Vehicles Prove Their Trustworthiness: Zero-Knowledge AI Comes to Smart Roads

Every day, millions of vehicles stream past cameras, sensors and GPS receivers, quietly collecting some of the most sensitive data imaginable: exactly where you drive, when you drive, and what the world looks like from your windshield. A new study from researchers at Politehnica University of Bucharest and the ‘Ferdinand I’ Military Technical Academy proposes a way for cars to learn together from this data without ever revealing it, and without trusting anyone in the network. The work, published in Frontiers in Future Transportation, introduces a framework called ZK-FL that weaves together three technologies rarely seen in one pipeline: semi-supervised learning, zero-knowledge cryptography and blockchain auditing.

The problem the team set out to solve is deceptively simple to state. Intelligent Transportation Systems, the software backbone of future smart cities, need models that can classify street scenes into categories such as city street, highway, residential area or parking lot. Training such models well requires vast amounts of imagery from many geographic locations and weather conditions. But pooling camera footage from thousands of vehicles into a central server is a privacy nightmare, and the vehicles themselves cannot be blindly trusted to report honest results.

Federated learning offers the standard escape hatch: each vehicle trains a model locally on its own data and shares only the resulting parameter updates, never the raw images. Yet the authors identify three stubborn obstacles that have kept this approach from working smoothly in real vehicular networks. First, vehicular data are inherently non-IID, meaning each car sees a statistically different slice of the world depending on where it drives and in what weather. Second, hand-labeling street scenes at fleet scale is prohibitively expensive, so most on-board data goes unused. Third, conventional federated learning simply assumes participants behave honestly, which is a dangerous assumption when a compromised vehicle could submit poisoned updates that corrupt the shared model.

The team’s answer to the label scarcity problem is a confidence-based pseudo-labeling pipeline. On the Mapillary Vistas v2 dataset, which provides only pixel-level semantic segmentation rather than scene labels, the researchers first derive scene labels by mapping dominant pixel classes to the four target categories. Then, in a semi-supervised twist, each vehicle uses the current global model to label its own unlabeled images, keeping only predictions whose maximum softmax probability exceeds a threshold of 0.85. The approach was tested under a harsh Dirichlet non-IID partition with just 10 percent labeled supervision per client. Pseudo-label acceptance rates climbed from 51 percent in the first round to over 80 percent by round 18, and the semi-supervised pipeline reached roughly 77 percent overall accuracy, outperforming a threshold-based labeling baseline by about 20 percentage points.

The cryptographic layer is where the framework gets its name. Each vehicle, after training locally and quantizing its model update from 32-bit floating point to 8-bit integers, generates a zk-SNARK proof using the Groth16 proving system implemented through ZoKrates. A zk-SNARK, or zero-knowledge succinct non-interactive argument of knowledge, lets a prover convince a verifier that a computation was performed correctly without revealing the underlying inputs. In this case, the vehicle proves that a distributed probe of coordinates drawn from its quantized update satisfies a norm-boundedness constraint, essentially certifying that the update’s magnitude falls within acceptable bounds. The proof is a mere 0.90 kilobytes against a model of about 32.36 megabytes, a striking illustration of how succinct these cryptographic artifacts can be.

Verification happens at the edge. Road-Side Units, or RSUs, act as regional aggregators, checking each proof before an update is allowed into the FedAvg averaging process. The choice of Groth16 matters here: its proofs consist of exactly three elliptic curve group elements, and verification reduces to three bilinear pairing checks that run in milliseconds, well within the latency budget of vehicle-to-infrastructure communication. The researchers also computed SHA-256 commitments binding the full transmitted update and its probe, so a proof generated for one update cannot be replayed for another.

The third pillar is accountability. A permissioned Hyperledger Besu blockchain running QBFT consensus maintains a tamper-evident audit trail of every training round, recording only compact metadata: update commitments, proof digests, global model hashes and participant counts. A full round’s on-chain payload for five vehicles amounts to just 736 bytes, with confirmation latency around 200 milliseconds on a four-node testnet. Any participant can later independently verify the integrity of a training round by comparing recomputed hashes against the ledger, providing traceability without exposing model contents.

Scalability measurements revealed both promise and caveats. With 5 to 10 vehicles, proof generation stayed below roughly 25 seconds per round and verification below 11 seconds. At 100 vehicles, those figures rose to 560 and 220 seconds respectively, or about 5.6 seconds of generation and 2.2 seconds of verification per vehicle. The authors are candid that these numbers reflect sequential execution on a single GPU server, with overhead inflated by repeated process initialization and memory contention, and that a distributed deployment with parallel proof generation would look considerably different.

The evaluation on BDD100K, using a weather-driven non-IID partition, compared five aggregation strategies and found FedAvg the most balanced performer, reaching 65.53 percent accuracy and a Macro-F1 of 0.3607 over 50 rounds. Notably, the team tested only benign conditions, so the results do not yet demonstrate resilience against actual poisoning attacks, and the authors acknowledge that an adaptive adversary aware of the fixed probe-selection rule could potentially manipulate unprobed coordinates. Randomized probe selection, empirically calibrated norm thresholds and adversarial evaluations are all flagged as future work.

Even with those limitations, the study marks a meaningful step toward trustworthy collaborative AI on the road. Its components reinforce one another in a virtuous cycle: pseudo-labeling expands each vehicle’s effective training set, verified updates yield a more reliable global model that in turn produces better pseudo-labels, and the blockchain guarantees that the whole process can be audited after the fact. As autonomous driving and connected mobility mature, frameworks like ZK-FL suggest a future where vehicles can learn from each other, prove their honesty, and keep your windshield view to themselves.

Subject of Research: Privacy-preserving federated learning with zero-knowledge proofs for vehicle scene classification in intelligent transportation systems

Article Title: Semi-supervised zero-knowledge federated learning for intelligent transportation systems

Article References: Medvei, M.-M., Modiga, M.-M., Aciobăniței, I., & Ţăpuş, N. (2026). Semi-supervised zero-knowledge federated learning for intelligent transportation systems. Frontiers in Future Transportation, 7, Article 1972925. https://doi.org/10.3389/ffutr.2026.1972925

Image Credits: AI Generated

DOI: 10.3389/ffutr.2026.1972925

Keywords: federated learning, zero-knowledge proofs, zk-SNARKs, intelligent transportation systems, VANETs, semi-supervised learning, pseudo-labeling, blockchain, Hyperledger Besu, privacy-preserving machine learning, Groth16, scene classification