面向车联网的采用后量子认证的通信高效隐私保护联邦强化学习

# Communication-Efficient Private Federated Reinforcement Learning with Post-Quantum Authentication forVehicular Networks
Source: [https://arxiv.org/html/2610.41055](https://arxiv.org/html/2610.41055)
Hojat Allah SalehiAffiliation:Knight Foundation School of Computing and Information Sciences, Florida International University, Miami, FL 33199, USA Affiliation:Security, Optimization, and Learning for Interdependent Networks Lab \(solid lab\), Miami, FL 33199, USADevrim ArasAffiliation:Knight Foundation School of Computing and Information Sciences, Florida International University, Miami, FL 33199, USA Affiliation:Security, Optimization, and Learning for Interdependent Networks Lab \(solid lab\), Miami, FL 33199, USAMd Jueal MiaAffiliation:Knight Foundation School of Computing and Information Sciences, Florida International University, Miami, FL 33199, USA Affiliation:Security, Optimization, and Learning for Interdependent Networks Lab \(solid lab\), Miami, FL 33199, USAM\. Hadi AminiAffiliation:Knight Foundation School of Computing and Information Sciences, Florida International University, Miami, FL 33199, USA Affiliation:Security, Optimization, and Learning for Interdependent Networks Lab \(solid lab\), Miami, FL 33199, USAImtiaz KarimAffiliation:Department of Computer Science, The University of Texas at Dallas, Richardson, TX 75080, USAMashrur ChowdhuryAffiliation:Glenn Department of Civil Engineering, Clemson University, Clemson, SC 29634, USA hsalehi@fiu\.edu, amini@cs\.fiu\.eduBhavani ThuraisinghamAffiliation:Department of Computer Science, The University of Texas at Dallas, Richardson, TX 75080, USA

###### Abstract

Federated reinforcement learning supports cooperative vehicular routing without centralizing trajectory data, but exchanging model updates may reveal private information and incur substantial communication overhead over intermittent vehicle\-to\-infrastructure links, particularly when post\-quantum authentication is required\. We study correlated private quantization, which uses complementary shared randomness between paired vehicles to reduce aggregation mean squared error while preserving the marginal parameter\-level local differential privacy guarantee and one\-bit communication cost of independent quantization\. A tunable extension mixes shared and independent randomness to bound privacy leakage under paired\-output observations and shared\-randomness side information\. For this extension, Rényi differential privacy accounting establishes vector\-level local differential privacy for one model upload even when pairings are revealed\. Under matched vector\-level privacy and identical local and global parameters, the extension yields 16\.5% lower analytical aggregation mean squared error than independent quantization\. We evaluate cooperative routing by coupling microscopic traffic simulation with packet\-level simulation of post\-quantum\-authenticated vehicle\-to\-infrastructure communication\. Compared with full\-precision updates, one\-bit uploads reduce authenticated uplink size by 92\.4% and increase the mean number of verified updates aggregated per round from 19\.6 to 26\.5\. Under mobility\-constrained communication at a parameter\-level privacy budget of 1, correlated private quantization reduces mean travel time by 14\.3% relative to independent quantization at the same budget and communication cost\. At a parameter\-level privacy budget of 0\.3, a vehicle\-origin inference attack trained on independent simulations reaches 30% accuracy with correlated private quantization and 22% with independent quantization after 100 rounds, versus 91% without privacy and 10% for random guessing\.

Code:[https://github\.com/solidlabnetwork/cpq\-vehicular\-frl](https://github.com/solidlabnetwork/cpq-vehicular-frl)

††footnotetext:This work has been submitted to the IEEE for possible publication\. Copyright may be transferred without notice, after which this version may no longer be accessible\.## 1Introduction

Connected and autonomous vehicles increasingly rely on sensing and vehicle\-to\-everything \(V2X\) communication to support cooperative transportation services\. Mobility data are distributed across vehicles and roadside infrastructure, making federated learning \(FL\) a suitable approach for collaborative model training without centralizing raw sensor and trajectory data\. However, repeated exchanges of model updates over bandwidth\-constrained vehicular links impose substantial communication overhead\.

Federated reinforcement learning \(FRL\) extends FL to sequential decision\-making, allowing distributed agents to learn policies through local interactions and periodically aggregate model updates\([Fan et al\., 2021](https://arxiv.org/html/2610.41055#bib.bib13);[Gao et al\., 2024](https://arxiv.org/html/2610.41055#bib.bib16);[Jin et al\., 2022](https://arxiv.org/html/2610.41055#bib.bib17);[Yuan et al\., 2023](https://arxiv.org/html/2610.41055#bib.bib43)\)\. In vehicular networks, FRL has been investigated for traffic signal control, emergency vehicle routing, travel\-time minimization, and communication resource management\([Bao et al\., 2023](https://arxiv.org/html/2610.41055#bib.bib4);[Ye et al\., 2021](https://arxiv.org/html/2610.41055#bib.bib41);[Su et al\., 2023](https://arxiv.org/html/2610.41055#bib.bib34);[Mamond et al\., 2025](https://arxiv.org/html/2610.41055#bib.bib20);[Zhao et al\., 2024](https://arxiv.org/html/2610.41055#bib.bib45);[Wang et al\., 2026](https://arxiv.org/html/2610.41055#bib.bib39);[Jing et al\., 2025](https://arxiv.org/html/2610.41055#bib.bib18)\)\. These applications motivate examining how privacy, authentication, and communication constraints affect collaborative policy learning in vehicular networks\.

Although keeping raw data local limits direct data exposure, federated learning does not by itself prevent information leakage through transmitted model updates\. Prior work has demonstrated that shared gradients and model parameters can reveal information about local training data through attacks such as membership inference and model inversion\([Shokri et al\., 2017](https://arxiv.org/html/2610.41055#bib.bib31);[Nasr et al\., 2019](https://arxiv.org/html/2610.41055#bib.bib23);[Fredrikson et al\., 2015](https://arxiv.org/html/2610.41055#bib.bib15)\)\. Differential privacy provides a principled approach for limiting such leakage by randomizing the information released during training\([Dwork and Roth, 2014](https://arxiv.org/html/2610.41055#bib.bib12);[Abadi et al\., 2016](https://arxiv.org/html/2610.41055#bib.bib1);[Sun et al\., 2021](https://arxiv.org/html/2610.41055#bib.bib35)\)\. In vehicular FRL, however, privacy mechanisms must be considered together with the communication cost of repeatedly exchanging model updates over bandwidth\-constrained wireless links\. This motivates mechanisms that provide formal privacy guarantees while reducing the size of transmitted model updates\.

Model updates must also be authenticated before aggregation so that the server can verify their origin and integrity\. Conventional public\-key signature schemes based on integer factorization or discrete logarithms are vulnerable to sufficiently capable quantum computers through Shor’s algorithm\([Shor, 1999](https://arxiv.org/html/2610.41055#bib.bib32)\), motivating the transition toward post\-quantum authentication\. NIST has standardized ML\-DSA and SLH\-DSA\([National Institute of Standards and Technology, 2024b](https://arxiv.org/html/2610.41055#bib.bib25);[National Institute of Standards and Technology, 2024c](https://arxiv.org/html/2610.41055#bib.bib26)\)and selected Falcon for standardization as an additional post\-quantum signature scheme\([Alagic et al\., 2022](https://arxiv.org/html/2610.41055#bib.bib2)\)\. These schemes provide authentication and integrity protection for exchanged federated model updates, but differ in signature size and computational cost, which can affect packet fragmentation, retransmissions, and delivery latency over V2X links\. Post\-quantum authentication is therefore both a security and a communication\-design consideration in vehicular FRL\.

This work investigates privacy\-preserving and communication\-efficient vehicular FRL with post\-quantum\-authenticated model exchange\. We investigate correlated private quantization \(CPQ\) for cooperative routing and compare it with independent stochastic binary quantization\([Sun et al\., 2021](https://arxiv.org/html/2610.41055#bib.bib35)\)and full\-precision Gaussian and Laplace mechanisms\. We also introduce CPQ\-λ\\lambda, which combines shared and independent local randomness to establish privacy guarantees under stronger server observations, including a vector\-level guarantee for one model upload\. We first evaluate routing performance across privacy budgets under ideal model exchange\. We then couple Simulation of Urban Mobility \(SUMO\) trajectories with packet\-level ns\-3 simulations of IEEE 802\.11p vehicle\-to\-infrastructure \(V2I\) communication\([Riley and Henderson, 2010](https://arxiv.org/html/2610.41055#bib.bib28)\)\. The primary mobility\-coupled evaluation uses ML\-DSA\-44 authentication, with successful model delivery and verification determining participation in federated aggregation\. Additional experiments compare ML\-DSA\-44, Falcon\-512, and SLH\-DSA\-SHA2\-128f with full\-precision and CPQ updates, supported by cryptographic microbenchmarks\. We also evaluate whether an honest\-but\-curious roadside unit \(RSU\) can infer vehicles’ starting road segments from received model updates across multiple rounds\. Figure[1](https://arxiv.org/html/2610.41055#S1.F1)illustrates the integrated framework\.

![Refer to caption](https://arxiv.org/html/2610.41055v1/CPQ_Arch.png)Figure 1:Architecture of the proposed privacy\-preserving and post\-quantum\-authenticated vehicular FRL framework\. SUMO trajectories drive ns\-3 V2I communication, with signed full\-precision global\-model downlinks and privacy\-protected, signed model\-update uplinks\.Our main contributions are:

- •Mobility\-Coupled Evaluation of Authenticated Vehicular FRL\.We develop an integrated SUMO and ns\-3 evaluation framework that couples cooperative vehicular FRL with post\-quantum\-authenticated IEEE 802\.11p V2I communication\. By incorporating model delivery and verification outcomes into federated aggregation, the framework enables joint evaluation of communication reliability, effective participation, and routing performance under intermittent connectivity\.
- •Communication\-Efficient Private Quantization and Privacy Guarantees\.We characterize CPQ for vehicular FRL, demonstrating reduced aggregation mean squared error \(MSE\) while preserving one\-bit communication and the sameϵp\\epsilon\_\{p\}\-PLDP guarantee as independent stochastic binary quantization\. We further introduce CPQ\-λ\\lambdaand establish privacy guarantees under stronger observation models, including\(ϵv,δv\)\(\\epsilon\_\{v\},\\delta\_\{v\}\)vector\-level local differential privacy for one complete model upload\. Under matched vector\-level privacy, CPQ\-λ\\lambdaalso demonstrates a theoretical aggregation\-MSE advantage over independent quantization\.
- •Post\-Quantum Authentication and V2I Communication Trade\-Offs\.We quantify how model\-update representation and post\-quantum signature selection affect authenticated V2I communication through cryptographic benchmarks and mobility\-coupled IEEE 802\.11p simulations\. The results show that one\-bit uploads reduce message size and transfer latency versus full\-precision updates, while signature overhead influences delivery reliability when model payloads are highly compressed\.
- •Vehicle\-Origin Inference Attack Evaluation\.We evaluate an inference attack in which an adversary attempts to identify vehicles’ starting road segments from observed model updates across federated rounds\. Under two attack settings with mobility\-constrained V2I communication, CPQ substantially reduces attack accuracy compared with unprotected model exchange\.

The paper is organized as follows\. Section[2](https://arxiv.org/html/2610.41055#S2)reviews related work\. Section[3](https://arxiv.org/html/2610.41055#S3)presents the private quantization mechanisms and their privacy and aggregation\-error analyses\. Section[4](https://arxiv.org/html/2610.41055#S4)describes the post\-quantum signature schemes, while Section[5](https://arxiv.org/html/2610.41055#S5)introduces the vehicular FRL formulation\. Section[6](https://arxiv.org/html/2610.41055#S6)details system design and authenticated model exchange\. Section[7](https://arxiv.org/html/2610.41055#S7)presents the experimental results, and Section[8](https://arxiv.org/html/2610.41055#S8)concludes the paper\.

## 2Related Work

Communication\-efficient and privacy\-preserving FL\.Prior research has investigated communication\-efficient and privacy\-aware mechanisms for distributed estimation and learning, including locally private estimation and telemetry collection\([Duchi et al\., 2018](https://arxiv.org/html/2610.41055#bib.bib11);[Ding et al\., 2017](https://arxiv.org/html/2610.41055#bib.bib9)\), binomial randomization with secure aggregation\([Chen et al\., 2022](https://arxiv.org/html/2610.41055#bib.bib8)\), randomized quantization with configurable output levels\([Youn et al\., 2023](https://arxiv.org/html/2610.41055#bib.bib42)\), and minimum\-variance unbiased mechanisms supporting different communication budgets\([Chaudhuri et al\., 2022](https://arxiv.org/html/2610.41055#bib.bib7)\)\. Related sign\-based methods address private and Byzantine\-resilient gradient compression\([Xiang and Su, 2023](https://arxiv.org/html/2610.41055#bib.bib40)\)and communication\-efficient federated averaging\([Tang et al\., 2024](https://arxiv.org/html/2610.41055#bib.bib36)\)\. LDP\-FL\([Sun et al\., 2021](https://arxiv.org/html/2610.41055#bib.bib35)\)provides independent stochastic binary quantization with one bit per parameter and anϵp\\epsilon\_\{p\}\-PLDP guarantee\. CorBin\-FL\([Salehi et al\., 2024](https://arxiv.org/html/2610.41055#bib.bib30)\)uses complementary shared randomness across clients to reduce aggregation error while preserving the same marginal PLDP guarantee\.

Privacy, security, and FRL in vehicular networks\.Vehicular FL research has investigated privacy\-aware knowledge trading using personalized differential privacy and contract theory\([Zhang et al\., 2024](https://arxiv.org/html/2610.41055#bib.bib44)\), personalized learning for autonomous driving using correlated differential privacy\([Tian et al\., 2025](https://arxiv.org/html/2610.41055#bib.bib37)\), and authenticated secure aggregation\([Byun et al\., 2024](https://arxiv.org/html/2610.41055#bib.bib6)\)\. For sequential decision\-making, federated deep reinforcement learning has been studied for task offloading and resource allocation in vehicular edge computing\([Zhao et al\., 2024](https://arxiv.org/html/2610.41055#bib.bib45)\), while federated graph\-based multi\-agent reinforcement learning has been applied to age\-of\-information optimization\([Wang et al\., 2026](https://arxiv.org/html/2610.41055#bib.bib39)\)\. More directly related to cooperative routing, FLDQN\([Mamond et al\., 2025](https://arxiv.org/html/2610.41055#bib.bib20)\)combines federated deep Q\-learning with SUMO\-based traffic simulation to minimize vehicle travel time and provides the routing and learning foundation adopted in this study\.

Vehicular traffic and communication simulation\.Prior vehicular studies have coupled microscopic traffic and wireless network simulations to capture mobility\-dependent communication\. Veins integrates SUMO and OMNeT\+\+ for bidirectionally coupled traffic and network simulation\([Sommer et al\., 2011](https://arxiv.org/html/2610.41055#bib.bib33)\), while iTETRIS combines SUMO and ns\-3 to evaluate cooperative intelligent transportation applications\([Rondinone et al\., 2013](https://arxiv.org/html/2610.41055#bib.bib29)\)\.

Research gap and positioning\.Prior studies have established important foundations for privacy\-preserving quantization, secure vehicular FL, cooperative FRL routing, and mobility\-aware traffic–network simulation\. Building on these foundations, two complementary research directions motivate this work\. The first concerns improving aggregation accuracy through correlated one\-bit quantization in vehicular FRL while maintaining formal parameter\-level privacy and low communication cost\. An additional theoretical question is how such mechanisms can provide privacy guarantees under stronger server observations while retaining an aggregation\-accuracy advantage under matched vector\-level privacy\. We investigate CPQ for the first objective and introduce CPQ\-λ\\lambdato extend the privacy analysis, including a vector\-level guarantee for one complete model upload\. The second direction concerns the interaction between privacy\-preserving model exchange and post\-quantum\-authenticated V2I communication\. Under intermittent connectivity, model\-update size and authentication overhead influence successful communication and verified participation in federated aggregation, which can ultimately affect routing performance\. We examine these interactions through mobility\-coupled, packet\-level evaluation of vehicular FRL and complement the formal privacy analysis with vehicle\-origin inference attack experiments\.

## 3Differential Privacy for Federated Learning

This section presents the privacy mechanisms used for local model exchange in vehicular FRL and analyzes their privacy and aggregation\-error properties\. We first establish a common parameter\-level local differential privacy \(PLDP\) formulation and describe the independent one\-bit LDP\-FL\([Sun et al\., 2021](https://arxiv.org/html/2610.41055#bib.bib35)\)and Gaussian and Laplace additive\-noise baselines\([Dwork and Roth, 2014](https://arxiv.org/html/2610.41055#bib.bib12)\)\. We then present CPQ and establish its privacy and aggregation\-error properties\. Finally, we introduce CPQ\-λ\\lambdaand analyze its guarantees under stronger observation models, including vector\-level privacy for one complete model upload and aggregation\-MSE comparisons under matched vector\-level privacy\.

Common setup\.At a given communication round, client𝒞i\\mathcal\{C\}\_\{i\}holds a locally trained parameter vector𝜽i=\(θi,j\)j∈\[m\]∈ℝm\\boldsymbol\{\\theta\}\_\{i\}=\(\\theta\_\{i,j\}\)\_\{j\\in\[m\]\}\\in\\mathbb\{R\}^\{m\}, wheremmis the number of model parameters andjjindexes their coordinates\. For each coordinatejj, all clients use a common public clipping intervalℐj=\[cj−rj,cj\+rj\]\\mathcal\{I\}\_\{j\}=\[c\_\{j\}\-r\_\{j\},c\_\{j\}\+r\_\{j\}\], wherecjc\_\{j\}andrj\>0r\_\{j\}\>0denote the clipping center and radius, respectively\. Clippingθi,j\\theta\_\{i,j\}toℐj\\mathcal\{I\}\_\{j\}yieldswi,jw\_\{i,j\}, and𝐰i=\(wi,j\)j∈\[m\]\\mathbf\{w\}\_\{i\}=\(w\_\{i,j\}\)\_\{j\\in\[m\]\}denotes the clipped parameter vector\. In our implementation,cjc\_\{j\}corresponds to the current global\-model parameter, and all coordinates share a common radiusrj=rr\_\{j\}=r\. For a clipped inputw∈ℐjw\\in\\mathcal\{I\}\_\{j\}, letW¯i,j​\(w\)\\overline\{W\}\_\{i,j\}\(w\)denote the randomized parameter output, after reconstruction where applicable\. We use the following parameter\-level local differential privacy definition to characterize these randomized outputs\.

###### Definition 1\(Parameter\-Level Local Differential Privacy \(PLDP\)\)

Forϵp\>0\\epsilon\_\{p\}\>0and0≤δp<10\\leq\\delta\_\{p\}<1, a randomized parameter mechanism satisfies\(ϵp,δp\)\(\\epsilon\_\{p\},\\delta\_\{p\}\)\-parameter\-level local differential privacy \(PLDP\) if, for every clientii, coordinatejj, inputsw,w′∈ℐjw,w^\{\\prime\}\\in\\mathcal\{I\}\_\{j\}, and measurable output set𝒯⊆ℝ\\mathcal\{T\}\\subseteq\\mathbb\{R\},

Pr⁡\(W¯i,j​\(w\)∈𝒯\)\\displaystyle\\Pr\\\!\\left\(\\overline\{W\}\_\{i,j\}\(w\)\\in\\mathcal\{T\}\\right\)≤eϵp​Pr⁡\(W¯i,j​\(w′\)∈𝒯\)\+δp\.\\displaystyle\\leq e^\{\\epsilon\_\{p\}\}\\Pr\\\!\\left\(\\overline\{W\}\_\{i,j\}\(w^\{\\prime\}\)\\in\\mathcal\{T\}\\right\)\+\\delta\_\{p\}\.\(1\)Pureϵp\\epsilon\_\{p\}\-PLDP corresponds toδp=0\\delta\_\{p\}=0\.

### 3\.1Independent Stochastic Binary Quantization \(LDP\-FL\)

LDP\-FL\([Sun et al\., 2021](https://arxiv.org/html/2610.41055#bib.bib35)\)provides the independent one\-bit quantization baseline for CPQ and satisfies pureϵp\\epsilon\_\{p\}\-PLDP for each clipped parameter\. To simplify the scalar quantization rule, we fix a clientiiand coordinatejjand write\(w,c,r\)=\(wi,j,cj,rj\)\(w,c,r\)=\(w\_\{i,j\},c\_\{j\},r\_\{j\}\)\. Forϵp\>0\\epsilon\_\{p\}\>0, define

α⁡\(ϵp\)=eϵp\+1eϵp−1,q⁡\(w\)=12\+w−c2​r​α​\(ϵp\)\.\\alpha\(\\epsilon\_\{p\}\)=\\frac\{e^\{\\epsilon\_\{p\}\}\+1\}\{e^\{\\epsilon\_\{p\}\}\-1\},\\qquad q\(w\)=\\frac\{1\}\{2\}\+\\frac\{w\-c\}\{2r\\,\\alpha\(\\epsilon\_\{p\}\)\}\.\(2\)Using independent local randomness, the client drawsB∼Bernoulli⁡\(q⁡\(w\)\)B\\sim\\mathrm\{Bernoulli\}\(q\(w\)\)and transmits the resulting one\-bit symbol\. WithU=2​B−1∈\{−1,\+1\}U=2B\-1\\in\\\{\-1,\+1\\\}, the server reconstructs

W¯=c\+U​r​α​\(ϵp\),W¯∈\{c−r​α​\(ϵp\),c\+r​α​\(ϵp\)\}\.\\overline\{W\}=c\+Ur\\,\\alpha\(\\epsilon\_\{p\}\),\\qquad\\overline\{W\}\\in\\bigl\\\{c\-r\\alpha\(\\epsilon\_\{p\}\),\\,c\+r\\alpha\(\\epsilon\_\{p\}\)\\bigr\\\}\.\(3\)The reconstruction is unbiased since𝔼⁡\[W¯\]=w\\mathbb\{E\}\[\\overline\{W\}\]=w\.

For a fixed coordinatejj, considernnclients with clipped parameterswi,j∈ℐjw\_\{i,j\}\\in\\mathcal\{I\}\_\{j\}and independent quantization randomness\. LetW¯i,j\\overline\{W\}\_\{i,j\}denote the reconstructed parameter of clientii, and define the reconstructed aggregateW¯g,j=1n​∑i=1nW¯i,j\\overline\{W\}\_\{g,j\}=\\frac\{1\}\{n\}\\sum\_\{i=1\}^\{n\}\\overline\{W\}\_\{i,j\}and clipped\-parameter meanw¯j=1n​∑i=1nwi,j\\bar\{w\}\_\{j\}=\\frac\{1\}\{n\}\\sum\_\{i=1\}^\{n\}w\_\{i,j\}\. The aggregate is unbiased, and its mean squared error is

𝔼⁡\[\(W¯g,j−w¯j\)2\]\\displaystyle\\mathbb\{E\}\\\!\\left\[\(\\overline\{W\}\_\{g,j\}\-\\bar\{w\}\_\{j\}\)^\{2\}\\right\]=1n2​∑i=1n\[rj2​α2​\(ϵp\)−\(wi,j−cj\)2\]≤rj2​α2​\(ϵp\)n\.\\displaystyle=\\frac\{1\}\{n^\{2\}\}\\sum\_\{i=1\}^\{n\}\\left\[r\_\{j\}^\{2\}\\alpha^\{2\}\(\\epsilon\_\{p\}\)\-\(w\_\{i,j\}\-c\_\{j\}\)^\{2\}\\right\]\\leq\\frac\{r\_\{j\}^\{2\}\\alpha^\{2\}\(\\epsilon\_\{p\}\)\}\{n\}\.\(4\)The equality follows from the independence of client randomization, which eliminates cross\-client error covariance\. Moreover, among unbiased binary quantizers with input\-independent reconstruction levels satisfyingϵp\\epsilon\_\{p\}\-PLDP on the clipping interval, LDP\-FL minimizes scalar MSE for every admissible input\([Salehi et al\., 2024](https://arxiv.org/html/2610.41055#bib.bib30), Proposition 1\)\. Thus, its aggregation\-error bound provides the reference for evaluating the benefits of correlated quantization\.

Certain quantization and sign\-based mechanisms admit one\-bit scalar configurations with the same response distribution and reconstruction levels as LDP\-FL\. The corresponding parameter mappings and conditions for equivalent aggregation behavior are detailed in Appendix[A](https://arxiv.org/html/2610.41055#A1)\.

### 3\.2Gaussian and Laplace Mechanisms

Gaussian and Laplace mechanisms provide additive\-noise baselines for comparison with one\-bit private quantization\. Both perturb parameters after they have been clipped to the public intervals defined in the common setup\.

Gaussian mechanism\.Each client adds independent Gaussian noise to its clipped parameters according to

W¯i,j=wi,j\+Zi,j,Zi,j∼𝒩⁡\(0,σj2\)\.\\overline\{W\}\_\{i,j\}=w\_\{i,j\}\+Z\_\{i,j\},\\qquad Z\_\{i,j\}\\sim\\mathcal\{N\}\(0,\\sigma\_\{j\}^\{2\}\)\.For coordinatejj, the sensitivity isΔj=2​rj\\Delta\_\{j\}=2r\_\{j\}\. We calibrateσj\\sigma\_\{j\}using the analytic Gaussian mechanism\([Balle and Wang, 2018](https://arxiv.org/html/2610.41055#bib.bib3)\), selecting the smallest positive value satisfying

Φ⁡\(Δj2​σj−ϵp​σjΔj\)−eϵp​Φ​\(−Δj2​σj−ϵp​σjΔj\)≤δp,\\displaystyle\\Phi\\\!\\left\(\\frac\{\\Delta\_\{j\}\}\{2\\sigma\_\{j\}\}\-\\frac\{\\epsilon\_\{p\}\\sigma\_\{j\}\}\{\\Delta\_\{j\}\}\\right\)\-e^\{\\epsilon\_\{p\}\}\\Phi\\\!\\left\(\-\\frac\{\\Delta\_\{j\}\}\{2\\sigma\_\{j\}\}\-\\frac\{\\epsilon\_\{p\}\\sigma\_\{j\}\}\{\\Delta\_\{j\}\}\\right\)\\leq\\delta\_\{p\},whereΦ\\Phidenotes the standard normal cumulative distribution function\. This calibration ensures\(ϵp,δp\)\(\\epsilon\_\{p\},\\delta\_\{p\}\)\-PLDP for each parameter\.

Laplace mechanism\.For pureϵp\\epsilon\_\{p\}\-PLDP, each client adds independent Laplace noise with scaleΔj/ϵp\\Delta\_\{j\}/\\epsilon\_\{p\}, whereΔj=2​rj\\Delta\_\{j\}=2r\_\{j\}\([Dwork and Roth, 2014](https://arxiv.org/html/2610.41055#bib.bib12)\)\.

W¯i,j=wi,j\+Lap⁡\(0,2​rj/ϵp\)\.\\overline\{W\}\_\{i,j\}=w\_\{i,j\}\+\\mathrm\{Lap\}\(0,2r\_\{j\}/\\epsilon\_\{p\}\)\.

### 3\.3Correlated Private Quantizer \(CPQ\)

CPQ coordinates the one\-bit quantization of paired vehicle clients using complementary shared randomness\. It preserves the marginal quantization distribution of LDP\-FL, maintaining unbiasedness and the sameϵp\\epsilon\_\{p\}\-PLDP guarantee for each client, while reducing pairwise aggregation mean squared error \(MSE\) when both members of a pair contribute\. We first describe the pairing and quantization procedures, then analyze their privacy and aggregation\-error properties at the pair and population levels\.

To realize this coupling, the vehicles establish a shared group secret and agree on an ordered participant list before training\. For each coordinatejjand communication roundtt, a secret\-keyed permutation of this list determines the client pairs\. Each pair derives a common pseudorandom valueVV, with one client usingVVand the other using1−V1\-Vfor quantization\. Pair assignments and random values are refreshed across coordinates and rounds without exchanging pairing information during training\. In the implemented protocol, the RSU does not possess the group secret or the pairing assignments\. The theoretical analysis models the shared values as independentUniform⁡\[0,1\]\\mathrm\{Uniform\}\[0,1\]variables across pairs, while the group\-establishment procedure and finite\-precision implementation are detailed in Appendix[K](https://arxiv.org/html/2610.41055#A11)and Appendix[E](https://arxiv.org/html/2610.41055#A5)\.

For each clipped parameterwi,jw\_\{i,j\}, client𝒞i\\mathcal\{C\}\_\{i\}uses its assigned complementary random valueVi,j,tV\_\{i,j,t\}in communication roundtt\. Using the same quantization probability as LDP\-FL,qi,j=12\+wi,j−cj2​rj​α​\(ϵp\)q\_\{i,j\}=\\frac\{1\}\{2\}\+\\frac\{w\_\{i,j\}\-c\_\{j\}\}\{2r\_\{j\}\\alpha\(\\epsilon\_\{p\}\)\}, the client generates the one\-bit output

bi,j=𝟏\{Vi,j,t<qi,j\}∈\{0,1\}\.b\_\{i,j\}=\\mathbf\{1\}\_\{\\\{V\_\{i,j,t\}<q\_\{i,j\}\\\}\}\\in\\\{0,1\\\}\.\(5\)The server reconstructs each parameter using the same two output levels as LDP\-FL,cj±rj​α​\(ϵp\)c\_\{j\}\\pm r\_\{j\}\\alpha\(\\epsilon\_\{p\}\)\. Fornnclient updates included in aggregation, indexed byi∈\[n\]i\\in\[n\], the reconstructed mean is

W¯g,j=cj\+rj​α​\(ϵp\)n​∑i=1n\(2​bi,j−1\)\.\\overline\{W\}\_\{g,j\}=c\_\{j\}\+\\frac\{r\_\{j\}\\alpha\(\\epsilon\_\{p\}\)\}\{n\}\\sum\_\{i=1\}^\{n\}\(2b\_\{i,j\}\-1\)\.\(6\)This reconstruction requires only the received bits and public parameters\(cj,rj,ϵp\)\(c\_\{j\},r\_\{j\},\\epsilon\_\{p\}\), without revealing the pairing assignments\. Algorithm[1](https://arxiv.org/html/2610.41055#alg1)summarizes the procedure\. The complementary coupling preserves each client’s quantization distribution while changing the dependence between paired outputs, which determines their aggregation error\.

Algorithm 1Correlated Private Quantizer \(CPQ\)Inputs:nnparticipating clients,mmmodel parameters, communication roundtt, privacy budgetϵp\\epsilon\_\{p\}\(α=eϵp\+1eϵp−1\\alpha=\\frac\{e^\{\\epsilon\_\{p\}\}\+1\}\{e^\{\\epsilon\_\{p\}\}\-1\}\), clipping parameters\(𝐜,𝐫\)\(\\mathbf\{c\},\\mathbf\{r\}\), and global model𝐖global\(t\)\\mathbf\{W\}\_\{\\mathrm\{global\}\}^\{\(t\)\}\.

Setup:Each vehicle holds\(ℛ,e,KG\)\(\\mathcal\{R\},e,K\_\{G\}\), established before training using Algorithm[K\.1](https://arxiv.org/html/2610.41055#A11.alg1)\.

1:foreach client

𝒞i\\mathcal\{C\}\_\{i\}, in paralleldo

2:Receive

𝐖global\(t\),𝐜,𝐫\\mathbf\{W\}\_\{\\mathrm\{global\}\}^\{\(t\)\},\\mathbf\{c\},\\mathbf\{r\}from the server

3:Perform local reinforcement learning to obtain

𝜽i\\boldsymbol\{\\theta\}\_\{i\}
4:foreach coordinate

j∈\[m\]j\\in\[m\]do

5:

wi,j←min⁡\{cj\+rj,max⁡\{cj−rj,θi,j\}\}w\_\{i,j\}\\leftarrow\\min\\\{c\_\{j\}\+r\_\{j\},\\max\\\{c\_\{j\}\-r\_\{j\},\\theta\_\{i,j\}\\\}\\\}
6:

qi,j←12\+wi,j−cj2​rj​αq\_\{i,j\}\\leftarrow\\frac\{1\}\{2\}\+\\frac\{w\_\{i,j\}\-c\_\{j\}\}\{2r\_\{j\}\\alpha\}
7:

Vi,j,t←HiddenPairValue​\(KG,ℛ,e,i,j,t\)V\_\{i,j,t\}\\leftarrow\\textsc\{HiddenPairValue\}\(K\_\{G\},\\mathcal\{R\},e,i,j,t\)
8:

bi,j←𝟏\{Vi,j,t<qi,j\}b\_\{i,j\}\\leftarrow\\mathbf\{1\}\_\{\\\{V\_\{i,j,t\}<q\_\{i,j\}\\\}\}
9:endfor

10:Transmit

𝐛i=\(bi,j\)j∈\[m\]\\mathbf\{b\}\_\{i\}=\(b\_\{i,j\}\)\_\{j\\in\[m\]\}to the server

11:endfor

12:Server aggregation

13:foreach coordinate

j∈\[m\]j\\in\[m\]do

14:

W¯g,j←cj\+rj​αn​∑i=1n\(2​bi,j−1\)\\overline\{W\}\_\{g,j\}\\leftarrow c\_\{j\}\+\\dfrac\{r\_\{j\}\\alpha\}\{n\}\\displaystyle\\sum\_\{i=1\}^\{n\}\(2b\_\{i,j\}\-1\)
15:endfor

###### Theorem 1\(PLDP, unbiasedness, and pairwise MSE optimality of CPQ\)

Letc∈ℝc\\in\\mathbb\{R\},r\>0r\>0, and0<ϵp<∞0<\\epsilon\_\{p\}<\\infty\. Consider two clipped inputsw1,w2∈\[c−r,c\+r\]w\_\{1\},w\_\{2\}\\in\[c\-r,c\+r\]and their CPQ reconstructionsQ1,Q2Q\_\{1\},Q\_\{2\}, obtained using complementary random valuesVVand1−V1\-V, whereV∼Uniform⁡\[0,1\]V\\sim\\mathrm\{Uniform\}\[0,1\]\. Writeα=α⁡\(ϵp\)\\alpha=\\alpha\(\\epsilon\_\{p\}\)and definexk=\(wk−c\)/\(r​α\)x\_\{k\}=\(w\_\{k\}\-c\)/\(r\\alpha\),A=\(w1\+w2\)/2A=\(w\_\{1\}\+w\_\{2\}\)/2, andA^=\(Q1\+Q2\)/2\\widehat\{A\}=\(Q\_\{1\}\+Q\_\{2\}\)/2\.

1. \(i\)PLDP and unbiasedness\.EachQkQ\_\{k\}follows the same output distribution as the LDP\-FL quantizer and satisfies pureϵp\\epsilon\_\{p\}\-PLDP according to Definition[1](https://arxiv.org/html/2610.41055#Thmdefinition1)\. Moreover,𝔼⁡\[Qk\]=wk\\mathbb\{E\}\[Q\_\{k\}\]=w\_\{k\}, so𝔼⁡\[A^\]=A\\mathbb\{E\}\[\\widehat\{A\}\]=A\. Applied coordinatewise, CPQ also provides an unbiased reconstructed aggregate for any fixed set of clients\.
2. \(ii\)Pairwise MSE optimality\.Among all couplings of individually unbiased binary quantizers with reconstruction levelsc±r​αc\\pm r\\alphasatisfyingϵp\\epsilon\_\{p\}\-PLDP, CPQ minimizes the pair\-average MSE for every admissible input pair, attaining m∗​\(w1,w2\)=r2​α22​\[\|x1\+x2\|−\(x1\+x2\)22\]\.\\displaystyle m^\{\*\}\(w\_\{1\},w\_\{2\}\)=\\frac\{r^\{2\}\\alpha^\{2\}\}\{2\}\\left\[\|x\_\{1\}\+x\_\{2\}\|\-\\frac\{\(x\_\{1\}\+x\_\{2\}\)^\{2\}\}\{2\}\\right\]\.\(7\)This MSE is strictly smaller than that of independent quantization with the same output distributions\.

Proof sketch\.Since bothVVand1−V1\-Vare uniformly distributed, eachQkQ\_\{k\}follows the LDP\-FL output distribution and therefore satisfiesϵp\\epsilon\_\{p\}\-PLDP\. Furthermore,𝔼⁡\[Qk\]=c\+r​α​\(2​q​\(wk\)−1\)=wk\\mathbb\{E\}\[Q\_\{k\}\]=c\+r\\alpha\(2q\(w\_\{k\}\)\-1\)=w\_\{k\}, establishing unbiasedness\.

For the pairwise MSE, letUk=\(Qk−c\)/\(r​α\)∈\{−1,\+1\}U\_\{k\}=\(Q\_\{k\}\-c\)/\(r\\alpha\)\\in\\\{\-1,\+1\\\}, with𝔼⁡\[Uk\]=xk\\mathbb\{E\}\[U\_\{k\}\]=x\_\{k\}\. Expanding the pair\-average error gives

𝔼⁡\[\(A^−A\)2\]\\displaystyle\\mathbb\{E\}\[\(\\widehat\{A\}\-A\)^\{2\}\]=r2​α24​\[2\+2​𝔼​\[U1​U2\]−\(x1\+x2\)2\]\.\\displaystyle=\\frac\{r^\{2\}\\alpha^\{2\}\}\{4\}\\bigl\[2\+2\\mathbb\{E\}\[U\_\{1\}U\_\{2\}\]\-\(x\_\{1\}\+x\_\{2\}\)^\{2\}\\bigr\]\.The individual output distributions fix all terms except𝔼⁡\[U1​U2\]\\mathbb\{E\}\[U\_\{1\}U\_\{2\}\]\. For any coupling of these binary outputs, the Fréchet lower bound gives𝔼⁡\[U1​U2\]≥\|x1\+x2\|−1\\mathbb\{E\}\[U\_\{1\}U\_\{2\}\]\\geq\|x\_\{1\}\+x\_\{2\}\|\-1\. The complementary random values used by CPQ attain this bound, yielding \([7](https://arxiv.org/html/2610.41055#S3.E7)\)\.

Under independent quantization,𝔼⁡\[U1​U2\]=x1​x2\\mathbb\{E\}\[U\_\{1\}U\_\{2\}\]=x\_\{1\}x\_\{2\}, giving

mind−m∗=r2​α22​\[1\+x1​x2−\|x1\+x2\|\]\>0\.\\displaystyle m\_\{\\mathrm\{ind\}\}\-m^\{\*\}=\\frac\{r^\{2\}\\alpha^\{2\}\}\{2\}\\left\[1\+x\_\{1\}x\_\{2\}\-\|x\_\{1\}\+x\_\{2\}\|\\right\]\>0\.The inequality is strict because\|xk\|≤1/α<1\|x\_\{k\}\|\\leq 1/\\alpha<1\. The complete derivation is provided in Appendix[B](https://arxiv.org/html/2610.41055#A2)\.■\\blacksquare

The pairwise MSE result extends to population\-level aggregation when all included clients form complete pairs and distinct pairs use independent shared randomness\. Under these conditions, the aggregation error can be bounded using the pairwise result\.

###### Corollary 1\(Population aggregation MSE of CPQ\)

For a fixed coordinatejj, suppose thennclient updates included in aggregation formn/2n/2complete pairs, with independent shared randomness across distinct pairs\. All clients use the same public clipping parameters\(cj,rj\)\(c\_\{j\},r\_\{j\}\)\. Letw¯j=1n​∑i=1nwi,j\\bar\{w\}\_\{j\}=\\frac\{1\}\{n\}\\sum\_\{i=1\}^\{n\}w\_\{i,j\}denote the mean clipped parameter\. Then

𝔼⁡\[\(W¯g,j−w¯j\)2\]\\displaystyle\\mathbb\{E\}\\\!\\left\[\(\\overline\{W\}\_\{g,j\}\-\\bar\{w\}\_\{j\}\)^\{2\}\\right\]≤rj2n​κ​\(ϵp\),\\displaystyle\\leq\\frac\{r\_\{j\}^\{2\}\}\{n\}\\,\\kappa\(\\epsilon\_\{p\}\),\(8\)κ⁡\(ϵp\)\\displaystyle\\kappa\(\\epsilon\_\{p\}\)=\{α2​\(ϵp\)/2,α⁡\(ϵp\)≤2,2​\(α⁡\(ϵp\)−1\),α⁡\(ϵp\)\>2\.\\displaystyle=\\begin\{cases\}\\alpha^\{2\}\(\\epsilon\_\{p\}\)/2,&\\alpha\(\\epsilon\_\{p\}\)\\leq 2,\\\\ 2\\bigl\(\\alpha\(\\epsilon\_\{p\}\)\-1\\bigr\),&\\alpha\(\\epsilon\_\{p\}\)\>2\.\\end\{cases\}For every finiteϵp\>0\\epsilon\_\{p\}\>0,κ⁡\(ϵp\)<α2​\(ϵp\)\\kappa\(\\epsilon\_\{p\}\)<\\alpha^\{2\}\(\\epsilon\_\{p\}\), yielding a strictly tighter aggregation\-MSE bound than independent LDP\-FL in \([4](https://arxiv.org/html/2610.41055#S3.E4)\)\. Asϵp→0\\epsilon\_\{p\}\\to 0, the CPQ bound grows linearly inα⁡\(ϵp\)\\alpha\(\\epsilon\_\{p\}\), compared with quadratic growth for LDP\-FL\.

Proof\.Fix coordinatejjand writec=cjc=c\_\{j\},r=rjr=r\_\{j\}, andα=α⁡\(ϵp\)\\alpha=\\alpha\(\\epsilon\_\{p\}\)\. LetSℓS\_\{\\ell\}andsℓs\_\{\\ell\}denote the reconstructed and clipped\-parameter sums of pairℓ\\ell, respectively\. Since the pair\-sum errors are unbiased and independent across distinct pairs,

𝔼⁡\[\(W¯g,j−w¯j\)2\]=1n2​∑ℓ=1n/2𝔼⁡\[\(Sℓ−sℓ\)2\]\.\\mathbb\{E\}\\\!\\left\[\(\\overline\{W\}\_\{g,j\}\-\\bar\{w\}\_\{j\}\)^\{2\}\\right\]=\\frac\{1\}\{n^\{2\}\}\\sum\_\{\\ell=1\}^\{n/2\}\\mathbb\{E\}\\\!\\left\[\(S\_\{\\ell\}\-s\_\{\\ell\}\)^\{2\}\\right\]\.Fortℓ=\|sℓ−2​c\|∈\[0,2​r\]t\_\{\\ell\}=\|s\_\{\\ell\}\-2c\|\\in\[0,2r\], the pair\-sum MSE is four times the pair\-average MSE in \([7](https://arxiv.org/html/2610.41055#S3.E7)\), giving

𝔼⁡\[\(Sℓ−sℓ\)2\]=2​r​α​tℓ−tℓ2\.\\mathbb\{E\}\\\!\\left\[\(S\_\{\\ell\}\-s\_\{\\ell\}\)^\{2\}\\right\]=2r\\alpha t\_\{\\ell\}\-t\_\{\\ell\}^\{2\}\.This concave expression is maximized over\[0,2​r\]\[0,2r\]attℓ=min⁡\{r​α,2​r\}t\_\{\\ell\}=\\min\\\{r\\alpha,2r\\\}\. The resulting upper bound isr2​α2r^\{2\}\\alpha^\{2\}whenα≤2\\alpha\\leq 2and4​r2​\(α−1\)4r^\{2\}\(\\alpha\-1\)otherwise\. Summing over then/2n/2pairs yields \([8](https://arxiv.org/html/2610.41055#S3.E8)\)\. Finally,κ⁡\(ϵp\)<α2​\(ϵp\)\\kappa\(\\epsilon\_\{p\}\)<\\alpha^\{2\}\(\\epsilon\_\{p\}\)forα⁡\(ϵp\)\>1\\alpha\(\\epsilon\_\{p\}\)\>1, establishing the comparison with LDP\-FL\.■\\blacksquare

CPQ also supports partial participation, allowing each received update to contribute to aggregation even when its paired client’s update is unavailable\. Complete pairs retain the pairwise MSE advantage of CPQ, while unmatched clients contribute the same quantization\-error variance as independent LDP\-FL\. Consequently, for a fixed set of accepted clients selected independently of the quantization randomness, CPQ preserves unbiased aggregation and achieves MSE no greater than independent quantization of the same clients, with a strict improvement whenever at least one complete pair contributes\. The population bound in \([8](https://arxiv.org/html/2610.41055#S3.E8)\) characterizes the complete\-pair case\.

### 3\.4CPQ\-λ\\lambdaunder Stronger Observations

CPQ\-λ\\lambdaextends CPQ by combining complementary shared randomness with independent local randomness in the one\-bit quantization process\. The mixing probabilities control the dependence between paired outputs, allowing us to characterize aggregation\-error behavior and privacy under stronger observation models, including access to both outputs of a pair or shared\-randomness side information\. The one\-bit representation and server reconstruction rule remain unchanged\. We first describe the mixing mechanism and then establish its privacy and aggregation\-error properties\.

For a leader–follower pair and a fixed coordinate, letV∼Uniform⁡\[0,1\]V\\sim\\mathrm\{Uniform\}\[0,1\]denote the shared random value\. Each clientk∈\{1,2\}k\\in\\\{1,2\\\}independently draws a mixing indicatorCk∼Bernoulli⁡\(λk\)C\_\{k\}\\sim\\mathrm\{Bernoulli\}\(\\lambda\_\{k\}\)and a private random valueRk∼Uniform⁡\[0,1\]R\_\{k\}\\sim\\mathrm\{Uniform\}\[0,1\], whereλk∈\[0,1\]\\lambda\_\{k\}\\in\[0,1\]\. All these random variables are mutually independent\. WhenCk=1C\_\{k\}=1, the client uses its assigned shared randomness, whileCk=0C\_\{k\}=0selects independent local randomness\. The resulting quantization thresholds are

T1=C1​V\+\(1−C1\)​R1,T2=C2​\(1−V\)\+\(1−C2\)​R2\.T\_\{1\}=C\_\{1\}V\+\(1\-C\_\{1\}\)R\_\{1\},\\qquad T\_\{2\}=C\_\{2\}\(1\-V\)\+\(1\-C\_\{2\}\)R\_\{2\}\.\(9\)Using the quantization probabilityq⁡\(wk\)q\(w\_\{k\}\)defined in \([2](https://arxiv.org/html/2610.41055#S3.E2)\), each client transmitsbk=𝟏\{Tk<q\(wk\)\}b\_\{k\}=\\mathbf\{1\}\_\{\\\{T\_\{k\}<q\(w\_\{k\}\)\\\}\}\. Since both thresholds are uniformly distributed,Pr⁡\(bk=1\)=q⁡\(wk\)\\Pr\(b\_\{k\}=1\)=q\(w\_\{k\}\), and the reconstruction rule in \([6](https://arxiv.org/html/2610.41055#S3.E6)\) remains unchanged\.

Letμ=λ1​λ2\\mu=\\lambda\_\{1\}\\lambda\_\{2\}denote the probability that both clients select the shared\-randomness branch\. For fixed clipped inputs, the joint output distribution is

Pλ=μ​PCPQ\+\(1−μ\)​PIND,P\_\{\\lambda\}=\\mu P\_\{\\mathrm\{CPQ\}\}\+\(1\-\\mu\)P\_\{\\mathrm\{IND\}\},\(10\)wherePCPQP\_\{\\mathrm\{CPQ\}\}andPINDP\_\{\\mathrm\{IND\}\}denote the joint distributions under complementary CPQ and independent LDP\-FL quantization, respectively\. When at least one client selects independent local randomness, the two outputs are independent\. Thus,μ=0\\mu=0yields independent quantization, whileλ1=λ2=1\\lambda\_\{1\}=\\lambda\_\{2\}=1recovers CPQ\. The dependence between paired outputs motivates two privacy criteria beyond the individual\-output PLDP guarantee\. The first considers an observer with access to both bits of a known pair, while the second allows additional side information about the shared randomness and paired client\.

###### Definition 2\(Pair\-view PLDP\)

For a fixed pair and coordinate, suppose an observer knows the pairing and observes\(b1,b2\)∈\{0,1\}2\(b\_\{1\},b\_\{2\}\)\\in\\\{0,1\\\}^\{2\}\. The mechanism satisfiesϵ\\epsilon\-pair\-view PLDP for client 1 if, for everyw1,w1′,w2∈\[c−r,c\+r\]w\_\{1\},w\_\{1\}^\{\\prime\},w\_\{2\}\\in\[c\-r,c\+r\]and every set𝒯⊆\{0,1\}2\\mathcal\{T\}\\subseteq\\\{0,1\\\}^\{2\},

Pr⁡\(\(b1,b2\)∈𝒯∣w1,w2\)≤eϵ​Pr⁡\(\(b1,b2\)∈𝒯∣w1′,w2\)\.\\Pr\\\!\\left\(\(b\_\{1\},b\_\{2\}\)\\in\\mathcal\{T\}\\mid w\_\{1\},w\_\{2\}\\right\)\\leq e^\{\\epsilon\}\\Pr\\\!\\left\(\(b\_\{1\},b\_\{2\}\)\\in\\mathcal\{T\}\\mid w\_\{1\}^\{\\prime\},w\_\{2\}\\right\)\.\(11\)The definition for client 2 is symmetric, withw1w\_\{1\}held fixed\.

###### Definition 3\(PLDP under side information\)

For a fixed pair and coordinate, letZZdenote side information generated without access to the protected inputw1w\_\{1\}and independently of client 1’s private random variables\(C1,R1\)\(C\_\{1\},R\_\{1\}\)\. Non\-protected inputs included inZZare held fixed in the privacy comparison\. The mechanism satisfiesϵ\\epsilon\-PLDP for client 1 conditioned onZZif, for everyw1,w1′∈\[c−r,c\+r\]w\_\{1\},w\_\{1\}^\{\\prime\}\\in\[c\-r,c\+r\], every set𝒯⊆\{0,1\}\\mathcal\{T\}\\subseteq\\\{0,1\\\}, and almost every realizationzzofZZ,

Pr⁡\(b1∈𝒯∣w1,Z=z\)≤eϵ​Pr⁡\(b1∈𝒯∣w1′,Z=z\)\.\\Pr\(b\_\{1\}\\in\\mathcal\{T\}\\mid w\_\{1\},Z=z\)\\leq e^\{\\epsilon\}\\Pr\(b\_\{1\}\\in\\mathcal\{T\}\\mid w\_\{1\}^\{\\prime\},Z=z\)\.\(12\)The definition for client 2 is symmetric\.

For CPQ\-λ\\lambda, we consider the side informationZ1=\(V,C2,R2,w2\)Z\_\{1\}=\(V,C\_\{2\},R\_\{2\},w\_\{2\}\)for client 1, with the corresponding observation defined symmetrically for client 2\. This observation includes the shared random value and the paired client’s input and local randomization, but excludes the protected client’s private randomness\. We now characterize the privacy guarantees under these observation models and the associated aggregation\-MSE properties\.

###### Theorem 2\(Privacy and aggregation MSE of CPQ\-λ\\lambda\)

Consider CPQ\-λ\\lambdawith0<ϵp<∞0<\\epsilon\_\{p\}<\\inftyandλ1,λ2∈\[0,1\)\\lambda\_\{1\},\\lambda\_\{2\}\\in\[0,1\)\. For a fixed pair and coordinate, letw1,w2∈\[c−r,c\+r\]w\_\{1\},w\_\{2\}\\in\[c\-r,c\+r\], setμ=λ1​λ2\\mu=\\lambda\_\{1\}\\lambda\_\{2\}, and writeα=α⁡\(ϵp\)\\alpha=\\alpha\(\\epsilon\_\{p\}\)\. The following properties hold\.

1. \(a\)PLDP and unbiasedness\.Each client’s one\-bit output follows the LDP\-FL distribution and satisfies pureϵp\\epsilon\_\{p\}\-PLDP\. The reconstructed parameters and their arithmetic mean are unbiased\.
2. \(b\)Privacy under stronger observations\.Under the pair\-view observation of Definition[2](https://arxiv.org/html/2610.41055#Thmdefinition2), CPQ\-λ\\lambdasatisfiesϵS\\epsilon\_\{S\}\-pair\-view PLDP, where ϵS​\(ϵp,μ\)=ln⁡\(eϵp\+μ1−μ​\(eϵp−e−ϵp\)\)\.\\epsilon\_\{S\}\(\\epsilon\_\{p\},\\mu\)=\\ln\\\!\\left\(e^\{\\epsilon\_\{p\}\}\+\\frac\{\\mu\}\{1\-\\mu\}\\left\(e^\{\\epsilon\_\{p\}\}\-e^\{\-\\epsilon\_\{p\}\}\\right\)\\right\)\.\(13\)Under the side\-information observationZ1=\(V,C2,R2,w2\)Z\_\{1\}=\(V,C\_\{2\},R\_\{2\},w\_\{2\}\)of Definition[3](https://arxiv.org/html/2610.41055#Thmdefinition3), client 1 satisfiesϵC\\epsilon\_\{C\}\-PLDP, where ϵC​\(ϵp,λ1\)=ln⁡\(eϵp\+λ11−λ1\)\.\\epsilon\_\{C\}\(\\epsilon\_\{p\},\\lambda\_\{1\}\)=\\ln\\\!\\left\(\\frac\{e^\{\\epsilon\_\{p\}\}\+\\lambda\_\{1\}\}\{1\-\\lambda\_\{1\}\}\\right\)\.\(14\)Both bounds are tight\. The corresponding side\-information bound for client 2 follows by symmetry\.
3. \(c\)Pairwise MSE\.Letxk=\(wk−c\)/\(r​α\)x\_\{k\}=\(w\_\{k\}\-c\)/\(r\\alpha\), and letmIND​\(w1,w2\)=r2​α24​\(2−x12−x22\)m\_\{\\mathrm\{IND\}\}\(w\_\{1\},w\_\{2\}\)=\\frac\{r^\{2\}\\alpha^\{2\}\}\{4\}\(2\-x\_\{1\}^\{2\}\-x\_\{2\}^\{2\}\)denote the pair\-average MSE of independent LDP\-FL quantization\. Withm∗​\(w1,w2\)m^\{\*\}\(w\_\{1\},w\_\{2\}\)defined in \([7](https://arxiv.org/html/2610.41055#S3.E7)\), the CPQ\-λ\\lambdapair\-average MSE is mμ​\(w1,w2\)\\displaystyle m\_\{\\mu\}\(w\_\{1\},w\_\{2\}\)=\(1−μ\)​mIND​\(w1,w2\)\+μ​m∗​\(w1,w2\)\.\\displaystyle=\(1\-\\mu\)m\_\{\\mathrm\{IND\}\}\(w\_\{1\},w\_\{2\}\)\+\\mu m^\{\*\}\(w\_\{1\},w\_\{2\}\)\.\(15\)For everyμ\>0\\mu\>0, this MSE is strictly smaller than that of independent quantization for all admissible input pairs\.
4. \(d\)Population MSE\.For a fixed coordinatejj, suppose thennupdates included in aggregation formn/2n/2complete pairs, with independent randomness across distinct pairs\. Letμℓ\\mu\_\{\\ell\}denote the mixing probability of pairℓ\\ell, and defineμ¯=2n​∑ℓ=1n/2μℓ\\bar\{\\mu\}=\\frac\{2\}\{n\}\\sum\_\{\\ell=1\}^\{n/2\}\\mu\_\{\\ell\}\. Then 𝔼⁡\[\(W¯g,j−w¯j\)2\]\\displaystyle\\mathbb\{E\}\\\!\\left\[\(\\overline\{W\}\_\{g,j\}\-\\bar\{w\}\_\{j\}\)^\{2\}\\right\]≤rj2n​\[\(1−μ¯\)​α2​\(ϵp\)\+μ¯​κ​\(ϵp\)\],\\displaystyle\\leq\\frac\{r\_\{j\}^\{2\}\}\{n\}\\left\[\(1\-\\bar\{\\mu\}\)\\alpha^\{2\}\(\\epsilon\_\{p\}\)\+\\bar\{\\mu\}\\,\\kappa\(\\epsilon\_\{p\}\)\\right\],\(16\)whereκ\\kappais defined in \([8](https://arxiv.org/html/2610.41055#S3.E8)\)\.

Proof sketch\.Writeqk=q⁡\(wk\)q\_\{k\}=q\(w\_\{k\}\),q−=\(1\+eϵp\)−1q\_\{\-\}=\(1\+e^\{\\epsilon\_\{p\}\}\)^\{\-1\}, andq\+=1−q−q\_\{\+\}=1\-q\_\{\-\}\. Since each thresholdTkT\_\{k\}is uniformly distributed, the outputbkb\_\{k\}follows the LDP\-FL distribution, preservingϵp\\epsilon\_\{p\}\-PLDP and unbiased reconstruction\.

For pair\-view privacy, the finite output alphabet allows the privacy loss to be bounded through the likelihood ratios of the four possible bit pairs\. Using the mixture in \([10](https://arxiv.org/html/2610.41055#S3.E10)\), the largest ratio is attained for the output\(1,1\)\(1,1\)when comparingq1=q\+q\_\{1\}=q\_\{\+\}withq1′=q−q\_\{1\}^\{\\prime\}=q\_\{\-\}atq2=q\+q\_\{2\}=q\_\{\+\}\. This ratio equalseϵSe^\{\\epsilon\_\{S\}\}in \([13](https://arxiv.org/html/2610.41055#S3.E13)\), establishing the bound and its tightness\.

For the side\-information model, conditioning onZ1=\(V,C2,R2,w2\)Z\_\{1\}=\(V,C\_\{2\},R\_\{2\},w\_\{2\}\)leaves the protected client’s private randomness\(C1,R1\)\(C\_\{1\},R\_\{1\}\)undisclosed\. Hence

Pr\(b1=1∣w1,Z1\)=λ1𝟏\{V<q1\}\+\(1−λ1\)q1\.\\Pr\(b\_\{1\}=1\\mid w\_\{1\},Z\_\{1\}\)=\\lambda\_\{1\}\\mathbf\{1\}\_\{\\\{V<q\_\{1\}\\\}\}\+\(1\-\\lambda\_\{1\}\)q\_\{1\}\.Maximizing the conditional likelihood ratios over both possible bit values yieldseϵCe^\{\\epsilon\_\{C\}\}in \([14](https://arxiv.org/html/2610.41055#S3.E14)\)\. The bound is attained whenV∈\[q−,q\+\)V\\in\[q\_\{\-\},q\_\{\+\}\), proving tightness\. The result for client 2 follows symmetrically\.

The mixture representation directly gives the pairwise MSE identity in \([15](https://arxiv.org/html/2610.41055#S3.E15)\)\. Its strict improvement forμ\>0\\mu\>0follows from the pairwise optimality result of Theorem[1](https://arxiv.org/html/2610.41055#Thmtheorem1)\. For population aggregation, the independent, zero\-mean errors of complete pairs allow their MSE contributions to be summed\. Applying the independent\-quantization bound and Corollary[1](https://arxiv.org/html/2610.41055#Thmcorollary1)to each pair yields \([16](https://arxiv.org/html/2610.41055#S3.E16)\)\. Complete derivations are provided in Appendix[C](https://arxiv.org/html/2610.41055#A3)\.■\\blacksquare

### 3\.5Vector\-Level Privacy under Server Observation

We extend the privacy analysis of CPQ\-λ\\lambdato a complete model upload, complementing the parameter\-level and stronger\-observation guarantees established above\. For one communication round, letℬ=∏j=1mℐj\\mathcal\{B\}=\\prod\_\{j=1\}^\{m\}\\mathcal\{I\}\_\{j\}denote the set of admissible clipped model vectors\. We consider any two vectors𝐰i,𝐰i′∈ℬ\\mathbf\{w\}\_\{i\},\\mathbf\{w\}^\{\\prime\}\_\{i\}\\in\\mathcal\{B\}for a target vehicleii, while holding the public round state and all other vehicles’ clipped inputs fixed\.

###### Definition 4\(Vector\-Level Local Differential Privacy\)

Forϵv≥0\\epsilon\_\{v\}\\geq 0and0≤δv<10\\leq\\delta\_\{v\}<1, a randomized observation mechanismℳobs\\mathcal\{M\}\_\{\\mathrm\{obs\}\}satisfies\(ϵv,δv\)\(\\epsilon\_\{v\},\\delta\_\{v\}\)vector\-level local differential privacy if, for any target clientii, any two clipped model vectors𝐰i,𝐰i′∈ℬ\\mathbf\{w\}\_\{i\},\\mathbf\{w\}^\{\\prime\}\_\{i\}\\in\\mathcal\{B\}, and every measurable output set𝒮\\mathcal\{S\},

Pr⁡\(ℳobs​\(𝐰i\)∈𝒮\)≤eϵv​Pr⁡\(ℳobs​\(𝐰i′\)∈𝒮\)\+δv\.\\displaystyle\\Pr\\\!\\left\(\\mathcal\{M\}\_\{\\mathrm\{obs\}\}\(\\mathbf\{w\}\_\{i\}\)\\in\\mathcal\{S\}\\right\)\\leq e^\{\\epsilon\_\{v\}\}\\Pr\\\!\\left\(\\mathcal\{M\}\_\{\\mathrm\{obs\}\}\(\\mathbf\{w\}^\{\\prime\}\_\{i\}\)\\in\\mathcal\{S\}\\right\)\+\\delta\_\{v\}\.\(17\)The public round state and all other clients’ clipped inputs are held fixed in this comparison\.

We consider three observation models\. An*upload\-only observer*receives one client’s quantized model vector, while the*RSU observer*receives the quantized updates of all participating clients without knowing the secret pairing assignments or shared randomness\. We further consider a stronger*pairing\-revealed observer*that additionally knows the client pairings but not the shared random values\. Establishing privacy under this stronger observation also provides a guarantee for the RSU when the pairing assignments remain hidden\.

To establish vector\-level privacy for one complete CPQ\-λ\\lambdamodel upload, we use Rényi differential privacy \(RDP\)\([Mironov, 2017](https://arxiv.org/html/2610.41055#bib.bib21)\)\. For an orderν\>1\\nu\>1and discrete distributionsPPandQQ, the Rényi divergence is defined as

Dν\(P∥Q\)=1ν−1ln∑xP\(x\)νQ\(x\)1−ν\.D\_\{\\nu\}\(P\\\|Q\)=\\frac\{1\}\{\\nu\-1\}\\ln\\sum\_\{x\}P\(x\)^\{\\nu\}Q\(x\)^\{1\-\\nu\}\.\(18\)A mechanism satisfies\(ν,ρ\)\(\\nu,\\rho\)\-RDP if this divergence is at mostρ\\rhofor every admissible input comparison\. We apply this criterion to the joint CPQ\-λ\\lambdaoutput distributions at each coordinate\. Under independent randomization across coordinates, the RDP bounds compose additively, yielding an\(ϵv,δv\)\(\\epsilon\_\{v\},\\delta\_\{v\}\)vector\-level privacy guarantee for any0<δv<10<\\delta\_\{v\}<1, whereϵv=ρ\+ln⁡\(1/δv\)/\(ν−1\)\\epsilon\_\{v\}=\\rho\+\\ln\(1/\\delta\_\{v\}\)/\(\\nu\-1\)\.

For symmetric CPQ\-λ\\lambda, defineq−=\(1\+eϵp\)−1q\_\{\-\}=\(1\+e^\{\\epsilon\_\{p\}\}\)^\{\-1\},q\+=1−q−q\_\{\+\}=1\-q\_\{\-\}, andμ=λ2\\mu=\\lambda^\{2\}\. For a fixed coordinate, letPu,zP\_\{u,z\}denote the joint distribution of the paired output bits\(B1,B2\)\(B\_\{1\},B\_\{2\}\), withPr⁡\(B1=1\)=u\\Pr\(B\_\{1\}=1\)=uandPr⁡\(B2=1\)=z\\Pr\(B\_\{2\}=1\)=z, whereu,z∈\[q−,q\+\]u,z\\in\[q\_\{\-\},q\_\{\+\}\]\. By \([10](https://arxiv.org/html/2610.41055#S3.E10)\),

Pu,z​\(1,1\)=\(1−μ\)​u​z\+μ​\(u\+z−1\)\+,P\_\{u,z\}\(1,1\)=\(1\-\\mu\)uz\+\\mu\(u\+z\-1\)\_\{\+\},where\(x\)\+=max⁡\{x,0\}\(x\)\_\{\+\}=\\max\\\{x,0\\\}\. The remaining joint probabilities are determined by the two Bernoulli marginals\.

###### Theorem 3\(Vector\-level privacy of CPQ\-λ\\lambda\)

Consider one model upload using symmetric CPQ\-λ\\lambda, withϵp\>0\\epsilon\_\{p\}\>0and0≤λ<10\\leq\\lambda<1\. Assume independent ideal randomization across coordinates and distinct client pairs, with pair assignments independent of the protected inputs\. The public round state and all other clients’ clipped inputs are held fixed\.

Under the pairing\-revealed observation model, the observer sees all quantized uploads and knows the client pairings but not the shared random values\. For any Rényi orderν\>1\\nu\>1, the exact worst\-case per\-coordinate divergence is

dν\\displaystyle d\_\{\\nu\}=1ν−1​ln⁡max\(u,v\)∈\{\(q−,q\+\),\(q\+,q−\)\}z∈\{q−,q\+\}\\displaystyle=\\frac\{1\}\{\\nu\-1\}\\ln\\max\_\{\\begin\{subarray\}\{c\}\(u,v\)\\in\\\{\(q\_\{\-\},q\_\{\+\}\),\(q\_\{\+\},q\_\{\-\}\)\\\}\\\\ z\\in\\\{q\_\{\-\},q\_\{\+\}\\\}\\end\{subarray\}\}\(19\)∑x∈\{0,1\}2Pu,z​\(x\)ν​Pv,z​\(x\)1−ν\.\\displaystyle\\sum\_\{x\\in\\\{0,1\\\}^\{2\}\}P\_\{u,z\}\(x\)^\{\\nu\}P\_\{v,z\}\(x\)^\{1\-\\nu\}\.
For a model withmmparameters, CPQ\-λ\\lambdasatisfies\(ϵv,δv\)\(\\epsilon\_\{v\},\\delta\_\{v\}\)vector\-level local differential privacy for one complete upload, where, for any0<δv<10<\\delta\_\{v\}<1, an RDP\-based privacy guarantee is obtained with

ϵv=infν\>1\[m​dν\+ln⁡\(1/δv\)ν−1\]\.\\epsilon\_\{v\}=\\inf\_\{\\nu\>1\}\\left\[m\\,d\_\{\\nu\}\+\\frac\{\\ln\(1/\\delta\_\{v\}\)\}\{\\nu\-1\}\\right\]\.\(20\)This guarantee holds with pairings revealed and therefore also applies to the RSU observation model in which pairings remain hidden\.

Proof sketch\.For a fixed partner probabilityzz, the partner’s output distribution is unchanged when the target input varies\. Conditioning on the partner’s bit yields Bernoulli distributions whose success probabilities are nondecreasing in the target probabilityuu\. The largest Rényi divergence is therefore attained when the alternative target probabilities areq−q\_\{\-\}andq\+q\_\{\+\}, in either order\.

For these target endpoints, the joint output probabilities are affine inzz\. The joint convexity of the Rényi power sum forν\>1\\nu\>1then places the maximum atz∈\{q−,q\+\}z\\in\\\{q\_\{\-\},q\_\{\+\}\\\}\. This establishes the exact per\-coordinate expression in \([19](https://arxiv.org/html/2610.41055#S3.E19)\)\.

Under independent coordinate randomization, the joint observation distribution factorizes across themmmodel coordinates\. Outputs of pairs not containing the target client have identical distributions under the two protected inputs and contribute zero divergence\. Hence the total RDP divergence is bounded bym​dνm\\,d\_\{\\nu\}\. Converting this bound to approximate differential privacy and optimizing overν\>1\\nu\>1yields \([20](https://arxiv.org/html/2610.41055#S3.E20)\)\. Hiding the pairing assignments is a post\-processing of the pairing\-revealed observation and preserves the guarantee\. The complete proof is provided in Appendix[D](https://arxiv.org/html/2610.41055#A4)\.■\\blacksquare

We compare the analytical per\-coordinate FedAvg MSE under a common vector\-level privacy target of\(ϵv,δv\)=\(1,10−5\)\(\\epsilon\_\{v\},\\delta\_\{v\}\)=\(1,10^\{\-5\}\)for one complete model upload\. All mechanisms are calibrated using the same RDP accounting framework, withm=29,653m=29\{,\}653parameters,K=50K=50vehicles, and clipping radiusr=0\.02r=0\.02\. To isolate the error introduced by privacy randomization, we consider identical local and global model parameters, such thatwi,j=cjw\_\{i,j\}=c\_\{j\}for all clients and coordinates\. For binary quantization, defineA⁡\(s\)=r⁡\(es\+1\)/\(es−1\)A\(s\)=r\(e^\{s\}\+1\)/\(e^\{s\}\-1\), wheressdenotes the mechanism\-specific parameter\-level privacy budget\. CPQ\-λ\\lambdauses symmetric mixing withλ1=λ2=λ=0\.627\\lambda\_\{1\}=\\lambda\_\{2\}=\\lambda=0\.627and is evaluated under the pairing\-revealed observation model\.

Table 1:Analytical FedAvg MSE under matched vector\-level privacy\.As shown in Table[1](https://arxiv.org/html/2610.41055#S3.T1), CPQ\-λ\\lambdaachieves 16\.5% lower aggregation MSE than independent LDP\-FL at the same RDP\-certified vector\-level privacy target, while retaining one\-bit communication\. The analysis in Appendix[D](https://arxiv.org/html/2610.41055#A4)further establishes an MSE advantage over LDP\-FL for all admissible clipped inputs under the considered calibration\. These comparisons use sufficient RDP\-based privacy certificates and characterize theoretical aggregation error rather than routing performance under the stated vector\-level privacy settings\.

## 4Post\-Quantum Cryptography

In vehicular FRL, digital signatures authenticate global\-model distributions and local\-update uploads, allowing recipients to verify message origin and integrity\([Twardokus et al\., 2024](https://arxiv.org/html/2610.41055#bib.bib38)\)\. We consider post\-quantum signatures to address long\-term quantum security concerns while examining how their communication and computational overhead affects authenticated model exchange over mobility\-constrained V2I links\.

We evaluate three post\-quantum signature schemes with distinct cryptographic constructions and authentication overheads\. ML\-DSA, derived from CRYSTALS\-Dilithium\([Ducas et al\., 2018](https://arxiv.org/html/2610.41055#bib.bib10)\), is a module\-lattice\-based scheme standardized under FIPS 204\([National Institute of Standards and Technology, 2024b](https://arxiv.org/html/2610.41055#bib.bib25)\), while SLH\-DSA, derived from SPHINCS\+\([Bernstein et al\., 2019](https://arxiv.org/html/2610.41055#bib.bib5)\), is a stateless hash\-based scheme standardized under FIPS 205\([National Institute of Standards and Technology, 2024c](https://arxiv.org/html/2610.41055#bib.bib26)\)\. Falcon is an NTRU\-lattice\-based signature scheme\([Fouque et al\., 2020](https://arxiv.org/html/2610.41055#bib.bib14)\)selected by NIST as the basis for FN\-DSA\([Alagic et al\., 2022](https://arxiv.org/html/2610.41055#bib.bib2)\)\. The primary mobility\-coupled V2I evaluation uses ML\-DSA\-44 to hold authentication constant, while controlled benchmarks and an additional signature\-sensitivity experiment compare ML\-DSA\-44, Falcon\-512, and SLH\-DSA\-SHA2\-128f\.

The evaluated parameter sets differ substantially in authentication overhead\. ML\-DSA\-44 produces fixed\-size 2,420\-byte signatures\([National Institute of Standards and Technology, 2024b](https://arxiv.org/html/2610.41055#bib.bib25)\), while Falcon\-512 generates compact, variable\-length signatures averaging 655\.1 bytes in our controlled microbenchmark\([Fouque et al\., 2020](https://arxiv.org/html/2610.41055#bib.bib14)\)\. In contrast, SLH\-DSA\-SHA2\-128f produces 17,088\-byte signatures\([National Institute of Standards and Technology, 2024c](https://arxiv.org/html/2610.41055#bib.bib26)\)\. These differences are particularly relevant for bit\-packed one\-bit model updates, where authentication data can constitute a substantial fraction of the transmitted payload\. Detailed measurements of public\-key sizes, signature sizes, and cryptographic operation times are provided in Appendix[H](https://arxiv.org/html/2610.41055#A8)\.

## 5Federated Deep Q\-Learning for Vehicular Routing

This section describes the adopted vehicular routing formulation, local DQN training, and federated model aggregation\.

### 5\.1Vehicular Routing Formulation

We adopt FLDQN\([Mamond et al\., 2025](https://arxiv.org/html/2610.41055#bib.bib20)\), a federated routing framework based on deep Q\-networks \(DQNs\)\([Mnih et al\., 2015](https://arxiv.org/html/2610.41055#bib.bib22)\)\. Each learning vehicle selects feasible outgoing road edges at successive intersections in response to evolving traffic conditions\. In the SUMO\-based simulation\([Lopez et al\., 2018](https://arxiv.org/html/2610.41055#bib.bib19)\), learning vehicles obtain network\-wide traffic observations through the TraCI interface to construct their routing states, while background vehicles contribute to congestion without participating in federated training\. For a road network withMMdirected edges, the state of a learning vehicle at decision stepttis defined as

𝐒t=\[𝐧t,𝐯¯t,𝐥,𝐩t,𝐩dest\],\\mathbf\{S\}\_\{t\}=\\left\[\\mathbf\{n\}\_\{t\},\\,\\bar\{\\mathbf\{v\}\}\_\{t\},\\,\\mathbf\{l\},\\,\\mathbf\{p\}\_\{t\},\\,\\mathbf\{p\}\_\{\\mathrm\{dest\}\}\\right\],\(21\)
where𝐧t,𝐯¯t,𝐥∈ℝM\\mathbf\{n\}\_\{t\},\\bar\{\\mathbf\{v\}\}\_\{t\},\\mathbf\{l\}\\in\\mathbb\{R\}^\{M\}represent the edgewise vehicle counts, mean speeds, and lengths, respectively\. The vectors𝐩t,𝐩dest∈ℝ2\\mathbf\{p\}\_\{t\},\\mathbf\{p\}\_\{\\mathrm\{dest\}\}\\in\\mathbb\{R\}^\{2\}specify the coordinates of the starting point of the vehicle’s current lane and its destination\. The resulting state dimension is3​M\+43M\+4\.

At each routing decision, the DQN produces Q\-values for a fixed set of action indices𝒜max\\mathcal\{A\}\_\{\\max\}, whose size corresponds to the maximum number of turning choices at any intersection\. Since feasible turns vary by location, unavailable actions are masked during action selection, ensuring that each selected action corresponds to a reachable outgoing edge\.

Routing rewards are based on the travel time experienced under the prevailing traffic conditions\. Letutu\_\{t\}denote the simulation time at which a vehicle enters the edge associated with routing decisiontt\. Upon entering the subsequent edge, the base reward is

rtbase=−\(ut\+1−ut\)\.r\_\{t\}^\{\\mathrm\{base\}\}=\-\(u\_\{t\+1\}\-u\_\{t\}\)\.\(22\)To discourage cyclic routes, an additional penalty is imposed for repeated edge visits\. LetNt​\(et\)N\_\{t\}\(e\_\{t\}\)denote the number of visits to the selected edgeete\_\{t\}within the current trip, including the current visit\. The complete reward is

rt=rtbase\+\{0,Nt​\(et\)=1,−κ2,Nt​\(et\)=2,−κ3\+,Nt​\(et\)≥3,r\_\{t\}=r\_\{t\}^\{\\mathrm\{base\}\}\+\\begin\{cases\}0,&N\_\{t\}\(e\_\{t\}\)=1,\\\\ \-\\kappa\_\{2\},&N\_\{t\}\(e\_\{t\}\)=2,\\\\ \-\\kappa\_\{3\+\},&N\_\{t\}\(e\_\{t\}\)\\geq 3,\\end\{cases\}\(23\)whereκ3\+\>κ2\>0\\kappa\_\{3\+\}\>\\kappa\_\{2\}\>0penalize the second and subsequent repeated visits\. The reward thus favors shorter experienced travel times while discouraging repeated edge traversal\.

A vehicle’s trip ends when it reaches its destination, encounters a dead end, or exceeds the maximum trip durationTtripT\_\{\\mathrm\{trip\}\}\. Time\-limit truncations are stored as nonterminal transitions in the local experience replay buffer, as detailed in Appendix[G](https://arxiv.org/html/2610.41055#A7)\.

### 5\.2Local DQN Training and Federated Aggregation

Each vehicle maintains an online Q\-networkQ⁡\(s,a,θi\)Q\(s,a;\\theta\_\{i\}\)and a target networkQ⁡\(s,a,θi−\)Q\(s,a;\\theta\_\{i\}^\{\-\}\), whose parameters are periodically synchronized with the online network\. The networks use fully connected layers with nonlinear hidden activations and a linear output layer\. Each agent collects transitions in a local experience replay bufferℬi\\mathcal\{B\}\_\{i\}and trains its online network using sampled mini\-batches\. Routing decisions follow anϵ\\epsilon\-greedy exploration policy\.

For a sampled transitionjj, letRjR\_\{j\}denote the observed reward\. The Bellman target is

yj=Rj\+γ⁡\(1−dj\)​maxa′∈𝒜max⁡Q⁡\(sj′,a′,θi−\),y\_\{j\}=R\_\{j\}\+\\gamma\(1\-d\_\{j\}\)\\max\_\{a^\{\\prime\}\\in\\mathcal\{A\}\_\{\\max\}\}Q\(s\_\{j\}^\{\\prime\},a^\{\\prime\};\\theta\_\{i\}^\{\-\}\),\(24\)whereγ\\gammais the discount factor anddj∈\{0,1\}d\_\{j\}\\in\\\{0,1\\\}indicates whether the transition is terminal\. The target maximization uses the full network output action set, whereas infeasible turns are masked during routing action selection\.

Defining the temporal\-difference error asej=yj−Q⁡\(sj,aj,θi\)e\_\{j\}=y\_\{j\}\-Q\(s\_\{j\},a\_\{j\};\\theta\_\{i\}\), the online network minimizes the Huber loss

ℒHuber​\(θi\)\\displaystyle\\mathcal\{L\}\_\{\\mathrm\{Huber\}\}\(\\theta\_\{i\}\)=1B​∑j=1BℓδH​\(ej\),\\displaystyle=\\frac\{1\}\{B\}\\sum\_\{j=1\}^\{B\}\\ell\_\{\\delta\_\{\\mathrm\{H\}\}\}\(e\_\{j\}\),\(25\)ℓδH​\(e\)\\displaystyle\\ell\_\{\\delta\_\{\\mathrm\{H\}\}\}\(e\)=\{12​e2,\|e\|≤δH,δH​\(\|e\|−δH2\),\|e\|\>δH,\\displaystyle=\\begin\{cases\}\\frac\{1\}\{2\}e^\{2\},&\|e\|\\leq\\delta\_\{\\mathrm\{H\}\},\\\\ \\delta\_\{\\mathrm\{H\}\}\\left\(\|e\|\-\\frac\{\\delta\_\{\\mathrm\{H\}\}\}\{2\}\\right\),&\|e\|\>\\delta\_\{\\mathrm\{H\}\},\\end\{cases\}whereBBis the mini\-batch size andδH\\delta\_\{\\mathrm\{H\}\}is the Huber\-loss threshold\. The network architecture, exploration schedule, and optimization parameters are specified in Appendix[G](https://arxiv.org/html/2610.41055#A7)\.

At federated roundtt, each vehicle performsEElocal training episodes using its available model\. Vehicles that successfully receive the authenticated current\-round global model𝐖global\(t\)\\mathbf\{W\}\_\{\\mathrm\{global\}\}^\{\(t\)\}are eligible to upload their locally trained online\-network parameters after privacy processing\. Target networks and experience replay buffers remain local\.

Let𝒱t\\mathcal\{V\}\_\{t\}denote the set of clients whose current\-round uploads are successfully delivered and verified\. For eachi∈𝒱ti\\in\\mathcal\{V\}\_\{t\}, let𝐰¯i\(t\+1\)\\overline\{\\mathbf\{w\}\}\_\{i\}^\{\(t\+1\)\}denote the model parameters reconstructed at the RSU using the selected privacy mechanism\. The global model is updated through uniform federated averaging

𝐖global\(t\+1\)=1\|𝒱t\|​∑i∈𝒱t𝐰¯i\(t\+1\),\\mathbf\{W\}\_\{\\mathrm\{global\}\}^\{\(t\+1\)\}=\\frac\{1\}\{\|\\mathcal\{V\}\_\{t\}\|\}\\sum\_\{i\\in\\mathcal\{V\}\_\{t\}\}\\overline\{\\mathbf\{w\}\}\_\{i\}^\{\(t\+1\)\},\(26\)when𝒱t≠∅\\mathcal\{V\}\_\{t\}\\neq\\emptyset\. Otherwise, the global model remains unchanged\. The authenticated, contact\-dependent model\-exchange procedure is detailed in Section[6](https://arxiv.org/html/2610.41055#S6)\.

## 6System Design and Implementation

The implementation couples a shared SUMO traffic environment with ns\-3 through synchronized vehicle mobility updates\. Learning vehicles train local DQN policies using SUMO traffic observations, while a roadside unit \(RSU\) coordinates post\-quantum\-authenticated model exchange over simulated IEEE 802\.11p V2I links\. Global models are distributed in full precision, whereas eligible vehicles return privacy\-protected updates\. Mobility\-dependent delivery and authentication determine which updates are accepted for federated aggregation\. Figure[1](https://arxiv.org/html/2610.41055#S1.F1)illustrates the integrated architecture\.

### 6\.1Privacy\-Protected and Authenticated Model Exchange

Before privacy processing, each eligible vehicle clips its locally trained model parameters relative to the authenticated current\-round global model𝐖global\(t\)\\mathbf\{W\}\_\{\\mathrm\{global\}\}^\{\(t\)\}\. For coordinatejj, the clipping center is the corresponding global parameterWglobal,j\(t\)W\_\{\\mathrm\{global\},j\}^\{\(t\)\}, with a common radiusr\>0r\>0across all coordinates\. The clipped parameter is

wi,j\(t\+1\)=Wglobal,j\(t\)\+clip⁡\(θi,j\(t\+1\)−Wglobal,j\(t\),−r,r\),w\_\{i,j\}^\{\(t\+1\)\}=W\_\{\\mathrm\{global\},j\}^\{\(t\)\}\+\\operatorname\{clip\}\\\!\\left\(\\theta\_\{i,j\}^\{\(t\+1\)\}\-W\_\{\\mathrm\{global\},j\}^\{\(t\)\},\-r,\\;r\\right\),\(27\)whereθi,j\(t\+1\)\\theta\_\{i,j\}^\{\(t\+1\)\}denotes the locally trained online\-network parameter\. This instantiates the public clipping parameters of Section[3](https://arxiv.org/html/2610.41055#S3)ascj=Wglobal,j\(t\)c\_\{j\}=W\_\{\\mathrm\{global\},j\}^\{\(t\)\}andrj=rr\_\{j\}=r, which are also used for server\-side quantized\-parameter reconstruction\.

For CPQ and CPQ\-λ\\lambda, vehicles establish a shared group secret and agree on an ordered participant listℛ\\mathcal\{R\}before federated training\. Secret\-derived ChaCha20 streams\([Nir and Langley, 2018](https://arxiv.org/html/2610.41055#bib.bib27)\)determine coordinate\- and round\-dependent pair assignments and complementary pseudorandom values for paired clients\. These values are generated locally without exchanging pairing information during training\. The RSU relays authenticated setup messages but does not obtain the group secret or pairing assignments, which are not required for model reconstruction\. Pairings are formed over the entire groupℛ\\mathcal\{R\}, independently of successful wireless delivery\. Consequently, a received update remains usable when its partner’s update is unavailable, although the corresponding pairwise error cancellation is not realized\. The complete setup and randomness\-derivation procedures are provided in Appendix[K](https://arxiv.org/html/2610.41055#A11)\.

CPQ, CPQ\-λ\\lambda, and LDP\-FL represent each model parameter with one bit\. The binary outputs are packed separately for each parameter tensor usingnumpy\.packbits, with the original tensor shapes stored as metadata\. The packed arrays and metadata are serialized into compressed NPZ payloads\. At the RSU, padding bits are removed according to the original tensor sizes, and the binary values are restored to their tensor shapes before parameter reconstruction\. In contrast, Gaussian and Laplace updates retain float32 representations, as do global\-model downlinks\. These payloads are subsequently authenticated and transmitted through the V2I communication framework\.

Before federated training, the RSU and learning vehicles generate post\-quantum signing key pairs and register their public keys through an assumed authenticated bootstrap channel, which may be supported by V2X credential\-management infrastructure\([Twardokus et al\., 2024](https://arxiv.org/html/2610.41055#bib.bib38)\)\. The primary mobility\-coupled evaluation uses ML\-DSA\-44, while the signature\-sensitivity experiment considers Falcon\-512 and SLH\-DSA\-SHA2\-128f\. In each configuration, the selected signature scheme authenticates global\-model downlinks, local\-update uplinks, and CPQ/CPQ\-λ\\lambdagroup\-establishment messages\. For CPQ and CPQ\-λ\\lambda, vehicles use ML\-KEM\-512 key pairs to establish a shared group secret through authenticated, ML\-KEM\-protected messages relayed by the RSU\([National Institute of Standards and Technology, 2024a](https://arxiv.org/html/2610.41055#bib.bib24)\)\. The RSU does not obtain the group secret, and the establishment protocol is provided in Appendix[K](https://arxiv.org/html/2610.41055#A11)\.

Each authenticated model object contains a compressed NPZ payloadPP, a serialized JSON headerHbytesH\_\{\\rm bytes\}, and a post\-quantum signatureσ\\sigma, with length fields delimiting the header and signature\. The header identifies the sender, vehicle, federated round, transmission direction, and signature scheme, together with payload metadata\. For both uplink and downlink exchanges, the sender signs the serialized header and payload jointly

σ=Sign𝒜\(𝑠𝑘sender,Hbytes∥P\),\\sigma=\\mathrm\{Sign\}\_\{\\mathcal\{A\}\}\\\!\\left\(\\mathit\{sk\}\_\{\\rm sender\},H\_\{\\rm bytes\}\\,\\\|\\,P\\right\),\(28\)where𝒜\\mathcal\{A\}denotes the selected signature scheme\. After complete SR\-ARQ reassembly, the receiver verifies the signature using the sender’s registered public key and validates the signed sender, vehicle, round, and direction against the expected transfer context\. These checks bind the model content to its authenticated communication context\. Only verified current\-round downlinks establish uplink eligibility, while only successfully delivered and verified uplinks contribute to aggregation\.

### 6\.2Mobility\-Coupled V2I Communication

We use ns\-3\([Riley and Henderson, 2010](https://arxiv.org/html/2610.41055#bib.bib28)\)to model IEEE 802\.11p V2I communication between learning vehicles and a single RSU located at junction J3 of the SUMO road network\. The wireless channel combines log\-distance path loss, Nakagami\-mmfading, and constant\-speed propagation delay, with fixed\-rate OFDM transmission and an 802\.11p ad hoc MAC\. The evaluated road\-network topology is shown in Appendix[F](https://arxiv.org/html/2610.41055#A6), while the radio and communication parameters are detailed in Appendix[G](https://arxiv.org/html/2610.41055#A7)\.

At each SUMO simulation stepΔ​t\\Delta t, the positions and velocities of active learning vehicles are supplied to ns\-3, which advances synchronously with the SUMO simulation clock\. Between updates, vehicle positions evolve according to a constant\-velocity mobility model\. Only theKKlearning vehicles are represented as wireless nodes, while background traffic affects vehicle mobility without generating wireless interference\. Vehicles that have not departed or are no longer active are kept outside communication range\. Transfer outcomes and delays are measured in simulation time, independently of training execution time\.

The RSU periodically broadcasts discovery beacons over the simulated IEEE 802\.11p channel\. A vehicle becomes eligible for model exchange after successfully receiving at leastNbeaconN\_\{\\mathrm\{beacon\}\}beacons within a sliding observation window of durationTobsT\_\{\\mathrm\{obs\}\}\. This reception\-based criterion accounts for wireless channel conditions rather than relying solely on geometric proximity\. Contact eligibility, however, does not guarantee successful delivery of a complete model object\.

Pending transfers from eligible vehicles are managed through a first\-come, first\-served \(FCFS\) queue, with only one active uplink or downlink transfer permitted at a time\. The RSU periodically updates contact eligibility and schedules the next eligible request after processing completed attempts\. Waiting vehicles that lose contact are removed from the queue, while unfinished transfers may be retried during subsequent contact opportunities before the communication phase ends\. Requests with additional transfer work rejoin at the end of the queue after each completed attempt\. Packet\-level reliability is handled separately by the SR\-ARQ mechanism described below\. The beacon and scheduling parameters are reported in Appendix[G](https://arxiv.org/html/2610.41055#A7)\.

Algorithm 2One contact\-dependent federated round1:Global model

𝐖global\(t\)\\mathbf\{W\}\_\{\\rm global\}^\{\(t\)\}, clients

𝒞\\mathcal\{C\}, local episodes

EE, privacy mechanism

ℳ\\mathcal\{M\}, signature scheme

𝒜\\mathcal\{A\}, network model

𝒩\\mathcal\{N\}
2:Updated global model

𝐖global\(t\+1\)\\mathbf\{W\}\_\{\\rm global\}^\{\(t\+1\)\}
3:Authenticated downlink

4:

ℰt←AuthenticatedDL𝒜,𝒩⁡\(𝐖global\(t\),𝒞,t\)\\mathcal\{E\}\_\{t\}\\leftarrow\\operatorname\{AuthenticatedDL\}\_\{\\mathcal\{A\},\\mathcal\{N\}\}\(\\mathbf\{W\}\_\{\\rm global\}^\{\(t\)\},\\mathcal\{C\},t\)
5:Local training

6:foreach

i∈𝒞i\\in\\mathcal\{C\}do

7:

𝐖istart←SelectModel⁡\(i,ℰt,𝐖global\(t\)\)\\mathbf\{W\}\_\{i\}^\{\\rm start\}\\leftarrow\\operatorname\{SelectModel\}\(i,\\mathcal\{E\}\_\{t\},\\mathbf\{W\}\_\{\\rm global\}^\{\(t\)\}\)
8:endfor

9:

\{𝜽i\(t\+1\)\}←TrainSharedSUMO⁡\(\{𝐖istart\},E\)\\\{\\boldsymbol\{\\theta\}\_\{i\}^\{\(t\+1\)\}\\\}\\leftarrow\\operatorname\{TrainSharedSUMO\}\(\\\{\\mathbf\{W\}\_\{i\}^\{\\rm start\}\\\},E\)
10:Protected uplink preparation

11:foreach

i∈ℰti\\in\\mathcal\{E\}\_\{t\}do

12:

𝐰i←Clip⁡\(𝜽i\(t\+1\),𝐖global\(t\),r\)\\mathbf\{w\}\_\{i\}\\leftarrow\\operatorname\{Clip\}\(\\boldsymbol\{\\theta\}\_\{i\}^\{\(t\+1\)\};\\mathbf\{W\}\_\{\\rm global\}^\{\(t\)\},r\)
13:

Pi←Encodeℳ⁡\(ℳ⁡\(𝐰i\)\)P\_\{i\}\\leftarrow\\operatorname\{Encode\}\_\{\\mathcal\{M\}\}\(\\mathcal\{M\}\(\\mathbf\{w\}\_\{i\}\)\)
14:

Ui←SignObject𝒜⁡\(i,t,UL,Pi\)U\_\{i\}\\leftarrow\\operatorname\{SignObject\}\_\{\\mathcal\{A\}\}\(i,t,\\mathrm\{UL\},P\_\{i\}\)
15:endfor

16:Contact\-dependent uplink

17:

𝒫tUL←UplinkDrive𝒩⁡\(\{Ui\}i∈ℰt\)\\mathcal\{P\}\_\{t\}^\{\\rm UL\}\\leftarrow\\operatorname\{UplinkDrive\}\_\{\\mathcal\{N\}\}\(\\\{U\_\{i\}\\\}\_\{i\\in\\mathcal\{E\}\_\{t\}\}\)
18:Verified aggregation

19:

𝒱t←∅\\mathcal\{V\}\_\{t\}\\leftarrow\\emptyset
20:foreach complete

Ui∈𝒫tULU\_\{i\}\\in\\mathcal\{P\}\_\{t\}^\{\\rm UL\}do

21:if

i∈ℰti\\in\\mathcal\{E\}\_\{t\}and

VerifyContext𝒜⁡\(Ui,i,t,UL\)\\operatorname\{VerifyContext\}\_\{\\mathcal\{A\}\}\(U\_\{i\},i,t,\\mathrm\{UL\}\)then

22:

𝐰¯i\(t\+1\)←Reconstructℳ⁡\(Pi,𝐖global\(t\),r\)\\overline\{\\mathbf\{w\}\}\_\{i\}^\{\(t\+1\)\}\\leftarrow\\operatorname\{Reconstruct\}\_\{\\mathcal\{M\}\}\(P\_\{i\};\\mathbf\{W\}\_\{\\rm global\}^\{\(t\)\},r\)
23:

𝒱t←𝒱t∪\{i\}\\mathcal\{V\}\_\{t\}\\leftarrow\\mathcal\{V\}\_\{t\}\\cup\\\{i\\\}
24:endif

25:endfor

26:if

𝒱t≠∅\\mathcal\{V\}\_\{t\}\\neq\\emptysetthen

27:Update

𝐖global\(t\+1\)\\mathbf\{W\}\_\{\\rm global\}^\{\(t\+1\)\}using \([26](https://arxiv.org/html/2610.41055#S5.E26)\)

28:else

29:

𝐖global\(t\+1\)←𝐖global\(t\)\\mathbf\{W\}\_\{\\rm global\}^\{\(t\+1\)\}\\leftarrow\\mathbf\{W\}\_\{\\rm global\}^\{\(t\)\}
30:endif

Authenticated model objects may exceed the payload capacity of a single IEEE 802\.11p frame\. We therefore use a custom Selective Repeat ARQ \(SR\-ARQ\) layer over UDP to fragment each object into indexed chunks and reassemble it at the receiver\. Each chunk carries message identification, sequencing, and CRC\-32 integrity metadata\. The receiver acknowledges valid chunks, while the sender retransmits unacknowledged chunks using a sliding window and a bounded retry count\. An attempt fails when a chunk exhausts its retransmission limit, after which the RSU may schedule another attempt during a subsequent contact opportunity before the communication drive ends\. Complete objects undergo signature and context verification after reassembly\. The transport configuration and chunk\-header format are detailed in Appendix[G](https://arxiv.org/html/2610.41055#A7)\(Table[G\.2](https://arxiv.org/html/2610.41055#A7.T2)\)\.

A persistent TCP control connection coordinates the Python co\-simulation driver and the ns\-3 process\. It supports mobility updates, contact queries, asynchronous transfer requests, and synchronized simulation advancement, while reporting transfer outcomes and completion times\. Model data is transmitted through the simulated UDP/IEEE 802\.11p wireless channel rather than the TCP control connection\. The end of each communication drive defines the deadline for pending model exchanges\.

The communication mechanisms described above are integrated into the contact\-dependent federated round summarized in Algorithm[2](https://arxiv.org/html/2610.41055#alg2)\. Let𝒞\\mathcal\{C\}denote the learning vehicles,ℰt⊆𝒞\\mathcal\{E\}\_\{t\}\\subseteq\\mathcal\{C\}those that successfully receive and authenticate the round\-ttglobal model, and𝒱t⊆ℰt\\mathcal\{V\}\_\{t\}\\subseteq\\mathcal\{E\}\_\{t\}those whose current\-round updates are delivered and verified\. Downlink and uplink exchanges occur in separate SUMO communication drives, during which vehicles follow their routing policies without learning\. Between these drives, all vehicles train in a shared SUMO environment using either the authenticated current\-round model or their previously held model\. Only vehicles inℰt\\mathcal\{E\}\_\{t\}are eligible to upload for aggregation\.

## 7Experimental Results

### 7\.1Experimental Setup and Evaluation Protocol

Figure 2:Evolution of mean evaluation travel time across privacy budgets during federated training\.The primary experiments use SUMO 1\.26 on a road network with 30 directed edges, 50 learning vehicles distributed equally across five starting edges, and a common destination\. Background traffic follows randomly generated trips with an average departure interval of 1\.75 s\. After a 200 s simulation warm\-up, learning vehicles depart over a 100 s window, with individual trips limited to 600 s\. The road topology and detailed traffic configuration are provided in Appendix[F](https://arxiv.org/html/2610.41055#A6)and Appendix[G](https://arxiv.org/html/2610.41055#A7)\.

The primary ideal\-communication and mobility\-coupled evaluations run forT=100T=100federated rounds withE=10E=10local training episodes per round\. Under ideal communication, all learning vehicles receive the current global model and contribute to aggregation in every round\. In the mobility\-coupled setting, participation depends on successful authenticated model delivery over the simulated V2I links, following Algorithm[2](https://arxiv.org/html/2610.41055#alg2)\.

We compare CPQ, CPQ\-λ\\lambda\(λ=0\.75\\lambda=0\.75\), LDP\-FL, Gaussian, and Laplace mechanisms, using full\-precision FLDQN without privacy perturbation as a reference\. The ideal\-communication experiments considerϵp∈\{0\.3,0\.5,1,2,5\}\\epsilon\_\{p\}\\in\\\{0\.3,0\.5,1,2,5\\\}, while the primary mobility\-coupled evaluation usesϵp=1\\epsilon\_\{p\}=1\. All private mechanisms use a clipping radius ofr=0\.02r=0\.02\. The privacy budgets apply to individual model parameters within one communication round\. CPQ, CPQ\-λ\\lambda, LDP\-FL, and Laplace satisfy pureϵp\\epsilon\_\{p\}\-PLDP, whereas Gaussian is calibrated to\(ϵp,δp\)\(\\epsilon\_\{p\},\\delta\_\{p\}\)\-PLDP withδp=10−5\\delta\_\{p\}=10^\{\-5\}\.

After each federated round, the global model is evaluated using greedy routing without exploration, further training, or model exchange\. The primary evaluations use three fixed SUMO traffic scenarios with 50 learning vehicles each\. Routing performance is measured by mean travel time over all evaluated trips, including elapsed time until termination for unsuccessful trips, and arrival rate, defined as the percentage of vehicles reaching their destinations within the trip limit\. Late\-round results are averaged over rounds 91–100 for each of five independent seeds\. We report the mean and sample standard deviation across these run\-level averages, using identical evaluation scenarios across the compared mechanisms and runs\.

### 7\.2Privacy–Utility Under Ideal Communication

Figure[2](https://arxiv.org/html/2610.41055#S7.F2)shows the evolution of routing performance across the evaluated privacy budgets\. Mean travel times are computed over nonoverlapping 10\-round intervals and averaged across five independent runs, with full\-precision FLDQN shown as a no\-privacy reference\. Under tighter privacy constraints, CPQ achieves lower late\-round travel times than the other private mechanisms, while Gaussian perturbation exhibits particularly poor performance atϵp=0\.3\\epsilon\_\{p\}=0\.3\. Performance differences generally narrow asϵp\\epsilon\_\{p\}increases, although the learning trajectories remain variable and do not follow a consistent ordering across rounds\. To avoid selecting favorable training checkpoints, Table[2](https://arxiv.org/html/2610.41055#S7.T2)reports results over the fixed rounds 91–100\.

CPQ achieves lower mean travel time than independent LDP\-FL at all five evaluated privacy budgets and ranks first among the private mechanisms at four of them\. It also attains the highest mean arrival rate at three budgets, while CPQ\-λ\\lambda\(λ=0\.75\\lambda=0\.75\) leads atϵp=1\\epsilon\_\{p\}=1; atϵp=5\\epsilon\_\{p\}=5, Laplace has the lowest travel time and LDP\-FL the highest arrival rate\. These results indicate favorable average routing utility for CPQ, particularly under tighter privacy constraints\. However, the observed differences vary across seeds\. The seed\-paired analysis in Appendix[J](https://arxiv.org/html/2610.41055#A10)finds that the nominal 95% confidence interval for the CPQ–LDP\-FL travel\-time difference excludes zero atϵp=1\\epsilon\_\{p\}=1, but not at the other evaluated budgets\.

Table 2:Privacy–utility performance of federated routing across privacy budgets\.We evaluate symmetric CPQ\-λ\\lambdaunder ideal communication atϵp=1\\epsilon\_\{p\}=1, withλ∈\{0\.25,0\.5,0\.75,0\.9,1\}\\lambda\\in\\\{0\.25,0\.5,0\.75,0\.9,1\\\}and independent LDP\-FL\. The fully correlated CPQ mechanism corresponds toλ=1\\lambda=1\. Empirical aggregation MSE is computed each round as the mean squared difference, across model parameters, between the reconstructed FedAvg model and the average of the clients’ clipped models, excluding clipping error\. Table[3](https://arxiv.org/html/2610.41055#S7.T3)reports MSE averaged over 100 rounds, together with routing metrics averaged over rounds 91–100 and ten seeds\. Reported uncertainties are 95% Student\-ttconfidence half\-widths\. The stronger\-observation privacy bounds follow \([13](https://arxiv.org/html/2610.41055#S3.E13)\) and \([14](https://arxiv.org/html/2610.41055#S3.E14)\)\.

Table 3:CPQ\-λ\\lambdaablation atϵp=1\\epsilon\_\{p\}=1\.Empirical aggregation MSE decreases monotonically withλ\\lambda, consistent with the correlation\-mixture relationship in \([15](https://arxiv.org/html/2610.41055#S3.E15)\)\. Atλ=0\.75\\lambda=0\.75, CPQ\-λ\\lambdareduces aggregation MSE by 54\.0% relative to independent LDP\-FL while retaining finite pair\-view and shared\-randomness side\-information privacy bounds ofϵS=1\.75\\epsilon\_\{S\}=1\.75andϵC=2\.63\\epsilon\_\{C\}=2\.63\. All intermediate mixing settings achieve lower mean travel times than LDP\-FL, although routing performance does not vary monotonically withλ\\lambda\. Theλ=0\.75\\lambda=0\.75configuration provides routing performance close to fully correlated CPQ, with variability across seeds limiting finer comparisons\.

We further examine sensitivity to the learning\-vehicle population by comparing CPQ and LDP\-FL atϵp=1\\epsilon\_\{p\}=1forK∈\{10,25,50\}K\\in\\\{10,25,50\\\}under ideal communication\. CPQ achieves positive mean travel\-time and arrival\-rate gains at all three population sizes, with lower travel times in all five matched seeds atK=25K=25andK=50K=50\. The travel\-time confidence intervals exclude zero for these two populations, while greater variability is observed atK=10K=10\. Because the learning vehicles share the SUMO environment, varyingKKalso changes traffic demand\. Detailed results are provided in Appendix[J](https://arxiv.org/html/2610.41055#A10)\.

### 7\.3Authenticated V2I Communication

We evaluate the impact of model\-update representation on authenticated IEEE 802\.11p V2I communication under mobility\-dependent connectivity\. All mechanisms receive full\-precision global\-model downlinks and use ML\-DSA\-44 authentication\. CPQ, CPQ\-λ\\lambda, and LDP\-FL transmit bit\-packed one\-bit updates, whereas Gaussian, Laplace, and the no\-privacy baseline use full\-precision uplinks\. Figure[3](https://arxiv.org/html/2610.41055#S7.F3)compares transmitted traffic, uplink transfer success, and delivery latency\.

Figure 3:Authenticated V2I communication under mobility\-dependent connectivity using ML\-DSA\-44\. Panels show wireless traffic, distance\-dependent uplink attempt success, and successful\-uplink latency\.As shown in Fig\.[3](https://arxiv.org/html/2610.41055#S7.F3), one\-bit quantization reduces authenticated uplink size from113\.76113\.76to8\.658\.65KB, a92\.4%92\.4\\%reduction\. Including retransmissions and unsuccessful attempts, mean uplink traffic decreases by96\.5%96\.5\\%, while the use of full\-precision global\-model downlinks limits the overall traffic reduction to approximately34%34\\%\. Compact updates also improve delivery under intermittent contact\. CPQ and LDP\-FL achieve96\.3%96\.3\\%uplink transfer\-attempt success, compared with32\.5%32\.5\\%for the full\-precision baseline, while median successful\-uplink latency decreases from2\.542\.54to0\.250\.25s\. The distance\-dependent results further demonstrate the reliability advantage of shorter model transfers as vehicles move away from the RSU\.

To examine the effect of post\-quantum signature selection on authenticated V2I communication, we compare ML\-DSA\-44, Falcon\-512, and SLH\-DSA\-SHA2\-128f with full\-precision no\-privacy and one\-bit CPQ updates atϵp=1\\epsilon\_\{p\}=1\. The experiment uses the same mobility\-coupled IEEE 802\.11p framework over 30 federated rounds, with one simulation seed per configuration\. Table[4](https://arxiv.org/html/2610.41055#S7.T4)reports authenticated uplink size, transfer\-attempt success, and overall delivery of initiated uplinks across all rounds\.

Table 4:Signature\-scheme sensitivity of V2I uplinks\. FP denotes full\-precision model updates\.The effect of signature selection is most pronounced for compact CPQ updates\. Falcon\-512 produces the smallest authenticated uplink at6\.896\.89KB, achieving99\.4%99\.4\\%transfer\-attempt success and99\.8%99\.8\\%overall delivery\. In contrast, SLH\-DSA\-SHA2\-128f increases the CPQ uplink to23\.3423\.34KB, with corresponding rates of48\.2%48\.2\\%and93\.1%93\.1\\%\. For full\-precision uploads, attempt success remains near30%30\\%across all three schemes, indicating that the larger model payload dominates transmission requirements\. These results illustrate the growing importance of authentication overhead when model updates are highly compressed\. Additional distance\-dependent results are provided in Appendix[I](https://arxiv.org/html/2610.41055#A9)\.

### 7\.4Mobility\-Constrained Federated Learning

We next examine how authenticated, mobility\-dependent V2I communication affects federated participation and routing performance atϵp=1\\epsilon\_\{p\}=1\. Unlike ideal communication, only vehicles receiving the authenticated current\-round global model can contribute updates, and aggregation includes only successfully delivered and verified uploads\. Table[5](https://arxiv.org/html/2610.41055#S7.T5)compares the six mechanisms across matched simulation seeds\. Routing metrics are averaged over rounds 91–100, while communication and participation metrics cover all 100 rounds\. Values are reported as mean±\\pmsample standard deviation across five seeds\.

Figure 4:Routing performance and verified aggregation under mobility\-constrained V2I communication\.Figure 5:Shadow\-run origin inference atϵp=0\.3\\epsilon\_\{p\}\\\!=\\\!0\.3\.
Table 5:Routing performance and participation under mobility\-constrained V2I communication\.*Notes:*UL delivery is conditioned on initiated uploads\.Δ​T\\Delta Tis the seed\-paired V2I minus ideal\-communication travel time, with positive values indicating an increase\.

Mobility\-dependent connectivity substantially restricts federated participation, with authenticated downlink reach remaining between51\.8%51\.8\\%and55\.6%55\.6\\%across the evaluated methods\. Among initiated uplinks, CPQ, CPQ\-λ\\lambda\(λ=0\.75\\lambda=0\.75\), and LDP\-FL achieve99\.499\.4–99\.5%99\.5\\%delivery, compared with75\.7%75\.7\\%for the full\-precision no\-privacy baseline\. Consequently, the one\-bit mechanisms contribute26\.126\.1–26\.526\.5verified updates per round, approximately3333–35%35\\%more than the baseline’s19\.619\.6\. Figure[5](https://arxiv.org/html/2610.41055#S7.F5)\(b\) shows that this participation advantage persists throughout training\. These results demonstrate the practical importance of compact uplinks, although full\-precision downlink delivery continues to limit aggregation participation\.

The resulting routing performance is shown in Fig\.[5](https://arxiv.org/html/2610.41055#S7.F5)\(a\)\. Despite nearly identical communication characteristics and aggregation participation, CPQ achieves a14\.3%14\.3\\%lower mean travel time than independent LDP\-FL \(167\.0167\.0versus194\.9194\.9s\) and a higher arrival rate \(79\.8%79\.8\\%versus72\.8%72\.8\\%\)\. CPQ\-λ\\lambda\(λ=0\.75\\lambda=0\.75\) achieves intermediate mean travel time \(177\.2177\.2s\) and arrival rate \(75\.8%75\.8\\%\) while retaining finite stronger\-observation privacy bounds\. This favorable mean routing trend is consistent with the aggregation\-accuracy benefits of correlated quantization, although variability across seeds limits conclusions about the magnitude of the utility improvement\. The seed\-paired comparisons with ideal communication further show variable increases in travel time across mechanisms, highlighting the combined influence of wireless delivery constraints and privacy perturbation on federated routing\.

### 7\.5Empirical Vehicle\-Origin Inference

We evaluate vehicle\-origin inference by an honest\-but\-curious RSU under mobility\-constrained communication\. The experiment uses 50 learning vehicles distributed across ten possible starting edges, giving a random\-guessing accuracy of10%10\\%\. Atϵp=0\.3\\epsilon\_\{p\}=0\.3, the attacker observes successfully received model updates, which can be associated with the same vehicle across rounds, but does not know private trajectories or the CPQ group secret\. We consider a known\-origin attacker with one labeled vehicle from each class and a shadow\-run attacker trained on independent simulations without labeled vehicles in the target deployment\. Both attacks accumulate evidence across federated rounds and are evaluated using three independent seeds\. Implementation details are provided in Appendix[L](https://arxiv.org/html/2610.41055#A12)\.

As shown in Fig\.[5](https://arxiv.org/html/2610.41055#S7.F5), shadow\-run inference accuracy reaches91%91\\%after 100 rounds without privacy, compared with30%30\\%for CPQ and22%22\\%for LDP\-FL\. In the known\-origin setting, the corresponding accuracies are69%69\\%,13%13\\%, and12%12\\%\. Both private mechanisms substantially reduce the effectiveness of the evaluated attacks, although the shadow\-run results remain above chance after prolonged observation\. These findings provide application\-level evidence of reduced vehicle\-origin leakage and complement the single\-upload privacy guarantees established in Section[3](https://arxiv.org/html/2610.41055#S3)\.

## 8Conclusion

This paper presented a privacy\-preserving and post\-quantum\-authenticated framework for vehicular federated reinforcement learning under mobility\-constrained V2I communication\. CPQ reduces one\-bit aggregation error through correlated randomness while preserving parameter\-level local differential privacy, and CPQ\-λ\\lambdaextends the framework with stronger\-observation and vector\-level privacy guarantees\. Theoretical analysis and experiments demonstrate the aggregation\-accuracy benefits of controlled correlation, while mobility\-coupled evaluations show that compact authenticated updates improve reliable delivery and federated participation while supporting favorable routing performance\. Vehicle\-origin inference experiments further demonstrate reduced empirical privacy leakage\. These findings highlight the importance of jointly considering privacy, authentication, and communication efficiency in vehicular learning\. Future work will explore more efficient global\-model distribution and coordination across multiple RSUs\.

## Code and Data Availability

## Acknowledgments

This work is based upon the work partly supported by the National Center for Transportation Cybersecurity and Resiliency \(TraCR\) \(a U\.S\. Department of Transportation National University Transportation Center\) headquartered at Clemson University, Clemson, South Carolina, USA\. Any opinions, findings, conclusions, and recommendations expressed in this material are those of the author\(s\) and do not necessarily reflect the views of TraCR, and the U\.S\. Government assumes no liability for the contents or use thereof\.

## References

- Abadi et al\. \(2016\)Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang\.Deep learning with differential privacy\.In*Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security*, pages 308–318, 2016\.
- Alagic et al\. \(2022\)Gorjan Alagic, Daniel Apon, David Cooper, Quynh Dang, Thinh Dang, John Kelsey, Jacob Lichtinger, Yi\-Kai Liu, Carl Miller, Dustin Moody, Rene Peralta, Ray Perlner, Angela Robinson, and Daniel Smith\-Tone\.Status report on the third round of the NIST post\-quantum cryptography standardization process\.NIST IR 8413\-upd1, National Institute of Standards and Technology, September 2022\.
- Balle and Wang \(2018\)Borja Balle and Yu\-Xiang Wang\.Improving the Gaussian mechanism for differential privacy: Analytical calibration and optimal denoising\.In*Proceedings of the 35th International Conference on Machine Learning*, volume 80 of*Proceedings of Machine Learning Research*, pages 394–403\. PMLR, 2018\.
- Bao et al\. \(2023\)Jingjing Bao, Celimuge Wu, Yangfei Lin, Lei Zhong, Xianfu Chen, and Rui Yin\.A scalable approach to optimize traffic signal control with federated reinforcement learning\.*Scientific Reports*, 13\(1\):19184, 2023\.doi:10\.1038/s41598\-023\-46074\-3\.
- Bernstein et al\. \(2019\)Daniel J\. Bernstein, Andreas Hülsing, Stefan Kölbl, Ruben Niederhagen, Joost Rijneveld, and Peter Schwabe\.The SPHINCS\+ signature framework\.In*Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security \(CCS\)*, pages 2129–2146, 2019\.doi:10\.1145/3319535\.3363229\.
- Byun et al\. \(2024\)Sanghyun Byun, Arijet Sarker, Sang\-Yoon Chang, and Jugal Kalita\.Secure aggregation for privacy\-preserving federated learning in vehicular networks\.*ACM Journal on Autonomous Transportation Systems*, 1\(3\):1–25, 2024\.doi:10\.1145/3657644\.
- Chaudhuri et al\. \(2022\)Kamalika Chaudhuri, Chuan Guo, and Mike Rabbat\.Privacy\-aware compression for federated data analysis\.In*Proc\. Conf\. Uncertainty Artif\. Intell\. \(UAI\)*, volume 180 of*PMLR*, pages 296–306, 2022\.
- Chen et al\. \(2022\)Wei\-Ning Chen, Ayfer Özgür, and Peter Kairouz\.The Poisson binomial mechanism for unbiased federated learning with secure aggregation\.In*Proc\. Int\. Conf\. Mach\. Learn\. \(ICML\)*, volume 162 of*PMLR*, pages 3490–3506, 2022\.
- Ding et al\. \(2017\)Bolin Ding, Janardhan Kulkarni, and Sergey Yekhanin\.Collecting telemetry data privately\.In*Advances in Neural Information Processing Systems*, volume 30, pages 3571–3580, 2017\.
- Ducas et al\. \(2018\)Léo Ducas, Eike Kiltz, Tancrède Lepoint, Vadim Lyubashevsky, Peter Schwabe, Gregor Seiler, and Damien Stehlé\.CRYSTALS\-Dilithium: A lattice\-based digital signature scheme\.*IACR Transactions on Cryptographic Hardware and Embedded Systems*, 2018\(1\):238–268, 2018\.doi:10\.13154/tches\.v2018\.i1\.238\-268\.
- Duchi et al\. \(2018\)John C\. Duchi, Michael I\. Jordan, and Martin J\. Wainwright\.Minimax optimal procedures for locally private estimation\.*Journal of the American Statistical Association*, 113\(521\):182–201, 2018\.
- Dwork and Roth \(2014\)Cynthia Dwork and Aaron Roth\.The algorithmic foundations of differential privacy\.*Foundations and Trends® in Theoretical Computer Science*, 9\(3–4\):211–407, 2014\.doi:10\.1561/0400000042\.
- Fan et al\. \(2021\)Xiaofeng Fan, Yining Ma, Zhongxiang Dai, Wei Jing, Cheston Tan, and Bryan Kian Hsiang Low\.Fault\-tolerant federated reinforcement learning with theoretical guarantee\.*Advances in Neural Information Processing Systems*, 34:1007–1021, 2021\.
- Fouque et al\. \(2020\)Pierre\-Alain Fouque, Jeffrey Hoffstein, Paul Kirchner, Vadim Lyubashevsky, Thomas Pornin, Thomas Prest, Thomas Ricosset, Gregor Seiler, William Whyte, and Zhenfei Zhang\.Falcon: Fast\-Fourier lattice\-based compact signatures over NTRU – specification v1\.2\.Submission to the NIST Post\-Quantum Cryptography Standardization Process, Round 3, 2020\.URL[https://falcon\-sign\.info](https://falcon-sign.info/)\.
- Fredrikson et al\. \(2015\)Matt Fredrikson, Somesh Jha, and Thomas Ristenpart\.Model inversion attacks that exploit confidence information and basic countermeasures\.In*Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security*, pages 1322–1333, 2015\.
- Gao et al\. \(2024\)Yunfei Gao, Mingliu Liu, Xiaopeng Yuan, Yulin Hu, Peng Sun, and Anke Schmeink\.Federated deep reinforcement learning based trajectory design for UAV\-assisted networks with mobile ground devices\.*Scientific Reports*, 14\(1\):22753, 2024\.doi:10\.1038/s41598\-024\-72654\-y\.
- Jin et al\. \(2022\)Hao Jin, Yang Peng, Wenhao Yang, Shusen Wang, and Zhihua Zhang\.Federated reinforcement learning with environment heterogeneity\.In*Proceedings of the 25th International Conference on Artificial Intelligence and Statistics*, volume 151 of*Proceedings of Machine Learning Research*, pages 18–37\. PMLR, 2022\.URL[https://proceedings\.mlr\.press/v151/jin22a\.html](https://proceedings.mlr.press/v151/jin22a.html)\.
- Jing et al\. \(2025\)Yao Jing, Bin Guo, Nuo Li, Ruonan Xu, and Zhiwen Yu\.Federated multi\-agent reinforcement learning: A comprehensive survey of methods, applications and challenges\.*Expert Systems with Applications*, 293:128729, 2025\.doi:10\.1016/j\.eswa\.2025\.128729\.
- Lopez et al\. \(2018\)Pablo Alvarez Lopez, Michael Behrisch, Laura Bieker\-Walz, Jakob Erdmann, Yun\-Pang Flötteröd, Robert Hilbrich, Leonhard Lücken, Johannes Rummel, Peter Wagner, and Evamarie Wießner\.Microscopic traffic simulation using SUMO\.In*2018 21st International Conference on Intelligent Transportation Systems \(ITSC\)*, pages 2575–2582\. IEEE, 2018\.
- Mamond et al\. \(2025\)Abdul Wahab Mamond, Majid Kundroo, Seong\-eun Yoo, Seonghoon Kim, and Taehong Kim\.FLDQN: Cooperative multi\-agent federated reinforcement learning for solving travel time minimization problems in dynamic environments using SUMO simulation\.*Sensors*, 25\(3\):911, 2025\.doi:10\.3390/s25030911\.
- Mironov \(2017\)Ilya Mironov\.Rényi differential privacy\.In*2017 IEEE 30th Computer Security Foundations Symposium \(CSF\)*, pages 263–275, 2017\.doi:10\.1109/CSF\.2017\.11\.
- Mnih et al\. \(2015\)Volodymyr Mnih, Koray Kavukcuoglu, David Silver, Andrei A Rusu, Joel Veness, Marc G Bellemare, Alex Graves, Martin Riedmiller, Andreas K Fidjeland, Georg Ostrovski, et al\.Human\-level control through deep reinforcement learning\.*Nature*, 518\(7540\):529–533, 2015\.
- Nasr et al\. \(2019\)Milad Nasr, Reza Shokri, and Amir Houmansadr\.Comprehensive privacy analysis of deep learning: Passive and active white\-box inference attacks against centralized and federated learning\.In*2019 IEEE Symposium on Security and Privacy \(SP\)*, pages 739–753\. IEEE, 2019\.
- National Institute of Standards and Technology \(2024a\)National Institute of Standards and Technology\.Module\-lattice\-based key\-encapsulation mechanism standard\.Technical Report FIPS PUB 203, U\.S\. Department of Commerce, 2024a\.
- National Institute of Standards and Technology \(2024b\)National Institute of Standards and Technology\.Module\-lattice\-based digital signature standard\.Technical Report FIPS PUB 204, National Institute of Standards and Technology, August 2024b\.
- National Institute of Standards and Technology \(2024c\)National Institute of Standards and Technology\.Stateless hash\-based digital signature standard\.Technical Report FIPS PUB 205, National Institute of Standards and Technology, August 2024c\.
- Nir and Langley \(2018\)Y\. Nir and A\. Langley\.ChaCha20 and Poly1305 for IETF protocols\.RFC 8439, RFC Editor, June 2018\.URL[https://www\.rfc\-editor\.org/rfc/rfc8439\.txt](https://www.rfc-editor.org/rfc/rfc8439.txt)\.
- Riley and Henderson \(2010\)George F\. Riley and Thomas R\. Henderson\.The ns\-3 network simulator\.In Klaus Wehrle, Mesut Güneş, and James Gross, editors,*Modeling and Tools for Network Simulation*, pages 15–34\. Springer Berlin Heidelberg, Berlin, Heidelberg, 2010\.doi:10\.1007/978\-3\-642\-12331\-3\_2\.
- Rondinone et al\. \(2013\)Michele Rondinone, Julen Maneros, Daniel Krajzewicz, Ramon Bauza, Pasquale Cataldi, Fatma Hrizi, Javier Gozalvez, Vineet Kumar, Matthias Röckl, Lan Lin, et al\.iTETRIS: A modular simulation platform for the large scale evaluation of cooperative ITS applications\.*Simulation Modelling Practice and Theory*, 34:99–125, 2013\.
- Salehi et al\. \(2024\)Hojat Allah Salehi, Md Jueal Mia, S Sandeep Pradhan, M Hadi Amini, and Farhad Shirani\.CorBin\-FL: A differentially private federated learning mechanism using common randomness\.*arXiv preprint arXiv:2409\.13133*, 2024\.
- Shokri et al\. \(2017\)Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov\.Membership inference attacks against machine learning models\.In*2017 IEEE Symposium on Security and Privacy \(SP\)*, pages 3–18\. IEEE, 2017\.
- Shor \(1999\)Peter W Shor\.Polynomial\-time algorithms for prime factorization and discrete logarithms on a quantum computer\.*SIAM Review*, 41\(2\):303–332, 1999\.
- Sommer et al\. \(2011\)Christoph Sommer, Reinhard German, and Falko Dressler\.Bidirectionally coupled network and road traffic simulation for improved IVC analysis\.*IEEE Transactions on Mobile Computing*, 10\(1\):3–15, 2011\.doi:10\.1109/TMC\.2010\.133\.
- Su et al\. \(2023\)Haoran Su, Yaofeng D Zhong, Joseph YJ Chow, Biswadip Dey, and Li Jin\.EMVLight: A multi\-agent reinforcement learning framework for an emergency vehicle decentralized routing and traffic signal control system\.*Transportation Research Part C: Emerging Technologies*, 146:103955, 2023\.
- Sun et al\. \(2021\)Lichao Sun, Jianwei Qian, and Xun Chen\.LDP\-FL: Practical private aggregation in federated learning with local differential privacy\.In*Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence \(IJCAI\-21\)*, pages 1571–1578\. International Joint Conferences on Artificial Intelligence Organization, 2021\.doi:10\.24963/ijcai\.2021/217\.
- Tang et al\. \(2024\)Zhiwei Tang, Yanmeng Wang, and Tsung\-Hui Chang\.z\-SignFedAvg: A unified stochastic sign\-based compression for federated learning\.In*Proceedings of the AAAI Conference on Artificial Intelligence*, volume 38, pages 15301–15309, 2024\.doi:10\.1609/aaai\.v38i14\.29454\.
- Tian et al\. \(2025\)Yuan Tian, Yanfeng Shi, Yue Zhang, and Qikun Tian\.Personalized federated learning scheme for autonomous driving based on correlated differential privacy\.*Sensors*, 25\(1\):178, 2025\.doi:10\.3390/s25010178\.
- Twardokus et al\. \(2024\)Geoff Twardokus, Nina Bindel, Hanif Rahbari, and Sarah McCarthy\.When cryptography needs a hand: Practical post\-quantum authentication for V2V communications\.In*Proceedings of the Network and Distributed System Security Symposium \(NDSS\)*, 2024\.URL[https://www\.ndss\-symposium\.org/ndss\-paper/when\-cryptography\-needs\-a\-hand\-practical\-post\-quantum\-authentication\-for\-v2v\-communications/](https://www.ndss-symposium.org/ndss-paper/when-cryptography-needs-a-hand-practical-post-quantum-authentication-for-v2v-communications/)\.
- Wang et al\. \(2026\)Wenhua Wang, Qiong Wu, Pingyi Fan, Nan Cheng, Wen Chen, Jiangzhou Wang, and Khaled B\. Letaief\.Optimizing age of information in vehicular edge computing with federated graph neural network multi\-agent reinforcement learning\.*IEEE Transactions on Wireless Communications*, 25:23017–23032, 2026\.doi:10\.1109/TWC\.2026\.3729785\.
- Xiang and Su \(2023\)Ming Xiang and Lili Su\.Distributed non\-convex optimization with one\-bit compressors on heterogeneous data: Efficient and resilient algorithms\.*arXiv preprint arXiv:2210\.00665*, 2023\.
- Ye et al\. \(2021\)Yutong Ye, Wupan Zhao, Tongquan Wei, Shiyan Hu, and Mingsong Chen\.FedLight: Federated reinforcement learning for autonomous multi\-intersection traffic signal control\.In*2021 58th ACM/IEEE Design Automation Conference \(DAC\)*, pages 847–852\. IEEE, 2021\.
- Youn et al\. \(2023\)Yeojoon Youn, Zihao Hu, Juba Ziani, and Jacob Abernethy\.Randomized quantization is all you need for differential privacy in federated learning\.*arXiv preprint arXiv:2306\.11913*, 2023\.
- Yuan et al\. \(2023\)Zhenyuan Yuan, Siyuan Xu, and Minghui Zhu\.Federated reinforcement learning for generalizable motion planning\.In*2023 American Control Conference \(ACC\)*, pages 78–83\. IEEE, 2023\.doi:10\.23919/ACC55779\.2023\.10156236\.
- Zhang et al\. \(2024\)Jiancong Zhang, Changhao Wang, and Shining Li\.Differential private knowledge trading in vehicular federated learning using contract theory\.*Knowledge\-Based Systems*, 285:111356, 2024\.
- Zhao et al\. \(2024\)Xu Zhao, Yichuan Wu, Tianhao Zhao, Feiyu Wang, and Maozhen Li\.Federated deep reinforcement learning for task offloading and resource allocation in mobile edge computing\-assisted vehicular networks\.*Journal of Network and Computer Applications*, 229:103941, 2024\.doi:10\.1016/j\.jnca\.2024\.103941\.

## Appendices

## Appendix AOne\-Bit Specializations of Related Quantization Mechanisms

This appendix examines the relationship between LDP\-FL and several established one\-bit randomization mechanisms\. We identify the conditions under which these mechanisms induce the same scalar output distribution and reconstruction levels as LDP\-FL, and distinguish these cases from mechanisms that share only the transmitted bit distribution or employ different randomization rules\.

Consider a scalar parameterw∈\[c−r,c\+r\]w\\in\[c\-r,c\+r\], with public clipping centerccand radiusr\>0r\>0\. Letx=w−c∈\[−r,r\]x=w\-c\\in\[\-r,r\]denote the centered input, and defineαp=α⁡\(ϵp\)\\alpha\_\{p\}=\\alpha\(\\epsilon\_\{p\}\)as in \([2](https://arxiv.org/html/2610.41055#S3.E2)\)\. For mechanisms originally defined on a zero\-centered interval, we apply the input transformationx=w−cx=w\-cand shift the reconstructed output bycc\.

The reference LDP\-FL quantizer generatesB∈\{0,1\}B\\in\\\{0,1\\\}according to

Pr⁡\(B=1∣w\)=12\+x2​r​αp,\\Pr\(B=1\\mid w\)=\\frac\{1\}\{2\}\+\\frac\{x\}\{2r\\alpha\_\{p\}\},\(A\.1\)and reconstructsW=c\+r​αp​\(2​B−1\)W=c\+r\\alpha\_\{p\}\(2B\-1\)\.

Two mechanisms are estimator\-equivalent when, after the corresponding input transformation, they have the same binary response probabilities and reconstruction levels for every admissible input\. Channel equivalence requires only the same conditional distribution of transmitted bits\.

Table[A\.1](https://arxiv.org/html/2610.41055#A1.T1)summarizes the conditions under which established one\-bit mechanisms coincide with LDP\-FL and identifies related mechanisms that are not generally estimator\-equivalent\.

Table A\.1:One\-bit mechanisms equivalent to LDP\-FL under specified configurations\.Fixed\-level binary characterization\.The following result recalls the scalar optimality property used in Section[3\.1](https://arxiv.org/html/2610.41055#S3.SS1)and makes the assumptions needed for the equivalence mappings explicit; see also\([Salehi et al\., 2024](https://arxiv.org/html/2610.41055#bib.bib30), Proposition 1\)\.

###### Proposition 1\(Unbiased fixed\-level one\-bit quantization\)

Letw∈\[c−r,c\+r\]w\\in\[c\-r,c\+r\],r\>0r\>0, andϵp\>0\\epsilon\_\{p\}\>0\. Consider a binary mechanism withB∈\{0,1\}B\\in\\\{0,1\\\}and fixed public reconstruction levelsa0=c−R0a\_\{0\}=c\-R\_\{0\}anda1=c\+R1a\_\{1\}=c\+R\_\{1\}, wherea0<a1a\_\{0\}<a\_\{1\}\. If𝔼⁡\[aB∣w\]=w\\mathbb\{E\}\[a\_\{B\}\\mid w\]=wfor every admissibleww, then

Pr⁡\(B=1∣w\)=w−c\+R0R0\+R1\.\\Pr\(B=1\\mid w\)=\\frac\{w\-c\+R\_\{0\}\}\{R\_\{0\}\+R\_\{1\}\}\.\(A\.2\)This mechanism satisfies pureϵp\\epsilon\_\{p\}\-PLDP if and only ifR0,R1≥r​α​\(ϵp\)R\_\{0\},R\_\{1\}\\geq r\\alpha\(\\epsilon\_\{p\}\)\. Its mean squared error is

𝔼⁡\[\(aB−w\)2∣w\]=\(R0\+w−c\)​\(R1−w\+c\)\.\\mathbb\{E\}\[\(a\_\{B\}\-w\)^\{2\}\\mid w\]=\\bigl\(R\_\{0\}\+w\-c\\bigr\)\\bigl\(R\_\{1\}\-w\+c\\bigr\)\.\(A\.3\)The unique pointwise MSE\-minimizing choice isR0=R1=r​α​\(ϵp\)R\_\{0\}=R\_\{1\}=r\\alpha\(\\epsilon\_\{p\}\), which yields the LDP\-FL response and reconstruction levels in \([2](https://arxiv.org/html/2610.41055#S3.E2)\)–\([3](https://arxiv.org/html/2610.41055#S3.E3)\)\.

Proof\.Writingp⁡\(w\)=Pr⁡\(B=1∣w\)p\(w\)=\\Pr\(B=1\\mid w\), unbiasedness givesc−R0\+\(R0\+R1\)​p​\(w\)=wc\-R\_\{0\}\+\(R\_\{0\}\+R\_\{1\}\)p\(w\)=w, establishing \([A\.2](https://arxiv.org/html/2610.41055#A1.E2)\)\. Sincep⁡\(w\)∈\[0,1\]p\(w\)\\in\[0,1\]over the clipping interval,R0,R1≥rR\_\{0\},R\_\{1\}\\geq r\. The probability is affine and increasing, so the two binary\-output privacy constraints attain their extreme ratios at the clipping endpoints:

ϵM=max⁡\{log⁡R0\+rR0−r,log⁡R1\+rR1−r\}\.\\epsilon\_\{M\}=\\max\\\!\\left\\\{\\log\\frac\{R\_\{0\}\+r\}\{R\_\{0\}\-r\},\\,\\log\\frac\{R\_\{1\}\+r\}\{R\_\{1\}\-r\}\\right\\\}\.\(A\.4\)For finiteϵp\\epsilon\_\{p\}, the denominators are positive\. The requirementϵM≤ϵp\\epsilon\_\{M\}\\leq\\epsilon\_\{p\}is equivalent toR0,R1≥r⁡\(eϵp\+1\)/\(eϵp−1\)R\_\{0\},R\_\{1\}\\geq r\(e^\{\\epsilon\_\{p\}\}\+1\)/\(e^\{\\epsilon\_\{p\}\}\-1\)\.

As the estimator is unbiased, its MSE equals its variance,\(R0\+R1\)2​p​\(w\)​\(1−p⁡\(w\)\)\(R\_\{0\}\+R\_\{1\}\)^\{2\}p\(w\)\(1\-p\(w\)\), which simplifies to \([A\.3](https://arxiv.org/html/2610.41055#A1.E3)\)\. Forx=w−c∈\[−r,r\]x=w\-c\\in\[\-r,r\], this expression is\(R0\+x\)​\(R1−x\)\(R\_\{0\}\+x\)\(R\_\{1\}\-x\)\. Both factors are strictly positive and strictly increasing in their respective reconstruction distances throughout the feasible set\. Its unique minimum is therefore atR0=R1=r​α​\(ϵp\)R\_\{0\}=R\_\{1\}=r\\alpha\(\\epsilon\_\{p\}\), giving the LDP\-FL channel and levels\.■\\blacksquare

Mechanism\-specific equivalences\.We now verify the rows of Table[A\.1](https://arxiv.org/html/2610.41055#A1.T1)\. In each case letx=w−c∈\[−r,r\]x=w\-c\\in\[\-r,r\],E=eϵpE=e^\{\\epsilon\_\{p\}\}, andαp=\(E\+1\)/\(E−1\)\\alpha\_\{p\}=\(E\+1\)/\(E\-1\)\. An equivalent scalar estimator must satisfy

Pr⁡\(B=1∣x\)=12\+x2​r​αp,aB=c\+r​αp​\(2​B−1\)\.\\Pr\(B=1\\mid x\)=\\frac\{1\}\{2\}\+\\frac\{x\}\{2r\\alpha\_\{p\}\},\\qquad a\_\{B\}=c\+r\\alpha\_\{p\}\(2B\-1\)\.\(A\.5\)All matching statements below refer to these conditional output distributions; aggregation equivalence additionally assumes independent client randomization and identical arithmetic\-mean reconstruction\.

*1\) Duchi et al\.*In the scalard=1d=1case, first stochastically roundxxtoS∈\{0,1\}S\\in\\\{0,1\\\}withPr⁡\(S=1\)=\(x\+r\)/\(2​r\)\\Pr\(S=1\)=\(x\+r\)/\(2r\), then apply binary randomized response, retainingSSwith probabilityE/\(E\+1\)E/\(E\+1\)\. Thus

Pr⁡\(B=1∣x\)=1E\+1\+E−1E\+1​x\+r2​r=12\+x2​r​αp\.\\Pr\(B=1\\mid x\)=\\frac\{1\}\{E\+1\}\+\\frac\{E\-1\}\{E\+1\}\\frac\{x\+r\}\{2r\}=\\frac\{1\}\{2\}\+\\frac\{x\}\{2r\\alpha\_\{p\}\}\.\(A\.6\)The scalar output levelsc±r​αpc\\pm r\\alpha\_\{p\}establish estimator equivalence\([Duchi et al\., 2018](https://arxiv.org/html/2610.41055#bib.bib11)\)\.

*2\) 1BitMean\.*For the telemetry interval\[0,m\]\[0,m\], setm=2​rm=2randu=x\+ru=x\+r\. Its response probability is

Pr⁡\(B=1∣u\)=1E\+1\+um​E−1E\+1=12\+x2​r​αp\.\\Pr\(B=1\\mid u\)=\\frac\{1\}\{E\+1\}\+\\frac\{u\}\{m\}\\frac\{E\-1\}\{E\+1\}=\\frac\{1\}\{2\}\+\\frac\{x\}\{2r\\alpha\_\{p\}\}\.\(A\.7\)Shifting its decoded estimate byc−rc\-rgivesc−r\+2​r​\(\(E\+1\)​B−1\)/\(E−1\)=c\+r​αp​\(2​B−1\)c\-r\+2r\(\(E\+1\)B\-1\)/\(E\-1\)=c\+r\\alpha\_\{p\}\(2B\-1\), proving estimator equivalence\([Ding et al\., 2017](https://arxiv.org/html/2610.41055#bib.bib9)\)\.

*3\) PBM\.*For a single Bernoulli trial \(m=1m=1\), clipping boundC=rC=r, andθ=12​tanh⁡\(ϵp/2\)=1/\(2​αp\)\\theta=\\tfrac\{1\}\{2\}\\tanh\(\\epsilon\_\{p\}/2\)=1/\(2\\alpha\_\{p\}\), PBM produces

Pr⁡\(B=1∣x\)=12\+θ​xr=12\+x2​r​αp\.\\Pr\(B=1\\mid x\)=\\frac\{1\}\{2\}\+\\frac\{\\theta x\}\{r\}=\\frac\{1\}\{2\}\+\\frac\{x\}\{2r\\alpha\_\{p\}\}\.\(A\.8\)The reconstructed valuec\+\(r/θ\)​\(B−1/2\)c\+\(r/\\theta\)\(B\-1/2\)equalsc\+r​αp​\(2​B−1\)c\+r\\alpha\_\{p\}\(2B\-1\)\. Under the original constraintθ≤1/4\\theta\\leq 1/4, this calibration is admissible forϵp≤log⁡3\\epsilon\_\{p\}\\leq\\log 3\. This identity concerns the one\-trial scalar randomizer observed locally; the original PBM also studies secure aggregation\([Chen et al\., 2022](https://arxiv.org/html/2610.41055#bib.bib8)\)\.

*4\) RQM\.*With two quantization levels \(m=2m=2\), the range\-extension parameterΔ=2​r/\(E−1\)\\Delta=2r/\(E\-1\)givesXmax=r\+Δ=r​αpX\_\{\\max\}=r\+\\Delta=r\\alpha\_\{p\}\. The upper\-level probability and decoded value satisfy

Pr⁡\(B=1∣x\)\\displaystyle\\Pr\(B=1\\mid x\)=x\+Xmax2​Xmax=12\+x2​r​αp,\\displaystyle=\\frac\{x\+X\_\{\\max\}\}\{2X\_\{\\max\}\}=\\frac\{1\}\{2\}\+\\frac\{x\}\{2r\\alpha\_\{p\}\},\(A\.9\)aB\\displaystyle a\_\{B\}=c\+Xmax​\(2​B−1\)\.\\displaystyle=c\+X\_\{\\max\}\(2B\-1\)\.Thus two\-level RQM with this exact local\-privacy calibration is estimator\-equivalent to LDP\-FL\([Youn et al\., 2023](https://arxiv.org/html/2610.41055#bib.bib42)\)\.

*5\) MVU\.*Consider the exactly solved one\-bit MVU optimization with pureϵp\\epsilon\_\{p\}\-LDP and hard unbiasedness constraints on an input grid containing both clipping endpoints\. Since there are only two fixed output levels, unbiasedness forces the affine probabilities in \([A\.2](https://arxiv.org/html/2610.41055#A1.E2)\) at every grid point\. The privacy constraints on the grid are tightest at its endpoints, so Proposition[1](https://arxiv.org/html/2610.41055#Thmproposition1)applies\.

Every grid\-point MSE is uniquely minimized atR0=R1=r​αpR\_\{0\}=R\_\{1\}=r\\alpha\_\{p\}, which is also the unique optimizer of their sum\. Unbiased stochastic interpolation between grid points preserves the affine response, establishing the scalar LDP\-FL estimator over the full interval\([Chaudhuri et al\., 2022](https://arxiv.org/html/2610.41055#bib.bib7)\)\.

*6\)β\\beta\-StoSign\.*For centered inputxx, clipping boundrr, andβ=2​r/\(E−1\)\\beta=2r/\(E\-1\), the probability of a positive sign is

Pr⁡\(S=\+1∣x\)=r\+β\+x2​\(r\+β\)=12\+x2​r​αp,\\Pr\(S=\+1\\mid x\)=\\frac\{r\+\\beta\+x\}\{2\(r\+\\beta\)\}=\\frac\{1\}\{2\}\+\\frac\{x\}\{2r\\alpha\_\{p\}\},\(A\.10\)becauser\+β=r​αpr\+\\beta=r\\alpha\_\{p\}\. With matched scalar decodingaS=c\+\(r\+β\)​Sa\_\{S\}=c\+\(r\+\\beta\)Sand arithmetic\-mean aggregation, this yields the LDP\-FL estimator\. The original sign\-based aggregation rule is a separate algorithmic choice\([Xiang and Su, 2023](https://arxiv.org/html/2610.41055#bib.bib40)\)\.

*7\) Uniform\-noise sign quantization\.*In the uniform\-noise limit of z\-SignFedAvg, letU∼Uniform⁡\[−1,1\]U\\sim\\mathrm\{Uniform\}\[\-1,1\]be locally generated and setσ=r​αp\\sigma=r\\alpha\_\{p\}\. Since\|x\|≤r<σ\|x\|\\leq r<\\sigma,

Pr⁡\(B=1∣x\)=Pr⁡\(x\+σ​U\>0\)=12\+x2​σ=12\+x2​r​αp\.\\Pr\(B=1\\mid x\)=\\Pr\(x\+\\sigma U\>0\)=\\frac\{1\}\{2\}\+\\frac\{x\}\{2\\sigma\}=\\frac\{1\}\{2\}\+\\frac\{x\}\{2r\\alpha\_\{p\}\}\.\(A\.11\)Reconstruction asaB=c\+σ⁡\(2​B−1\)a\_\{B\}=c\+\\sigma\(2B\-1\)gives precisely the LDP\-FL scalar estimator\([Tang et al\., 2024](https://arxiv.org/html/2610.41055#bib.bib36)\)\.

Implication for the independent baseline\.For any fixed collection of clipped client values, the seven specified scalar configurations generate the same conditional distribution of reconstructed values as LDP\-FL\. If all clients use independent private randomness and the same arithmetic\-mean aggregation, their aggregate estimators have the same conditional distribution and MSE as \([4](https://arxiv.org/html/2610.41055#S3.E4)\)\. The CPQ comparison therefore extends to these matched independent one\-bit scalar configurations\. This conclusion uses the stated scalar channel, decoding, clipping, and aggregation assumptions\.

## Appendix BProof of Theorem[1](https://arxiv.org/html/2610.41055#Thmtheorem1)

\(i\) PLDP\.Since1−V∼Uniform⁡\[0,1\]1\-V\\sim\\mathrm\{Uniform\}\[0,1\], bothQkQ\_\{k\}satisfyP⁡\(Qk=c\+r​α\)=q⁡\(wk\)P\(Q\_\{k\}=c\+r\\alpha\)=q\(w\_\{k\}\), matching the LDP\-FL output distribution\. The PLDP ratio for the upper output is

q⁡\(w\)q⁡\(w′\)≤q⁡\(c\+r\)q⁡\(c−r\)=12\+12​α12−12​α=α\+1α−1=eϵp\.\\frac\{q\(w\)\}\{q\(w^\{\\prime\}\)\}\\leq\\frac\{q\(c\+r\)\}\{q\(c\-r\)\}=\\frac\{\\tfrac\{1\}\{2\}\+\\tfrac\{1\}\{2\\alpha\}\}\{\\tfrac\{1\}\{2\}\-\\tfrac\{1\}\{2\\alpha\}\}=\\frac\{\\alpha\+1\}\{\\alpha\-1\}=e^\{\\epsilon\_\{p\}\}\.By symmetry, the same bound holds for the lower \(complementary\) output:

1−q⁡\(w\)1−q⁡\(w′\)≤1−q⁡\(c−r\)1−q⁡\(c\+r\)=12\+12​α12−12​α=α\+1α−1=eϵp\.\\frac\{1\-q\(w\)\}\{1\-q\(w^\{\\prime\}\)\}\\leq\\frac\{1\-q\(c\-r\)\}\{1\-q\(c\+r\)\}=\\frac\{\\tfrac\{1\}\{2\}\+\\tfrac\{1\}\{2\\alpha\}\}\{\\tfrac\{1\}\{2\}\-\\tfrac\{1\}\{2\\alpha\}\}=\\frac\{\\alpha\+1\}\{\\alpha\-1\}=e^\{\\epsilon\_\{p\}\}\.Since the output alphabet is binary, bounding the ratio at both atoms bounds it for every measurable output set𝒯⊆ℝ\\mathcal\{T\}\\subseteq\\mathbb\{R\}, establishingϵp\\epsilon\_\{p\}\-PLDP\.

\(i\) Unbiasedness\.𝔼⁡\[Qk​\(wk,V\)\]=c\+r​α​\(2​q​\(wk\)−1\)=wk\\mathbb\{E\}\[Q\_\{k\}\(w\_\{k\},V\)\]=c\+r\\alpha\(2q\(w\_\{k\}\)\-1\)=w\_\{k\}, so𝔼⁡\[W¯g,j\]=cj\+rj​αn​∑i\(2​q​\(wi,j\)−1\)=1n​∑iwi,j\\mathbb\{E\}\[\\overline\{W\}\_\{g,j\}\]=c\_\{j\}\+\\frac\{r\_\{j\}\\alpha\}\{n\}\\sum\_\{i\}\(2q\(w\_\{i,j\}\)\-1\)=\\frac\{1\}\{n\}\\sum\_\{i\}w\_\{i,j\}\.

\(ii\) Pairwise MSE optimality\.LetUk=\(Qk−c\)/\(r​α\)∈\{−1,\+1\}U\_\{k\}=\(Q\_\{k\}\-c\)/\(r\\alpha\)\\in\\\{\-1,\+1\\\}andxk=\(wk−c\)/\(r​α\)x\_\{k\}=\(w\_\{k\}\-c\)/\(r\\alpha\)\. Expanding the MSE of the pair\-average estimator12​\(Q1\+Q2\)\\tfrac\{1\}\{2\}\(Q\_\{1\}\+Q\_\{2\}\)\(hence the factorr2​α24\\tfrac\{r^\{2\}\\alpha^\{2\}\}\{4\}\),

m⁡\(Q1,Q2,w1,w2\)=\\displaystyle m\(Q\_\{1\},Q\_\{2\},w\_\{1\},w\_\{2\}\)=r2​α24​\[\(1−x12\)\+\(1−x22\)\+2​\(𝔼⁡\[U1​U2\]−x1​x2\)\]\.\\displaystyle\\frac\{r^\{2\}\\alpha^\{2\}\}\{4\}\\bigl\[\(1\-x\_\{1\}^\{2\}\)\+\(1\-x\_\{2\}^\{2\}\)\+2\(\\mathbb\{E\}\[U\_\{1\}U\_\{2\}\]\-x\_\{1\}x\_\{2\}\)\\bigr\]\.\(B\.1\)
The terms\(1−xk2\)\(1\-x\_\{k\}^\{2\}\)are fixed by the marginals, so minimizing \([B\.1](https://arxiv.org/html/2610.41055#A2.E1)\) is equivalent to minimising𝔼⁡\[U1​U2\]\\mathbb\{E\}\[U\_\{1\}U\_\{2\}\]\.

Fréchet–Hoeffding lower bound\.For binaryUk∈\{−1,\+1\}U\_\{k\}\\in\\\{\-1,\+1\\\}withP⁡\(Uk=\+1\)=qk=\(1\+xk\)/2P\(U\_\{k\}=\+1\)=q\_\{k\}=\(1\+x\_\{k\}\)/2,𝔼⁡\[U1​U2\]=1−2​P​\(U1≠U2\)\\mathbb\{E\}\[U\_\{1\}U\_\{2\}\]=1\-2P\(U\_\{1\}\\neq U\_\{2\}\)\. MaximizingP⁡\(U1≠U2\)P\(U\_\{1\}\\neq U\_\{2\}\)over all couplings gives

P∗​\(U1≠U2\)\\displaystyle P^\{\*\}\(U\_\{1\}\\neq U\_\{2\}\)=min⁡\(q1,1−q2\)\+min⁡\(1−q1,q2\)=1−\|q1\+q2−1\|,\\displaystyle=\\min\(q\_\{1\},1\-q\_\{2\}\)\+\\min\(1\-q\_\{1\},q\_\{2\}\)=1\-\|q\_\{1\}\+q\_\{2\}\-1\|,
so the minimum cross\-term is𝔼min​\[U1​U2\]=2​\|q1\+q2−1\|−1=\|x1\+x2\|−1\\mathbb\{E\}\_\{\\min\}\[U\_\{1\}U\_\{2\}\]=2\|q\_\{1\}\+q\_\{2\}\-1\|\-1=\|x\_\{1\}\+x\_\{2\}\|\-1\.

CPQ achieves this bound\.Under CPQ,U1=2⋅𝟏\[V<q1\]−1U\_\{1\}=2\\cdot\\mathbf\{1\}\_\{\[V<q\_\{1\}\]\}\-1andU2=2⋅𝟏\[1−V<q2\]−1U\_\{2\}=2\\cdot\\mathbf\{1\}\_\{\[1\-V<q\_\{2\}\]\}\-1\. Computing the joint probabilities:

P⁡\(U1=\+1,U2=\+1\)\\displaystyle P\(U\_\{1\}=\+1,U\_\{2\}=\+1\)=P⁡\(V⁡<q1,V\>​1−q2\)=max⁡\(q1\+q2−1,0\),\\displaystyle=P\(V<q\_\{1\},\\;V\>1\-q\_\{2\}\)=\\max\(q\_\{1\}\+q\_\{2\}\-1,\\,0\),P⁡\(U1=−1,U2=−1\)\\displaystyle P\(U\_\{1\}=\-1,U\_\{2\}=\-1\)=P⁡\(V≥q1,V≤1−q2\)=max⁡\(1−q1−q2,0\)\.\\displaystyle=P\(V\\geq q\_\{1\},\\;V\\leq 1\-q\_\{2\}\)=\\max\(1\-q\_\{1\}\-q\_\{2\},\\,0\)\.ThereforeP⁡\(U1≠U2\)=1−\|q1\+q2−1\|P\(U\_\{1\}\\neq U\_\{2\}\)=1\-\|q\_\{1\}\+q\_\{2\}\-1\|, so𝔼⁡\[U1​U2\]=\|x1\+x2\|−1\\mathbb\{E\}\[U\_\{1\}U\_\{2\}\]=\|x\_\{1\}\+x\_\{2\}\|\-1, exactly matching the Fréchet lower bound\. Substituting into \([B\.1](https://arxiv.org/html/2610.41055#A2.E1)\),

m∗\\displaystyle m^\{\*\}=r2​α24​\[2−x12−x22\+2​\(\|x1\+x2\|−1\)−2​x1​x2\]=r2​α22​\[\|x1\+x2\|−\(x1\+x2\)22\],\\displaystyle=\\frac\{r^\{2\}\\alpha^\{2\}\}\{4\}\\bigl\[2\-x\_\{1\}^\{2\}\-x\_\{2\}^\{2\}\+2\(\|x\_\{1\}\+x\_\{2\}\|\-1\)\-2x\_\{1\}x\_\{2\}\\bigr\]=\\frac\{r^\{2\}\\alpha^\{2\}\}\{2\}\\\!\\left\[\|x\_\{1\}\+x\_\{2\}\|\-\\frac\{\(x\_\{1\}\+x\_\{2\}\)^\{2\}\}\{2\}\\right\],which is \([7](https://arxiv.org/html/2610.41055#S3.E7)\)\.

Comparison with LDP\-FL\.For independent quantizers,𝔼⁡\[U1​U2\]=x1​x2\\mathbb\{E\}\[U\_\{1\}U\_\{2\}\]=x\_\{1\}x\_\{2\}, so

mLDP−m∗=r2​α22​\(1\+x1​x2−\|x1\+x2\|\)≥0,m\_\{\\mathrm\{LDP\}\}\-m^\{\*\}=\\frac\{r^\{2\}\\alpha^\{2\}\}\{2\}\\bigl\(1\+x\_\{1\}x\_\{2\}\-\|x\_\{1\}\+x\_\{2\}\|\\bigr\)\\geq 0,where the inequality follows from1\+x1​x2−\|x1\+x2\|=\(1−x1\)​\(1−x2\)≥01\+x\_\{1\}x\_\{2\}\-\|x\_\{1\}\+x\_\{2\}\|=\(1\-x\_\{1\}\)\(1\-x\_\{2\}\)\\geq 0whenx1\+x2≥0x\_\{1\}\+x\_\{2\}\\geq 0and=\(1\+x1\)​\(1\+x2\)≥0=\(1\+x\_\{1\}\)\(1\+x\_\{2\}\)\\geq 0whenx1\+x2<0x\_\{1\}\+x\_\{2\}<0\. Equality therefore holds if and only if one marginal is deterministic \(x1∈\{−1,\+1\}x\_\{1\}\\in\\\{\-1,\+1\\\}orx2∈\{−1,\+1\}x\_\{2\}\\in\\\{\-1,\+1\\\}\)\. Since\|xk\|=\|wk−c\|/\(r​α\)≤1/α<1\|x\_\{k\}\|=\|w\_\{k\}\-c\|/\(r\\alpha\)\\leq 1/\\alpha<1for everywk∈\[c−r,c\+r\]w\_\{k\}\\in\[c\-r,c\+r\], this never occurs, so the improvement is strict for all clipped weights\. This establishes the strict MSE advantage over independent quantization\. Finally, writings=x1\+x2s=x\_\{1\}\+x\_\{2\}, \([7](https://arxiv.org/html/2610.41055#S3.E7)\) givesm∗=r2​α22​\|s\|​\(1−\|s\|2\)m^\{\*\}=\\frac\{r^\{2\}\\alpha^\{2\}\}\{2\}\\,\|s\|\\bigl\(1\-\\tfrac\{\|s\|\}\{2\}\\bigr\), which is zero if and only ifs=0s=0, since0<\|s\|≤20<\|s\|\\leq 2makes both factors positive\. Hence the paired noises cancel exactly precisely whenw1\+w2=2​cw\_\{1\}\+w\_\{2\}=2c\.□\\square

## Appendix CProof of Theorem[2](https://arxiv.org/html/2610.41055#Thmtheorem2)

Writeqk=q⁡\(wk\)q\_\{k\}=q\(w\_\{k\}\),p2=1−q2p\_\{2\}=1\-q\_\{2\},α=α⁡\(ϵp\)\\alpha=\\alpha\(\\epsilon\_\{p\}\), andμ=λ1​λ2\\mu=\\lambda\_\{1\}\\lambda\_\{2\}\. Define the endpoint probabilities

q−=1eϵp\+1,q\+=eϵpeϵp\+1\.q\_\{\-\}=\\frac\{1\}\{e^\{\\epsilon\_\{p\}\}\+1\},\\qquad q\_\{\+\}=\\frac\{e^\{\\epsilon\_\{p\}\}\}\{e^\{\\epsilon\_\{p\}\}\+1\}\.Thenq⁡\(w\)∈\[q−,q\+\]q\(w\)\\in\[q\_\{\-\},q\_\{\+\}\],q−\+q\+=1q\_\{\-\}\+q\_\{\+\}=1, andq\+/q−=eϵpq\_\{\+\}/q\_\{\-\}=e^\{\\epsilon\_\{p\}\}\.

\(a\) Marginal PLDP and unbiasedness\.The mixture representation in \([10](https://arxiv.org/html/2610.41055#S3.E10)\) follows by conditioning on the independent mixing coins\(C1,C2\)\(C\_\{1\},C\_\{2\}\)\. Both mixture components have the same marginalsPr⁡\(bk=1\)=qk\\Pr\(b\_\{k\}=1\)=q\_\{k\}\. Hence each bit has exactly the LDP\-FL output law, which satisfiesϵp\\epsilon\_\{p\}\-PLDP\([Sun et al\., 2021](https://arxiv.org/html/2610.41055#bib.bib35)\)\. The reconstruction expectation is therefore unchanged:

𝔼⁡\[W¯g,j\]=cj\+rj​αn​∑i\(2​q​\(wi,j\)−1\)=1n​∑iwi,j\.\\mathbb\{E\}\[\\overline\{W\}\_\{g,j\}\]=c\_\{j\}\+\\frac\{r\_\{j\}\\alpha\}\{n\}\\sum\_\{i\}\(2q\(w\_\{i,j\}\)\-1\)=\\frac\{1\}\{n\}\\sum\_\{i\}w\_\{i,j\}\.
\(b\) Pair\-view privacy\.The output alphabet is finite, so it is sufficient to bound the likelihood ratio at each atom\. From the mixture representation in \([10](https://arxiv.org/html/2610.41055#S3.E10)\),

P11​\(q1,q2\)\\displaystyle P\_\{11\}\(q\_\{1\},q\_\{2\}\)=μ​max⁡\(q1\+q2−1,0\)\+\(1−μ\)​q1​q2,\\displaystyle=\\mu\\max\(q\_\{1\}\+q\_\{2\}\-1,0\)\+\(1\-\\mu\)q\_\{1\}q\_\{2\},\(C\.1\)P10​\(q1,q2\)\\displaystyle P\_\{10\}\(q\_\{1\},q\_\{2\}\)=μ​min⁡\(q1,1−q2\)\+\(1−μ\)​q1​\(1−q2\)\.\\displaystyle=\\mu\\min\(q\_\{1\},1\-q\_\{2\}\)\+\(1\-\\mu\)q\_\{1\}\(1\-q\_\{2\}\)\.\(C\.2\)The remaining atoms follow from complementation\. In particular, with the reflectionR⁡\(q1,q2\)=\(1−q1,1−q2\)R\(q\_\{1\},q\_\{2\}\)=\(1\-q\_\{1\},1\-q\_\{2\}\),

P00=P11∘R,P01=P10∘R\.P\_\{00\}=P\_\{11\}\\circ R,\\qquad P\_\{01\}=P\_\{10\}\\circ R\.Sinceq−\+q\+=1q\_\{\-\}\+q\_\{\+\}=1,RRmaps\[q−,q\+\]2\[q\_\{\-\},q\_\{\+\}\]^\{2\}onto itself\. Therefore the worst ratios for\(0,0\)\(0,0\)and\(0,1\)\(0,1\)equal those for\(1,1\)\(1,1\)and\(1,0\)\(1,0\), respectively\.

For\(1,1\)\(1,1\),P11P\_\{11\}is nondecreasing inq1q\_\{1\}and is strictly increasing because1−μ\>01\-\\mu\>0\. Thus the largest ratio overq1,q1′q\_\{1\},q\_\{1\}^\{\\prime\}is obtained atq1=q\+q\_\{1\}=q\_\{\+\}andq1′=q−q\_\{1\}^\{\\prime\}=q\_\{\-\}\. Sinceq−\+q2−1≤0q\_\{\-\}\+q\_\{2\}\-1\\leq 0andq\+\+q2−1=q2−q−≥0q\_\{\+\}\+q\_\{2\}\-1=q\_\{2\}\-q\_\{\-\}\\geq 0,

P11​\(q\+,q2\)P11​\(q−,q2\)\\displaystyle\\frac\{P\_\{11\}\(q\_\{\+\},q\_\{2\}\)\}\{P\_\{11\}\(q\_\{\-\},q\_\{2\}\)\}=μ⁡\(q2−q−\)\+\(1−μ\)​q\+​q2\(1−μ\)​q−​q2=eϵp\+μ1−μ​\(1q−−1q2\)\.\\displaystyle=\\frac\{\\mu\(q\_\{2\}\-q\_\{\-\}\)\+\(1\-\\mu\)q\_\{\+\}q\_\{2\}\}\{\(1\-\\mu\)q\_\{\-\}q\_\{2\}\}=e^\{\\epsilon\_\{p\}\}\+\\frac\{\\mu\}\{1\-\\mu\}\\left\(\\frac\{1\}\{q\_\{\-\}\}\-\\frac\{1\}\{q\_\{2\}\}\\right\)\.The right\-hand side is increasing inq2q\_\{2\}, hence it is maximized atq2=q\+q\_\{2\}=q\_\{\+\}\. Using

1q−−1q\+=\(eϵp\+1\)​\(1−e−ϵp\)=eϵp−e−ϵp,\\frac\{1\}\{q\_\{\-\}\}\-\\frac\{1\}\{q\_\{\+\}\}=\(e^\{\\epsilon\_\{p\}\}\+1\)\(1\-e^\{\-\\epsilon\_\{p\}\}\)=e^\{\\epsilon\_\{p\}\}\-e^\{\-\\epsilon\_\{p\}\},the maximum equalseϵSe^\{\\epsilon\_\{S\}\}in \([13](https://arxiv.org/html/2610.41055#S3.E13)\)\.

For\(1,0\)\(1,0\),P10P\_\{10\}is also nondecreasing inq1q\_\{1\}\. Sincep2∈\[q−,q\+\]p\_\{2\}\\in\[q\_\{\-\},q\_\{\+\}\],min⁡\(q\+,p2\)=p2\\min\(q\_\{\+\},p\_\{2\}\)=p\_\{2\}andmin⁡\(q−,p2\)=q−\\min\(q\_\{\-\},p\_\{2\}\)=q\_\{\-\}\. Therefore

P10​\(q\+,q2\)P10​\(q−,q2\)=p2​\[μ\+\(1−μ\)​q\+\]q−​\[μ\+\(1−μ\)​p2\]\.\\frac\{P\_\{10\}\(q\_\{\+\},q\_\{2\}\)\}\{P\_\{10\}\(q\_\{\-\},q\_\{2\}\)\}=\\frac\{p\_\{2\}\[\\mu\+\(1\-\\mu\)q\_\{\+\}\]\}\{q\_\{\-\}\[\\mu\+\(1\-\\mu\)p\_\{2\}\]\}\.The mapp↦p/\[μ\+\(1−μ\)​p\]p\\mapsto p/\[\\mu\+\(1\-\\mu\)p\]is increasing, so the ratio is maximized atp2=q\+p\_\{2\}=q\_\{\+\}, where it equalsq\+/q−=eϵp≤eϵSq\_\{\+\}/q\_\{\-\}=e^\{\\epsilon\_\{p\}\}\\leq e^\{\\epsilon\_\{S\}\}\. Reflection handles the other two atoms\. Hence every atom, and therefore every output set, satisfies \([11](https://arxiv.org/html/2610.41055#S3.E11)\)\. The\(1,1\)\(1,1\)bound is attained at\(q1,q1′,q2\)=\(q\+,q−,q\+\)\(q\_\{1\},q\_\{1\}^\{\\prime\},q\_\{2\}\)=\(q\_\{\+\},q\_\{\-\},q\_\{\+\}\), proving tightness\.

\(b, continued\) Privacy under side information\.Condition onZ1=\(V,C2,R2,w2\)Z\_\{1\}=\(V,C\_\{2\},R\_\{2\},w\_\{2\}\)\. The only remaining randomness inb1b\_\{1\}is\(C1,R1\)\(C\_\{1\},R\_\{1\}\), which is independent ofZ1Z\_\{1\}\. Forq=q⁡\(w1\)q=q\(w\_\{1\}\),

gV\(q\):=Pr\(b1=1∣w1,Z1\)=λ1𝟏\{V<q\}\+\(1−λ1\)q\.g\_\{V\}\(q\):=\\Pr\(b\_\{1\}=1\\mid w\_\{1\},Z\_\{1\}\)=\\lambda\_\{1\}\\mathbf\{1\}\_\{\\\{V<q\\\}\}\+\(1\-\\lambda\_\{1\}\)q\.\(C\.3\)The function is nondecreasing inqq, so the largest ratio for the outputb1=1b\_\{1\}=1isgV​\(q\+\)/gV​\(q−\)g\_\{V\}\(q\_\{\+\}\)/g\_\{V\}\(q\_\{\-\}\)\. IfV∈\[q−,q\+\)V\\in\[q\_\{\-\},q\_\{\+\}\), the indicator is zero atq−q\_\{\-\}and one atq\+q\_\{\+\}, giving

gV​\(q\+\)gV​\(q−\)\\displaystyle\\frac\{g\_\{V\}\(q\_\{\+\}\)\}\{g\_\{V\}\(q\_\{\-\}\)\}=λ1\+\(1−λ1\)​q\+\(1−λ1\)​q−=eϵp\+λ11−λ1\.\\displaystyle=\\frac\{\\lambda\_\{1\}\+\(1\-\\lambda\_\{1\}\)q\_\{\+\}\}\{\(1\-\\lambda\_\{1\}\)q\_\{\-\}\}=\\frac\{e^\{\\epsilon\_\{p\}\}\+\\lambda\_\{1\}\}\{1\-\\lambda\_\{1\}\}\.WhenV<q−V<q\_\{\-\}orV≥q\+V\\geq q\_\{\+\}the ratio is no larger\. For the outputb1=0b\_\{1\}=0, the probability1−gV​\(q\)1\-g\_\{V\}\(q\)is nonincreasing inqq, and the corresponding endpoint ratio is maximized over the same intervalV∈\[q−,q\+\)V\\in\[q\_\{\-\},q\_\{\+\}\), producing the identical value\. Sinceq\+−q−\>0q\_\{\+\}\-q\_\{\-\}\>0, this event has positive probability, so the bound is tight\. The follower result follows by replacingVVwith1−V1\-V\.

\(c\) Pairwise MSE\.For fixed inputs, squared pair\-average error is a deterministic function of the output pair\. Taking expectation under the mixture \([10](https://arxiv.org/html/2610.41055#S3.E10)\) therefore gives

mμ=\(1−μ\)​mIND\+μ​m∗\.m\_\{\\mu\}=\(1\-\\mu\)m\_\{\\mathrm\{IND\}\}\+\\mu m^\{\*\}\.Using the independent cross\-term𝔼⁡\[U1​U2\]=x1​x2\\mathbb\{E\}\[U\_\{1\}U\_\{2\}\]=x\_\{1\}x\_\{2\}in \([B\.1](https://arxiv.org/html/2610.41055#A2.E1)\) gives

mIND=r2​α24​\(2−x12−x22\)\.m\_\{\\mathrm\{IND\}\}=\\frac\{r^\{2\}\\alpha^\{2\}\}\{4\}\(2\-x\_\{1\}^\{2\}\-x\_\{2\}^\{2\}\)\.The difference derived in Appendix[B](https://arxiv.org/html/2610.41055#A2)is

mIND−m∗=r2​α22​\(1\+x1​x2−\|x1\+x2\|\)\.m\_\{\\mathrm\{IND\}\}\-m^\{\*\}=\\frac\{r^\{2\}\\alpha^\{2\}\}\{2\}\\left\(1\+x\_\{1\}x\_\{2\}\-\|x\_\{1\}\+x\_\{2\}\|\\right\)\.Substitution establishes \([15](https://arxiv.org/html/2610.41055#S3.E15)\)\. As shown in the proof of Theorem[1](https://arxiv.org/html/2610.41055#Thmtheorem1), the bracket is strictly positive for all admissible clipped inputs because\|xk\|≤1/α<1\|x\_\{k\}\|\\leq 1/\\alpha<1\. Hence everyμ\>0\\mu\>0yields a strict improvement over independent quantization\.

\(d\) Population MSE\.LetSℓ−sℓS\_\{\\ell\}\-s\_\{\\ell\}denote the pair\-sum error for pairℓ\\ell\. Pair errors are unbiased and independent across distinct pairs, so

𝔼⁡\[\(W¯g,j−w¯j\)2\]=1n2​∑ℓ=1n/2𝔼⁡\[\(Sℓ−sℓ\)2\]\.\\mathbb\{E\}\[\(\\overline\{W\}\_\{g,j\}\-\\bar\{w\}\_\{j\}\)^\{2\}\]=\\frac\{1\}\{n^\{2\}\}\\sum\_\{\\ell=1\}^\{n/2\}\\mathbb\{E\}\[\(S\_\{\\ell\}\-s\_\{\\ell\}\)^\{2\}\]\.By part \(c\), the pair\-sum error is the mixture of the independent and CPQ pair\-sum errors\. The former satisfies

eIND=rj2​α2​\(2−x12−x22\)≤2​rj2​α2,e\_\{\\mathrm\{IND\}\}=r\_\{j\}^\{2\}\\alpha^\{2\}\(2\-x\_\{1\}^\{2\}\-x\_\{2\}^\{2\}\)\\leq 2r\_\{j\}^\{2\}\\alpha^\{2\},while Corollary[1](https://arxiv.org/html/2610.41055#Thmcorollary1)giveseCPQ≤2​rj2​κe\_\{\\mathrm\{CPQ\}\}\\leq 2r\_\{j\}^\{2\}\\kappa\. Hence

𝔼⁡\[\(W¯g,j−w¯j\)2\]\\displaystyle\\mathbb\{E\}\[\(\\overline\{W\}\_\{g,j\}\-\\bar\{w\}\_\{j\}\)^\{2\}\]≤2​rj2n2​∑ℓ=1n/2\[\(1−μℓ\)​α2\+μℓ​κ\]=rj2n​\[\(1−μ¯\)​α2\+μ¯​κ\],\\displaystyle\\leq\\frac\{2r\_\{j\}^\{2\}\}\{n^\{2\}\}\\sum\_\{\\ell=1\}^\{n/2\}\\left\[\(1\-\\mu\_\{\\ell\}\)\\alpha^\{2\}\+\\mu\_\{\\ell\}\\kappa\\right\]=\\frac\{r\_\{j\}^\{2\}\}\{n\}\\left\[\(1\-\\bar\{\\mu\}\)\\alpha^\{2\}\+\\bar\{\\mu\}\\kappa\\right\],which proves \([16](https://arxiv.org/html/2610.41055#S3.E16)\)\.□\\square

## Appendix DProof of Theorem[3](https://arxiv.org/html/2610.41055#Thmtheorem3)

Joint output distribution\.Consider one coordinate of a CPQ\-λ\\lambdapair, with target and partner bit\-one probabilitiesu,z∈\[q−,q\+\]u,z\\in\[q\_\{\-\},q\_\{\+\}\], respectively, where

q−=11\+eϵp,q\+=1−q−,μ=λ2\.q\_\{\-\}=\\frac\{1\}\{1\+e^\{\\epsilon\_\{p\}\}\},\\qquad q\_\{\+\}=1\-q\_\{\-\},\\qquad\\mu=\\lambda^\{2\}\.With probabilityμ\\mu, both clients use complementary shared randomness\. Otherwise, their quantization outputs are independent\. The joint distribution is therefore

Pu,z​\(1,1\)\\displaystyle P\_\{u,z\}\(1,1\)=\(1−μ\)​u​z\+μ​\(u\+z−1\)\+,\\displaystyle=\(1\-\\mu\)uz\+\\mu\(u\+z\-1\)\_\{\+\},Pu,z​\(1,0\)\\displaystyle P\_\{u,z\}\(1,0\)=u−Pu,z​\(1,1\),\\displaystyle=u\-P\_\{u,z\}\(1,1\),Pu,z​\(0,1\)\\displaystyle P\_\{u,z\}\(0,1\)=z−Pu,z​\(1,1\),\\displaystyle=z\-P\_\{u,z\}\(1,1\),Pu,z​\(0,0\)\\displaystyle P\_\{u,z\}\(0,0\)=1−u−z\+Pu,z​\(1,1\),\\displaystyle=1\-u\-z\+P\_\{u,z\}\(1,1\),\(D\.1\)where\(x\)\+=max⁡\{x,0\}\(x\)\_\{\+\}=\\max\\\{x,0\\\}\.

Worst\-case Rényi divergence\.For a Rényi orderν\>1\\nu\>1, define

Hν​\(P,Q\)=∑xP​\(x\)ν​Q​\(x\)1−ν,H\_\{\\nu\}\(P,Q\)=\\sum\_\{x\}P\(x\)^\{\\nu\}Q\(x\)^\{1\-\\nu\},so that

Dν\(P∥Q\)=ln⁡Hν​\(P,Q\)ν−1\.D\_\{\\nu\}\(P\\\|Q\)=\\frac\{\\ln H\_\{\\nu\}\(P,Q\)\}\{\\nu\-1\}\.We maximize this divergence over alternative target probabilitiesu,v∈\[q−,q\+\]u,v\\in\[q\_\{\-\},q\_\{\+\}\], while keeping the partner probabilityzzfixed\.

The partner bit followsBernoulli⁡\(z\)\\mathrm\{Bernoulli\}\(z\)under both target inputs\. Conditional on the partner’s bit, the target bit is Bernoulli with success probabilities

p1​\(u\)\\displaystyle p\_\{1\}\(u\)=Pu,z​\(1,1\)z,\\displaystyle=\\frac\{P\_\{u,z\}\(1,1\)\}\{z\},\(D\.2\)p0​\(u\)\\displaystyle p\_\{0\}\(u\)=Pu,z​\(1,0\)1−z\.\\displaystyle=\\frac\{P\_\{u,z\}\(1,0\)\}\{1\-z\}\.Both probabilities are nondecreasing inuu, as follows from \([D\.1](https://arxiv.org/html/2610.41055#A4.E1)\)\.

For Bernoulli distributions with success probabilitiesp≤qp\\leq q, the Rényi power sum

hν​\(p,q\)=pν​q1−ν\+\(1−p\)ν​\(1−q\)1−νh\_\{\\nu\}\(p,q\)=p^\{\\nu\}q^\{1\-\\nu\}\+\(1\-p\)^\{\\nu\}\(1\-q\)^\{1\-\\nu\}is nonincreasing inppand nondecreasing inqq\. Therefore, increasing the separation between the alternative target probabilities cannot decrease the corresponding divergence\. Since the partner\-bit distribution remains unchanged, the maximum overuuandvvis attained at

\(u,v\)∈\{\(q−,q\+\),\(q\+,q−\)\}\.\(u,v\)\\in\\\{\(q\_\{\-\},q\_\{\+\}\),\(q\_\{\+\},q\_\{\-\}\)\\\}\.
For either endpoint ordering, the joint probabilities in \([D\.1](https://arxiv.org/html/2610.41055#A4.E1)\) are affine functions ofz∈\[q−,q\+\]z\\in\[q\_\{\-\},q\_\{\+\}\]\. In particular,

\(q−\+z−1\)\+=0,\(q\+\+z−1\)\+=z−q−\.\(q\_\{\-\}\+z\-1\)\_\{\+\}=0,\\qquad\(q\_\{\+\}\+z\-1\)\_\{\+\}=z\-q\_\{\-\}\.The Rényi power sumHν​\(P,Q\)H\_\{\\nu\}\(P,Q\)is jointly convex in its distribution arguments forν\>1\\nu\>1\. Consequently, its maximum over the resulting affine interval occurs atz∈\{q−,q\+\}z\\in\\\{q\_\{\-\},q\_\{\+\}\\\}\.

Thus,

supu,v,z∈\[q−,q\+\]Dν\(Pu,z∥Pv,z\)=max\(u,v\)∈\{\(q−,q\+\),\(q\+,q−\)\}z∈\{q−,q\+\}Dν\(Pu,z∥Pv,z\),\\displaystyle\\sup\_\{u,v,z\\in\[q\_\{\-\},q\_\{\+\}\]\}D\_\{\\nu\}\(P\_\{u,z\}\\\|P\_\{v,z\}\)=\\max\_\{\\begin\{subarray\}\{c\}\(u,v\)\\in\\\{\(q\_\{\-\},q\_\{\+\}\),\(q\_\{\+\},q\_\{\-\}\)\\\}\\\\ z\\in\\\{q\_\{\-\},q\_\{\+\}\\\}\\end\{subarray\}\}D\_\{\\nu\}\(P\_\{u,z\}\\\|P\_\{v,z\}\),\(D\.3\)which establishes the exact worst\-case per\-coordinate divergence in \([19](https://arxiv.org/html/2610.41055#S3.E19)\)\.

Vector\-level composition\.Fix the public round state and all other clients’ clipped inputs\. Under independent ideal randomization across coordinates, the joint observation distributions factorize over themmmodel coordinates\.

Outputs of pairs not containing the target client have identical distributions under the two alternative target inputs and contribute zero Rényi divergence\. Therefore,

Dν​\(ℳobs​\(𝐰i\)∥ℳobs​\(𝐰i′\)\)≤m​dν\.D\_\{\\nu\}\\\!\\left\(\\mathcal\{M\}\_\{\\mathrm\{obs\}\}\(\\mathbf\{w\}\_\{i\}\)\\middle\\\|\\mathcal\{M\}\_\{\\mathrm\{obs\}\}\(\\mathbf\{w\}^\{\\prime\}\_\{i\}\)\\right\)\\leq m\\,d\_\{\\nu\}\.\(D\.4\)
The conversion from\(ν,ρ\)\(\\nu,\\rho\)\-RDP to approximate differential privacy gives the sufficient vector\-level privacy certificate

ϵv=infν\>1\[m​dν\+ln⁡\(1/δv\)ν−1\],\\epsilon\_\{v\}=\\inf\_\{\\nu\>1\}\\left\[m\\,d\_\{\\nu\}\+\\frac\{\\ln\(1/\\delta\_\{v\}\)\}\{\\nu\-1\}\\right\],which establishes \([20](https://arxiv.org/html/2610.41055#S3.E20)\)\.

Because the pairing assignments are independent of the protected inputs, hiding them is a post\-processing of the stronger pairing\-revealed observation\. The same privacy guarantee therefore applies to the RSU observer when the pairings remain hidden\.□\\square

Calibration of comparison mechanisms\.For the matched vector\-level privacy comparison in Table[1](https://arxiv.org/html/2610.41055#S3.T1), we use the exact per\-coordinate Rényi divergences of the independent baseline mechanisms\.

For LDP\-FL with parameter\-level privacy budgetss,

dνLDP​\(s\)=1ν−1​ln⁡eν​s\+e\(1−ν\)​s1\+es\.d\_\{\\nu\}^\{\\mathrm\{LDP\}\}\(s\)=\\frac\{1\}\{\\nu\-1\}\\ln\\frac\{e^\{\\nu s\}\+e^\{\(1\-\\nu\)s\}\}\{1\+e^\{s\}\}\.\(D\.5\)
For coordinatewise Laplace noise with scaleβ\\beta, lett=2​r/βt=2r/\\beta\. The corresponding divergence is

dνLap​\(t\)=1ν−1​ln⁡\(ν​e\(ν−1\)​t\+\(ν−1\)​e−ν​t2​ν−1\)\.d\_\{\\nu\}^\{\\mathrm\{Lap\}\}\(t\)=\\frac\{1\}\{\\nu\-1\}\\ln\\left\(\\frac\{\\nu e^\{\(\\nu\-1\)t\}\+\(\\nu\-1\)e^\{\-\\nu t\}\}\{2\\nu\-1\}\\right\)\.\(D\.6\)
For independent Gaussian noise with standard deviationσ\\sigma,

dνGau=ν​\(2​r\)22​σ2\.d\_\{\\nu\}^\{\\mathrm\{Gau\}\}=\\frac\{\\nu\(2r\)^\{2\}\}\{2\\sigma^\{2\}\}\.\(D\.7\)
Each per\-coordinate divergence is composed across themmcoordinates and converted to an\(ϵv,δv\)\(\\epsilon\_\{v\},\\delta\_\{v\}\)guarantee using the same RDP accounting procedure as in \([20](https://arxiv.org/html/2610.41055#S3.E20)\)\. The mechanisms are calibrated to the common target\(ϵv,δv\)=\(1,10−5\)\(\\epsilon\_\{v\},\\delta\_\{v\}\)=\(1,10^\{\-5\}\)\.

Aggregation\-MSE comparison\.Define the binary reconstruction scale

A⁡\(s\)=r​es\+1es−1,A\(s\)=r\\frac\{e^\{s\}\+1\}\{e^\{s\}\-1\},and consider an even numberKKof learning vehicles forming independent pairs\.

At centered clipped inputswi,j=cjw\_\{i,j\}=c\_\{j\}, each binary output has probability1/21/2\. For CPQ\-λ\\lambda, the covariance between the reconstructed parameters of a pair is−μ​A​\(s\)2\-\\mu A\(s\)^\{2\}\. Consequently, the per\-coordinate FedAvg MSEs are

MCPQ​\-​λ\\displaystyle M\_\{\\mathrm\{CPQ\}\\text\{\-\}\\lambda\}=\(1−μ\)​A​\(s\)2K,\\displaystyle=\\frac\{\(1\-\\mu\)A\(s\)^\{2\}\}\{K\},\(D\.8\)MLDP\\displaystyle M\_\{\\mathrm\{LDP\}\}=A​\(s0\)2K,\\displaystyle=\\frac\{A\(s\_\{0\}\)^\{2\}\}\{K\},MGau\\displaystyle M\_\{\\mathrm\{Gau\}\}=σ2K,\\displaystyle=\\frac\{\\sigma^\{2\}\}\{K\},MLap\\displaystyle M\_\{\\mathrm\{Lap\}\}=2​β2K,\\displaystyle=\\frac\{2\\beta^\{2\}\}\{K\},wheressands0s\_\{0\}are the respective RDP\-calibrated parameter\-level privacy budgets of CPQ\-λ\\lambdaand LDP\-FL\.

The MSE advantage can also be bounded for arbitrary admissible clipped inputs\. Writing

q−​\(s\)=11\+es,q\_\{\-\}\(s\)=\\frac\{1\}\{1\+e^\{s\}\},the CPQ\-λ\\lambdapair\-average MSE satisfies

MpairCPQ​\-​λ≤A​\(s\)22​\(1−4​μ​q−2​\(s\)\),M\_\{\\mathrm\{pair\}\}^\{\\mathrm\{CPQ\}\\text\{\-\}\\lambda\}\\leq\\frac\{A\(s\)^\{2\}\}\{2\}\\left\(1\-4\\mu q\_\{\-\}^\{2\}\(s\)\\right\),while the independent LDP\-FL pair\-average MSE satisfies

MpairLDP≥A​\(s0\)2−r22\.M\_\{\\mathrm\{pair\}\}^\{\\mathrm\{LDP\}\}\\geq\\frac\{A\(s\_\{0\}\)^\{2\}\-r^\{2\}\}\{2\}\.Since the errors of distinct pairs are independent, these inequalities imply

MCPQ​\-​λMLDP≤A​\(s\)2​\(1−4​μ​q−2​\(s\)\)A​\(s0\)2−r2\.\\frac\{M\_\{\\mathrm\{CPQ\}\\text\{\-\}\\lambda\}\}\{M\_\{\\mathrm\{LDP\}\}\}\\leq\\frac\{A\(s\)^\{2\}\\left\(1\-4\\mu q\_\{\-\}^\{2\}\(s\)\\right\)\}\{A\(s\_\{0\}\)^\{2\}\-r^\{2\}\}\.\(D\.9\)
For the matched\-privacy configuration in Table[1](https://arxiv.org/html/2610.41055#S3.T1), the right\-hand side is approximately0\.8360\.836atλ=0\.627\\lambda=0\.627\. Thus, the considered CPQ\-λ\\lambdaconfiguration achieves lower theoretical aggregation MSE than the independent LDP\-FL baseline throughout the admissible clipping range\.

The comparison applies a common RDP\-based privacy certification procedure\. Tighter mechanism\-specific approximate\-DP accounting may be available for independent LDP\-FL and Gaussian mechanisms and could permit lower aggregation error at the same privacy target\. These results concern one model upload under ideal independent randomization and do not establish multi\-round or trajectory\-level privacy\.

## Appendix EFinite\-Precision Analysis

To analyze finite\-precision effects, consider add\-bit integerKKuniformly distributed over\{0,…,2d−1\}\\\{0,\\dots,2^\{d\}\-1\\\}\. The leader usesK1=KK\_\{1\}=Kand the follower usesK2=2d−1−KK\_\{2\}=2^\{d\}\-1\-K, providing a discrete counterpart ofVVand1−V1\-V\. Withqk=q⁡\(wk\)q\_\{k\}=q\(w\_\{k\}\)andkk=⌊2d​qk⌋k\_\{k\}=\\lfloor 2^\{d\}q\_\{k\}\\rfloor, clientk∈\{1,2\}k\\in\\\{1,2\\\}transmits

bk=\{1,Kk<kk,0,Kk\>kk,Bernoulli⁡\(2d​qk−kk\),Kk=kk,b\_\{k\}=\\begin\{cases\}1,&K\_\{k\}<k\_\{k\},\\\\ 0,&K\_\{k\}\>k\_\{k\},\\\\ \\mathrm\{Bernoulli\}\\bigl\(2^\{d\}q\_\{k\}\-k\_\{k\}\\bigr\),&K\_\{k\}=k\_\{k\},\\end\{cases\}\(E\.1\)where the Bernoulli draw uses local randomness and is needed only whenKkK\_\{k\}falls in the cell containingqkq\_\{k\}\. As is standard for local randomized response, this local draw is modeled as exact; only the shared randomness must be finite, since both clients must reproduce it identically\.

###### Proposition 2\(Finite\-precision CPQ\)

For everyd∈ℕd\\in\\mathbb\{N\}, the pair\(b1,b2\)\(b\_\{1\},b\_\{2\}\)generated by \([E\.1](https://arxiv.org/html/2610.41055#A5.E1)\) satisfies:

1. \(a\)P⁡\(bk=1\)=q⁡\(wk\)P\(b\_\{k\}=1\)=q\(w\_\{k\}\)exactly fork∈\{1,2\}k\\in\\\{1,2\\\}; hence part \(i\) of Theorem[1](https://arxiv.org/html/2610.41055#Thmtheorem1)holds exactly\.
2. \(b\)The pairwise MSEmd​\(w1,w2\)m\_\{d\}\(w\_\{1\},w\_\{2\}\)satisfies0≤md​\(w1,w2\)−m∗​\(w1,w2\)≤r2​α2​\(ϵp\)/2d−20\\leq m\_\{d\}\(w\_\{1\},w\_\{2\}\)\-m^\{\*\}\(w\_\{1\},w\_\{2\}\)\\leq r^\{2\}\\alpha^\{2\}\(\\epsilon\_\{p\}\)/2^\{d\-2\}\.

Proof\.\(a\)Sinceqk<1q\_\{k\}<1,kk≤2d−1k\_\{k\}\\leq 2^\{d\}\-1\. BothK1K\_\{1\}andK2K\_\{2\}are uniform on\{0,…,2d−1\}\\\{0,\\dots,2^\{d\}\-1\\\}, so

P⁡\(bk=1\)\\displaystyle P\(b\_\{k\}=1\)=P⁡\(Kk<kk\)\+P⁡\(Kk=kk\)​\(2d​qk−kk\)=kk2d\+2d​qk−kk2d=qk\.\\displaystyle=P\(K\_\{k\}<k\_\{k\}\)\+P\(K\_\{k\}=k\_\{k\}\)\\,\(2^\{d\}q\_\{k\}\-k\_\{k\}\)=\\frac\{k\_\{k\}\}\{2^\{d\}\}\+\\frac\{2^\{d\}q\_\{k\}\-k\_\{k\}\}\{2^\{d\}\}=q\_\{k\}\.
This output distribution preserves both unbiasedness andϵp\\epsilon\_\{p\}\-PLDP, so the arguments of part \(i\) of Theorem[1](https://arxiv.org/html/2610.41055#Thmtheorem1)apply unchanged\.

\(b\)LetW1,W2W\_\{1\},W\_\{2\}be i\.i\.d\.Uniform\[0,1\)\\mathrm\{Uniform\}\[0,1\), independent ofKK, and setVk=\(Kk\+Wk\)/2dV\_\{k\}=\(K\_\{k\}\+W\_\{k\}\)/2^\{d\}\. Conditional onKkK\_\{k\}, the bit𝟏\{Vk<qk\}\\mathbf\{1\}\\\{V\_\{k\}<q\_\{k\}\\\}has the same law asbkb\_\{k\}: ifKk<kkK\_\{k\}<k\_\{k\}thenVk<\(Kk\+1\)/2d≤qkV\_\{k\}<\(K\_\{k\}\+1\)/2^\{d\}\\leq q\_\{k\}; ifKk\>kkK\_\{k\}\>k\_\{k\}thenVk≥\(kk\+1\)/2d\>qkV\_\{k\}\\geq\(k\_\{k\}\+1\)/2^\{d\}\>q\_\{k\}; and ifKk=kkK\_\{k\}=k\_\{k\}thenP⁡\(Vk<qk\)=P⁡\(Wk<2d​qk−kk\)=2d​qk−kkP\(V\_\{k\}<q\_\{k\}\)=P\(W\_\{k\}<2^\{d\}q\_\{k\}\-k\_\{k\}\)=2^\{d\}q\_\{k\}\-k\_\{k\}\. Hence we may takebk=𝟏\{Vk<qk\}b\_\{k\}=\\mathbf\{1\}\\\{V\_\{k\}<q\_\{k\}\\\}\. HereV1V\_\{1\}is uniform on\[0,1\)\[0,1\), and the idealized follower of Theorem[1](https://arxiv.org/html/2610.41055#Thmtheorem1)uses1−V1=\(K2\+1−W1\)/2d1\-V\_\{1\}=\(K\_\{2\}\+1\-W\_\{1\}\)/2^\{d\}; denote its bit byb2∘b\_\{2\}^\{\\circ\}, so that\(b1,b2∘\)\(b\_\{1\},b\_\{2\}^\{\\circ\}\)is the idealized CPQ pair with MSEm∗m^\{\*\}\. The bitsb2b\_\{2\}andb2∘b\_\{2\}^\{\\circ\}are both determined byK2K\_\{2\}unlessK2=k2K\_\{2\}=k\_\{2\}, so they differ only on an event of probability2−d2^\{\-d\}\. The pair\-average error satisfies\|e\|≤r​α\+r≤2​r​α\|e\|\\leq r\\alpha\+r\\leq 2r\\alpha, soe2∈\[0,4​r2​α2\]e^\{2\}\\in\[0,4r^\{2\}\\alpha^\{2\}\], and thereforemd−m∗≤4​r2​α2⋅2−d=r2​α2/2d−2m\_\{d\}\-m^\{\*\}\\leq 4r^\{2\}\\alpha^\{2\}\\cdot 2^\{\-d\}=r^\{2\}\\alpha^\{2\}/2^\{d\-2\}\. Finally,md≥m∗m\_\{d\}\\geq m^\{\*\}since, by \(a\), the pair has the prescribed marginals, and the Fréchet–Hoeffding bound in the proof of Theorem[1](https://arxiv.org/html/2610.41055#Thmtheorem1)applies to every coupling with these marginals\.■\\blacksquare

###### Proposition 3\(Finite\-precision stronger\-view privacy of CPQ\-λ\\lambda\)

Let the shared branch of CPQ\-λ\\lambdause thedd\-bit rule in \([E\.1](https://arxiv.org/html/2610.41055#A5.E1)\), while the private branch uses local randomness\. Then the marginal PLDP and unbiasedness result of Theorem[2](https://arxiv.org/html/2610.41055#Thmtheorem2)\(a\) holds exactly, and the side\-information boundϵC\\epsilon\_\{C\}in \([14](https://arxiv.org/html/2610.41055#S3.E14)\) remains valid without a finite\-precision correction\. For0<μ<10<\\mu<1, defineϵS\(d\)\\epsilon\_\{S\}^\{\(d\)\}as the pair\-view privacy parameter of the finite\-precision mechanism\. If

2−d≤14​μ​\(eϵp\+1\)2,2^\{\-d\}\\leq\\frac\{1\}\{4\\mu\(e^\{\\epsilon\_\{p\}\}\+1\)^\{2\}\},\(E\.2\)then

eϵS\(d\)≤eϵS\+4​μ​eϵp​\(eϵp\+1\)21−μ​2−d\.e^\{\\epsilon\_\{S\}^\{\(d\)\}\}\\leq e^\{\\epsilon\_\{S\}\}\+\\frac\{4\\mu e^\{\\epsilon\_\{p\}\}\(e^\{\\epsilon\_\{p\}\}\+1\)^\{2\}\}\{1\-\\mu\}\\,2^\{\-d\}\.\(E\.3\)Forμ=0\\mu=0, the mechanism is the independent LDP\-FL coupling andϵS\(d\)=ϵp\\epsilon\_\{S\}^\{\(d\)\}=\\epsilon\_\{p\}exactly\.

Proof\.Part \(a\) of Proposition[2](https://arxiv.org/html/2610.41055#Thmproposition2)gives the exact marginal probabilities, so marginal PLDP and unbiasedness are unchanged\. Conditional on a revealeddd\-bit shared value, the shared\-branch probability ofb1=1b\_\{1\}=1is a nondecreasing functionhd​\(q\)∈\[0,1\]h\_\{d\}\(q\)\\in\[0,1\]\. Hence

Pr⁡\(b1=1∣q,Z\)=λ1​hd​\(q\)\+\(1−λ1\)​q\.\\Pr\(b\_\{1\}=1\\mid q,Z\)=\\lambda\_\{1\}h\_\{d\}\(q\)\+\(1\-\\lambda\_\{1\}\)q\.The largest possible endpoint ratio is obtained by the extreme valueshd​\(q−\)=0h\_\{d\}\(q\_\{\-\}\)=0andhd​\(q\+\)=1h\_\{d\}\(q\_\{\+\}\)=1, which gives exactly the upper bound in \([14](https://arxiv.org/html/2610.41055#S3.E14)\); the same argument applied to the complementary output handlesb1=0b\_\{1\}=0\. Thus no additional correction is needed forϵC\\epsilon\_\{C\}\(although exact attainment of the continuous bound need not occur on a very coarse grid\)\.

For the pair view, use the coupling constructed in the proof of Proposition[2](https://arxiv.org/html/2610.41055#Thmproposition2)\. The finite\-precision CPQ pair and the ideal continuous CPQ pair differ only when the follower lies in its boundary cell, an event of probability at mostδd=2−d\\delta\_\{d\}=2^\{\-d\}\. Therefore, for every output atoma∈\{0,1\}2a\\in\\\{0,1\\\}^\{2\},

\|PCPQ\(d\)​\(a\)−PCPQ​\(a\)\|≤δd,\\left\|P\_\{\\mathrm\{CPQ\}\}^\{\(d\)\}\(a\)\-P\_\{\\mathrm\{CPQ\}\}\(a\)\\right\|\\leq\\delta\_\{d\},\(E\.4\)and the CPQ\-λ\\lambdamixture differs from its continuous counterpart at any atom by at mostx=μ​δdx=\\mu\\delta\_\{d\}\.

Consider first the concordant atom\(1,1\)\(1,1\)and the extremal changeq1:q−→q\+q\_\{1\}:q\_\{\-\}\\to q\_\{\+\}\. Forq1=q−q\_\{1\}=q\_\{\-\}, the ideal CPQ contribution to this atom is zero; the finite CPQ contribution is nonnegative\. Hence the finite denominator is at least the continuous denominatorD=\(1−μ\)​q−​q2D=\(1\-\\mu\)q\_\{\-\}q\_\{2\}, while the numerator increases by at mostxx\. Using the continuous boundN/D≤eϵSN/D\\leq e^\{\\epsilon\_\{S\}\}gives

NdDd≤eϵS\+x\(1−μ\)​q−2\.\\frac\{N\_\{d\}\}\{D\_\{d\}\}\\leq e^\{\\epsilon\_\{S\}\}\+\\frac\{x\}\{\(1\-\\mu\)q\_\{\-\}^\{2\}\}\.This additive term is no larger than the correction in \([E\.3](https://arxiv.org/html/2610.41055#A5.E3)\)\.

For the discordant atom\(1,0\)\(1,0\), letN,DN,Ddenote the continuous probabilities atq\+q\_\{\+\}andq−q\_\{\-\}, respectively\. The continuous proof givesN/D≤eϵpN/D\\leq e^\{\\epsilon\_\{p\}\}\. Moreover

D=q−​\[μ\+\(1−μ\)​p2\]≥q−2\.D=q\_\{\-\}\[\\mu\+\(1\-\\mu\)p\_\{2\}\]\\geq q\_\{\-\}^\{2\}\.Condition \([E\.2](https://arxiv.org/html/2610.41055#A5.E2)\) impliesx≤q−2/4≤D/4x\\leq q\_\{\-\}^\{2\}/4\\leq D/4, so

NdDd\\displaystyle\\frac\{N\_\{d\}\}\{D\_\{d\}\}≤N\+xD−x≤eϵp\+x⁡\(eϵp\+1\)D−x≤eϵp\+2​μ​δd​\(eϵp\+1\)3\.\\displaystyle\\leq\\frac\{N\+x\}\{D\-x\}\\leq e^\{\\epsilon\_\{p\}\}\+\\frac\{x\(e^\{\\epsilon\_\{p\}\}\+1\)\}\{D\-x\}\\leq e^\{\\epsilon\_\{p\}\}\+2\\mu\\delta\_\{d\}\(e^\{\\epsilon\_\{p\}\}\+1\)^\{3\}\.Becauseeϵp\>1e^\{\\epsilon\_\{p\}\}\>1and0<μ<10<\\mu<1,

2​μ​\(eϵp\+1\)3≤4​μ​eϵp​\(eϵp\+1\)21−μ,2\\mu\(e^\{\\epsilon\_\{p\}\}\+1\)^\{3\}\\leq\\frac\{4\\mu e^\{\\epsilon\_\{p\}\}\(e^\{\\epsilon\_\{p\}\}\+1\)^\{2\}\}\{1\-\\mu\},andeϵp≤eϵSe^\{\\epsilon\_\{p\}\}\\leq e^\{\\epsilon\_\{S\}\}\. Reflection gives the same bounds for\(0,0\)\(0,0\)and\(0,1\)\(0,1\)\. Taking the largest atom\-wise ratio proves \([E\.3](https://arxiv.org/html/2610.41055#A5.E3)\)\.■\\blacksquare

PRG\-generated randomness\.Proposition[2](https://arxiv.org/html/2610.41055#Thmproposition2)assumesKKis uniformly random\. WhenKKis produced by a cryptographically secure PRG, each transmitted bit is a polynomial\-time function of the PRG output and local randomness, so any efficient adversary that distinguishes the PRG\-based outputs from those of the truly random mechanism would also distinguish the PRG from uniform\. The guarantees therefore hold against computationally bounded adversaries, up to a negligible loss\. Withd=32d=32, the MSE gap in \(b\) is below10−9​r2​α2​\(ϵp\)10^\{\-9\}\\,r^\{2\}\\alpha^\{2\}\(\\epsilon\_\{p\}\)\.

The experimental implementation uses ChaCha20\-derived 53\-bit floating\-point values with direct threshold comparisons\. The boundary\-randomized construction analyzed above provides an idealized finite\-precision model with exact marginal guarantees; the direct comparison used in the experiments is a numerically close approximation\.

## Appendix FSUMO Network Topology Characteristics

The simulated environment represents a custom 10\-junction road network mapped out over a 723 m×\\times200 m coordinate plane \(see Figure[F\.1](https://arxiv.org/html/2610.41055#A6.F1)\)\. The topology consists of primary arterial roads connecting major junctions \(J0 through J12\)\. To simulate diverse urban driving conditions, the edges have distinct speed constraints\. The majority of the 30 directional edges permit a maximum velocity of 15\.00 m/s \(≈\\approx54 km/h\)\. However, the central connecting route between junctions J3 and J5 \(edgesE7and\-E7\) enforces a stricter speed limit of 10\.00 m/s \(≈\\approx36 km/h\), acting as a systematic bottleneck designed to force the RL agents to balance spatial distance against congestion and speed constraints\.

For the privacy–utility evaluation, the road network containsM=30M=30directed edges\. Accordingly, the state representation defined in \([21](https://arxiv.org/html/2610.41055#S5.E21)\) has dimension3​M\+4=943M\+4=94\. The maximum number of turning actions is\|𝒜max\|=3\|\\mathcal\{A\}\_\{\\max\}\|=3, with unavailable turns excluded through action masking\.

Figure F\.1:Topology of the synthetic road network implemented in the SUMO environment\. The network comprises 10 junctions \(J0–J6 and J10–J12\) and 30 directed edges \(15 bidirectional corridors\) covering a total distance of 5\.37 km\.
## Appendix GExperimental Configuration

This appendix consolidates the training and communication parameters used in the experimental evaluation\. The FLDQN configuration specifies the learning architecture and training schedule, while the SR\-ARQ configuration documents the fragmentation and retransmission settings used in ns\-3\.

FLDQN training configuration\.The FLDQN agents use the network architecture and training procedure described in Section[5\.2](https://arxiv.org/html/2610.41055#S5.SS2)of the main manuscript\. Table[G\.1](https://arxiv.org/html/2610.41055#A7.T1)summarizes the corresponding hyperparameters, including optimization, exploration, episode termination, and federated training settings\.

SUMO traffic configuration\.The privacy–utility experiment uses SUMO 1\.26 and the road network described in Appendix[F](https://arxiv.org/html/2610.41055#A6)\. Background traffic is generated usingrandomTrips\.py, with an average departure interval of 1\.75 s\. A warm\-up period of 200 s precedes the departure of the learning vehicles\.

TheK=50K=50learning vehicles are distributed equally across starting edgesE0,E1,E3,E11, andE8, with a common destination at edgeE15\. Their departures are sampled uniformly within a 100 s window following the warm\-up period and regenerated for each training episode\.

Individual trips are subject to a maximum duration ofTtrip=600T\_\{\\mathrm\{trip\}\}=600s, measured from the scheduled departure\. Vehicles that exceed this limit are classified as not arrived\. Such time\-limit terminations are stored as non\-terminal transitions in the local replay buffers\.

For evaluation, three fixed traffic scenarios are used, with background traffic seeds 1000, 1001, and 1002, and corresponding departure seeds 5000, 5001, and 5002\. The same evaluation scenarios are used for all privacy mechanisms, privacy budgets, and training seeds\.

Privacy clipping configuration\.For privacy\-preserving model exchange, each locally trained parameter is clipped around the corresponding parameter of the current global model using a fixed radiusr=0\.02r=0\.02across all parameter tensors\. The resulting coordinate\-wise interval is shared by clients trained from the same global model and is used for privacy calibration and parameter reconstruction\.

Agent–SUMO interaction\.The Python training process interacts with a shared SUMO simulation through TraCI\. Each learning vehicle maintains an individual DQN policy and experience buffer while observing traffic conditions within the common environment\. At routing decision points, the vehicle obtains the traffic and positional information required to construct the state in \([21](https://arxiv.org/html/2610.41055#S5.E21)\)\.

The base reward is determined from the elapsed SUMO simulation time between consecutive edge\-entry events, as defined in \([22](https://arxiv.org/html/2610.41055#S5.E22)\), with repeated\-edge penalties applied according to \([23](https://arxiv.org/html/2610.41055#S5.E23)\)\. Individual trip termination follows the conditions described in Section[5\.1](https://arxiv.org/html/2610.41055#S5.SS1)\.

ns\-3 channel and radio configuration\.The V2I simulation uses ns\-3 version 3\.46, a 5\.9 GHz carrier frequency, and a 10 MHz channel\. The RSU is located at junction J3,\(300,100,0\)\(300,100,0\)m, of the SUMO road network\. Both data and control transmissions useOfdmRate6MbpsBW10MHzthroughConstantRateWifiManager, with transmission power set to 20 dBm\. Propagation is modeled using Log\-Distance path loss with exponentn=2\.7n=2\.7and reference lossL0=46\.68L\_\{0\}=46\.68dB, followed by Nakagami\-mmfading and constant\-speed propagation delay\. The MAC usesAdhocWifiMacwithout QoS extensions\. The receiver noise figure is 7 dB, the CCA energy\-detection threshold is−85\-85dBm, the minimum preamble\-detection RSSI is−82\-82dBm, and the receiver sensitivity is−101\-101dBm\.

Table G\.1:FLDQN configuration for the privacy–utility experiment\.Network address resolution\.The ns\-3 implementation prepopulates ARP caches for vehicle–RSU communication to prevent address\-resolution state from introducing prolonged delivery failures when vehicles temporarily leave radio coverage\.

Beacon\-based contact configuration\.The RSU transmits discovery beacons of sizeLb=100L\_\{\\mathrm\{b\}\}=100B at intervals ofTb=0\.1T\_\{\\mathrm\{b\}\}=0\.1s over the same simulated IEEE 802\.11p channel used for model transfers\. Contact eligibility is evaluated over a sliding observation window ofTobs=0\.5T\_\{\\mathrm\{obs\}\}=0\.5s, requiring at leastNbeacon=3N\_\{\\mathrm\{beacon\}\}=3successful beacon receptions\. This corresponds to the nominal three\-of\-five beacon reception criterion used in the experiments\.

RSU transfer scheduling configuration\.The RSU evaluates the transfer queue at intervals ofΔ​tsched=0\.1\\Delta t\_\{\\mathrm\{sched\}\}=0\.1s of simulation time\. At each scheduling step, the controller processes completed transfers, updates vehicle contact eligibility using the beacon\-reception criterion, and starts the next queued transfer when no other transfer is active\.

Waiting vehicles that lose contact are removed from the queue\. Following an unsuccessful transfer, the corresponding model object remains pending and may be scheduled for another attempt when the vehicle is eligible again\. Completed attempts are placed at the end of the queue when additional transfer work remains\. No new attempts are initiated after the end of the corresponding communication drive\.

Communication\-drive configuration\.Each downlink or uplink communication phase is executed during a non\-learning SUMO drive\. Following a 200 s traffic warm\-up, learning vehicles depart at randomized times within a 100 s departure window and follow their current routing policies greedily\. Individual trips terminate upon arrival, route failure, or a maximum trip duration of 600 s\.

The RSU schedules transfers during the available vehicle contacts, with the end of the drive serving as the deadline for outstanding requests\. Each federated round includes separate downlink and uplink drives, followed by global\-model evaluation on three fixed scenarios without additional V2I model communication\.

SUMO\-ns\-3 control interface\.The Python co\-simulation driver maintains one persistent TCP connection to a control endpoint in the ns\-3 process\. Supported operations include updating vehicle positions and velocities, moving inactive vehicles outside communication range, querying beacon\-reception status, initiating uplink and downlink transfers, advancing the ns\-3 simulation clock, and resetting the simulation state\.

Transfer initiation is asynchronous\. When the driver advances ns\-3 to a specified simulation time, the interface reports transfers completed during the elapsed interval, including their delivery outcomes, simulated completion times, and received bytes\. Successfully delivered objects are then passed to the corresponding receiving endpoint for signature and communication\-context verification\. Model traffic itself is carried through the simulated UDP/IEEE 802\.11p data plane rather than the TCP control connection\.

SR\-ARQ transport configuration\.The ns\-3 communication model employs a custom Selective Repeat ARQ layer for packet fragmentation, retransmission, and reassembly\. Table[G\.2](https://arxiv.org/html/2610.41055#A7.T2)summarizes its transport parameters, including chunk sizes, window limits, retransmission settings, and UDP port assignments\.

Each SR\-ARQ chunk additionally carries a 44\-byte binary header containing message identification, sequencing, transmission timing, and integrity metadata\. The header layout is specified as follows:

Header=u8⏟type​u8⏟rsv​u16⏟flags​u64⏟msg​\_​id​u32⏟round​u16⏟veh​u16⏟idx​u16⏟total​u16⏟wnd​u64⏟tx​\_​ns​u32⏟tot​\_​len​u32⏟chk​\_​len​u32⏟crc32\|⏟payload\\text\{Header\}=\\underbrace\{\\texttt\{u8\}\}\_\{\\rm type\}\\underbrace\{\\texttt\{u8\}\}\_\{\\rm rsv\}\\underbrace\{\\texttt\{u16\}\}\_\{\\rm flags\}\\underbrace\{\\texttt\{u64\}\}\_\{\\rm msg\\\_id\}\\underbrace\{\\texttt\{u32\}\}\_\{\\rm round\}\\underbrace\{\\texttt\{u16\}\}\_\{\\rm veh\}\\underbrace\{\\texttt\{u16\}\}\_\{\\rm idx\}\\underbrace\{\\texttt\{u16\}\}\_\{\\rm total\}\\underbrace\{\\texttt\{u16\}\}\_\{\\rm wnd\}\\underbrace\{\\texttt\{u64\}\}\_\{\\rm tx\\\_ns\}\\underbrace\{\\texttt\{u32\}\}\_\{\\rm tot\\\_len\}\\underbrace\{\\texttt\{u32\}\}\_\{\\rm chk\\\_len\}\\underbrace\{\\texttt\{u32\}\}\_\{\\rm crc32\}\\;\\Big\|\\;\\underbrace\{\\phantom\{xxxx\}\}\_\{\\text\{payload\}\}\(G\.1\)
Theflagsfield identifies the transmission direction, whileidxandtotalspecify the chunk index and the total number of chunks in the message\. Thecrc32field contains the CRC\-32 checksum used to validate the chunk payload\.

Table G\.2:SR\-ARQ transport parameters used in ns\-3\.Software and execution environment\.The experimental framework integrates SUMO, ns\-3, and the Python\-based learning process\. SUMO communicates with the training process through TraCI, while ns\-3 operates as a separate process and advances in lockstep with the SUMO simulation clock\. Local DQN training uses TensorFlow/Keras, whereas privacy processing and model serialization use NumPy\.

Federated aggregation is coordinated within the Python training process using Flower’s strategy classes, without its client–server gRPC transport\. Post\-quantum signature operations and ML\-KEM\-512 key establishment use liboqs through its Pythonoqsinterface\. The CPQ group setup additionally employs ChaCha20, ChaCha20\-Poly1305, HKDF\-SHA256, and HMAC\-SHA256 through thecryptographypackage\. Table[G\.3](https://arxiv.org/html/2610.41055#A7.T3)summarizes the software components and their versions\.

Execution hardware\.The controlled cryptographic microbenchmarks were performed on an x86\_64 Linux workstation equipped with an Intel Core i7\-8700 CPU at 3\.20 GHz, 12 logical CPUs, and 15\.42 GiB of RAM\. The software environment used Linux 5\.4 and Python 3\.10\.20\. Signature timing measurements were CPU\-based\.

PQC key persistence\.Signing key pairs are generated through the Pythonoqsinterface to liboqs during system initialization\. The resulting keys are stored as\{identity\}\_\{scheme\}\.pk/\.skfiles and reloaded when available to maintain consistency across restarts within a training run\.

Table G\.3:Software components and reported versions\.
## Appendix HControlled Signature Microbenchmark

This section presents a controlled microbenchmark of the digital signature schemes considered in this study\. Table[H\.1](https://arxiv.org/html/2610.41055#A8.T1)compares public\-key sizes, signature sizes, and the computational costs of key generation, signing, and verification across four post\-quantum configurations and two classical reference schemes\. These measurements isolate cryptographic operations from model serialization and network transmission, providing a reference for interpreting the integrated V2X communication results in Section[7\.3](https://arxiv.org/html/2610.41055#S7.SS3)\.

Measurement protocol\.The microbenchmark was conducted on the evaluation workstation described in Appendix[G](https://arxiv.org/html/2610.41055#A7)\. Post\-quantum signature operations were evaluated using liboqs 0\.15\.0 through liboqs\-python 0\.14\.1\. The classical RSA and ECDSA reference schemes were evaluated using thecryptography46\.0\.7 package with its OpenSSL backend\.

For each signature scheme, five warm\-up trials were executed and excluded from measurement, followed byN=200N=200recorded trials\. Each recorded trial generated a fresh key pair, signed a 4096\-byte message, and verified the resulting signature\. Key generation, signing, and verification were timed independently using a monotonic high\-resolution clock\.

Table H\.1:Controlled signature microbenchmark on the evaluation workstation\. Timing values are mean±\\pmstandard deviation in milliseconds overN=200N=200measured trials using 4096\-byte messages\.AlgorithmBasisPK \(B\)Sig\. \(B\)Keygen \(ms\)Sign \(ms\)Verify \(ms\)ML\-DSA\-44MLWE/MSIS131224200\.037±0\.0090\.037\\pm 0\.0090\.105±0\.0630\.105\\pm 0\.0630\.045±0\.0090\.045\\pm 0\.009Falcon\-512NTRU/SIS897655\.15\.771±1\.2855\.771\\pm 1\.2850\.210±0\.0270\.210\\pm 0\.0270\.059±0\.0120\.059\\pm 0\.012SLH\-DSA\-SHA2\-128fHash32170880\.989±0\.0860\.989\\pm 0\.08623\.078±1\.37723\.078\\pm 1\.3771\.412±0\.1101\.412\\pm 0\.110SLH\-DSA\-SHA2\-128sHash32785661\.707±2\.62461\.707\\pm 2\.624469\.949±4\.877469\.949\\pm 4\.8770\.491±0\.0300\.491\\pm 0\.030RSA\-2048\-PSS\-SHA256IFP25625638\.741±24\.43038\.741\\pm 24\.4300\.799±0\.0250\.799\\pm 0\.0250\.048±0\.0030\.048\\pm 0\.003ECDSA\-P256\-SHA256ECDLP6571\.00\.022±0\.0040\.022\\pm 0\.0040\.053±0\.0060\.053\\pm 0\.0060\.084±0\.0080\.084\\pm 0\.008Because Falcon\-512 and ECDSA P\-256 produce variable\-length signatures, Table[H\.1](https://arxiv.org/html/2610.41055#A8.T1)reports their mean signature sizes across the measured trials\. For Falcon\-512, signature sizes ranged from 648 to 661 bytes, with a mean of 655\.1 bytes\. ECDSA P\-256 signatures ranged from 69 to 72 bytes, with a mean of 71\.0 bytes\. The evaluated Falcon\-512 implementation supports a maximum signature size of 752 bytes, which is distinct from the sizes observed during the 200 trials\.

The microbenchmark includes both SLH\-DSA\-SHA2\-128f and SLH\-DSA\-SHA2\-128s to characterize the trade\-offs between hash\-based signature parameter sets\. The primary mobility\-coupled vehicular evaluation employs ML\-DSA\-44 for authenticated model exchange, while the additional signature\-sensitivity experiment evaluates ML\-DSA\-44, Falcon\-512, and SLH\-DSA\-SHA2\-128f under mobility\-coupled V2I communication\. RSA\-2048\-PSS\-SHA256 and ECDSA\-P256\-SHA256 are included as conventional reference baselines for computational comparison\. These classical signature schemes are not quantum\-resistant and are not used in the integrated vehicular experiments\.

For the notation in Table[H\.1](https://arxiv.org/html/2610.41055#A8.T1), PK refers to the raw public\-key representation used for comparison\. The underlying mathematical bases are identified using IFP for the Integer Factorization Problem, ECDLP for the Elliptic Curve Discrete Logarithm Problem, MLWE for Module Learning With Errors, and MSIS for Module Short Integer Solution\.

## Appendix ISignature\-Scheme Sensitivity Under Mobility\-Coupled V2I Communication

This appendix provides an additional analysis of the signature\-sensitivity experiment presented in Section[7\.3](https://arxiv.org/html/2610.41055#S7.SS3)\. We examine how the different authenticated message sizes influence uplink transfer reliability as vehicle\-to\-RSU distance increases\. The comparison includes ML\-DSA\-44, Falcon\-512, and SLH\-DSA\-SHA2\-128f, each evaluated with full\-precision and one\-bit CPQ model updates under the same IEEE 802\.11p communication framework\.

Distance\-dependent uplink reliability\.Figure[I\.1](https://arxiv.org/html/2610.41055#A9.F1)reports the uplink transfer\-attempt success rates across vehicle\-to\-RSU distance intervals\. With full\-precision updates, all three signature schemes exhibit a similar decline in transfer reliability as the vehicle moves farther from the RSU\. At distances of125125–150150m, the attempt success rates are3%3\\%,4%4\\%, and3%3\\%for ML\-DSA\-44, Falcon\-512, and SLH\-DSA\-SHA2\-128f, respectively\.

In contrast, CPQ substantially improves distance\-dependent communication reliability by reducing the authenticated uplink size\. At125125–150150m, CPQ achieves100%100\\%transfer\-attempt success with ML\-DSA\-44 and Falcon\-512, compared with25%25\\%for SLH\-DSA\-SHA2\-128f\. At150150–175175m, the corresponding success rates are77%77\\%,94%94\\%, and0%0\\%\. These results illustrate how signature size becomes increasingly influential when the model\-update payload is highly compressed and wireless connectivity is constrained by vehicle mobility\.

The overall uplink delivery rate remains distinct from the per\-attempt success rate, since the communication protocol can retransmit unsuccessful transfers\. For CPQ, the overall uplink delivery rates are99\.8%99\.8\\%with ML\-DSA\-44,99\.8%99\.8\\%with Falcon\-512, and93\.1%93\.1\\%with SLH\-DSA\-SHA2\-128f\. Thus, retransmissions support eventual delivery, but larger authenticated messages impose additional wireless communication costs\.

Figure I\.1:Distance\-dependent uplink transfer\-attempt success under IEEE 802\.11p communication for three post\-quantum signature schemes: \(a\) full\-precision updates and \(b\) one\-bit CPQ updates\. Each point represents the percentage of successful uplink transfer attempts within the corresponding vehicle\-to\-RSU distance interval at transfer initiation \(ϵp=1\\epsilon\_\{p\}=1\)\.
## Appendix JDetailed Privacy–Utility Experimental Results

This appendix provides additional analyses of the privacy–utility results presented in Section[7\.2](https://arxiv.org/html/2610.41055#S7.SS2)\. We examine seed\-paired differences between CPQ and LDP\-FL, the effect of CPQ\-λ\\lambdacorrelation mixing, run\-to\-run variability, and secondary traffic\-delay measures\. The primary comparisons consider privacy budgetsϵp∈\{0\.3,0\.5,1,2,5\}\\epsilon\_\{p\}\\in\\\{0\.3,0\.5,1,2,5\\\}, while the CPQ\-λ\\lambdaanalysis is conducted at a fixedϵp=1\\epsilon\_\{p\}=1\.

### J\.1Paired Comparison with Independent Quantization

To isolate the empirical effect of correlated quantization, Fig\.[J\.1](https://arxiv.org/html/2610.41055#A10.F1)compares CPQ with LDP\-FL at identical privacy budgets using matched random seeds\. Both mechanisms employ the same one\-bit representation and clipping configuration, differing in the correlation of their quantization randomness\. For each seed, performance is summarized over rounds 91–100 before computing the paired difference between the two mechanisms\.

The travel\-time benefit is defined as the LDP\-FL travel time minus the corresponding CPQ travel time, while the arrival\-rate benefit is defined as the CPQ arrival rate minus that of LDP\-FL\. Positive values therefore favor CPQ in both metrics\. The figure reports the individual seed\-paired differences, their mean, and the corresponding 95% Student\-ttconfidence intervals across five seeds\.

CPQ exhibits a positive mean travel\-time benefit at all five evaluated privacy budgets, ranging from 8\.2 to 61\.7 s\. However, the uncertainty varies considerably across configurations\. The nominal 95% confidence interval excludes zero atϵp=1\\epsilon\_\{p\}=1, where the mean paired benefit is43\.1±26\.543\.1\\pm 26\.5s, but includes zero at the other evaluated privacy budgets\. For arrival rate, the mean paired differences are generally smaller, and all corresponding confidence intervals include zero\.

These observations support a favorable average routing\-efficiency trend for CPQ relative to independent quantization, particularly at tighter privacy budgets\. Nevertheless, the variability across seeds indicates that the observed benefit is not uniformly established across all settings\.

Figure J\.1:Seed\-paired routing\-performance differences between CPQ and LDP\-FL\.
### J\.2Learning\-Vehicle Population Sensitivity

We further examine the effect of the learning\-vehicle population under ideal communication, comparing CPQ and LDP\-FL atϵp=1\\epsilon\_\{p\}=1withK∈\{10,25,50\}K\\in\\\{10,25,50\\\}\. Each configuration uses 100 federated rounds, 10 local training episodes per round, and five matched seeds\. Results are averaged over rounds 91–100 before computing the seed\-paired differences\. TheK=50K=50results are taken from the primary privacy–utility evaluation\. ForK=25K=25, CPQ forms 12 pairs per coordinate, with the remaining vehicle using independent quantization\.

Table[J\.1](https://arxiv.org/html/2610.41055#A10.T1)reports travel\-time gains, defined as LDP\-FL minus CPQ, and arrival\-rate gains, defined as CPQ minus LDP\-FL\. Positive values favor CPQ in both metrics\. Results are reported as paired means with 95% Student\-ttconfidence half\-widths, while the final column indicates the number of seeds in which CPQ achieves lower travel time\.

Table J\.1:Population sensitivity atϵp=1\\epsilon\_\{p\}=1\.CPQ achieves positive mean travel\-time and arrival\-rate gains across all three populations\. The travel\-time confidence intervals exclude zero atK=25K=25andK=50K=50, whereas theK=10K=10results show substantially greater variability\. The gains do not increase monotonically withKK\. Since all learning vehicles share the SUMO environment, changing the population also changes traffic demand, rather than isolating the effect of aggregation population size\.

### J\.3Correlation Mixing and Seed\-Paired Analysis

The CPQ\-λ\\lambdaablation in Table[3](https://arxiv.org/html/2610.41055#S7.T3)includes empirical aggregation\-MSE measurements and seed\-paired routing comparisons\. For each round, aggregation MSE is measured across all model coordinates relative to the average of the clients’ clipped models, excluding clipping error\. The measurements are averaged over 100 rounds within each run and then across ten seeds\. The observed MSE decreases monotonically withλ\\lambda, consistent with the theoretical correlation\-mixture relationship\.

To examine routing variability, Fig\.[J\.2](https://arxiv.org/html/2610.41055#A10.F2)reports seed\-paired travel\-time differences relative to independent LDP\-FL and fully correlated CPQ\. For each of ten matched seeds, travel time is first averaged over rounds 91–100 before computing the paired difference\. The figure shows individual differences and their mean with 95% Student\-ttconfidence intervals\. Negative values indicate lower travel time than the reference mechanism\.

Relative to LDP\-FL, the intermediate mixing configurations exhibit mean travel\-time differences ranging from−41\.3\-41\.3to−30\.7\-30\.7s, with only the confidence interval forλ=0\.75\\lambda=0\.75excluding zero\. Fully correlated CPQ yields a paired difference of−45\.8±38\.0\-45\.8\\pm 38\.0s\. Relative to fully correlated CPQ, all intermediate configurations have confidence intervals containing zero\. These results indicate favorable average routing performance with partial correlation but do not establish a consistent ranking among the mixing configurations\.

Figure J\.2:Seed\-paired travel\-time differences for CPQ\-λ\\lambda\.
### J\.4Run\-to\-Run Variability

Figure[J\.3](https://arxiv.org/html/2610.41055#A10.F3)provides a seed\-level view of the late\-round routing performance reported in Table[2](https://arxiv.org/html/2610.41055#S7.T2)\. Each individual marker represents the mean evaluation result over rounds 91–100 for one independent seed\. The larger markers and error bars indicate the across\-seed mean and sample standard deviation, respectively\. The no\-privacy FLDQN reference is shown separately using a dashed line and a shaded standard\-deviation band\.

Figure J\.3:Seed\-level variability of late\-round travel time and arrival rate across privacy budgets\.
### J\.5Secondary Routing Delay Measures

To complement the travel\-time and arrival\-rate results, Fig\.[J\.4](https://arxiv.org/html/2610.41055#A10.F4)reports two additional SUMO metrics: time loss and waiting time\. Time loss represents the difference between experienced travel time and free\-flow travel time along the driven route, whereas waiting time measures the accumulated duration during which vehicle speed falls below0\.10\.1m/s\. Both metrics are summarized over rounds 91–100 and averaged across five independent runs\.

Atϵp=0\.3\\epsilon\_\{p\}=0\.3, CPQ achieves a mean time loss of51\.451\.4s and waiting time of20\.220\.2s, compared with86\.786\.7s and42\.242\.2s for LDP\-FL, respectively\. The Laplace and Gaussian mechanisms exhibit higher values for both metrics under the same privacy budget\.

As the privacy budget increases, the differences among the mechanisms generally become smaller, although their relative ordering is not uniform\. Atϵp=5\\epsilon\_\{p\}=5, Laplace achieves slightly lower time loss and waiting time than CPQ\. These results provide additional context for the routing\-efficiency differences observed in the main evaluation\.

![Refer to caption](https://arxiv.org/html/2610.41055v1/E1_secondary_delays.png)Figure J\.4:Secondary routing\-delay measures across privacy mechanisms and privacy budgets\.

## Appendix KServer\-Hidden Pairing for CPQ and CPQ\-λ\\lambda

This appendix details the authenticated group establishment and server\-hidden pairing procedures underlying CPQ and CPQ\-λ\\lambda\. An agreed vehicle group establishes a shared secret before federated training and subsequently derives coordinate\- and round\-dependent pair assignments and complementary pseudorandom values without exchanging pairing information during training\. We first describe group establishment over the simulated V2I channel, followed by the local pairing construction and its security assumptions\.

Setup and trust assumptions\.Before federated training, the vehicles establish an agreed ordered participant listℛ\\mathcal\{R\}and a group epoch identifieree\. The first vehicle inℛ\\mathcal\{R\}serves as the designated group coordinatorDD\. Each vehicle possesses registered post\-quantum signing and ML\-KEM\-512 public keys, established through an authenticated bootstrap channel\.

The coordinator distributes a group secretKGK\_\{G\}to the other vehicles using authenticated, ML\-KEM\-protected messages relayed by the RSU\. The RSU acts as a store\-and\-forward intermediary and does not require access to the group secret or the vehicles’ KEM private keys\. Each recipient verifies the sender, intended recipient, group epoch, and ordered participant list before accepting the setup information\. Training begins only after the required group confirmations have completed successfully\.

The server\-hidden pairing model assumes an honest\-but\-curious RSU without access toKGK\_\{G\}or the information required to derive it\. Participating vehicles are assumed not to disclose the group secret to the RSU; compromised or colluding group members fall outside this secrecy assumption\. Group membership remains fixed within an epoch, and a changed participant group requires a new group setup\.

Authenticated group establishment\.The coordinatorDDexecutes a three\-stage protocol using signed messages delivered through the RSU:

1. 1\.KEY\.For each other participantu∈ℛu\\in\\mathcal\{R\}, the coordinator encapsulates a shared secret using the recipient’s ML\-KEM\-512 public key\. A key derived from the encapsulated secret through HKDF\-SHA256 protectsKGK\_\{G\}using ChaCha20\-Poly1305\. The authenticated context binds the recipient, epoch, and hash of the ordered participant list\.
2. 2\.CONFIRM\.After verifying and recoveringKGK\_\{G\}, each recipient returns a signed key\-confirmation message containing an HMAC\-SHA256 tag derived fromKcheckK\_\{\\rm check\}and bound to its identity, the epoch, and the participant\-list hash\.
3. 3\.SETUP\_OK\.Once all required confirmations have been validated, the coordinator sends a signed completion message to the group\. Any failed authentication, decryption, context validation, or incomplete confirmation prevents successful completion of the group setup\.

Because the vehicles may contact the RSU at different times, setup messages are stored and forwarded as recipients become available\. They traverse the same beacon\-controlled, RSU\-scheduled, SR\-ARQ V2I communication system used for model exchange, during dedicated setup drives preceding federated training\. No additional pairing messages are transmitted during subsequent training rounds\.

Figure K\.1:Authenticated CPQ group\-establishment progress across post\-quantum signature schemes\. All 49 recipients verifiedSETUP\_OKafter 7 \(Falcon\-512\), 9 \(ML\-DSA\-44\), or 19 \(SLH\-DSA\-SHA2\-128f\) communication drives\. The vertical line marks the 20\-drive setup limit\.Group\-establishment overhead\.In the primary ML\-DSA\-44 mobility\-coupled evaluation, authenticated group establishment completed in33–99dedicated setup drives across five independent CPQ runs, generating714\.6714\.6–717\.2717\.2KB of total wire traffic per run\. The protocol required246246–247247transfer attempts, including retransmissions when necessary\.

The signature\-sensitivity experiment further characterizes the communication cost of CPQ initialization under three post\-quantum authentication schemes\. All three configurations successfully completed group establishment for the same4949recipient vehicles\. Falcon\-512 completed setup in77drives with246246successful transfers and280\.4280\.4KB of total wire traffic\. ML\-DSA\-44 completed setup in99drives with246246successful transfers and714\.6714\.6KB of traffic\. In comparison, SLH\-DSA\-SHA2\-128f required1919setup drives and426426transfer attempts to complete the same246246successful message deliveries, generating7,462\.27\{,\}462\.2KB of wire traffic\.

Figure[K\.1](https://arxiv.org/html/2610.41055#A11.F1)illustrates the progression of group\-establishment completion across the dedicated setup drives\. The shorter Falcon\-512 signatures permit more compact authenticated setup messages, while the larger SLH\-DSA signatures increase wireless transmission and retransmission costs\. Consequently, signature selection influences both the communication overhead of model exchange and the time required to establish CPQ’s shared randomness under intermittent V2I connectivity\.

Group establishment is performed once per participant\-group epoch, before federated training\. Its communication cost is therefore distinct from the per\-round uplink and downlink traffic reported in the main evaluation\.

Algorithm K\.1Authenticated setup and server\-hidden CPQ shared\-randomness generation1:Group setup \(once per epoch\)

2:Agree on ordered group

ℛ\\mathcal\{R\}and epoch

ee; let

DDbe the first vehicle\.

3:

hℛ←SHA256⁡\(Encode⁡\(ℛ\)\)h\_\{\\mathcal\{R\}\}\\leftarrow\\operatorname\{SHA256\}\(\\operatorname\{Encode\}\(\\mathcal\{R\}\)\)
4:

DDobtains

KGK\_\{G\}and distributes signed, ML\-KEM\-protectedKEYmessages through the RSU\.

5:Recipients authenticate and recover

KGK\_\{G\}\.

6:Derive

KpairK\_\{\\rm pair\},

KcoinK\_\{\\rm coin\}, and

KcheckK\_\{\\rm check\}using HKDF\-SHA256 with purpose labels,

ee, and

hℛh\_\{\\mathcal\{R\}\}\.

7:Recipients return signedCONFIRMmessages using

KcheckK\_\{\\rm check\}\.

8:

DDverifies all confirmations and distributes signedSETUP\_OK; abort on incomplete or invalid setup\.

9:

10:Local procedure

11:HiddenPairValue

\(KG,ℛ,e,i,j,t\)\(K\_\{G\},\\mathcal\{R\},e,i,j,t\):

12:Use the epoch keys

KpairK\_\{\\rm pair\}and

KcoinK\_\{\\rm coin\}derived during setup\.

13:foreach

u∈ℛu\\in\\mathcal\{R\}do

14:

su←ChaCha20Stream⁡\(Kpair,t,u\)​\[j\]s\_\{u\}\\leftarrow\\operatorname\{ChaCha20Stream\}\(K\_\{\\rm pair\};t,u\)\[j\]
15:endfor

16:Sort

ℛ\\mathcal\{R\}by increasing

sus\_\{u\}, breaking ties by original list position\.

17:Let

kkbe the zero\-based position of vehicle

iiin the sorted list\.

18:if

\|ℛ\|\|\\mathcal\{R\}\|is odd and

k=\|ℛ\|−1k=\|\\mathcal\{R\}\|\-1then

19:returna private uniform value\.

20:endif

21:

ℓ←⌊k/2⌋\\ell\\leftarrow\\lfloor k/2\\rfloor
22:

V←Float53⁡\(ChaCha20Stream⁡\(Kcoin,t,ℓ\)​\[j\]\)V\\leftarrow\\operatorname\{Float53\}\\\!\\left\(\\operatorname\{ChaCha20Stream\}\(K\_\{\\rm coin\};t,\\ell\)\[j\]\\right\)
23:if

kmod2=0k\\bmod 2=0then

24:return

VV
25:else

26:return

1−V1\-V
27:endif

Key and randomness derivation\.The group secretKGK\_\{G\}is expanded using HKDF\-SHA256 into three purpose\-separated, 32\-byte keys:KpairK\_\{\\rm pair\}for pair assignment,KcoinK\_\{\\rm coin\}for shared\-value generation, andKcheckK\_\{\\rm check\}for group confirmation\. The derivation incorporates the group epocheeand the SHA\-256 hash of the consistently encoded ordered participant listℛ\\mathcal\{R\}\.

For each roundtt, ChaCha20 streams indexed by vehicle identity generate the sorting values for all model coordinates, while separate streams indexed by pair position generate the corresponding shared values\. At each coordinate, the vehicles sort the entire agreed group by the derived keys, using original list positions to break ties\. Adjacent sorted vehicles form pairs and use complementary valuesVVand1−V1\-V\. No pairing assignments or shared random values are transmitted during training\.

Quantization properties and partial participation\.Under the ideal model of independent, continuous uniform shared values across distinct pairs, the construction realizes the complementary coupling analyzed in Theorem[1](https://arxiv.org/html/2610.41055#Thmtheorem1)\. The population MSE bound in Corollary[1](https://arxiv.org/html/2610.41055#Thmcorollary1)additionally assumes that the aggregate contains complete pairs\.

In the contact\-dependent implementation, pair assignments are determined overℛ\\mathcal\{R\}, regardless of which vehicles successfully deliver their updates\. If only one member of a pair is included, the pairwise error cancellation is not realized\. Consequently, the complete\-pair population bound does not directly apply to arbitrary accepted\-client sets\. The finite\-precision implementation requires separate consideration, as discussed in Appendix[E](https://arxiv.org/html/2610.41055#A5)\.

## Appendix LVehicle\-Origin Inference Attack: Design and Evaluation

Experimental configuration\.To complement the empirical privacy evaluation in Section[7\.5](https://arxiv.org/html/2610.41055#S7.SS5), we investigate vehicle\-origin inference using the mobility\-coupled SUMO and ns\-3 framework\. The road network contains 30 directed edges, with 50 learning vehicles distributed equally across 10 possible starting edges: E0, E1, E3, E11, E8, \-E1, \-E11, \-E8, \-E13, and E14\. Each vehicle retains its assigned origin throughout training, while all vehicles share the publicly known destination E15\.

The DQN architecture consists of 94 state inputs, two hidden layers with 150 and 100 neurons, and three output actions, resulting in 29,653 trainable parameters\. Training proceeds for 100 federated rounds with 10 local episodes per round\. The learning rate is10−310^\{\-3\}, the mini\-batch size is 32, and the exploration rate decreases from 1\.0 to 0\.05 over 80 rounds\. Three independent random seeds are evaluated for each method\.

The communication environment employs IEEE 802\.11p at 6 Mb/s over a 10 MHz channel, with 20 dBm transmission power, log\-distance path loss \(exponent 2\.7\), and Nakagami fading\. The RSU is located at junction J3\. Vehicles discover the RSU through beacon transmissions and upload their updates only during available communication opportunities\. The origins are selected such that their shortest routes pass the RSU at comparable distances of 120–143 m, reducing differences in nominal RSU proximity across origin classes\. Background traffic is generated at an average interval of 1\.75 s following a 200 s warm\-up, while learning\-vehicle departures are randomized within a 100 s window in each episode\.

Model uploads are authenticated using ML\-DSA\-44, and the CPQ group secret is established using ML\-KEM\. The evaluation compares full\-precision model exchange without privacy against CPQ and independent LDP\-FL quantization atϵp=0\.3\\epsilon\_\{p\}=0\.3\. Both private mechanisms clip local model updates relative to the global model usingr=0\.02r=0\.02and encode each parameter with one bit\. The server retains only successfully received and authenticated uploads\.

Adversary and observation model\.We consider an honest\-but\-curious RSU that follows the communication and aggregation protocol while attempting to infer each vehicle’s private starting edge from received model updates\. The attacker knows the road network, learning architecture, privacy mechanism, privacy budget, clipping radius, and global model at each round\. It also observes individual successfully received uploads and can associate observations belonging to the same pseudonymous vehicle across rounds\.

The attacker does not observe private vehicle trajectories or possess the CPQ group secret\. Vehicle identifiers carry no origin information, and vehicle order is randomized before evaluating each attack\. The attack objective is to identify one of 10 possible origins for each target vehicle, corresponding to a random\-guessing accuracy of10%10\\%\. The attacker uses only the updates actually available at the RSU and does not assume complete federated participation\.

Attack feature construction\.The attacker extracts information from received updates by evaluating their influence on the learned Q\-function\. Specifically, 60 fixed probe states are constructed from the public road network, covering each of the 30 directed edges under two traffic conditions representing empty and busy traffic\. These states do not depend on the private trajectories of target vehicles\.

For each received update, the attacker evaluates the difference between the uploaded model’s Q\-values and those of the corresponding global model at every probe state:

Δ​Qi\(t\)​\(s,a\)=Qi\(t\)​\(s,a\)−Qg\(t\)​\(s,a\),\\Delta Q\_\{i\}^\{\(t\)\}\(s,a\)=Q\_\{i\}^\{\(t\)\}\(s,a\)\-Q\_\{g\}^\{\(t\)\}\(s,a\),\(L\.1\)
whereQi\(t\)Q\_\{i\}^\{\(t\)\}andQg\(t\)Q\_\{g\}^\{\(t\)\}denote the Q\-functions associated with the received client model and the global model at roundtt, respectively\. With 60 probe states and three actions, each update produces a 180\-dimensional feature vector\.

This representation captures the changes in routing decisions induced by local training while providing comparable features across training runs\. Alternative representations, including selected first\-layer weights and principal\-component features of complete updates, are also evaluated\.

Temporal evidence accumulation\.Because each vehicle retains the same origin throughout training, the attacker combines evidence across multiple federated rounds\. We evaluate two inference strategies\.

In the first strategy, an L2\-regularized logistic regression classifier estimates the probability of each origin from the features of an individual received update\. Log\-probabilities are accumulated over the observed rounds, and the origin with the largest cumulative score is selected:

o^i\(k\)=arg⁡max⁡∑t∈𝒯i​\(k\)o∈𝒪⁡log⁡P⁡\(o∣𝐱i\(t\)\),\\hat\{o\}\_\{i\}^\{\(k\)\}=\\arg\\max\_\{o\\in\\mathcal\{O\}\}\\sum\_\{t\\in\\mathcal\{T\}\_\{i\}\(k\)\}\\log P\(o\\mid\\mathbf\{x\}\_\{i\}^\{\(t\)\}\),\(L\.2\)
where𝒪\\mathcal\{O\}denotes the set of candidate origins,𝐱i\(t\)\\mathbf\{x\}\_\{i\}^\{\(t\)\}is the feature vector extracted from vehicleiiat roundtt, and𝒯i​\(k\)\\mathcal\{T\}\_\{i\}\(k\)contains the rounds up tokkin which the RSU successfully received an update from that vehicle\.

In the second strategy, the received updates of each vehicle are averaged across the observation window, and a classifier trained on averaged updates predicts its origin\. Both strategies account for missing uploads by using only successfully received observations\. Vehicles without any received updates in the observation window are assigned random guesses\.

Attack accuracy is evaluated afterk∈\{1,2,5,10,20,50,100\}k\\in\\\{1,2,5,10,20,50,100\\\}observed rounds\.

Attack 1: Known\-origin vehicles\.In the first scenario, the RSU knows the starting edge of one vehicle from each origin class, corresponding to 10 known vehicles among the 50 participants\. These vehicles are ordinary honest clients, and their cryptographic secrets are not available to the attacker\.

The attacker trains on the labeled updates from these vehicles and evaluates origin inference on the remaining 40 vehicles\. It uses the Q\-function probe features and the per\-round probability accumulation strategy in \([L\.2](https://arxiv.org/html/2610.41055#A12.E2)\)\. The classifier employs L2\-regularized logistic regression withC=0\.1C=0\.1, fixed using separate pilot experiments\. Five random selections of the known\-origin vehicles are evaluated for each simulation run\.

Attack 2: Shadow\-run inference\.In the second scenario, the RSU has no labeled vehicles in the target deployment\. Instead, it generates independent simulations of the same road network and learning configuration, using their known origin labels to train an inference classifier\.

We employ leave\-one\-seed\-out evaluation\. For each method, two simulation seeds are used for attacker training, while the third seed is held out for evaluation\. This process is repeated with each seed serving as the target once\. Feature representation, classifier regularization, and temporal aggregation strategy are selected using only training\-seed data\. The target seed is never used for classifier training or model selection\.

The attacker then predicts the origins of all 50 vehicles in the held\-out deployment, providing an evaluation without labeled vehicles in the target run\.

Evaluation and validation\.Attack effectiveness is measured as the percentage of target vehicles whose origins are correctly identified after observingkkfederated rounds\. The evaluation includes three independent simulation seeds for each privacy method\.

In addition to reporting seed\-level variability, 95% confidence intervals are estimated through a cluster bootstrap that resamples simulation seeds and vehicles\. Shuffled\-label controls are also evaluated, using five random permutations of origin labels to verify that the attack does not exploit artificial label associations\.

To verify consistency between the attack observations and federated training, the server records its global model and all successfully received individual uploads\. Reconstructing and aggregating these logged updates reproduces the server’s next global model with a maximum difference below10−610^\{\-6\}across all nine runs\. The shuffled\-label controls achieve approximately88–11%11\\%accuracy, consistent with random guessing\.

The mean percentages of vehicle\-round updates successfully received by the RSU are47%47\\%for the no\-privacy baseline,61%61\\%for CPQ, and62%62\\%for LDP\-FL\. Thus, the attack results reflect the actual observations available under mobility\-dependent communication\.

Origin inference results\.Table[L\.1](https://arxiv.org/html/2610.41055#A12.T1)summarizes the inference accuracy of the two attacks at three representative observation windows\. Values are reported as mean±\\pmsample standard deviation across three seeds, consistent with the reporting convention used in the main paper\. The statistics are computed from the reported rounded seed\-level accuracies\.

Table L\.1:Vehicle\-origin inference accuracy \(mean±\\pmSD\)\.The known\-origin attack reaches68\.7%68\.7\\%mean accuracy after 100 rounds without privacy, compared with13\.0%13\.0\\%for CPQ and12\.0%12\.0\\%for LDP\-FL\. Both private mechanisms substantially reduce inference accuracy across the evaluated observation windows\.

Under the shadow\-run attack, which requires no known\-origin vehicles in the target deployment, the no\-privacy baseline reaches91\.3%91\.3\\%mean accuracy after 100 rounds\. In comparison, CPQ and LDP\-FL achieve30\.0%30\.0\\%and22\.0%22\.0\\%, respectively\. The stronger late\-round inference results for the private mechanisms arise from the strategy that averages received updates across rounds\.

These findings show that the unprotected federated updates contain information that can be exploited to infer private vehicle origins\. Both CPQ and LDP\-FL substantially reduce the effectiveness of the evaluated attacks, providing application\-level empirical evidence that complements the theoretical privacy analysis\. Together with the routing and communication evaluations, the results further characterize the privacy–utility–communication trade\-offs of private quantization in vehicular federated learning\.

Ethical Considerations:The origin\-inference attacks were conducted entirely within a simulated vehicular environment using synthetically generated mobility and federated learning data\. No real driver information, personal mobility records, or operational vehicular infrastructure were involved\. The attacks were implemented solely to evaluate potential privacy vulnerabilities and assess the effectiveness of the proposed privacy\-preserving mechanism\.