Semi-supervised zero-knowledge federated learning for intelligent transportation systems

Abstract

Privacy-preserving machine learning in Vehicular Ad Hoc Networks (VANETs) must address sensitive on-board data, limited ground-truth annotations, and verifiable model-update integrity. This paper proposes ZK-FL, a decentralized federated learning framework for Intelligent Transportation Systems (ITS) scene classification that combines semi-supervised pseudo-labeling, zk-SNARK-based update validation, and Hyperledger Besu blockchain auditability. Vehicles train local models, quantize the resulting updates, and generate zero-knowledge proofs demonstrating that distributed update probes satisfy a predefined norm-boundedness constraint. Road-Side Units (RSUs) verify the proofs before aggregation and anchor the corresponding audit metadata on-chain. The framework is evaluated on the BDD100K and Mapillary Vistas v2 datasets under multiple non-IID data distributions and five aggregation methods: FedAvg, Norm Clipping, Median, Trimmed Mean, and Krum. Since Mapillary Vistas does not provide scene-level annotations, two scene-label generation strategies, including a semi-supervised pseudo-labeling approach, are introduced. Experimental results demonstrate effective scene classification, verifiable update integrity, and practical proof-generation and verification, supporting the feasibility of privacy-preserving federated learning for ITS.

1 Introduction

Vehicular Ad Hoc Networks (VANETs) constitute a key enabling technology for ITS, supporting applications such as cooperative perception, adaptive traffic management, autonomous driving, road-safety monitoring, and scene understanding. Among these applications, street-scene classification is particularly important, as it provides contextual awareness of the driving environment by distinguishing between urban streets, highways, residential areas, and parking lots. Accurate scene recognition enables more informed decision-making and enhances the performance of higher-level ITS services. However, training robust scene-classification models typically requires large-scale and diverse datasets collected from geographically distributed vehicles, raising significant privacy and scalability concerns.

Federated Learning (FL) has emerged as a promising solution to these challenges by enabling collaborative model training without requiring the exchange of raw data with a central server. Instead, participating vehicles perform local optimization and share only model updates with an aggregation entity. Despite its advantages, applying federated learning in VANET environments introduces several challenges. First, vehicular data are inherently non-independent and identically distributed (non-IID) due to variations in geographic locations, traffic conditions, weather conditions, and driving behaviors. Second, obtaining high-quality scene annotations is costly and time-consuming, leading to limited labeled data and large amounts of unlabeled observations. Third, conventional FL assumes that participating clients behave honestly during local training and lacks mechanisms for verifying the integrity of submitted model updates. In practice, compromised or malicious vehicles may contribute poisoned, malformed, or manipulated updates that negatively affect global model performance.

Recent advances in semi-supervised learning and zero-knowledge cryptography offer complementary solutions to these limitations. Semi-supervised approaches exploit unlabeled data through pseudo-label generation, reducing dependence on costly manual annotation. Meanwhile, Zero-Knowledge Proofs (ZKPs), particularly Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge (zk-SNARKs), enable participants to prove the correctness of computations without disclosing either the underlying data or model parameters. When combined with blockchain technology, ZKPs further provide transparency, auditability, and tamper-resistant verification, making them particularly attractive for trust-aware collaborative learning in decentralized transportation infrastructures.

These two directions have already been combined in prior work, yet existing zero-knowledge federated learning systems for vehicular environments typically address data heterogeneity or annotation scarcity in isolation, rarely both together (Smahi et al., 2023; Raveendra Reddy and Muralidhar, 2026; Cui et al., 2025; Feng et al., 2024). In particular, none of these systems incorporate semi-supervised learning or pseudo-labeling, despite the fact that obtaining scene-level ground truth at vehicular scale is costly and often impractical. The present work addresses both limitations jointly, within a single zero-knowledge federated learning pipeline.

The remainder of this paper is organized as follows. Section 2 introduces the background concepts underlying federated learning, zero-knowledge proofs, and blockchain-based coordination, while Section 3 reviews related work. Section 4 presents the proposed ZK-FL methodology, including the learning architecture, semi-supervised labeling strategy, zk-SNARK validation mechanism, and system workflow. Section 5 describes the experimental setup, and Section 6 discusses the obtained results. Finally, Section 7 discusses the limitations and future research directions, and Section 8 concludes the paper.

2 Background

2.1 Federated learning in ITS

FL enables decentralized participants to collaboratively train a global model without sharing their raw local data. Each client performs local training and transmits model updates to an aggregation entity, which combines them into an updated global model (McMahan et al., 2017). This paradigm is particularly relevant to ITS, where vehicles and roadside infrastructure continuously generate distributed, privacy-sensitive data under heterogeneous operating conditions (Zhang et al., 2023; Li et al., 2024). Figure 1 presents a structured taxonomy of FL systems characterized by their data partitioning, learning paradigm, communication topology, privacy mechanisms, federation scale, and aggregation strategy, each evaluated below in the context of ITS requirements.

FIGURE 1

In ITS, horizontal FL is the dominant setting, as vehicles or RSUs typically collect similar features (e.g., traffic speed measurements, LiDAR point clouds, camera frames) over different geographic regions and traffic conditions, whereas vertical and transfer FL address complementary feature spaces and cross-domain knowledge transfer, respectively (Yang et al., 2019; Yuan et al., 2025).

Depending on label availability, FL may operate in supervised, unsupervised, semi-supervised, or reinforcement-learning settings. Semi-supervised FL is particularly relevant when labeled vehicular data are scarce, combining limited ground truth with larger unlabeled local datasets, commonly through confidence-based pseudo-labeling (Jeong et al., 2021; Kim et al., 2023).

Communication may follow centralized, decentralized, or hierarchical topologies. Centralized FL relies on a single aggregation server, decentralized FL enables peer-to-peer model exchange, while hierarchical FL introduces intermediate edge nodes, such as RSUs, to perform regional aggregation and reduce cloud communication overhead (Zhang et al., 2023; Vela Romo et al., 2026; Zhou et al., 2021).

Although FL keeps raw data local, exchanged updates may still expose information through attacks such as gradient inversion or membership inference (Mothukuri et al., 2021). Differential privacy, secure aggregation, homomorphic encryption, and trusted execution environments provide complementary privacy guarantees, while blockchain primarily contributes decentralized trust, integrity, and auditability rather than confidentiality (Bonawitz et al., 2017; Hardy et al., 2017; Li Q. et al., 2021).

Finally, aggregation can be synchronous, asynchronous, hierarchical, or robust. FedAvg performs weighted synchronous averaging (McMahan et al., 2017), whereas asynchronous and hierarchical schemes better accommodate intermittent vehicular connectivity. Robust methods such as Krum and Trimmed Mean suppress anomalous or malicious updates, improving resilience in open vehicular environments (Blanchard et al., 2017; Pillutla et al., 2022).

2.2 Zero-knowledge proofs

A ZKP is a cryptographic protocol between a prover and a verifier in which convinces that a statement belongs to a language without disclosing any information beyond the validity of the statement itself (Sheybani et al., 2025).

In vehicular authentication contexts, the ideal guarantee requires an RSU to confirm that a vehicle holds valid credentials without ever exposing the credentials themselves. Approaches relying on certificates or pseudonyms cannot fully secure this property since pseudonym schemes remain vulnerable to linkability attacks during successive identity changes (Li et al., 2026).

A fundamental distinction exists between interactive ZKPs, which require multiple message rounds between the prover and verifier, and non-interactive ZKPs, which produce a single self-contained proof string verifiable without further communication (Sheybani et al., 2025). Non-interactivity is essential in VANET deployments, where vehicle mobility and the strict latency constraints of V2I communication make round-trip interactive protocols impractical (Wang et al., 2026; Zhang et al., 2024).

2.2.1 ZK-SNARKs

Among the available non-interactive constructions, zk-SNARKs have emerged as the practically deployed primitive for privacy-preserving verification in distributed and edge-computing environments (Al-Karawi and Akdeniz, 2026). While basic ZKPs prove knowledge of a single cryptographic secret, zk-SNARKs are capable of verifying arbitrary computational statements. This allows a prover to guarantee that a specific program was executed correctly according to a public specification without ever revealing the private inputs involved (Thaler, 2022; Wang et al., 2026).

2.2.1.1 Formal construction

This three-phase structure enforces all three ZKP properties simultaneously: completeness (an honest prover with a valid witness always convinces the verifier), soundness (no cheating prover can produce an accepting proof for a false statement except with negligible probability ), and zero-knowledge (the proof reveals nothing about the witness beyond the validity of the statement ) (Qi et al., 2023).

2.2.1.2 The Groth16 proving system

While the zk-SNARK framework described above is a general construction, it must be instantiated in practice through a concrete proving system that specifies how the Setup, Prove, and Verify algorithms are realized cryptographically. Several such systems have been proposed, each offering different trade-offs between proof size, verification time, and setup assumptions. Pinocchio (Parno et al., 2016) and PLONK (Gabizon et al., 2019) established the foundational paradigm, with PLONK introducing a universal updatable reference string that eliminated circuit-specific trusted setups. More recent systems such as Marlin (Chiesa et al., 2020), HyperPlonk (Chen et al., 2023), and Nova (Kothapalli et al., 2022) further improved prover efficiency and recursive proof composition, the latter being extended by HyperNova (Kothapalli and Setty, 2024) to support customizable constraint systems.

Among these, Groth16 (Groth, 2016) remains the most widely adopted in privacy-preserving applications where proof size and verification speed are the primary constraints. A Groth16 proof consists of exactly three elliptic curve group elements , yielding a constant proof size regardless of circuit complexity. Verification reduces to three bilinear pairing checks executable in milliseconds, making it well suited to VANET deployments where RSUs operate under strict latency constraints.

3 Related work

3.1 Zero-knowledge federated learning in VANETs

Non-IID data heterogeneity constitutes a fundamental barrier to effective federated learning in VANET environments, as vehicles operating under heterogeneous traffic, geographic, and environmental conditions collect locally divergent datasets that undermine the convergence guarantees of standard aggregation algorithms (Zhang et al., 2023). Beyond statistical heterogeneity, the open and decentralized character of VANETs introduces trust challenges, as participating vehicles may submit manipulated updates, while semi-honest aggregators may deviate from prescribed protocols undetected. Conventional privacy-preserving mechanisms, such as differential privacy or homomorphic encryption, do not directly address these integrity and trust violations (Wang et al., 2026).

The integration of zero-knowledge proofs into federated learning pipelines for vehicular and distributed environments has been explored along several distinct axes. These include the trust boundary being addressed, the architectural tier at which verification is applied, the ZKP construction employed, the role assigned to the blockchain layer, and whether the underlying learning task accounts for statistical heterogeneity and annotation scarcity. Table 1 provides a structured comparison of representative recent approaches according to these characteristics, together with their aggregation strategies and support for semi-supervised learning and pseudo-labeling.

The earliest on-chain approaches delegate proof execution, storage, and consensus entirely to smart contracts deployed on permissioned or public blockchains. BV-ICVs (Smahi et al., 2023) evaluates update reliability using zk-SNARKs on the MNIST (LeCun et al., 1998) and BelgiumTS (Mathias et al., 2012) datasets under strictly IID data partitioning, distributing training samples uniformly across up to 30 simulated vehicles and relying entirely on fully labeled data. FLARE (Chai et al., 2026) extends this on-chain paradigm by combining Groth16-based zk-SNARKs with Paillier homomorphic encryption to enforce gradient norm thresholds. It is evaluated on the MNIST, CIFAR-10 (Krizhevsky and Hinton, 2009), and COVID-19^−ΔΔCT datasets across 100 simulated clients. Notably, non-IID heterogeneity is explicitly simulated through Dirichlet partitioning with , making it one of the few on-chain approaches that directly account for realistic data distributions in its evaluation. ChainDrive-FL-VRA (Raveendra Reddy and Muralidhar, 2026) is evaluated on the trajectory prediction datasets NGSIM US-101 and I-80 (Williams, 2025), and partially mitigates the non-IID problem through a staleness-aware, reputation-weighted aggregation mechanism combined with a contextual-bandit trigger.

In contrast, off-chain and hybrid approaches shift verification away from smart contracts toward edge infrastructure. The scheme proposed in Li Y. et al. (2021) adopts a hybrid architecture, performing identity authentication via Feige-Fiat-Shamir ZKPs at MEC servers while retaining a blockchain layer for PoA consensus. It is evaluated on simulated autonomous driving imagery. Non-IID data heterogeneity is acknowledged as an inherent source of performance degradation relative to centralized training, but no mitigation strategy is proposed as the work focuses exclusively on identity privacy and authentication. Fully off-chain models (Cui et al., 2025; Feng et al., 2024) choose to perform verification entirely at the RSU edge layer, bypassing blockchain involvement. For instance, the k-regular graph secure aggregation scheme introduced in Cui et al. (2025) is evaluated on both IID and non-IID partitions of the MNIST and GTSRB (Stallkamp et al., 2012) datasets, making it a rare example of an off-chain framework explicitly tested under heterogeneous data distributions. The Batch-Aggregate scheme (Feng et al., 2024) targets aggregation efficiency using the PeMS (Chen, 2002) and GTSRB datasets, but it lacks an evaluation of its distributional robustness under non-IID conditions.

Across all surveyed systems, as summarized in Table 1, a consistent gap emerges along two complementary dimensions. First, non-IID data heterogeneity, the dominant challenge in real-world VANET deployments, is either assumed away, only partially mitigated, or left entirely unaddressed, even in works that otherwise provide strong cryptographic guarantees. Second, none of the surveyed systems incorporate semi-supervised learning or pseudo-labeling, as every approach assumes fully annotated client data, despite the fact that obtaining scene-level ground truth at vehicular scale is costly and often impractical. The proposed ZK-FL framework directly targets this gap by evaluating federated scene classification on BDD100K (Yu et al., 2020) and Mapillary Vistas v2 (Neuhold et al., 2017) under explicit non-IID partitioning strategies. It combines zk-SNARK-based update validation with a semi-supervised, confidence-based pseudo-labeling pipeline designed to operate effectively under scarce and heterogeneously distributed labeled data.

3.2 Pseudo labeling

Pseudo-labeling is a semi-supervised technique in which a model assigns temporary labels to unlabeled samples based on prediction confidence, retaining only those whose maximum softmax probability exceeds a threshold (Kage et al., 2026). In the context of federated learning, pseudo-labeling has been explored as a practical solution to annotation scarcity across distributed clients. For privacy-preserving travel mode identification, confidence-based pseudo-labels are applied locally at each client to exploit unlabeled GPS trajectories without sharing raw data (Zhu et al., 2021). In road scene segmentation under class imbalance, pseudo-labels are further stratified by prediction mismatch to prioritize minority-class samples overlooked by standard filtering (Hong et al., 2026). The proposed ZK-FL framework adopts a similar confidence-based pseudo-labeling strategy, adapted for ITS scene classification, where pseudo-labels are generated locally at each vehicle using the current global model, under a Dirichlet non-IID partition with only 10% labeled supervision per client.

4 Methodology

We propose a decentralized Zero-Knowledge Federated Learning (ZK-FL) framework tailored for ITS scene classification in VANETs, integrating three core components: (i) federated learning performed locally at the vehicle level, enabling vehicle data privacy by design; (ii) zk-SNARK-based validation, allowing RSUs to verify that submitted updates satisfy a predefined probe-level norm-boundedness and commitment-consistency policy; and (iii) a permissioned blockchain that maintains a tamper-evident audit log of each training round.

The architecture follows a vehicle–RSU–blockchain paradigm, where vehicles operate as federated clients responsible for local training and proof generation, while RSUs act as edge aggregators that verify zero-knowledge proofs and perform model aggregation. The blockchain layer, implemented using Hyperledger Besu, maintains an immutable record of training rounds, including update commitments, verification outcomes, and aggregated model hashes.

4.1 Problem formulation

Let denote the set of participating vehicles, each associated with an RSU acting as an edge-level aggregator. Each vehicle holds a private local dataset comprising street-scene images paired with scene-level labels , corresponding to city street, highway, residential, and parking lot, respectively. Raw data and intermediate feature representations remain on-board at all times; no sample in is transmitted outside vehicle .

Formally, the local dataset of each vehicle is drawn from one of these two sources, depending on the experimental protocol:The dataset assignment for each vehicle is formalized in Equation 1, where carries ground-truth scene annotations and carries labels derived through , subject to the noise inherent in pixel-dominant class inference.

The global objective is to learn a classifier that minimizes the weighted empirical risk across all vehicles without centralizing raw data, as presented in Equation 2:where is the effective training-set size after pseudo-label augmentation, , and is the weighted cross-entropy loss defined in Section 5.2.2.

4.2 System architecture

FIGURE 2

4.3 System workflow

The proposed system follows a round-based federated learning protocol coordinated by the RSU, as formally described in Algorithm 1. At the beginning of each training round , the RSU initializes and broadcasts the current global model to all participating vehicles.

Upon receiving the global model, each vehicle performs local training on its private dataset and computes a model update , defined as the difference between the locally optimized parameters and the received global model . To reduce communication overhead in bandwidth-constrained VANET environments, each local update is quantized from 32-bit floating-point to 8-bit integer representation before transmission, producing a compressed update . Quantization is performed independently for each model layer using a set of scale factors , where with denoting the number of model layers and . The scale factors map the floating-point values in each layer to the signed int8 range .

Each vehicle then computes two complementary cryptographic commitments. First, the full-update commitment binds the complete quantized update and its fixed-point scale representation. Second, the vehicle extracts the distributed probe comprising coordinates from each parameter tensor and computes the corresponding probe commitment . The zk-SNARK proof attests that the distributed probe bound to satisfies the specified fixed-point norm constraint. The vehicle subsequently transmits to the RSU.

As detailed in Algorithm 1, upon receiving local updates, the RSU verifies each accompanying proof using a ZoKrates-based Groth16 system, discarding any update that fails the validity check. Upon successful verification, the RSU reconstructs each accepted client update by dequantizing the transmitted int8 tensor using the corresponding per-layer scale factors. Federated aggregation is then performed directly over these reconstructed updates via FedAvg to produce the updated global model , which is subsequently redistributed to all vehicles for the next communication round.

4.4 CNN architecture

The classification model adopts a transfer-learning strategy. A ResNet-18 backbone pre-trained on ImageNet serves as the feature extractor, replacing the original fully-connected layer with the identity function to yield a 512-dimensional embedding. A custom two-layer classifier head is appended, as presented in Equation 3.where is the backbone embedding, and are learnable weights, and dropout rates of 0.3 and 0.2 are applied before and , respectively.

The backbone parameters are fine-tuned jointly with the classifier head from the first local training epoch, and no layers are frozen during federated learning. Full fine-tuning was adopted because street-scene images differ considerably from the ImageNet pretraining domain in terms of viewpoint, scene composition, and visual appearance, requiring adaptation of the feature extractor. A learning rate of with cosine annealing enables gradual adaptation while preserving useful pretrained representations. To improve optimization stability under heterogeneous non-IID client distributions, gradient clipping with a maximum norm of 5.0 is applied during each local training step.

Input images are resized to pixels and normalized using ImageNet statistics , . Data augmentation is applied during local training to improve generalization: random resized crops with a scale of 0.7–1.0, random horizontal flips, and color jitter with brightness , contrast , saturation , and hue . Validation uses center-crop only. All details are summarized in Table 2.

4.5 Federated learning with FedAvg

The FL protocol follows the FedAvg algorithm (McMahan et al., 2017). At each global round , the server broadcasts the current global model weights to all vehicles. Each vehicle independently performs epochs of local stochastic gradient descent on its combined training set , and computes the local model update . Instead of transmitting the complete local model, the update is quantized to int8 representation and transmitted together with the corresponding per-layer scale factors. After successful zk-SNARK verification, the RSU reconstructs the accepted update and performs weighted update aggregation, as shown in Equation 4.where is the set of clients whose updates pass zk-SNARK verification at round and the reconstructed update, obtained by dequantizing the transmitted int8 update using the canonical fixed-point scales .

To reflect the location-specific data distributions inherent in real-world ITS deployments, non-IID heterogeneity is introduced under both experimental protocols. For BDD100K experiments, non-IID heterogeneity is introduced via a weather-driven partition: each client receives of its samples from a dominant weather condition and the remainder from other categories. For Mapillary experiments, the training data is partitioned using a Dirichlet distribution with a concentration parameter . Lower values of yield greater label heterogeneity across clients.

Local optimization uses the Adam optimizer with a learning rate , weight decay , and cosine annealing learning rate scheduling over local epochs. Gradient clipping with a max norm of 5.0 is applied to stabilize training across heterogeneous client data, as summarized in Table 2.

4.6 Zero-knowledge validity proof

Each vehicle generates a zk-SNARK proof using ZoKrates (Eberhardt and Tai, 2018) under the Groth16 proving system (Baghery et al., 2021). Among existing zk-SNARK constructions, Groth16 was chosen as it is particularly suitable for vehicular FL due to its compact proof representation and efficient verification complexity, enabling low-latency authentication of model updates at RSUs. In the proposed prototype, the cryptographic mechanism provides two complementary checks: a SHA-256 commitment binds the complete transmitted quantized update and its scale representation, while the zk-SNARK verifies a norm-boundedness predicate over a fixed-size probe of coordinates selected from each independently quantized parameter tensor, with tensors containing fewer than elements zero-padded to maintain a uniform probe size.

4.6.1 Numerical encoding

Model updates are quantized layer-wise from float32 to signed int8 representation. For each layer , the quantization scale is defined as in Equation 5, which maps the corresponding update values to the integer range and yields the complete quantized update .

To enable arithmetic within the zk-SNARK constraint system, the per-layer scale factors are further encoded using a fixed-point multiplier , as presented in Equation 6.

Accordingly, each reconstructed update coordinate is represented inside the circuit as illustrated in Equation 7.where indexes the individual parameters of layer , and denotes the number of parameters in that layer.

The fixed-point scale factors are transmitted to the RSU and used for both cryptographic verification and update reconstruction during aggregation. Consequently, the zk-SNARK and the federated aggregation procedure operate on the same canonical scale representation. The approximation introduced by the fixed-point encoding is bounded by Equation 8.corresponding to a maximum absolute scale approximation error of for .

4.6.2 Full-update commitment

Prior to commitment generation, the complete quantized update and its fixed-point scale factors are serialized. Parameter tensors follow the deterministic ordering returned by model.named_parameters(), thereby excluding non-parameter state such as BatchNorm running statistics and tracking counters. For each layer , the quantized tensor is flattened in row-major order and encoded as signed 8-bit integers. The corresponding fixed-point scale is encoded as a 64-bit unsigned little-endian integer, while and use 32-bit unsigned little-endian integers. The serialized message is constructed as presented in equation Equation 9.where denotes byte concatenation and denotes the number of parameters in layer . The commitment is subsequently computed as by vehicle.

The canonical fixed-point scales are transmitted together with . Upon reception, the RSU reconstructs and verifies . The same fixed-point scales are subsequently used for zk-SNARK verification and for reconstructing the update applied during federated aggregation.

Importantly, this full-update SHA-256 computation is performed outside the zk-SNARK circuit. The current prototype does not recompute the SHA-256 digest of the complete ResNet-18 update inside Groth16, as doing so would introduce a circuit cost proportional to the complete serialized model update.

4.6.3 zk-SNARK circuit specification

The individual layer commitments are subsequently combined into the final probe commitment:

Upon receiving the submission, the RSU extracts the same probe coordinates from the transmitted quantized update , uses the transmitted fixed-point scales , and recomputes . The recomputed commitment and scale factors are supplied as public inputs to Groth16 verification. Consequently, a proof generated for a different probe or a different scale representation cannot be accepted for the transmitted update.

Since the norm is invariant to coordinate sign, the circuit operates on the absolute values of the selected signed int8 coordinates. Each value is therefore represented as a non-negative field element in [0, 127], avoiding ambiguity associated with representing negative integers directly in the BN128 scalar field.

The private witness consists of the absolute quantized probe coordinates selected from each of the parameter tensors. The public inputs comprise the corresponding fixed-point scale factors , the probe norm threshold , and the final probe commitment .

4.6.4 Implementation

The circuit is compiled using zokrates compile --input update_norm_layerwise.zok --debug, followed by zokrates setup --proving-scheme g16 --backend bellman to generate the Groth16 proving and verification keys over the BN128 curve. For each submitted update, the witness is computed using zokrates compute-witness --arguments <witness_args>, the proof is generated using zokrates generate-proof, and verification is performed using zokrates verify.

Each of the 64 layer-wise sub-circuits contributes approximately R1CS constraints, with the dominant cost arising from the SHA-256 gadget (sha256/512bitPadded, approximately constraints per evaluation), while the remaining constraints implement the range checks, fixed-point reconstruction, and norm-bound verification. The final commitment is computed over the concatenation of all 64 per-layer SHA-256 digests, corresponding to bytes. Processing this input requires 32 SHA-256 blocks, contributing approximately additional constraints (including padding). The complete circuit, therefore, contains approximately R1CS constraints. The proving key is expected to occupy 320 MB, while the verification-key is 1 KB, and each serialized Groth16 proof is 0.90 KB.

4.7 Blockchain integration

A permissioned blockchain based on Hyperledger Besu (Fan et al., 2022), configured with the QBFT consensus protocol, maintains an append-only audit log of the FL lifecycle.

The blockchain layer does not store raw datasets, model parameters, or complete gradient updates, as this information would introduce excessive storage overhead and potentially compromise privacy. Instead, only compact cryptographic metadata and verification artefacts are recorded on-chain.

This design provides tamper-evident provenance and decentralized traceability without incurring the storage overhead of persisting large model artifacts on the ledger. Any participant can independently verify the integrity of a training round by recomputing and checking it against the on-chain record.

5 Datasets

This section describes the datasets and partitioning strategies used to evaluate the proposed ZK-FL framework on two street-scene datasets: BDD100K and Mapillary Vistas v2.

BDD100K serves as the baseline dataset, providing directly annotated scene-level labels against which the pipeline is validated. Mapillary Vistas v2 constitutes the primary experimental dataset, where scene labels are derived from pixel-level semantic masks via the dominant-class mapping (Section 5.2), introducing realistic label noise and a considerably more challenging learning scenario.

5.1 BDD100K dataset

Table 3 reports the BDD100K class distribution after filtering to the four selected scene categories, together with the corresponding class weights. The resulting dataset is highly imbalanced, with city street dominating both splits. To mitigate this imbalance, training uses class-weighted cross-entropy with weights inversely proportional to class frequency.

Images are resized to pixels and normalized using ImageNet statistics. Moreover, to reduce overfitting and improve generalization under class imbalance, we apply data augmentation during local client training, including random resized cropping, horizontal flipping, color jittering, and small rotations. Augmentation is applied only to the training split, while validation images are resized and normalized without stochastic transformations.

Non-IID heterogeneity is introduced via a weather-driven partition: each of the vehicles receives of its samples from a dominant weather condition (e.g., clear, rainy, or foggy) and the remainder from other categories, ensuring that each client retains exposure to all scene classes while exhibiting distributional shifts. This setup emulates realistic vehicular environments in which vehicles operate under different environmental and geographical conditions.

5.2 Mapillary Vistas dataset

To evaluate the generalization capability of the proposed framework beyond BDD100K, additional experiments are conducted using the Mapillary Vistas dataset. Mapillary Vistas v2 is a large-scale street-scene understanding dataset containing 20,000 densely annotated images (18,000 for training and 2,000 for validation) spanning 124 semantic classes. Unlike BDD100K, however, Mapillary Vistas does not provide explicit scene-level annotations suitable for scene classification tasks. Therefore, pseudo-scene labels are automatically derived from the semantic segmentation masks using two complementary strategies.

5.2.1 Threshold-based dataset construction

The first strategy follows a threshold-based semantic heuristic, where selected segmentation classes are grouped according to their traffic-scene relevance. For each image, semantic-region ratios are computed from the segmentation masks for categories such as road surfaces, parking areas, guard rails, buildings, vegetation, and sidewalks. Based on these ratios, scene labels are assigned using a set of manually defined semantic rules. For example, images containing a dominant parking-related region are classified as parking lot, while highway scenes are identified through the simultaneous presence of guard rails or road medians and limited sidewalk coverage.

The semantic-region ratio associated with class is computed according to Equation 11, where denotes the semantic segmentation mask, and represent the mask dimensions, and corresponds to the set of semantic labels associated with scene category .

Labels are then assigned according to Equation 12.

As shown in Table 4, the resulting dataset exhibits a pronounced class imbalance. The city street category dominates both the training and validation partitions, whereas the parking lot class contains only a limited number of samples. To reduce the impact of this imbalance during local optimization, inverse-frequency class weights are incorporated into the cross-entropy loss function.

5.2.2 Mapping-based label derivation with pseudo-labeling

Images for which no mapped category appears in the mask are treated as unlabeled and are assigned to the pseudo-label pool .

5.2.2.1 Pseudo-labeling

To exploit the large unlabeled pool at each vehicle, a confidence-based pseudo-labeling strategy is employed. At a designated refresh interval of every global rounds, each client uses the current global model to infer soft predictions over its unlabeled data. A pseudo-label is assigned to an unlabeled sample if the maximum softmax probability (Equation 15) exceeds a threshold , as formally described in Equation 14.where

Samples below the threshold are discarded. The accepted pseudo-labeled samples are concatenated with the labeled set to form the effective local training set for the subsequent rounds. Periodic refresh ensures pseudo-labels improve as the global model converges.

To mitigate class imbalance in the pseudo-labeled pool, particularly relevant given the uneven distribution of ITS scene types in Mapillary Vistas, a per-class cap is optionally applied, restricting each class to at most accepted pseudo-labeled samples per refresh cycle. Pseudo-labels are generated after local training using the post-training model, ensuring that labels are produced by a model that has undergone at least one supervised update. The complete pipeline is summarized in Algorithm 2.

6 Results

This section evaluates the proposed ZK-FL framework for privacy-preserving scene classification in ITS using two datasets: BDD100K and Mapillary Vistas v2. The experiments assess both learning performance and system-level overhead under realistic non-IID vehicular settings.

6.1 Experiment setup

All experiments are conducted on a single server equipped with four NVIDIA A100 80 GB PCIe GPUs, running Ubuntu 24.04 with CUDA 12.2 and driver version 535.230.02. Training is performed on a single GPU, as the federated learning simulation executes clients sequentially within one process. The framework is implemented in Python 3.8 and PyTorch 2.4.1.

6.2 Federated scene classification on BDD100K

The objective of this experiment is to evaluate the convergence behavior and classification performance of multiple federated aggregation strategies under heterogeneous and highly imbalanced data distributions. The BDD100K-based setup exhibits significant class imbalance, with the city street category dominating the training data, while classes such as parking lot contain substantially fewer samples, as illustrated in Section 5.1. To mitigate this imbalance during optimization, inverse-frequency class weights are incorporated into the cross-entropy loss function.

The BDD100K experiment consists of vehicular clients collaboratively training a global scene-classification model over 50 communication rounds under the coordination of an RSU aggregator. To emulate realistic VANET conditions, the local datasets are distributed in a non-IID manner using a weather-driven partition, where each client receives of its samples from a dominant weather condition. Five aggregation strategies are evaluated: FedAvg, Norm Clipping, Coordinate-wise Median, Trimmed Mean, and Krum. Performance is reported using accuracy, macro-averaged F1-score, and cross-entropy loss. Macro-F1 is the primary metric given the strong class imbalance, as it provides a more reliable assessment across minority scene categories.

As illustrated in Figure 3, the evaluated aggregation strategies exhibit distinct convergence behaviors under non-IID vehicular data distributions. FedAvg provides the most balanced performance, combining stable convergence with the highest Macro-F1 score, while Norm Clipping stabilizes training by limiting large updates, and Median and Trimmed Mean improve robustness to noisy or outlier updates. Krum is more sensitive to strongly non-IID distributions and exhibits less stable convergence. After 50 rounds, FedAvg achieves an accuracy of 0.6553, a Macro-F1 score of 0.3607, and a validation loss of 0.8975.

FIGURE 3

6.3 Cross-dataset evaluation using Mapillary Vistas

The Mapillary Vistas v2 training split is distributed across simulated federated clients using a Dirichlet non-IID partition with a concentration parameter . Each client retains of its locally mappable images as the labeled subset ; the remaining form the unlabeled pool , which is exploited via pseudo-labeling. This configuration closely reflects practical ITS deployments, where vehicles continuously collect large volumes of street-scene data, but manual annotation remains expensive and limited.

The official Mapillary Vistas v2 validation split of 2,000 images is reserved exclusively for global evaluation and is never exposed to any client during training. A ResNet-18 backbone pre-trained on ImageNet (detailed in Section 4.4) is used as the feature extractor for all experiments. Key hyperparameters are summarized in Table 6.

Table 7 illustrates the client-level data heterogeneity produced through Dirichlet partitioning. Each vehicle receives a distinct number of labeled and unlabeled samples, together with different local scene-class distributions, thereby emulating realistic non-IID vehicular sensing environments. For example, Client 0 contains the largest local dataset, dominated by city street and residential samples, whereas Client 4 represents a low-resource client with substantially fewer labeled instances. Overall, this setup creates a challenging non-IID environment characterized by simultaneous class imbalance, distribution divergence, and annotation scarcity.

Pseudo-label generation progressively expands the effective local training set across communication rounds, as illustrated for Client 0 in Table 8. The raw acceptance count represents all unlabeled images exceeding the confidence threshold , whereas the cached pool contains only those retained after applying the per-class cap and is used for local training. For Client 0, the acceptance rate increases from 51.0% ( images) in round 1%–80.8% by round 18. Similar trends are observed across clients, with acceptance rates increasing from approximately 22%–65% in early rounds to above 70% in later rounds, indicating progressively greater pseudo-label coverage and model confidence during training.

Figure 4a illustrates the convergence dynamics of the proposed federated learning with pseudo-labeling (FL-PL) method over 20 federated communication rounds. The overall validation accuracy (solid blue) increases rapidly during the early training stages as pseudo-labeled samples are progressively incorporated into the local client datasets (detailed in Table 8). After the first few communication rounds, the model stabilizes within the 75%–80% accuracy range, indicating consistent global convergence. Simultaneously, the validation cross-entropy loss (lower panel) decreases steadily from approximately 0.74 in the first round to nearly 0.50 b y round 7, after which it remains relatively stable, suggesting that the global model approaches a well-converged optimization regime.

FIGURE 4

The class-wise performance trends further highlight the impact of pseudo-labeling under class imbalance. The city street and residential categories maintain consistently high accuracy throughout training, reaching 82%–90% and 77%–92%, respectively. This behavior reflects the abundance of labeled samples for these two dominant classes. In contrast, the highway class exhibits a progressive improvement pattern, increasing steadily from near zero in early rounds to above 60% by round 10. This improvement is primarily driven by the gradual accumulation of highway pseudo-labels (for instance, from Client 1, the client with meaningful highway supervision). Similarly, the parking lot accuracy, while lower overall due to the scarcity of training data (110 images), follows a similar upward trend and stabilizes around 62% from round 9 onward.

The vertical dashed lines corresponding to pseudo-label refresh stages reveal a moderate perturbation effect during training. Small temporary accuracy dips slightly at refresh rounds, as newly generated pseudo-labels temporarily introduce noise into the training set before the model re-adapts in the subsequent round. This effect is most noticeable around round 3 and progressively diminishes in later communication rounds as the global model becomes more confident and the generated pseudo-labels become increasingly reliable.

The comparison presented in Figure 4b demonstrates the significant performance gains achieved by the proposed FL-PL framework relative to the threshold-based dataset construction strategy. Starting from an initial accuracy of approximately 48.9% in the first communication round, the FL-PL approach rapidly improves during training, reaching nearly 76.5% by round 9 and subsequently stabilizing within the 76%–77% range after successive pseudo-label refinement stages. This behavior highlights the cumulative benefits of confidence-based pseudo-label augmentation combined with federated aggregation as the global model progressively converges.

In contrast, the threshold-based method exhibits relatively unstable convergence and remains limited to approximately 53%–56% overall accuracy throughout training. Furthermore, the baseline quickly reaches an early plateau near 56% from round 1 and shows only marginal improvements in later communication rounds. These results suggest that heuristic threshold-based labeling alone is insufficient, while the proposed FL-PL strategy benefits from iterative pseudo-label refinement and collaborative federated optimization, enabling substantially improved generalization and more stable convergence dynamics.

The lower subplot of Figure 4b further emphasizes the difference in optimization behavior between the two approaches. The threshold-based strategy maintains a relatively high validation loss throughout training, fluctuating around 0.82–0.85, which indicates limited generalization capability under strong class imbalance and sparse supervision. In contrast, the proposed FL-PL framework achieves a rapid and sustained reduction in validation loss, converging toward approximately 0.49–0.50 after several communication rounds. The resulting performance gap of nearly 20% in overall accuracy and approximately 0.32 in validation loss clearly demonstrates the effectiveness of the complete FL-PL pipeline compared to naive confidence-threshold filtering alone.

6.4 Ablation study

This section presents two complementary analyzes of the proposed pseudo-labeling framework. First, a confidence threshold ablation examines the effect of the pseudo-label confidence threshold, , on pseudo-label coverage, accuracy, and noise rate. Second, a label derivation analysis compares the two Mapillary label generation strategies against manually annotated ground-truth labels to quantify the label noise introduced before the pseudo-labeling stage.

6.4.1 Label quality analysis

To evaluate the quality of the pseudo-labeling process, we analyze the relationship between the confidence threshold and the amount of label noise introduced into the training set. A subset of 500 images was selected from the Mapillary Vistas v2 validation split using stratified random sampling with a fixed random seed , where strata were defined by the mapping-based derived labels to preserve the relative representation of the four ITS scene classes. Each image was independently assigned one of the four scene labels by three annotators according to the dominant road-environment context visible in the RGB image. Final labels were determined by majority vote. The 16 images for which no majority was reached were independently reviewed and resolved by a fourth adjudicator. Inter-rater reliability among the three primary annotators, computed prior to adjudication using Fleiss’ (Falotico and Quatto, 2015), was .

An ablation study was then conducted by varying the pseudo-label confidence threshold, , over , while keeping all the other hyperparameters fixed. For each threshold, three metrics were measured: pseudo-label coverage (Equation 16 - the proportion of images for which model confidence exceeded ), pseudo-label accuracy (Equation 17 - the proportion of accepted pseudo-labels matching the ground-truth), and noise rate (Equation 18 - the proportion of accepted pseudo-labels that did not match the ground-truth). The resulting overall classification accuracy after federated training is also reported.where denotes the number of accepted pseudo-labeled samples, those matching the ground-truth, and those that do not.

The results in Table 9 confirm that the confidence threshold governs a fundamental trade-off between coverage and label quality. Specifically, in terms of best balance between pseudo-label coverage and quality: lower thresholds increase acceptance rates but introduce noisy labels that degrade minority-class accuracy, while higher thresholds reduce coverage excessively, limiting the semi-supervised gain.

6.4.2 Label derivation strategy comparison

While the previous experiment evaluates the influence of the pseudo-label confidence threshold, this analysis focuses on the quality of the two label derivation strategies, independently of the pseudo-labeling threshold. We evaluated the agreement between each strategy and the manually annotated ground-truth on the same 500-image subset.

The threshold-based strategy described in Section 5.2.1 achieves an agreement rate of 64.6%, whereas the mapping-based strategy presented in Section 5.2.2 reaches 90.8%, as shown by the corresponding row-normalized confusion matrices in Figure 5. At the class level, the threshold-based approach (Figure 5a) achieves recall values of 0.78 for city street, 0.39 for highway, 0.35 for residential, and 0.60 for parking lot. The most pronounced confusion occurs for the highway and residential classes. Only 39% of highway images are correctly labeled, while another 39% are incorrectly assigned to city street. This error is likely related to the sensitivity of the pixel-ratio threshold to partially visible highway-related structures and to similar visual elements that may also occur in urban scenes.

FIGURE 5

In contrast, the mapping-based strategy produces a substantially stronger diagonal pattern, indicating more reliable class assignments. It mitigates the previous failure mode by assigning the highway label only when explicitly highway-related Mapillary categories, including Guard Rail, Road Shoulder, Bridge, Tunnel, and Temporary Barrier, dominate the pixel distribution. This results in a less threshold-sensitive labeling rule. At the class level, the mapping-based strategy (Figure 5b) achieves recall values of 0.94 for city street, 0.72 for highway, 0.89 for residential, and 0.75 for parking lot. Although some confusion remains, particularly between highway and city street, the class-wise error rates are substantially lower than those obtained with the threshold-based strategy.

6.5 Computational overhead

6.5.1 zk-SNARK computational overhead

Beyond conventional learning metrics, the evaluation further analyzes the computational and communication overhead introduced by the zk-SNARK validation pipeline. The proposed framework employs a Groth16-based zk-SNARK mechanism implemented through ZoKrates to validate client-side model updates at the RSU prior to federated aggregation, as described in Section 4.6.

The analysis considers proof generation latency at the vehicle level, proof verification latency at the RSU, proof size, and blockchain anchoring overhead. Experimental measurements indicate that the global model size is approximately 32.36 MB, whereas the generated Groth16 proof remains compact at only 0.90 KB, demonstrating the communication efficiency of succinct zero-knowledge proofs.

Figure 6 reports the computational overhead for 5–100 participating vehicles. Proof generation represents the dominant cost (Figure 6a), while verification remains considerably faster (Figure 6b) due to the compact verification complexity of the Groth16 proving system. For 5–10 vehicles, generation remains below approximately 25 s per round and verification below 11 s. With 100 vehicles, these increase to 560 s and 220 s, respectively, corresponding to approximately 5.6 s generation and 2.2 s verification per vehicle. The per-vehicle distributions are reported in Figures 6c,d.

FIGURE 6

It is important to note that these measurements reflect a simulated setting in which all vehicle proofs are generated and verified sequentially on a single GPU server. Increasing the number of participating vehicles from 5 to 100 increases the total proof generation time by approximately and the verification time by approximately , substantially exceeding the increase expected under strict linear scaling. This additional overhead is primarily attributable to implementation-level factors, including repeated ZoKrates process initialization, temporary file I/O, and memory contention during sequential execution, rather than to the underlying protocol itself. Consequently, these measurements should not be interpreted as representative of a distributed deployment in which proof generation is performed independently by multiple vehicles in parallel. Further evaluation under concurrent execution and realistic vehicle-RSU communication conditions is required to characterize practical scalability.

6.5.2 Blockchain cost and storage overhead

In addition to transaction confirmation latency, we evaluated the storage and transaction overhead introduced by recording federated-learning metadata on the permissioned Hyperledger Besu network. For each federated round , the application-level metadata follows the structure defined in Equation 10. With vehicles, this amounts to bytes per transaction, independent of model size.

Since Hyperledger Besu operates as a permissioned blockchain under QBFT consensus, it does not employ a Gas model in the public Ethereum sense. Consequently, blockchain costs are characterized by the application-level metadata overhead and confirmation latency. Both are measured on a local four-node Hyperledger Besu QBFT testnet deployed on the same server used for all the experiments above. Table 10 reports the corresponding measurements over all federated rounds.

7 Limitations and future work

The present study has several limitations that define directions for future work. First, the zk-SNARK verifies a deterministic probe of coordinates per parameter tensor rather than the complete update. An adaptive adversary aware of the probe selection rule could therefore modify unprobed coordinates without affecting the verified norm predicate. The full-update commitment provides integrity and binding, while future work will investigate randomized or challenge-dependent probe selection to reduce this limitation.

Second, the norm threshold is a prototype-level design choice rather than an empirically optimized value. Future experiments will evaluate the distribution of benign and adversarial probe norms and investigate threshold sensitivity and calibration.

Third, the aggregation experiments consider benign non-IID client heterogeneity and do not explicitly include malicious clients. Consequently, the reported results should not be interpreted as demonstrating robustness against poisoning or Byzantine attacks. Future work will evaluate poisoning, model-replacement, Byzantine, and adaptive probe-avoidance attacks.

Finally, the cryptographic scalability experiments were conducted through sequential execution on a single server and therefore do not reproduce a concurrent vehicle-RSU deployment. Future evaluation will consider parallel proof generation, concurrent verification, communication latency, and RSU resource contention under larger-scale vehicular participation.

8 Conclusion

This paper presents a decentralized Zero-Knowledge Federated Learning framework for privacy-preserving ITS scene classification in VANETs, integrating semi-supervised federated learning, zk-SNARK-based update validation, and blockchain-based auditability into a unified pipeline. The framework addresses three fundamental challenges in vehicular machine learning: data privacy, label scarcity, and decentralized trust.

The experimental evaluation on BDD100K demonstrated that FedAvg provides the most balanced performance among the five evaluated aggregation strategies under non-IID weather-driven data distributions, reaching 65.53% accuracy and a Macro-F1 of 0.3607 over 50 communication rounds. On Mapillary Vistas v2, the proposed FL-PL pipeline was evaluated under a more challenging semi-supervised setting in which only 10% of each client’s data was labeled. The confidence-based pseudo-labeling strategy progressively expanded each client’s effective training set across rounds, with acceptance rates growing from 51% at round 1 to over 80% by round 18. The FL-PL method achieved a final overall accuracy of 77%, outperforming the threshold-based baseline by approximately 20% and reducing validation loss from 0.82 to 0.50. Class-wise results confirmed that the dominant classes, city street and residential, are learned reliably, while highway and parking lot accuracy improved progressively through pseudo-label accumulation.

The Groth16 proofs remain compact at only 0.90 KB compared with the 32.36 MB model, indicating that the zk-SNARK mechanism introduces negligible communication overhead despite the increasing computational costs associated with larger numbers of participating vehicles.

Beyond the individual contributions of each component, the three modules exhibit a mutually reinforcing collaborative structure. The pseudo-labeling mechanism addresses annotation scarcity by progressively expanding the effective local training sets, thereby improving the quality of client models under limited supervision. zk-SNARK verification ensures that only valid updates are aggregated, resulting in a more reliable global model that, in turn, generates higher-quality pseudo-labels in subsequent rounds. Finally, the blockchain layer provides a tamper-evident audit trail of model updates and verification outcomes. Together, these components improve label efficiency, ensure update integrity, and strengthen system accountability, thereby establishing a trustworthy federated learning pipeline for ITS.

References

• 1

  Al-KarawiA. L. S.AkdenizR. (2026). Zero-knowledge federated learning for privacy-preserving 5g authentication. Computers15, 206. 10.3390/computers15040206

  • CrossRef
  • Google Scholar
  • View reference in article

• 2

  BagheryK.KohlweissM.SiimJ.VolkhovM. (2021). “Another look at extraction and randomization of groth’s zk-snark,” in International Conference on Financial Cryptography and Data Security (Springer), 457–475. 10.1007/978-3-662-64322-8_22

  • CrossRef
  • Google Scholar
  • View reference in article

• 3

  Bellés-MuñozM.IsabelM.Muñoz-TapiaJ. L.RubioA.BaylinaJ. (2022). Circom: a circuit description language for building zero-knowledge applications. IEEE Trans. Dependable Secure Comput.20, 4733–4751. 10.1109/TDSC.2022.3232813

  • CrossRef
  • Google Scholar
  • View reference in article

• 4

  BlanchardP.El MhamdiE. M.GuerraouiR.StainerJ. (2017). “Machine learning with adversaries: byzantine tolerant gradient descent,”In Advances in Neural Information Processing Systems. Editors GuyonI.LuxburgU. V.BengioS.WallachH.FergusR.VishwanathanS.et al. (Red Hook, NY: Curran Associates, Inc.), 30.

  • Google Scholar
  • View reference in article

• 5

  BonawitzK.IvanovV.KreuterB.MarcedoneA.McMahanH. B.PatelS.et al (2017). “Practical secure aggregation for privacy-preserving machine learning,” in In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, 1175–1191. 10.1145/3133956.3133982

  • CrossRef
  • Google Scholar
  • View reference in article

• 6

  ChaiJ.ChenM.ZhangW.WangX.SongJ. (2026). Federated learning with assured privacy and reputation-driven incentives for internet of vehicles. Sensors26, 1720. 10.3390/s26051720

  • CrossRef
  • Google Scholar
  • View reference in article

• 7

  ChenC. (2002). Freeway Performance Measurement System (PeMS). Berkeley: University of California.

  • Google Scholar
  • View reference in article

• 8

  ChenB.BünzB.BonehD.ZhangZ. (2023). “Hyperplonk: plonk with linear-time prover and high-degree custom gates,” in Annual International Conference on the Theory and Applications of Cryptographic Techniques (Springer), 499–530. 10.1007/978-3-031-30617-4_17

  • CrossRef
  • Google Scholar
  • View reference in article

• 9

  ChiesaA.HuY.MallerM.MishraP.VeselyN.WardN. (2020). “Marlin: preprocessing zksnarks with universal and updatable srs,” in Annual International Conference on the Theory and Applications of Cryptographic Techniques (Springer), 738–768.

  • Google Scholar
  • View reference in article

• 10

  CuiK.FengX.WangL.YingZ. (2025). Secure aggregation with logarithmic overhead for federated learning in vanets. IEEE Trans. Consumer Electron.71, 2072–2089. 10.1109/TCE.2025.3533750

  • CrossRef
  • Google Scholar
  • View reference in article

• 11

  EberhardtJ.TaiS. (2018). “Zokrates-scalable privacy-preserving off-chain computations,” in 2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (Greencom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (Smartdata) (IEEE), 1084–1091. 10.1109/Cybermatics_2018.2018.00199

  • CrossRef
  • Google Scholar
  • View reference in article

• 12

  FaloticoR.QuattoP. (2015). Fleiss’ kappa statistic without paradoxes. Qual. and Quantity49, 463–470. 10.1007/s11135-014-0003-1

  • CrossRef
  • Google Scholar
  • View reference in article

• 13

  FanC.LinC.KhazaeiH.MusilekP. (2022). “Performance analysis of hyperledger besu in private blockchain,” in 2022 IEEE International Conference on Decentralized Applications and Infrastructures (DAPPS) (IEEE), 64–73. 10.1109/DAPPS55202.2022.00016

  • CrossRef
  • Google Scholar
  • View reference in article

• 14

  FengX.LiuH.YangH.XieQ.WangL. (2024). Batch-aggregate: efficient aggregation for private federated learning in vanets. IEEE Trans. Dependable Secure Comput.21, 4939–4952. 10.1109/TDSC.2024.3364371

  • CrossRef
  • Google Scholar
  • View reference in article

• 15

  GabizonA.WilliamsonZ. J.CiobotaruO.-M. (2019). Plonk: permutations over lagrange-bases for oecumenical noninteractive arguments of knowledge. IACR Cryptol. ePrint Arch.2019, 953. Available online at: https://eprint.iacr.org/2019/953.

  • Google Scholar
  • View reference in article

• 16

  GrothJ. (2016). “On the size of pairing-based non-interactive arguments,” in Annual International Conference on the Theory and Applications of Cryptographic Techniques (Springer), 305–326. 10.1007/978-3-662-49896-5_11

  • CrossRef
  • Google Scholar
  • View reference in article

• 17

  HardyS.HeneckaW.Ivey-LawH.NockR.PatriniG.SmithG.et al (2017). Private federated learning on vertically partitioned data via entity resolution and additively homomorphic encryption

  • Google Scholar
  • View reference in article

• 18

  HongY.WuY.XiaoH.HaoH.QiuX.YaoB.et al (2026). Exploiting Minority Pseudo-labels for Semi-supervised fine-grained Road Scene Understanding.

  • Google Scholar
  • View reference in article

• 19

  JeongW.YoonJ.YangE.HwangS. J. (2021). Federated semi-supervised learning with inter-client consistency disjoint learning

  • Google Scholar
  • View reference in article

• 20

  KageP.RothenbergerJ.AndreadisP.DiochnosD. (2026). A review of pseudo-labeling for computer vision. J. Artif. Intell. Res.85 (2026). 10.1613/jair.1.19656

  • CrossRef
  • Google Scholar
  • View reference in article

• 21

  KimT.LinE.LeeJ.LauC.MugunthanV. (2023). “Navigating data heterogeneity in federated learning: a semi-supervised federated object detection,” in Proceedings of the 37th International Conference on Neural Information Processing Systems (Red Hook, NY, USA: Curran Associates Inc.).

  • Google Scholar
  • View reference in article

• 22

  KothapalliA.SettyS. (2024). “Hypernova: recursive arguments for customizable constraint systems,” in Annual International Cryptology Conference (Springer), 345–379. 10.1007/978-3-031-68403-6_11

  • CrossRef
  • Google Scholar
  • View reference in article

• 23

  KothapalliA.SettyS.TziallaI. (2022). “Nova: recursive zero-knowledge arguments from folding schemes,” in Annual International Cryptology Conference (Springer), 359–388. 10.1007/978-3-031-15985-5_13

  • CrossRef
  • Google Scholar
  • View reference in article

• 24

  KrizhevskyA.HintonG. (2009). Learning Multiple Layers of Features from Tiny Images. Available online at: https://cave.cs.toronto.edu/kriz/learning-features-2009-TR.pdf.

  • Google Scholar
  • View reference in article

• 25

  LeCunY.BottouL.BengioY.HaffnerP. (1998). Gradient-based learning applied to document recognition. Proc. IEEE86, 2278–2324. 10.1109/5.726791

  • CrossRef
  • Google Scholar
  • View reference in article

• 26

  LiQ.WenZ.WuZ.HuS.WangN.LiY.et al (2021a). A survey on federated learning systems: Vision, hype and reality for data privacy and protection. IEEE Trans. Knowl. Data Eng.35, 3347–3366. 10.1109/TKDE.2021.3124599

  • CrossRef
  • Google Scholar
  • View reference in article

• 27

  LiY.TaoX.ZhangX.LiuJ.XuJ. (2021b). Privacy-preserved federated learning for autonomous driving. IEEE Trans. Intelligent Transp. Syst.23, 8423–8434. 10.1109/TITS.2021.3081560

  • CrossRef
  • Google Scholar
  • View reference in article

• 28

  LiQ.ZhouW.ZhengX. (2024). Distributed learning in intelligent transportation systems: a survey. Information15, 550. 10.3390/info15090550

  • CrossRef
  • Google Scholar
  • View reference in article

• 29

  LiH.OzaD.YoshidaM.NoguchiT. (2026). Privacy-preserving emergency vehicle authentication scheme using zero-knowledge proofs and blockchain. IoT7, 35. 10.3390/iot7020035

  • CrossRef
  • Google Scholar
  • View reference in article

• 30

  MathiasM.TimofteR.BenensonR.Van GoolL. (2012). Belgian Traffic Sign Dataset (BTSD). Available online at: https://btsd.ethz.ch/shareddata/(Accessed 06 February, 2026).

  • Google Scholar
  • View reference in article

• 31

  McMahanB.MooreE.RamageD.HampsonS.y ArcasB. A. (2017). “Communication-efficient learning of deep networks from decentralized data,” in Artificial Intelligence and Statistics (Pmlr), 1273–1282.

  • Google Scholar
  • View reference in article

• 32

  MothukuriV.PariziR. M.PouriyehS.HuangY.DehghantanhaA.SrivastavaG. (2021). A survey on security and privacy of federated learning. Future Gener. Comput. Syst.115, 619–640. 10.1016/j.future.2020.10.007

  • CrossRef
  • Google Scholar
  • View reference in article

• 33

  NeuholdG.OllmannT.BulòS. R.KontschiederP. (2017). “The mapillary vistas dataset for semantic understanding of street scenes,” in 2017 IEEE International Conference on Computer Vision ICCV, 5000–5009. 10.1109/ICCV.2017.534

  • CrossRef
  • Google Scholar
  • View reference in article

• 34

  ParnoB.HowellJ.GentryC.RaykovaM. (2016). Pinocchio: nearly practical verifiable computation. Commun. ACM59, 103–112. 10.1145/2856449

  • CrossRef
  • Google Scholar
  • View reference in article

• 35

  PillutlaK.KakadeS. M.HarchaouiZ. (2022). Robust aggregation for federated learning. IEEE Trans. Signal Process.70, 1142–1154. 10.1109/TSP.2022.3153135

  • CrossRef
  • Google Scholar
  • View reference in article

• 36

  QiH.ChengY.XuM.YuD.WangH.LyuW. (2023). Split: a hash-based memory optimization method for zero-knowledge succinct non-interactive argument of knowledge zk-snark. IEEE Trans. Comput.72, 1857–1870. 10.1109/TC.2023.3235975

  • CrossRef
  • Google Scholar
  • View reference in article

• 37

  Raveendra ReddyK.MuralidharA. (2026). Zero knowledge verifiable, semi asynchronous federated learning for trajectory prediction on permissioned blockchain. Sci. Rep.16, 18218. 10.1038/s41598-026-42886-1

  • CrossRef
  • Google Scholar
  • View reference in article

• 38

  SheybaniN.AhmedA.KinsyM.KoushanfarF. (2025). Zero-knowledge proof frameworks: a systematic survey

  • Google Scholar
  • View reference in article

• 39

  SmahiA.LiH.YangY.YangX.LuP.ZhongY.et al (2023). Bv-icvs: a privacy-preserving and verifiable federated learning framework for v2x environments using blockchain and zksnarks. J. King Saud University-Computer Inf. Sci.35, 101542. 10.1016/j.jksuci.2023.03.020

  • CrossRef
  • Google Scholar
  • View reference in article

• 40

  SmahiA.LiH.HanW.FatehA. A.ChanC. C. (2024). Vfl-chain: bulletproofing federated learning in the v2x environments. Future Gener. Comput. Syst.155, 419–436. 10.1016/j.future.2024.02.012

  • CrossRef
  • Google Scholar
  • View reference in article

• 41

  StallkampJ.SchlipsingM.SalmenJ.IgelC. (2012). Man vs. computer: benchmarking machine learning algorithms for traffic sign recognition. Neural Networks32, 323–332. 10.1016/j.neunet.2012.02.016

  • Pubmed Abstract
  • CrossRef
  • Google Scholar
  • View reference in article

• 42

  ThalerJ. (2022). Proofs, arguments, and zero-knowledge. Found. Trends® Priv. Secur.4, 117–660. 10.1561/3300000030

  • CrossRef
  • Google Scholar
  • View reference in article

• 43

  Vela RomoM. S.Tripp-BarbaC.Orozco GarzónN.BarbechoP.Calderón HinojosaX.Urquiza-AguiarL. (2026). Federated learning frameworks for intelligent transportation systems: a comparative adaptation analysis. Smart Cities9, 12. 10.3390/smartcities9010012

  • CrossRef
  • Google Scholar
  • View reference in article

• 44

  WangT.JinY.YangQ.XiaY.ShiL.ZhangS. (2026). Zero-knowledge federated learning: a new trustworthy and privacy-preserving distributed learning paradigm. IEEE Commun. Mag.64, 172–178. 10.1109/MCOM.001.2500141

  • CrossRef
  • Google Scholar
  • View reference in article

• 45

  WilliamsN. (2025). NGSIM vehicle trajectory data US-101. Available online at: https://www.kaggle.com/datasets/nigelwilliams/ngsim-vehicle-trajectory-data-us-101 (Accessed 06 February, 2026).

  • Google Scholar
  • View reference in article

• 46

  YangQ.LiuY.ChenT.TongY. (2019). Federated machine learning: concept and applications. ACM Trans. Intelligent Syst. Technol. (TIST)10, 1–19. 10.1145/3298981

  • CrossRef
  • Google Scholar
  • View reference in article

• 47

  YuF.ChenH.WangX.XianW.ChenY.LiuF.et al (2020). “Bdd100k: a diverse driving dataset for heterogeneous multitask learning,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2636–2645. 10.1109/CVPR42600.2020.00271

  • CrossRef
  • Google Scholar
  • View reference in article

• 48

  YuanX.LuoZ.ZhangN.GuoG.WangL.LiC.et al (2025). Federated transfer learning for privacy-preserved cross-city traffic flow prediction. IEEE Trans. Intelligent Transp. Syst.26, 4418–4431. 10.1109/TITS.2025.3545445

  • CrossRef
  • Google Scholar
  • View reference in article

• 49

  ZhangS.LiJ.ShiL.DingM.NguyenD. C.TanW.et al (2023). Federated learning in intelligent transportation systems: recent applications and open problems. IEEE Trans. Intelligent Transp. Syst.25, 3259–3285. 10.1109/TITS.2023.3324962

  • CrossRef
  • Google Scholar
  • View reference in article

• 50

  ZhangX.ChenX.LiuS.ZhongS. (2024). Anonymous authentication and information sharing scheme based on blockchain and zero knowledge proof for vanets. IEEE Trans. Veh. Technol.73, 18043–18058. 10.1109/TVT.2024.3432553

  • CrossRef
  • Google Scholar
  • View reference in article

• 51

  ZhouX.LiangW.SheJ.YanZ.WangK. I.-K. (2021). Two-layer federated learning with heterogeneous model aggregation for 6g supported internet of vehicles. IEEE Trans. Veh. Technol.70, 5308–5317. 10.1109/TVT.2021.3077893

  • CrossRef
  • Google Scholar
  • View reference in article

• 52

  ZhuY.LiuY.JamesJ.YuanX. (2021). Semi-supervised federated learning for travel mode identification from gps trajectories. IEEE Trans. Intelligent Transp. Syst.23, 2380–2391. 10.1109/TITS.2021.3092015

  • CrossRef
  • Google Scholar
  • View reference in article