Binary Encoding-Based Federated Learning for Traffic Sign Recognition in Autonomous Driving

Abstract

Autonomous driving involves collaborative data sensing and traffic sign recognition. Emerging artificial intelligence technology has brought tremendous advances to vehicular networks. However, it is challenging to guarantee privacy and security when using traditional centralized machine learning methods for traffic sign recognition. It is urgent to introduce a distributed machine learning approach to protect private data of connected vehicles. In this paper, we propose a local differential privacy-based binary encoding federated learning approach. The binary encoding techniques and random perturbation methods are used in distributed learning scenarios to enhance the efficiency and security of data transmission. For the vehicle layer in this approach, the model is trained locally, and the model parameters are uploaded to the central server through encoding and perturbing. The central server designs the corresponding decoding, correction scheme, and regression statistical method for the received binary string. Then, the model parameters are aggregated and updated in the server and transmitted to the vehicle until the learning model is trained. The performance of the proposed approach is verified using the German Traffic Sign Recognition Benchmark data set. The simulation results show that the convergence of the approach is better with the increase in the learning cycle. Compared with baseline methods, such as the convolutional neural network, random forest, and backpropagation, the proposed approach achieves higher accuracy in the process of traffic sign recognition, with an increase of 6%.

1. Introduction

With the development of the internet of things (IoT) and artificial intelligence (AI), autonomous driving is becoming an effective technology to solve traffic congestion and reduce traffic accidents [1]. As a part of autonomous driving, in addition to using radar to detect surrounding vehicles [2,3], vehicles also need to detect traffic signs in real-time through onboard cameras [4]. The realization of these applications and services is dependent on a large amount of data generated by the vehicles, which contains private data, such as vehicle location information [5] or owner privacy information [6].

In autonomous driving, the commonly used methods for recognizing traffic signs include convolutional neural networks (CNNs) [7], support vector machine (SVM) [8], and random forest (RF) [9]. These classification methods belong to the traditional centralized learning method. A central server is needed to collect all the data, including private data, so as to better train the model and realize high-accuracy traffic sign recognition. However, with the increase in personal privacy issues [10], the centralized learning method is no longer applicable to vehicle applications and services. How to achieve efficient traffic sign recognition while ensuring vehicle data privacy and security has become an urgent problem. Traditional centralized machine learning methods face privacy leakage and security risks when processing vehicle network data, making it difficult to meet the high requirements of modern autonomous driving systems for data protection. Therefore, there is an urgent need to explore a distributed machine learning method to improve the accuracy and efficiency of traffic sign recognition while protecting vehicle privacy.

Federated learning, proposed by Google, is a typical distributed machine learning method that can avoid the above privacy problems. For federated learning, the model is trained locally through the data owners, and then the model parameters are uploaded to the server. All parameters are received and aggregated by the server, and then the updated parameters are transmitted to each owner for model updating. This process continues to be iterative until the learning model is trained. Federated learning works similarly to centralized machine learning methods [11], except that it does not require the transfer of local data.

While federated learning has already received great research interest in agriculture [12], medicine [13], and intelligent security [14], its application to the internet of vehicles is challenging. Although federated learning does not directly expose vehicle information, attackers can obtain it by cracking model parameters, which means that there are still security risks in federated learning [15]. Therefore, researchers have studied a series of defense measures, including defense measures based on secure multi-party computation and privacy protection technology based on differential privacy. In secure multi-party computation, participants can use private data to participate in secure computing without disclosing private data. However, encrypted data onto different technologies cannot be intercommunicated, which easily causes new data island problems. Differential privacy protection technology can be divided into centralized differential privacy and local differential privacy. Centralized differential privacy requires an absolutely credible third party. Once the third party is no longer trusted, private data of the users may be leaked at any time [16]. Local differential privacy technology can resist security attacks by adding random perturbations to model parameters or gradients, but it is still possible to leak private data, although inversion will incur higher costs [17].

In order to address the security risks in federated learning and better apply it to the internet of vehicles, we propose a binary encoding federated learning method based on local differential privacy technology (BCFL-LDP). It can effectively prevent privacy leakage during data transmission by implementing local differential privacy protection. It employs binary encoding technology to reduce data transmission volume and improve processing efficiency. Furthermore, leveraging the federated learning framework, BCFL-LDP realizes distributed training and model aggregation, thereby enhancing the model’s generalization capabilities. BCFL-LDP not only resolves privacy and security issues in autonomous driving but also improves the system’s adaptability and computational efficiency, offering a novel solution for the advancement of autonomous driving technology. From the perspective of security, federated learning algorithms are superior to centralized ML algorithms and can better protect the privacy of vehicle users. Meanwhile, compared with traditional federated learning algorithms, the proposed BCFL-LDP algorithm adds binary encoding and perturbation techniques before uploading model parameters to the central server. Even if the model parameters are leaked, attackers cannot obtain any valid information, further enhancing the security of the model. In autonomous driving scenarios, the shooting angle of each vehicle and the number of traffic signs captured is limited. Therefore, the vision models trained for traffic signs may not be particularly accurate by employing the information of individual vehicles. Benefiting from federated learning with privacy protection, each vehicle can be trained locally; then, the trained model parameters are encrypted and randomly perturbed and uploaded to the central server. All collected vehicle model parameters are decrypted and aggregated by the central server, and then updated model parameters are transmitted to each vehicle for model updating. Specifically, the contributions of this paper are as follows:

• A local differential privacy-based federated learning method is proposed. The model is trained locally in vehicles, and then the model parameters are uploaded to the central server. The advantage is that the original data can be saved in the vehicle itself, which can achieve higher recognition accuracy while protecting the privacy of vehicle users.
• A new random perturbation method of binary string bits is proposed. Before the model parameters are uploaded to the central server, binary encoding and disturbance are carried out. Therefore, even if the model parameters are leaked, the attacker cannot obtain any valid information.
• Through the training of the GTSRB dataset, the proposed BCFL-LDP is verified to be superior to the existing traffic sign recognition methods. The proposed BCFL-LDP has a faster convergence speed than the baselines and is more suitable for actual autonomous driving scenes.

The rest of the paper is organized as follows: Section 2 reviews the relevant work. Section 3 presents the basic framework of federated learning for traffic sign recognition in the internet of vehicles. Section 4 introduces federated learning and local differential privacy encryption techniques. The experiment and evaluation results are shown in Section 5. Conclusions are presented in Section 6.

2. Related Work

With the development of the information age, more and more research on privacy protection methods is coming along. The purpose of the privacy protection method in the internet of vehicles is to protect the identity information and location privacy of vehicles during data mining, data analysis, and processing, so as to prevent the illegal tracking down of vehicles by attackers. The aim of our work is to enhance the security and privacy of the traffic sign recognition model, so we mainly introduce privacy protection techniques. This section includes three subsections. In Section 2.1, the related works of federated learning are presented. In Section 2.2 and Section 2.3, two traditional privacy protection technologies of federated learning are presented: differential privacy and secure multi-party computation.

2.1. Federated Learning

In the intelligent transportation industry, federated learning [18] is generally used to protect the data privacy of users. In traditional machine learning [19,20], all data are concentrated on a single server for training. In federated learning, each model is first trained locally, and the gradient or parameter of the training model is uploaded to the aggregation server to solve privacy problems. McMahan et al. [21] introduced the federated averaging algorithm, which combined the random gradient descent of each client with the model averaging of the server to protect the original training data. Yuan et al. [10] connected federated learning and broad learning systems and offloaded data sharing into clusters. They improved the aggregation ability of the model and protected the privacy of data sharing.

Traditional federated learning adopts synchronous aggregation, which will undoubtedly produce high communication costs, making it easy for attackers to extract private data information from the model gradient in reverse. Therefore, researchers have made some improvements to existing federated learning methods. Zhu et al. [22] proposed a semi-supervised federated learning framework, which does not require users to provide original trajectory data or rely on prominent data labels. Yu et al. [23] applied federated learning techniques to construct a global model to predict content popularity while protecting the privacy of training data on local vehicles.

2.2. Differential Privacy

2.2.1. Centralized Differential Privacy

In centralized differential privacy protection technology, the privacy of algorithm expansion is defined by the nearest neighbor dataset. Therefore, it requires an absolutely credible third party to aggregate the data together and then add disturbance to the dataset to achieve differential privacy. According to this definition, the data collector has to manage the centralized dataset. In order to obtain private data, the attacker can only infer private information by querying the distribution of statistical data several times. Poddar et al. [24] attempted to predict traffic flow through a real-time traffic state estimator with differential privacy technology to protect the potentially sensitive location information of private users.

2.2.2. Local Differential Privacy

In local differential privacy, each user can process private data independently; that is, the model training process is transferred from the data collector to a single user. Therefore, it can also ensure that users’ private information will not be leaked, even if the third party is not reliable. Although local differential privacy technology can resist security attacks by adding random perturbations to model parameters or gradients, private data may still be leaked, even if the cost of backstepping is higher. Wang et al. [25] used local differential privacy technology based on a histogram algorithm to interfere with the context information about the vehicle and then upload it to the base station for offloading decision, which protects the privacy of the resume. Nie et al. [26] introduced Gaussian differential encryption, adding Gaussian noise directly to the Q-network of the output Markov decision process rather than to the model gradient.

2.3. Secure Multi-Party Computation

As a sub-field of cryptography, secure multi-party computation allows multiple users to calculate tasks together and output the calculation results in the case of mutual distrust. Moreover, in the entire user set, two arbitrary users will know nothing about each other except the output results. In terms of the implementation principle, MPC does not rely on a single security algorithm but a comprehensive application of a variety of basic cryptography tools, including homomorphic encryption [27], unintentional transmission, secret sharing [28], symmetric encryption [29], asymmetric encryption [30,31], etc. Through the combination of various algorithms, cipher text data can realize cross-domain flow and security calculation. Peng et al. [29] proposed a security optimization algorithm using symmetric encryption to achieve secure multimedia data transmission of vehicles.

3. Model Definition

3.1. A Basic Model Structure

The vehicular network system consists of a central server and a large number of vehicles, as shown in Figure 1. The distributed vehicles obtain the information of traffic signs through the camera in real-time, and train the model locally. Then, the trained model parameters are uploaded to the central server after processing by local differential privacy technology, which makes all data remain local and protects the privacy and safety of vehicle owners.

In addition, a unified deep-learning model is shared for all vehicles. In this case, vehicles only upload the model parameters to protect data privacy and ensure efficient knowledge sharing. The parameters are received by the central server, and then decoded, corrected, and aggregated. The server returns the updated parameters to each vehicle, until the model is convergent.

The dataset generated by a single vehicle shares the same learning model with other vehicles while training. Compared with a single vehicle, the vehicular network system can obtain more different types of data. For example, one vehicle traveling in the city may obtain data on vehicle speed limits, pedestrians, and traffic lights, while another vehicle traveling in mountainous areas may obtain data drawing attention to falling rocks, continuous bends, uphills, etc. Therefore, using the same learning model, when vehicles driving in mountainous areas enter the urban area, they can identify traffic signs faster and better to ensure the safety and effectiveness of autonomous driving. Therefore, the model can obtain better recognition accuracy and universality.

3.2. Problem Definition

This paper constructs a vehicle-mounted network system composed of K vehicles and a central server, in which the vehicle is represented by $V={\left\{v_k\right\}}_{k=1}^K$ and the central server is represented by $CS$. The vehicle takes photos with traffic signs as the original data in real-time and then labels the data. We assume that the original data are $imag{e}_k$ and the corresponding label is $labe{l}_k$. For each group of data, $Dat{e}_k$ can be expressed as ${Date}_k=\left({image}_k,{label}_k\right)$. In traditional centralized learning, vehicles send all data, including original data, location information, etc., to centralized processors (such as central servers). In order to protect the private data of vehicles from being captured by attackers, a federated learning framework is proposed for real-time traffic sign detection across vehicles. In this framework, the vehicle can retain all data, train the deep learning model $M=h(x,w)$ locally, and then send the trained model parameter w to the central server, where x is the dataset $Date$ collected by the vehicles.

As a typical federated average learning framework, our purpose is to make the central server protect the private information of all vehicles well. In order to achieve this, binary encoding encryption and interference are needed for the model parameters trained locally by the vehicle $v_k$. Then, the encrypted model parameters are transmitted to the central server for aggregation to ensure that the private data of all vehicles are not leaked.

4. BCFL-LDP

4.1. Convolutional Neural Network

In order to better recognize traffic signs, a convolutional neural network (CNN) is used to detect images captured by vehicle cameras. The input sample data of the vehicle $v_k$ are set as $x_k$, and the deep learning model can be expressed as follows:

$$h\left(x_k,w\right)=FC\left(\mathrm{Pool}\left(\mathrm{Conv}\left(x_k,w_{Conv}\right),w_{\mathrm{Pool}}\right),w_{FC}\right),$$

(1)

where $\mathrm{Conv}(\ast )$, $\mathrm{Pool}(\ast )$, and $\mathrm{FC}(\ast )$ represent the convolution layer, pool layer, and full connection layer, respectively, and w represents parameters corresponding to different layers, which can be expressed as follows:

$$w=\left\{w_{\mathrm{Conv}},w_{\mathrm{Pool}},w_{FC}\right\}.$$

(2)

The prediction results of model $h\left(x_k,w\right)$ are expressed by the SoftMax function:

$$y^{\mathrm{pred}}=\mathrm{SoftMax}\left(h\left(x_k,w\right)\right).$$

(3)

4.2. Federated Learning Based on Local Differential Privacy

4.2.1. Vehicle Layer

In order to prevent the model parameters from being leaked in the process of being uploaded to the central server, a local differential privacy technology of federated learning is introduced to deal with the privacy information contained in the parameters. A new random perturbation method based on binary bits is then proposed. Thus, even if leaks occur, the attacker will not obtain any useful information.

Suppose that the number of vehicles is K. For each iteration, every vehicle divides its dataset into several parts of size M according to parameter M. Each piece of data is updated locally by training round E, and the gradient of data loss is calculated. Then, the gradient descent update is carried out to obtain the new local parameter $w_k$.

$$w_k\leftarrow w_k-\eta \overline{g_t},$$

(4)

where $\eta$ is the learning rate, and $\overline{g_t}$ is the mean model gradient.

$$\overline{g_t}=\sum _{k=1}^K{\displaystyle \frac{n_k}{n}}{g}_i.$$

(5)

Before parameter $w_k$ is transmitted to the central server, vehicles perform a binary conversion on $w_k$ and add a disturbance. The binary strings consist of three parts: the symbol of the input, the integer part, and the decimal part. The positive and negative bits of the input symbol are represented by 1 and 0, respectively. For ease of calculation, the integer part is n bits, and the decimal part is d bits. So, the length of the binary string is $l=1+n+d$.

The binary encoding processes are as follows:

• The initial value of a binary string of length l is set to 0.
• Model parameters are converted to binary strings and represented as $b_k$.
• Each bit i on $b_k$ is added with random perturbation to obtain a new string $b_k^{\prime }$.

4.2.2. Central Server Layer

As we know from the above, the model parameter $w_k$ is binary encoded, so there are only two results for each bit: 0 and 1. Assuming that the result of a bit in a binary string is 1, and its true proportion is $\pi$, but we do not know which one it is. Therefore, the model parameters of all vehicles are counted to obtain the real proportion of bit 1. But, because of privacy reasons, the vehicles answer the bit with probability p and answer the opposite with probability $1-p$.

Perturbation statistics are the first proceeding. Suppose that in the statistical result, the number of bits 1 is $n_1$ and the number of bits 0 is $n-n_1$, and $J_i$ represents the answer to the $\mathrm{i}$ bit. The probability of the two answers is as follows:

$$P\left(J_i=1\right)=\pi p+(1-\pi )(1-p),$$

(6)

$$P\left(J_i=0\right)=(1-\pi )p+\pi (1-p).$$

(7)

By correcting the above results, the likelihood function can be constructed as follow:

$$L={[\pi p+(1-\pi )(1-p)]}^{n_1}{[(1-\pi )p+\pi (1-p)]}^{n-n_1}.$$

(8)

Maximum likelihood estimation of $\pi$:

$$\widehat{\pi }={\displaystyle \frac{p-1}{2p-1}}+{\displaystyle \frac{n_1}{(2p-1)n}}.$$

(9)

Mathematic expectations for $\widehat{\pi }$:

$$E\left(\widehat{\pi }\right)={\displaystyle \frac{1}{2p-1}}[p-1+\pi p+(1-\pi )(1-p)]=\pi .$$

(10)

It follows that $\widehat{\pi }$ is an unbiased estimate of $\pi$. Therefore, a corrected estimate of the number of vehicle ends for which the bit is 1 can be obtained as follows:

$$N=\widehat{\pi }n={\displaystyle \frac{p-1}{2p-1}}n+{\displaystyle \frac{n_1}{2p-1}}.$$

(11)

Thus, the binary decoding process is as follows:

• The binary string $b_k^{\prime }$ is received by the central server from the vehicles.
• The value 1 corresponding to each bit i of $b_k^{\prime }$ in the central server is summed to obtain $B_k^{\prime }$.
• Each $B_k^{\prime }$ is corrected to obtain the statistical value ${\mathrm{T}}_{\mathrm{k}}$:

  $$T_k={\displaystyle \frac{p-1}{2p-1}}n+{\displaystyle \frac{B_k^{\prime }}{2p-1}}.$$

  (12)
• The model parameter $w_k$ is obtained by aggregating the binary string T according to its corresponding weights.

4.3. Model Aggregation Update

The vehicle model parameters $w_k$ in the central server are collected and aggregated on average:

$$\overline{w}={\displaystyle \frac{{\sum }_{k=1}^K{w}_k}{K}}.$$

(13)

4.4. BCFL-LDP Method

Federated learning is proposed on the basis that participants retain local data. However, the attackers can obtain private data of vehicles by deducing model gradient or each updated model parameter, which is still privacy leakage in essence. Therefore, if leaks occur in the data transmission of participants (such as vehicles) and the central server, the privacy and security of users cannot be protected.

To solve this problem, the BCFL-LDP method proposed in this paper applies local differential privacy technology based on a random response mechanism. The BCFL-LDP method is mainly divided into three steps to achieve the protection for private data. First of all, binary conversion coding and random disturbance processes are performed on the model parameters that need to be protected in the vehicle. Then, the received binary string is decoded, corrected, and averaged in the central server according to different disturbance methods. Finally, the results are summarized in the server, and the model parameters are aggregated (Algorithm 1).

Algorithm 1 Traffic sign recognitin based on BCFL-LDP.

Input: A set of raw provided by data owners $X={\left\{x_k\right\}}_{k=1}^K$     Participated data owners $V={\left\{v_k\right\}}_{k=1}^K$     Deep learning model $h\left(x_k,w\right)$ Output: A trained global object detection model M   1: Initialize model parameter $w_0$, maximum number of learning round $\mathrm{R}$   2: for int r = 1 to R do   3:     for each vehicle $v_k\in V$ do   4:         for each local epoch from 1 to E do   5:             Update model parameters by Equation (4)   6:         end for   7:         Convert model parameter $w_k$ to binary string $b_k$   8:         Add random perturbations from $b_k$ to $b_k^{\prime }$   9:         Send $b_k^{\prime }$ to server $\mathrm{CS}$ 10:     end for 11:     CS sums the number 1 of each corresponding bit in all $b_k^{\prime }$ to $B_k^{\prime }$ 12:     Correct $B_k^{\prime }$ to $T_k$ by Equation (12) 13:     Convert $T_k$ to $w_k$ by proportion value 14:     Aggregat $w_i$ to obtain $\overline{w_t}$ by Equation (13) 15:     if the model does not converge then 16:         goto 14 17:     else 18:         send the updated $\overline{w_t}$ to all vehicles $v_i$ 19:     end if   The model parameters of all vehicles and the CS are updated once 20: end for   The trained model is designated as the global object detection model M 21: return M

5. Experiment and Analysis

5.1. Dataset and Experiment Setup

We consider a dataset named the German Traffic Sign Detection Benchmark (GTSDB). It contains 51,840 traffic sign images with 43 categories, among which 39,210 images constitute the training set and 12,630 images constitute the test set. In this experiment, each vehicle randomly samples the entire dataset.

A central server and 20 candidate vehicles are considered to constitute a vehicular network system. The central server has a huge computing capacity, which can aggregate the obtained model parameters globally and finally transmit them to the vehicles for updating. Candidate vehicles have different categories of data. The size of the dataset owned by either of them is the same. When the number of vehicles involved in training is [1,5,10,15,20], the convergence times and classification accuracy of the model are analyzed, respectively.

In order to evaluate the advantages and disadvantages of the proposed method, the experimental results of three commonly used methods are compared. This experiment is completed on a Windows 10 system, NVIDIA GeForce RTX 3050 Laptop GPU.

In the experiments, the CNN model was chosen for its powerful ability to extract image features. The learning rate was set to 0.0001 to stably and efficiently approach the optimal solution. The batch size was set to 200 to balance computational efficiency and memory usage while enhancing the model’s generalization capabilities. The maximum number of training epochs was set to 500 to ensure that the model learns sufficiently and converges.

5.2. Experiment Results

In order to validate the significance of the results, the proposed BCFL-LDP method was compared with the traditional baselines of the convolutional neural network (CNN), random forest (RF), and backpropagation (BP) methods. The superiority of the BCFL-LDP method was validated from three perspectives: convergence time, loss, and accuracy.

We first evaluated the learning efficiency of this method. The learning rate was set to 0.0001, the batch was 200, and the maximum number of learning rounds was 500.

Figure 2 shows the differences in model accuracy of the four methods with the increase in the number of training vehicles. As can be seen from the figure, the proposed BCFL-LDP had the best accuracy in all cases. When only a small number of vehicles were involved, the model maintained good accuracy, while the accuracy of the baseline methods decreased significantly. Meanwhile, the error rate of the proposed BCFL-LDP was only 4.01%, which is 56% lower than that of BP and RF and 68% lower than that of CNN.

Figure 3 compares the model convergence time of the proposed method with the other three baseline methods under different numbers of training vehicles. The four methods generally reach a state of convergence around 100 epochs, with the proposed BCFL-LDP method exhibiting the lowest loss value. It can be seen from Figure 3 that BCFL-LDP has a long convergence time when there are fewer participating vehicles, which is roughly the same as BP. When only five vehicles are involved, the convergence time of BCFL-LDP is increased by 7% compared with CNN, which has the fastest convergence. The convergence time of BCFL-LDP and the three baseline methods is approximately the same when there are more vehicles involved. When the number of participating vehicles is 15, the convergence time of BCFL-LDP only increases by 0.4% longer than that of CNN, with the fastest convergence.

Figure 4 and Figure 5 show the comparison results of the influence of BCFL-LDP and three baseline methods on accuracy and loss when the training vehicle is 10. As can be seen from the figure, the number of learning rounds required for BCFL-LDP convergence is the least. This is not inconsistent with the above experimental results because each learning round of BCFL-LDP consumes more time. At the same time, the accuracy of BCFL-LDF is the best (up to 96.6%) when convergence is achieved. From Figure 5, it can be seen that as the training epochs increase, the accuracy of the BCFL-LDP method always remains the highest, and the convergence is very smooth. Finally, a comparison table was drawn for the convergence time and model accuracy of four methods with a vehicle quantity of 10, as shown in

Table 1. Comparisons on traffic sign recognition performance.

Model	Methods
Performance	CNN	RF	BP	BCFL-LDP
Accuracy	1	104%	104%	110%
Convergence time	1	98%	102%	101%

. Based on the benchmark results of the most classic CNN method, the BCFL-LDP method has 10% higher accuracy, while the convergence times of the four methods are relatively similar.

Finally, we compared four traffic sign recognition methods when the training vehicle is 10. Based on Table 1, the proposed BCFL-LDP had the highest accuracy, which was 110% of the CNN. The convergence time of BCFL-LDP was 101% of the CNN. This shows that compared with other baseline methods, the proposed BCFL-LDP has obvious advantages in traffic sign recognition, with a slight sacrifice in time, but the cost is acceptable.

6. Conclusions

In this paper, a federated averaging method based on the model parameter averaging was proposed for intelligent traffic sign recognition in autonomous driving. This method has a generalization ability and aims to achieve faster model convergence speed and higher training accuracy.

In particular, a federated learning method based on local differential privacy technology was proposed, which uses a locally trained model and only uploads parameters to the central server. This method can protect the privacy of vehicle users and effectively improve the recognition accuracy of model training. On this basis, a new random perturbation method based on binary bit string was proposed. An integrated BCFL-LDP was also constructed. Before model parameters were uploaded to the central server, binary encoding and disturbance were carried out. Therefore, even if parameters are leaked, no privacy information of vehicle users will be exposed to the attacker. However, in extremely complex or highly variable traffic environments, the recognition performance of BCFL-LDP may be affected.

The experimental results show that the proposed BCFL-LDP has higher training accuracy (up to 96%), approximately 6% higher than the three baseline methods, and has a better convergence effect.

In the future, with the continuous development of autonomous driving technology, it is necessary to further improve the real-time processing capability and computational efficiency of BCFL-LDP and consider the crossing pedestrians. Meanwhile, exploring more advanced privacy protection techniques and optimization algorithms to further enhance the robustness and scalability of BCFL-LDP is also a topic worthy of in-depth research.