🤖 machine learning

SecureDrive-FL: Joint Differential Privacy and Gradient-Aware Selective Homomorphic Encryption for Federated Driver Monitoring

The paper introduces SecureDrive-FL, a federated driver monitoring framework that integrates Differential Privacy with a novel Gradient-Aware Selective Homomorphic Encryption (GASHE) mechanism to simultaneously protect against model poisoning and Man-in-the-Middle attacks while maintaining high accuracy and incurring only minimal computational overhead.

Original authors: Baran Can Gül, Hanuma Siddhartha Tunuguntla, Anjana Arvind Naik, Abhishek Vijay Potekar, Nasser Jazdi, Michael Weyrich

Published 2026-08-28

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Baran Can Gül, Hanuma Siddhartha Tunuguntla, Anjana Arvind Naik, Abhishek Vijay Potekar, Nasser Jazdi, Michael Weyrich

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the modern world of connected cars, vehicles are no longer just machines; they are rolling data centers. Every time a driver adjusts the radio, checks a phone, or glances at the road, sensors capture these moments as streams of information. To make driving safer and more autonomous, engineers want to teach computers to recognize these behaviors, such as spotting a driver who is texting or reaching for a drink. However, this learning process faces a fundamental dilemma: to teach a computer well, you need vast amounts of data, but that data belongs to individual people and is often too sensitive to share. If a car manufacturer collects every driver's private video footage to train a safety system, they risk exposing intimate details of people's lives.

To solve this, researchers developed a method called federated learning. Instead of sending raw data to a central computer, the learning happens inside each car. The car's computer learns from the local data and sends only the "lessons learned"—mathematical updates describing what it discovered—back to the central server. The server combines these lessons to improve the global model without ever seeing the original videos. Yet, this approach has its own vulnerabilities. The mathematical updates themselves can sometimes be reverse-engineered to reveal the private data they came from, or they can be intercepted and altered by hackers to sabotage the learning process. The challenge for scientists is to build a system that protects privacy, keeps the data secure during transmission, and ensures the learning remains accurate, all while running on the limited computing power of a car.

A team of researchers at the University of Stuttgart and the Eindhoven University of Technology has addressed these challenges with a new framework called SecureDrive-FL. Their work focuses on a specific type of privacy protection that combines two distinct strategies: one that adds noise to hide individual contributions during the learning phase, and another that encrypts the most sensitive parts of the data before it leaves the car. The core of their innovation is a clever way of deciding exactly what needs to be encrypted. Rather than locking up every single piece of information sent between cars and the server, which would slow everything down, their system identifies only the most critical pieces of data that reveal the most about the driver. They call this method Gradient-Aware Selective Homomorphic Encryption.

The researchers tested their system on a task designed to recognize ten different types of distracted driving, such as talking to a passenger, adjusting makeup, or using a phone with the right or left hand. They used a dataset containing over 50,000 images of drivers in various states of distraction. To mimic real-world conditions where different drivers have different habits, they split the data so that each simulated car in their experiment only saw a small, unique subset of drivers. This setup ensured that the system had to learn from diverse, non-uniform data, just as it would in a real fleet of vehicles. They ran the learning process over 120 rounds, with six cars participating in each round, using a lightweight computer model that could run efficiently on embedded hardware.

The results showed that their combined approach worked remarkably well. When they tested the system against a common attack where hackers intercept the data traveling between the cars and the server, the traditional method of adding noise alone failed completely. In that scenario, the accuracy of the safety system collapsed to near-random guessing, dropping to about 10 percent. However, when the researchers added their selective encryption, the system maintained an accuracy of 78.2 percent, effectively neutralizing the interception threat. This demonstrated that encrypting the specific, high-value parts of the data was enough to stop hackers from stealing the information, without needing to encrypt everything.

The system also proved resilient against a different kind of attack known as model poisoning, where a hacker tries to corrupt the learning process by sending fake updates from a compromised car. In this scenario, the researchers found that their new system performed just as well as the standard noise-based method, achieving an accuracy of 73.6 percent compared to 74.0 percent for the noise-only approach. Crucially, the system did this without sacrificing speed. While encrypting all the data would have made the process significantly slower, their selective method added only about 8 to 10 percent more time to the total runtime compared to using noise alone. This small overhead suggests that the system is practical for real-world deployment, where cars need to process information quickly.

The researchers also compared their method to other existing security techniques. Some older methods that rely on encrypting every single piece of data were found to be much slower and more memory-intensive, making them difficult to run on the limited hardware inside a car. Other methods that focused only on detecting bad data without encrypting it failed to protect against interception. SecureDrive-FL stood out because it was the only approach that successfully combined formal privacy guarantees, protection against data theft during transmission, and resistance to data corruption, all while keeping the computational cost low enough for a vehicle to handle.

In the end, the study demonstrates that it is possible to build a secure, privacy-preserving learning system for connected vehicles without choosing between safety and efficiency. By intelligently selecting which parts of the data to protect, the researchers created a pipeline that keeps driver behavior private while still allowing the collective intelligence of the fleet to improve. The work suggests that future driver monitoring systems can be both robust against hackers and respectful of personal privacy, provided the right balance of noise and selective encryption is applied. The team plans to take these findings further by testing the system on actual vehicle hardware and expanding the approach to larger, more diverse groups of cars, moving from simulation to the real road.

Technical Summary: SecureDrive-FL

Problem Statement
Federated Learning (FL) enables privacy-aware distributed training for applications like driver monitoring by keeping raw data on edge devices. However, FL lacks inherent formal privacy guarantees. Gradient updates transmitted to a central aggregator are vulnerable to two primary threats:

Inference Attacks: Adversaries can reconstruct sensitive input data (e.g., driver behavior) from gradient updates via model inversion, membership inference, or deep gradient leakage.
Interception and Poisoning: Man-in-the-Middle (MitM) attacks can intercept updates in transit, while malicious clients can inject poisoned gradients to corrupt global model convergence.

Existing solutions face a trade-off: Fully Homomorphic Encryption (FHE) provides confidentiality but incurs prohibitive computational overhead on resource-constrained edge devices when encrypting all parameters. Differential Privacy (DP), specifically DP-SGD, offers rigorous privacy guarantees but degrades model accuracy and provides no confidentiality for updates during network transmission. Furthermore, prior hybrid approaches often treat DP and HE as independent, orthogonal modules rather than a unified system.

Methodology
The paper proposes SecureDrive-FL, a framework that couples DP-SGD with a novel Gradient-Aware Selective Homomorphic Encryption (GASHE) mechanism. The core innovation is a closed-loop design where the encryption strategy is dynamically derived from the DP-SGD calibration parameters.

GASHE (Gradient-Aware Selective Homomorphic Encryption):
- Instead of encrypting all model parameters uniformly, GASHE identifies gradient components that exceed a sensitivity threshold ( $\tau_i$ ).
- This threshold is directly calculated from the DP-SGD clipping norm ( $C$ ) and noise scale ( $\sigma$ ). Specifically, $\tau_i$ corresponds to the minimum noise standard deviation required to satisfy the configured $(\epsilon, \delta)$ privacy budget.
- Only gradient components with magnitudes exceeding this threshold (those dominating the DP noise floor and thus most informative/sensitive) are encrypted using the CKKS scheme. Low-magnitude components are transmitted in plaintext alongside a compact bitmask.
- This selective approach reduces the fraction of encrypted parameters, lowering ciphertext size and evaluation time.
SecureDrive-FL Pipeline:
- Training Phase: Clients perform local training using DP-SGD (clipping gradients and adding Gaussian noise).
- Communication Phase: Clients generate a binary mask based on the DP-calibrated threshold. High-sensitivity gradients are encrypted; low-sensitivity ones remain plaintext.
- Aggregation: The server aggregates encrypted updates homomorphically and sums the plaintext components. The global model update is recovered by combining the decrypted high-sensitivity aggregate and the plaintext low-sensitivity aggregate.
- Threat Model: The system assumes an honest-but-curious server (which follows the protocol but attempts to infer data) and active network adversaries (MitM) or malicious clients (poisoning).

Key Contributions

GASHE: A novel, architecture-agnostic selective encryption strategy that targets only the most privacy-sensitive gradient components based on DP-calibrated thresholds, avoiding the overhead of full-parameter encryption.
DP-GASHE Coupling: SecureDrive-FL is presented as the first framework to explicitly derive HE encryption decisions directly from DP-SGD sensitivity bounds, creating a unified privacy pipeline that aligns training-time privacy with communication-time confidentiality.
Multi-Threat Robustness: The framework is evaluated against both model poisoning and MitM interception, demonstrating that the joint design closes the MitM attack surface while maintaining the poisoning resistance inherent to DP-SGD.
Automotive Validation: The system is validated on a ten-class distracted driver classification task using non-IID data splits and a lightweight MobileNetV2-Tiny model, demonstrating feasibility in a connected vehicle context.

Experimental Results
Evaluated on a distracted driver detection task with non-IID splits and active attacks:

Clean Performance: SecureDrive-FL achieves 82.2% accuracy, slightly outperforming DP-SGD alone (80.0%) and significantly outperforming the unencrypted FedAvg baseline under attack conditions.
MitM Resilience: Under MitM interception, DP-SGD alone collapses to near-random accuracy (10.4%). SecureDrive-FL maintains 78.2% accuracy, effectively neutralizing the interception threat.
Poisoning Resistance: Under model poisoning, SecureDrive-FL achieves 73.6% accuracy with an Attack Success Rate (ASR) of 3.9%, comparable to DP-SGD alone (74.0% accuracy, 3.9% ASR).
Overhead: The framework incurs only ≈8–10% additional runtime overhead relative to DP-SGD alone. While DP-SGD alone is computationally expensive (≈23× FedAvg baseline), adding GASHE increases this to ≈25×, a marginal increase given the added confidentiality.
Comparison: Unlike robust aggregation methods (e.g., TrimmedMean, Krum) which resist poisoning but lack confidentiality, or full-CKKS which lacks DP, SecureDrive-FL is the only configuration evaluated that simultaneously provides formal DP, IND-CPA communication security, and poisoning resistance.

Significance and Claims
The authors claim that SecureDrive-FL represents a significant step toward practical, privacy-preserving FL in automotive systems. By deriving encryption decisions directly from DP calibration, the system creates a "principled, closed-loop coupling" that avoids the inefficiencies of static or independent privacy mechanisms. The paper asserts that this approach allows for the first time a unified pipeline where training-time privacy (DP) and communication-time confidentiality (HE) are mutually reinforcing rather than conflicting. The results suggest that SecureDrive-FL can withstand both passive eavesdropping and active model poisoning in realistic, non-IID automotive scenarios with minimal performance degradation relative to the baseline DP-SGD approach.

Limitations and Future Work
The paper notes that the current implementation does not target Byzantine-tolerant aggregation or Sybil attacks, as robust aggregation is considered orthogonal to GASHE's confidentiality guarantees. Future work includes scaling to heterogeneous vehicle fleets, integrating stronger Byzantine-robust aggregation rules (e.g., BALANCE), and deploying on physical in-vehicle cockpit prototypes to benchmark end-to-end latency and energy consumption on embedded hardware.

Technical Summary: SecureDrive-FL

More like this