Federated learning defense protects autonomous driving models from hidden attacks
Poster: FedWM-Guard: Thwarting Imagination Poisoning in Federated World Model-based Autonomous Driving
Cryptography and Security
Summary
Autonomous cars use 'world models' to predict what will happen next and decide how to drive safely. Training these models together across many cars without sharing private data is called federated learning. The authors found a new kind of attack—some cars covertly poison the model so it looks good in short-term predictions but causes errors later on, tricking the car's planning system. They designed FedWM-Guard, a defense that watches not just model updates but how these updates change the car’s imagined future, stopping attackers who try to sneak in harmful changes.
What this means in practice
- •For autonomous vehicle engineers: Integrate FedWM-Guard to detect and block subtle training-time attacks on vehicle world models during federated updates.
- •For federated learning platform developers: Use FedWM-Guard techniques to improve model verification by testing how model updates affect predicted future scenarios.
Authors
Sheng Liu, Panos Papadimitratos
Abstract
Federated learning (FL) can improve world model (WM)-based autonomous driving (AD) without centralizing raw private vehicle data, but it also turns model aggregation into a safety-critical integrity boundary. We introduce a new threat in federated WM-AD, namely \emph{imagination poisoning}: compromised vehicles submit bounded WM updates that preserve benign short-horizon predictions yet corrupt long-horizon rollouts (e.g., trigger-conditioned) during training, thereby misleading a downstream planner. We present \emph{FedWM-Guard}, to the best of our knowledge, the first defense to characterize planner-facing rollouts in federated WM-AD, screen authenticated updates in hidden-canary scenarios, audit predicted futures against later observations, and invoke a WM-independent safety shield when persistent inconsistency is detected. Unlike parameter-space defenses, it scores what an update makes the model \emph{imagine}, not only how the update looks. We also outline how we plan to evaluate it under non-IID (not independent and identically distributed) data, adaptive attacks, and benign distribution shift. This work highlights an unexplored domain, federated WM-AD, and its threat surface and potential countermeasures.