Initiating Removal from Operational Symptoms in Federated Vehicular Networks

I. INTRODUCTION

• Conventional federated unlearning assumes a request names what to forget, but a delayed driving symptom identifies neither the responsible vehicle nor the contribution.Aggregation has already copied the contribution into models downloaded since it was added.Source: §I · p. 1
• Existing defenses inspect updates at submission or trace past influence; tracing needs labeled misclassified inputs and stored checkpoints and can flag effects training has already washed out.A contribution collected in fog may look normal when submitted, and its contributor need not be malicious.Source: §I · p. 1
• ATONE embeds unlearning in the roadside unit’s aggregation rule, projecting everyday errors and symptoms onto recent global increments to score contributions in one backward pass.The coordinator stores no past model or update, retaining only one small curvature operator per window.Source: §I · pp. 1–2
• A two-tier correction suppresses suspected effects each round and eliminates confirmed effects after a one-round probe that measures utility loss and filters fabricated symptoms.The probe measures the utility loss of each elimination instead of estimating it.Source: §I · p. 1
• The propagation operator represents training curvature within the evidence subspace, backward and forward scoring agree, and the two-part elimination recovers the model trained without the target.The elimination is exact under the stated result; the contribution summary specifies the operator as training curvature inside the evidence subspace.Source: §I · p. 2
• Across three datasets, ATONE leaves 43% to 61% less residual harm than the strongest baseline in eight of nine settings, while keeping utility within 0.36 points of retraining.Source: §I · p. 2

A. System Model

• A fleet of N connected vehicles is coordinated by a roadside unit, and each vehicle keeps its local driving dataset on board.The union of local datasets is denoted D.Source: A. System Model · p. 2
• Vehicles collaboratively train a shared model θ against a global objective over the union of their local datasets.Each vehicle’s data-volume weight is p_k = |D_k|/|D|.Source: A. System Model · p. 2
• At each round, the coordinator sends the current model to in-range vehicles, which run local SGD and return updates for weighted aggregation.The returned update is g_k[t] = θ_k[t]−θ[t].Source: A. System Model · p. 2
• Vehicles may perform different numbers of local epochs, and those outside communication range keep using older model versions until they reconnect.Source: A. System Model · p. 2
• A symptom is a reported operational event that may reveal faulty learned behavior but does not directly identify the responsible training contribution.Examples include a near miss, inconsistent prediction, or disagreement with another vehicle.Source: A. System Model · p. 2
• A contribution groups one vehicle’s updates over a time window and scope, and its effect can spread to vehicles that later download the global model.Consequently, removing it only from the source vehicle may leave its effect with other holders.Source: A. System Model · p. 2
• The threat model allows compromised vehicles to collude, fabricate symptoms, and delay updates, but not to impersonate honest vehicles or read raw data.The adversary controls a fraction f of vehicles.Source: A. System Model · p. 2

B. Problem Formulation

• A delayed symptom identifies neither the responsible vehicle, update window, nor data scope, so the removal target must be inferred rather than supplied.The symptom may arise many rounds after aggregation has spread a harmful contribution through the model.Source: B. Problem Formulation · p. 2
• The objective minimizes average residual harm over T rounds while limiting removal-induced utility degradation and total removal cost.The formulation defines faulty status, the remaining fraction of a contribution’s effect, and its driving-task harm.Source: B. Problem Formulation · p. 2
• The coordinator cannot directly solve the formulation because faulty status and surviving effect are unknown, and symptoms do not label their causal contribution.Measuring a contribution’s surviving effect directly would require constructing a counterfactual model trained without it.Source: B. Problem Formulation · p. 3

OPERATIONAL-EVIDENCE NEUTRALIZATION OF EFFECTS

• ATONE is an in-loop unlearning method that makes removal part of the FL aggregation rule rather than a post-incident procedure.Its three modules are operational-evidence aggregation, residual propagation and scoring, and two-tier correction.Source: OPERATIONAL-EVIDENCE NEUTRALIZATION OF… · p. 3

A. Operational Evidence Aggregation

• The evidence subspace is spanned by the q most recent global increments, and vehicles rebuild its shared orthonormal basis from downloaded global models without an extra broadcast.The increments are defined as consecutive differences between global models.Source: A. Operational Evidence Aggregation · p. 3
• Vehicles upload q projected coefficients from recent driving-data loss gradients, while symptoms enter the same fleet evidence with greater weight.This combines sparse reported failures and dense everyday errors into a q-coefficient quantity.Source: A. Operational Evidence Aggregation · p. 3

B. Residual Propagation and Scoring

• ATONE propagates each contribution’s residual—the difference from the model that would have existed without it—using one linear operator shared across contributions.Reading the residual directly would require constructing that counterfactual model.Source: B. Residual Propagation and Scoring · p. 3
• The coordinator computes the propagation operator from existing increments, whose consecutive differences approximate curvature products without on-board Hessian-vector products.The coordinator keeps one operator per window regardless of fleet size or the number of contributions.Source: B. Residual Propagation and Scoring · p. 3
• A contribution’s score is the inner product of current fleet evidence and its surviving residual, measuring alignment with where the fleet errs now rather than past influence.The propagated residual is formed from the contribution’s weighted updates beginning with the first global model that contains them.Source: B. Residual Propagation and Scoring · p. 3
• One backward pass serves every contribution, with one q-dimensional inner product per score; the backward and forward directions yield the same score.The backward pass applies transposed propagation operators from the latest round toward each contribution’s origin.Source: B. Residual Propagation and Scoring · p. 3

C. Two-Tier In-Loop Correction

• The first correction tier suppresses suspected effects every round, with score-dependent gain capped to keep per-round utility loss within ϵ.It requires no trigger or added uplink, but reaches only residual components inside V[t].Source: C. Two-Tier In-Loop Correction · p. 4
• When a score exceeds κ, the coordinator probes a candidate counterfactual model for one round, checking reported-error removal and clean-accuracy movement before confirmation.The clean-accuracy movement measures utility change, and a candidate based on a fabricated report is discarded if it improves no genuine behavior.Source: C. Two-Tier In-Loop Correction · p. 4
• Confirmed elimination subtracts an unmoved component returned once by the source and a discounted component, which together equal the contribution’s residual.If the source withholds its update, only the discounted component is applied; the source is then suspended for the affected scope in later rounds.Source: C. Two-Tier In-Loop Correction · p. 4
• ATONE adds q uplink coefficients per vehicle per round, a model-sized exchange per second-tier trigger, and one q×q operator per coordinator window.A smaller κ means earlier elimination and more probes, while shortening residual-harm accumulation and keeping elimination error small under Theorem 2.Source: C. Two-Tier In-Loop Correction · p. 4

IV. THEORETICAL ANALYSIS

• Under the flatness assumption, an effect persisting long after tu lies mostly outside the subspace, where ATONE subtracts it as submitted.The residual's orthogonal part stays unchanged, while its subspace coefficients are scaled by I − M[τ].Source: §IV · p. 4
• One backward pass scores every contribution without assumptions, while the propagation operator estimates loss curvature inside the evidence subspace.The operator is M[τ] = η V[τ]⊤∇²L(θ[τ])V[τ]; the analysis assumes a quadratic objective with fixed Hessian over q+1 rounds.Source: §IV · p. 4
• Under Assumptions 1 and 2, subtracting the quantity in Eq. (9) from θ[t] returns exactly θ−u[t].Assumption 2 requires a fixed evidence subspace and training flat in its orthogonal directions.Source: §IV · p. 4
• The score captures first-order harm inside the evidence subspace, but its orthogonal-residual term requires the second-tier probe before elimination.The evidence loss is ψ, with d[t] = V[t]⊤∇ψ(θ[t]).Source: §IV · p. 4
• With bounded curvature and a fixed evidence subspace, Eq. (9) differs from the exact removal residual by at most (t − tu)δ∥gu∥.The error grows at most linearly with elapsed rounds, so a smaller κ that eliminates sooner is more accurate.Source: §IV · pp. 4–5

A. Experimental Setup

• CARLA simulates 50 simultaneous vehicles using LR-ASPP with MobileNetV3-Large, trained separately on Foggy Cityscapes, ACDC, and BDD100K; one vehicle’s images relabel pedestrians as road during one window.Source: A. Experimental Setup · p. 5
• The physical testbed uses MentorPi cars trained on Foggy Cityscapes with Raspberry Pi 5 devices, exchanging models and updates with a server over LAN.Source: A. Experimental Setup · p. 5
• Evaluation measures FmIoU, MIA, RmIoU, TmIoU, residual harm, reaction delay, and removal cost, comparing ATONE with five unlearning or tracing baselines.FedRecover, FedOSD, and FedEditor receive the faulty contribution; FLForensics and FLTracer trace it and pass it to FedRecover for removal.Source: A. Experimental Setup · p. 5

B. Experimental Results

• ATONE brings H[t] below 0.1 points by round 47, four rounds before FedEditor and 25 before FLForensics; its Top-1 accuracy is 11.9 to 17.6 points above FLForensics.A larger κ cuts uplink up to 6.1 times but raises reaction delay to at most 11.3 rounds; both tiers keep each harm component below 0.22 points.Source: Figure 6 · p. 6, B. Experimental Results · p. 6
• ATONE scoring stays below 6 ms up to N = 200 with 206 MB storage, while FLTracer needs 63.5 s and 10.6 GB.Top-1 attribution accuracy rises little beyond q = 8, while uplink per vehicle keeps growing.Source: Figure 7 · p. 6, B. Experimental Results · p. 6
• Across eight of nine settings, ATONE’s average residual harm was 43% to 61% below FedEditor’s, even though FedEditor was told the faulty contribution; ATONE stayed within 0.36 points of Retrain in FmIoU, RmIoU, and TmIoU.Source: B. Experimental Results · pp. 5–6

• In eight of nine settings across three driving datasets, ATONE yields the lowest residual harm and stays within 0.36 points of Retrain.Source: §VI · p. 6
• ATONE infers and removes a faulty contribution inside the aggregation rule without storing past checkpoints.Source: §VI · p. 6
• ATONE targets fleets that discover a faulty contribution only through delayed symptoms.Source: §VI · p. 6