or 1. The minimum-accuracy gains in Table 2 (0.4490 to 0.6750 for the small DNN; 0.4720 to 0.7040 for the large DNN) can therefore be driven by one or two corrected predictions in the worst node's test set. No per-node accuracy vectors, confidence intervals, bootstrap estimates, paired significance tests, or repeated seeds are reported. Because the central contribution is the lifting of low-accuracy vehicles, this issue is load-bearing. Please report per-node accuracies with binomial confidence intervals and/or a paired test across nodes (and over seeds), or revise the universal-improvement and minimum-accuracy claims accordingly; the same issue affects the minimum-accuracy entries in Tables 4 through 7.
[Section 2.2] The DFL training protocol is underspecified. The paper does not state the number of aggregation rounds, local training epochs, learning rate, optimizer, batch size, or how a vehicle aggregates model weights from multiple one-hop neighbors over concurrent multi-hop propagations (for example, ordering, weighting by dataset size, and whether stale models are discarded). It also does not state the validation procedure used to select models. Without these details the comparison between DFL and local-only training cannot be reproduced, and the fairness of the comparison cannot be checked. Please add a complete protocol description.
[Section 4.1] Jamming is modeled as selecting the Top K DFL performers and severing all their incoming connections, with the explanation that directional jamming can achieve this without affecting BSMs. This is a strong assumption. Real jamming would affect incoming and outgoing links probabilistically, may affect all nearby nodes, and may also disrupt the reception of the safety messages being classified. Please state this limitation explicitly and provide a sensitivity analysis for at least a random or probabilistic jamming model, or adjust the claims about resilience and attack effectiveness.

minor comments (5)

[Section 3, Table 3] The correlation table reports no p-values or confidence intervals. With 94 nodes, correlations around 0.3 to 0.5 are only modest evidence of a 'highly correlated' relationship; please add uncertainty measures or soften the wording.
[Section 3, data description] Please report the class balance (benign versus malicious messages) both overall and per node, since accuracy is a misleading metric under strong class imbalance and the per-node test sets are very small.
[Section 4.3 and Table 7] Table 7 repeats the 'Jam Only' rows for both p_a values even though jamming-only results do not depend on p_a; this formatting is confusing and should be simplified.
[Section 4.3] The text refers to 'the no attack DFL accuracy of 80%' while the tables use 0.8004; please use one consistent numeric representation.
[Abstract and Section 3] The word 'significant' is used without statistical testing; after the requested uncertainty analysis is added, please align the wording with the actual statistical evidence.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the DFL benefit and attack effects are measured on the public VeReMi Extension dataset against a local-training baseline, not derived from fitted parameters or self-cited theorems.

full rationale

This is an empirical simulation study rather than a derivation chain. The central claim, that DFL improves per-node and network-wide anomaly detection accuracy relative to local training alone, is established by running a fixed DFL aggregation procedure from prior literature on the public VeReMi Extension dataset and comparing the resulting Table 2 accuracies with a local-learning baseline. That comparison is not forced by construction: the DFL and no-DFL runs use the same model architectures, the same data partitions, and the same per-node test sets, and no fitted parameter is subsequently renamed as a prediction. The correlation analysis in Table 3 is descriptive, not a fitted model used to generate the headline accuracy numbers: the reported DFL accuracies are computed directly from the simulation, while the correlations merely summarize relationships among training data size, connectivity metrics, and accuracy. The attack results in Section 4 are also measurements under explicitly defined node-selection rules (top-K jamming, label-flipping probabilities, and network-property-based selection), and the attack outcomes are read out of the simulation rather than implied by the attack definitions. The paper cites prior work by the authors for DFL and attack mechanisms, e.g., references [6]-[11], but those citations provide the method or the attack concept; they are not used to assert the numerical result, which is reproducible from the public dataset and the stated protocol. There is no equation in the paper that defines a target quantity in terms of its own output, no fitted input that is later relabeled a prediction, and no imported uniqueness theorem that forces the paper's choice of model or attack. The small per-node test sets (3 to 114 samples) and the absence of confidence intervals are genuine statistical-evidence concerns about the strength of the 'improves every node' claim, but they are correctness risks rather than circularity. Because the empirical comparison is self-contained and externally grounded in a public dataset, the appropriate circularity finding is no significant circularity; the small number of same-author citations in the method/related-work layer warrants at most a minimal nonzero score.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new physical entities or theoretical constructs. Its central claims rest on standard FedAvg heuristics, a public dataset, and several unstated experimental choices. The two most important ledger items are the unspecified DFL training schedule and the small per-node test sets, both of which directly affect the reported accuracy magnitudes.

free parameters (2)

DFL aggregation rounds
The number of rounds over which vehicles exchange and aggregate model weights is central to convergence and accuracy, but is not reported in the paper.
Local training epochs and learning rate
These hyperparameters determine how well each local model fits its data before exchange; without them the reported accuracy values cannot be reproduced.

assumptions (4)

domain assumption FedAvg-based model aggregation among one-hop neighbors converges to a useful global model in a dynamic vehicular topology.
The whole DFL approach relies on this assumption, and the paper does not prove it or compare aggregation schedules; it is invoked throughout Section 2.2.
domain assumption The VeReMi Extension dataset's ground truth labels and message features are correct and representative of real vehicular misbehavior.
All accuracy numbers are computed against this dataset; if the labels or simulation parameters are biased, the reported improvements may not transfer to real-world conditions.
ad hoc to paper Jamming can be modeled as selectively removing incoming connections of chosen nodes without affecting the victim's local training data.
This is the model used in Section 4.1 and Figure 5b. Real jamming may also disrupt sensor data or affect multiple nodes differently than a clean graph cut.
domain assumption Per-vehicle test sets of 3 to 114 samples yield reliable accuracy estimates.
Section 3 reports these test set sizes. With so few samples, a single misclassification changes accuracy by several percentage points, so the reported minimum accuracies carry large sampling noise.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Distributed Federated Learning for Vehicular Network Security: Anomaly Detection Benefits and Multi-Domain Attack Threats." pith.science (2026). https://pith.science/paper/QXWQ6XA4

@misc{pith2026250523706,
  author       = {Pith},
  title        = {Pith review of: Distributed Federated Learning for Vehicular Network Security: Anomaly Detection Benefits and Multi-Domain Attack Threats},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QXWQ6XA4}},
  note         = {Machine review of arXiv:2505.23706}
}

read the original abstract

In connected and autonomous vehicles, machine learning for safety message classification has become critical for detecting malicious or anomalous behavior. However, conventional approaches that rely on centralized data collection or purely local training face limitations due to the large scale, high mobility, and heterogeneous data distributions inherent in inter-vehicle networks. To overcome these challenges, this paper explores Distributed Federated Learning (DFL), whereby vehicles collaboratively train deep learning models by exchanging model updates among one-hop neighbors and propagating models over multiple hops. Using the Vehicular Reference Misbehavior (VeReMi) Extension Dataset, we show that DFL can significantly improve classification accuracy across all vehicles compared to learning strictly with local data. Notably, vehicles with low individual accuracy see substantial accuracy gains through DFL, illustrating the benefit of knowledge sharing across the network. We further show that local training data size and time-varying network connectivity correlate strongly with the model's overall accuracy. We investigate DFL's resilience and vulnerabilities under attacks in multiple domains, namely wireless jamming and training data poisoning attacks. Our results reveal important insights into the vulnerabilities of DFL when confronted with multi-domain attacks, underlining the need for more robust strategies to secure DFL in vehicular networks.

Figures

Figures reproduced from arXiv: 2505.23706 by the authors.

**Figure 2.** Network metrics over time. 2.2 Distributed Federated Learning Operation In FL, each vehicle trains a local model and shares only model updates instead of raw data. However, standard FL relies on a central server for model aggregation, which introduces bottlenecks and single points of failure. To address these challenges, DFL supports vehicles to exchange model updates directly with their one-hop [PITH_FULL_IMAGE:f… view at source ↗

**Figure 4.** In both models, DFL improves every node’s classification [PITH_FULL_IMAGE:figures/full_fig_p003_4.png] view at source ↗

Figures from the paper (1 more)

**Figure 5.** Figure 5: Jamming and poisoning attacks on DFL. over time. 𝑪 is the average size of connected components for nodes, where 𝑪𝑖 is the average size of connected components that node 𝑖 ∈ N belongs to over time. 𝒄 is the ratio of connected times for nodes, where 𝒄𝑖 is the ratio of ti…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

15 extracted references · 15 canonical work pages

[1]

Ahmed Saleh Bataineh, Mohammad Zulkernine, Adel Abusitta, and Talal Halabi

work page
[2]

Secil Ercan, Leo Mendiboure, Lylia Alouache, Sassi Maaloul, Tidiane Sylla, and Hasnaa Aniss. 2023. An Enhanced Model for Machine Learning-Based DoS De- tection in Vehicular Networks. In IFIP Networking Conference (IFIP Networking)

work page 2023
[3]

Jiaqi Huang, Yili Jiang, Sohan Gyawali, Zhiguo Zhou, and Fangtian Zhong. 2024. Semi-supervised Federated Learning for Misbehavior Detection of BSMs in Vehicular Networks. In IEEE 100th Vehicular Technology Conference (VTC2024- Fall)

work page 2024
[4]

van der Hei, Arnaud Kaiser, Pascal Urien, and Frank Kargl

Joseph Kamel, Michael Wolf, Rens W. van der Hei, Arnaud Kaiser, Pascal Urien, and Frank Kargl. 2020. VeReMi Extension: A Dataset for Comparable Evalua- tion of Misbehavior Detection in VANETs. InIEEE International Conference on Communications (ICC)

work page 2020
[5]

Qiang Lu, Hojin Jung, and Kyoung-Dae Kim. 2022. Optimization-Based Approach for Resilient Connected and Autonomous Intersection Crossing Traffic Control Under V2X Communication. IEEE Transactions on Intelligent Vehicles 7, 2 (2022)

work page 2022
[6]

Yalin E Sagduyu, Tugba Erpek, and Yi Shi. 2023. Securing NextG Systems against Poisoning Attacks on Federated Learning: A Game-Theoretic Solution. In IEEE Military Communications Conference (MILCOM)

work page 2023
[7]

Y. E. Sagduyu, T. Erpek, and Y. Shi. 2025. Poisoning Attack and Defense Game for Federated Learning in Resilient NextG Networks. In Autonomous Cyber Resilience. Wiley-IEEE Press. to appear

work page 2025
[8]

Yi Shi and Yalin E Sagduyu. 2022. How to launch jamming attacks on federated learning in NextG wireless networks. InIEEE Globecom Workshops (GC Wkshps)

work page 2022

Show all 15 references

[9]

Yi Shi and Yalin E Sagduyu. 2022. Jamming attacks on federated learning in wireless networks. arXiv preprint arXiv:2201.05172 (2022)

2022 arXiv
[10]

Yi Shi, Yalin E Sagduyu, and Tugba Erpek. 2022. Federated learning for dis- tributed spectrum sensing in NextG communication networks. arXiv preprint arXiv:2204.03027 (2022)

2022 arXiv
[11]

Yi Shi, Yalin E Sagduyu, and Tugba Erpek. 2023. Jamming attacks on decentralized federated learning in general multi-hop wireless networks. In IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS)

2023
[12]

Chen-Khong Tham, Lu Yang, Akshit Khanna, and Bhavya Gera. 2023. Federated learning for anomaly detection in vehicular networks. In IEEE 97th Vehicular Technology Conference (VTC2023-Spring)

2023
[13]

Zhe Wang and Tingkai Yan. 2023. Federated learning-based vehicle trajectory prediction against cyberattacks. In IEEE 29th International Symposium on Local and Metropolitan Area Networks (LANMAN)

2023
[14]

Hadi Yakan, Ilhem Fajjari, Nadjib Aitsaadi, and Cedric Adjih. 2023. Federated learning for V2X misbehavior detection system in 5G edge networks. In ACM Conference on Modeling Analysis and Simulation of Wireless and Mobile Systems

2023
[2024]

Journal on Autonomous Transportation Systems 2, 3 (2024)

Detecting Poisoning Attacks in Collaborative IDSs of Vehicular Networks Using XAI and Shapley Value. Journal on Autonomous Transportation Systems 2, 3 (2024)

2024

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

Ahmed Saleh Bataineh, Mohammad Zulkernine, Adel Abusitta, and Talal Halabi

work page

[2] [2]

Secil Ercan, Leo Mendiboure, Lylia Alouache, Sassi Maaloul, Tidiane Sylla, and Hasnaa Aniss. 2023. An Enhanced Model for Machine Learning-Based DoS De- tection in Vehicular Networks. In IFIP Networking Conference (IFIP Networking)

work page 2023

[3] [3]

Jiaqi Huang, Yili Jiang, Sohan Gyawali, Zhiguo Zhou, and Fangtian Zhong. 2024. Semi-supervised Federated Learning for Misbehavior Detection of BSMs in Vehicular Networks. In IEEE 100th Vehicular Technology Conference (VTC2024- Fall)

work page 2024

[4] [4]

van der Hei, Arnaud Kaiser, Pascal Urien, and Frank Kargl

Joseph Kamel, Michael Wolf, Rens W. van der Hei, Arnaud Kaiser, Pascal Urien, and Frank Kargl. 2020. VeReMi Extension: A Dataset for Comparable Evalua- tion of Misbehavior Detection in VANETs. InIEEE International Conference on Communications (ICC)

work page 2020

[5] [5]

Qiang Lu, Hojin Jung, and Kyoung-Dae Kim. 2022. Optimization-Based Approach for Resilient Connected and Autonomous Intersection Crossing Traffic Control Under V2X Communication. IEEE Transactions on Intelligent Vehicles 7, 2 (2022)

work page 2022

[6] [6]

Yalin E Sagduyu, Tugba Erpek, and Yi Shi. 2023. Securing NextG Systems against Poisoning Attacks on Federated Learning: A Game-Theoretic Solution. In IEEE Military Communications Conference (MILCOM)

work page 2023

[7] [7]

Y. E. Sagduyu, T. Erpek, and Y. Shi. 2025. Poisoning Attack and Defense Game for Federated Learning in Resilient NextG Networks. In Autonomous Cyber Resilience. Wiley-IEEE Press. to appear

work page 2025

[8] [8]

Yi Shi and Yalin E Sagduyu. 2022. How to launch jamming attacks on federated learning in NextG wireless networks. InIEEE Globecom Workshops (GC Wkshps)

work page 2022