Privacy-Preserving Information Fusion of Heterogeneous Cross-Jurisdictional Sources for Traffic Accident Severity Prediction

Abstract

Road safety authorities each hold accident records that, when combined, could train stronger severity prediction models, yet these records can be neither centralized, for privacy and governance reasons, nor naively merged, because jurisdictions encode severity under incompatible ontologies. This paper recasts that impasse as an information fusion problem and fuses model updates from multiple road safety data silos into a single severity model while every raw record stays at its source. Three components act together: model-level fusion under differential privacy, a reliability-weighted aggregation rule that trusts each source based on its measured quality rather than its size, and a per-source centered logit adjustment layer that reconciles mismatched label priors without double-correcting the shared class imbalance. The primary evaluation is a clean cross-silo setting: five United States state datasets (US Accidents) that share one severity ontology but are held by distinct custodians. Here, over five seeds with 95% confidence intervals, effect sizes, and Holm–Bonferroni correction, private fusion recovers most of a centralized upper bound while keeping data local ($0.599$ balanced accuracy versus $0.624$ when centralized and $0.544$ when local-only), and reliability-weighted fusion attains the highest macro F1 of all methods ($0.567$). Reliability weighting yields a small but consistent robustness advantage under privacy noise; in leave-one-state-out transfer, its improvement over uniform averaging is large on every held-out state but, after Holm correction, survives in two out of five cases. Crucially, we also report a boundary honestly; a United Kingdom source that encodes injury severity—an ontologically different target from the US traffic impact scale—is used as a deliberate out-of-ontology transfer stress test, and a transfer to it collapses to chance ($0.50$, $p=0.62$). Two further honest results are reported: alignment raises accuracy everywhere but does not close the across-source gap, and a membership inference attack reveals no measurable leakage for differential privacy to remove.

1. Introduction

Predicting the severity of road traffic accidents supports early warning systems, emergency resource allocation, and evidence-based road safety policy [1,2]. The quality of such predictions depends on the volume and diversity of the underlying crash records. Individual custodians, however, observe only their own data silos, and the records they hold cannot in general be pooled into a single central dataset. Two obstacles stand in the way. First, crash records are sensitive administrative data, whose centralization raises privacy, legal, and governance concerns. Second, custodians in different jurisdictions annotate severity under different ontologies; the severity field of one authority may encode traffic impact, while another encodes injury outcome. Thus, even the target variable is not directly comparable across those sources.

These obstacles are naturally framed as an information fusion problem. Each custodian is a distributed information source; combining the parametric knowledge of locally trained models is a form of decision-level fusion; and reconciling incompatible label spaces is a fusion operation over heterogeneous, incomplete, and imprecise annotations. This framing places the problem within the scope of fusion learning in imperfect environments [3,4].

A central design decision in this work, sharpened during peer review, is to separate two questions that a careless evaluation would conflate. The first is whether privacy-preserving fusion of same-ontology silos helps, relative to training in isolation and relative to a centralized model that is forbidden by the privacy constraint. This is a clean, well-posed question, and it is our primary claim. We instantiate it on five United States states drawn from the US Accidents dataset [5]. The states share a single severity ontology (a traffic impact scale), yet each state’s records are held by a separate custodian and cannot be pooled as raw data. This is the clean cross-silo federated setting [6]. The second question is whether the same fusion machinery transfers across genuinely different severity ontologies. Here, we are deliberately conservative; a United Kingdom source (STATS19 [7]) encodes injury severity (the killed-or-seriously-injured (KSI) convention), which is not the same target as the US traffic impact scale. We therefore do not treat the UK source as a KSI-equivalent partner in fusion; we use it only as an out-of-ontology transfer stress test, and we report—plainly—that transfers to it fail.

This paper presents a privacy-preserving information fusion framework and evaluates it under this two-question discipline. Local models are trained under differential privacy so that no raw record leaves its source [8,9], the per-source models are fused by a reliability-weighted rule rather than by data volume alone, and a per-source logit adjustment layer aligns mismatched label priors [10,11]. The privacy loss is composed over all local steps and rounds with a Rényi differential privacy accountant [12] and reported per source, because the sources differ in size.

The contributions of this work are the following:

• A privacy-preserving cross-silo fusion framework combining reliability-weighted model fusion, a formally accounted differential privacy mechanism, and a centered label shift alignment layer (Section 3).
• A clean primary evaluation on five same-ontology US state silos with 95% confidence intervals, Cohen’s d effect sizes, and Holm–Bonferroni correction, isolating the contribution of each component (Section 4).
• An honest characterization of the method’s boundary; transfer across a genuinely different severity ontology (US impact severity → UK injury severity) collapses to chance, reported as a first-class negative result rather than being hidden (Section 4.2 and Section 5).
• Two further transparent findings—alignment improves accuracy without closing the across-source gap and a null membership inference result—together with the released harmonization and experiment pipeline.

The remainder of the paper is organized as follows. Section 2 reviews the related work. Section 3 presents the framework, the corrected privacy mechanism and its Rényi accounting, the reliability-weighted fusion rule, the centered label shift alignment, and the data. Section 4 reports the primary same-ontology results and the out-of-ontology boundary, with full statistical treatment. Section 5 discusses the findings, Section 6 relates the work to the Sustainable Development Goals, and Section 7 concludes the paper.

2. Related Work

Information fusion of heterogeneous sources. Multi-source and multi-sensor information fusion spans data-, feature-, and decision-level operators [3,4,13]. Fusion in imperfect, imprecise, and incomplete environments is a long-standing concern, with model- and decision-level fusion used where raw data cannot be shared. The present contribution operates at the model level and treats mismatched label priors as a heterogeneity to be fused rather than assumed away.

Federated learning. Federated averaging trains a shared model from decentralized data without moving it [14], and the setting has matured into a broad research area [6,15]. The cross-silo regime, with a small number of reliable institutional participants, is distinguished from cross-device federation [6]. Heterogeneity across clients motivates proximal and personalized variants [16,17]. Federated learning has been applied to intelligent transportation and traffic tasks [18,19]. This paper treats federated aggregation explicitly as model-level information fusion and adds a reliability weighting and label shift alignment operator.

Differential privacy. Differential privacy provides a formal bound on the influence of any single record [8], and differentially private stochastic gradient descent (DP-SGD) extends it to deep learning via per-sample gradient clipping and Gaussian noise [9]. Tight composition across many steps is obtained through Rényi differential privacy [12] with privacy amplification by subsampling. Differential privacy has been combined with federated learning to protect client contributions [20,21]. Membership inference attacks quantify what a model leaks about its training data [22].

Label shift and logit adjustment. When the label distribution differs across domains, logit adjustment and label shift estimation recalibrate predictions [10,11,23]. The present framework uses a per-source, centered logit adjustment as the operator that reconciles sources whose label priors differ.

Accident severity prediction. Machine learning models for crash severity prediction have been thoroughly studied [1,2], typically in a single-region, centralized, non-private setting. The present work differs in being cross-silo, privacy-preserving, and fusion-centric and in reporting where the framework fails as well as where it succeeds.

Positioning. 

Table 1. Positioning against representative prior work. The four axes are MS (fuses multiple sources); Local (raw data remains local); DP (provides formal differential privacy); and Shift (reconciles mismatched label priors). A check mark denotes that the property is provided, and a dash indicates that it is not.

Approach	MS	Local	DP	Shift
Centralized severity models [1,2]	✓	–	–	–
Federated averaging [14]	✓	✓	–	–
Federated traffic prediction [18,19]	✓	✓	partial	–
DP-SGD/DP-FL [9,20]	✓	✓	✓	–
Logit adjustment/label shift [10,23]	–	–	–	✓
This work	✓	✓	✓	✓

places the present work against representative prior art along four axes: whether the method fuses multiple sources, whether raw data stays local, whether formal differential privacy is provided, and whether sources with mismatched label priors are reconciled. To the authors’ knowledge, no prior study addresses all four together for accident severity prediction while also reporting the cross-ontology transfer boundary honestly.

3. Materials and Methods

3.1. Notation

To keep the description self-contained,

Table 2. Notation used throughout the paper.

Symbol	Meaning
K	Number of distributed cross-silo sources.
$D_k$	Local dataset held by source k; never leaves the source.
$n_k$	Number of records at source k.
$y\in \{0,1\}$	Binary target; $y=1$ denotes the high-severity outcome.
${\pi }_k$	Local label prior at source k; that is, ${Pr}_k(y=1)$.
${\pi }_{\mathrm{glob}}$	Pooled (global) label prior across participating sources.
$r_k$	Reliability of source k; the balanced accuracy of a quick local model on a held-out split of $D_k$.
$w_k$	Fusion weight assigned to source k (Equation (2)).
$a_k\left[y\right]$	Per-class centered logit adjustment for source k (Equation (3)).
${\beta }_k\left[y\right]$	Per-class weight applied at source k to counter class imbalance.
$\theta ,{\theta }^{\left(t\right)}$	Model parameters; the global model after fusion round t.
$T,E$	Number of fusion rounds; local epochs per round.
B	Minibatch size; sampling rate $q_k=B/n_k$.
C	Per-sample gradient clipping norm in DP-SGD.
${\sigma }_k$	Gaussian noise multiplier at source k.
$({\epsilon }_k,\delta )$	Per-source differential privacy budget.

lists every symbol used in this paper together with its meaning. All symbols are also defined at first use in the text.

All experiments were implemented in Python 3.11 (Python Software Foundation, Wilmington, DE, USA) using PyTorch 2.2 (Meta AI, Menlo Park, CA, USA) for model training and per-sample differentially private stochastic gradient descent, the Opacus 1.4 library (Meta AI, Menlo Park, CA, USA) for Rényi differential-privacy accounting, and NumPy 2.5.3, pandas 3.0.5, and Matplotlib 3.11.2 (NumFOCUS, Austin, TX, USA) for data processing and visualization.

3.2. Problem Set-up and Threat Model

Let there be K distributed sources, each a custodian holding local crash records that never leave the source. Records are mapped to a shared feature space and to a binary target $y\in \{0,1\}$, where $y=1$ denotes the high-severity outcome under that source’s own ontology. Each source k has a local label prior ${\pi }_k={Pr}_k(y=1)$, and these priors differ across sources. The threat model assumes an honest-but-curious server and observers, and it protects the membership of individual records through $({\epsilon }_k,\delta )$-differential privacy applied to every quantity each source releases, namely its model updates and its released summary statistics.

3.3. Private Local Training with Correct Sensitivity

Each source trains a local classifier via differentially private stochastic gradient descent [9]. Class imbalance is pronounced for the high-severity target, and thus a per-class weight ${\beta }_k\left[y\right]$ is used to keep minority cases from being lost under privacy noise. The order of operations matters for the privacy guarantee. In the revised mechanism, the class weight is applied to each per-sample gradient before clipping, and the weighted per-sample gradient is then clipped to ${\ell }_2$-norm C:

$${\tilde{g}}_i=\mathrm{clip}\left({\beta }_k\left[y_i\right]g_i,C\right),\overline{g}=\frac{1}{\left|B\right|}\left({\sum }_{i\in B}{\tilde{g}}_i+\mathcal{N}(0,{\sigma }_k^2{C}^{2}I)\right).$$

(1)

Because clipping is the last operation before summation, the per-sample sensitivity is exactly C, independent of the class weights. This corrects an error in the earlier version of the mechanism, in which the class weight multiplied the gradient after clipping; there, the sensitivity was as large as ${\beta }_{max}C$, and thus the noise calibrated to C did not deliver the stated guarantee. With Equation (1), the Gaussian noise ${\sigma }_{k}C$ is correctly calibrated, and the $({\epsilon }_k,\delta )$ guarantee is formal, with no “up to a constant” caveat.

3.4. Reliability-Weighted Fusion

Rather than fusing sources in proportion to their size, the source k is weighted by

$$w_k\propto max(r_k,0.05)\sqrt{n_k},$$

(2)

where $r_k$ is the reliability of source k, defined as the balanced accuracy of a quick local model on a held-out split of $D_k$. The $\sqrt{n_k}$ factor is a deliberate variance-stabilizing choice; the sampling error of a source’s update scales as $1/\sqrt{n_k}$, and thus weighting by $\sqrt{n_k}$ (rather than $n_k$) equalizes the influence of the estimation noise across sources of vastly different sizes, preventing one large source from dominating the fused estimate under privacy noise. Reliable sources contribute more; the floor $0.05$ prevents a single unreliable source from being removed entirely. The two factors together bound a source’s influence from both sides; the $\sqrt{n_k}$ term keeps a large jurisdiction from overwhelming the others, while the reliability term and its floor keep a small or noisy jurisdiction from exerting disproportionate influence. Thus, no single jurisdiction dominates the fused estimate purely by virtue of its record count. Because the alignment claim in this paper is isolated by comparing aligned against unaligned fusion under identical weighting (Section 4), the alignment result does not depend on the choice of weighting scheme.

3.5. Label Shift Alignment as a Full Per-Class Adjustment

Sources annotate severity under different priors, and thus the aligned method adds, during local training, a per-source, per-class centered logit adjustment [10]. For the binary target, the adjustment shifts the logit of class y by

$$a_k\left[y\right]=log{\pi }_k\left[y\right]-log{\pi }_{\mathrm{glob}}\left[y\right],y\in \{0,1\},$$

(3)

so that the adjusted score for class y is $s_k^{\prime }\left(x\right)\left[y\right]=s_k\left(x\right)\left[y\right]+a_k\left[y\right]$. In the binary case, this is equivalent to shifting the single decision logit by $a_k\left[1\right]-a_k\left[0\right]=\left(log\frac{{\pi }_k\left[1\right]}{{\pi }_{\mathrm{glob}}\left[1\right]}\right)-\left(log\frac{{\pi }_k\left[0\right]}{{\pi }_{\mathrm{glob}}\left[0\right]}\right)$, i.e., by the log-ratio of the source-to-global odds. Centering on the global prior ${\pi }_{\mathrm{glob}}$ is essential; the class weighting of Section 3.3 already handles the absolute imbalance, and thus an uncentered adjustment would correct the prior twice and drive the classifier toward the minority class. The centered adjustment instead corrects only each source’s deviation from the global prior. At inference, the adjustment is removed, recovering the prior-corrected posterior for the target distribution.

3.6. General Fusion Algorithm

Algorithm 1 states the complete procedure in a general, source-agnostic form. The server broadcasts the current global model; each source performs a private local update with its class weighting applied before clipping and, for the aligned method, its centered per-class logit adjustment, and the updated source models are combined by the reliability weights of Equation (2).

Algorithm 1 Privacy-preserving reliability-weighted model fusion with centered label shift alignment.
1: Input: sources ${\left\{D_k\right\}}_{k=1}^K$; rounds T; local epochs E; clip norm C; per-source noise $\left\{{\sigma }_k\right\}$; $\delta$
2: Output: fused global model ${\theta }^{\left(T\right)}$
3: each source releases DP-noised statistics ${\widehat{r}}_k,{\widehat{\pi }}_k$; server forms weights $w_k\propto max({\widehat{r}}_k,0.05)\sqrt{n_k}$ and ${\widehat{\pi }}_{\mathrm{glob}}$
4: if aligned, compute centered adjustments $a_k\left[y\right]=log{\widehat{\pi }}_k\left[y\right]-log{\widehat{\pi }}_{\mathrm{glob}}\left[y\right]$
5: initialize global model ${\theta }^{\left(0\right)}$
6: for $t=1\dots T$ do
7:       for each source k in parallel do
8:             ${\theta }_k\leftarrow {\theta }^{(t-1)}$
9:             for E local epochs, each minibatch $B\subseteq D_k$ do
10:                    compute per-sample gradients (add $a_k$ to the logits if aligned)
11:                    apply class weight ${\beta }_k$, then clip each weighted per-sample gradient to ${\ell }_2$-norm C	▹ Equation (1)
12:                    add Gaussian noise $\mathcal{N}(0,{\sigma }_k^2{C}^{2}I)$, average, and update ${\theta }_k$
13:             end for
14:       end for
15:       ${\theta }^{\left(t\right)}\leftarrow {\sum }_k{w}_k{\theta }_k$	▹ reliability-weighted fusion
16: end for
17: return ${\theta }^{\left(T\right)}$

3.7. Privacy Analysis with a Rényi Accountant

Privacy is accounted with a Rényi differential-privacy (RDP) accountant for the subsampled Gaussian mechanism [9,12], which composes the privacy loss over every local SGD step across all rounds and local epochs and then converts to $({\epsilon }_k,\delta )$ at $\delta ={10}^{-5}$ under add- or remove-one-record adjacency. The number of composed steps at source k is ${\mathrm{steps}}_k=TE\lceil n_k/B\rceil$, and the per-step sampling rate is $q_k=B/n_k$; both differ across sources, and thus a per-source ${\epsilon }_k$ is reported, and no single global $\epsilon$ is claimed. Two quantities beyond the model updates are released by each source: the reliability $r_k$ and the label prior ${\pi }_k$. These are bounded, low-sensitivity scalars, and they are released under differential privacy by adding calibrated Gaussian noise; their cost is included in the per-source budget, and the global prior ${\pi }_{\mathrm{glob}}$ is then a post-processing of the noised priors. Because the corrected mechanism of Section 3.3 has a per-sample sensitivity of exactly C, the resulting guarantee is formal.

Table 3. Per-source Rényi DP accounting for the subsampled Gaussian mechanism ($B=1024$, $T=40$ rounds, $E=2$ local epochs, $\delta ={10}^{-5}$, and add- or remove-one adjacency). Entries are the noise multiplier ${\sigma }_k$ that attains each target per-source ${\epsilon }_k$; verified to reproduce the target to three decimals.

Source		$n_k$	$q_k=B/n_k$		${\mathrm{steps}}_k$
US state (CA, TX, FL, NY, PA)		40,000	0.0256		3200
UK (out-of-ontology probe)		150,000	0.0068		11,760
${\sigma }_k$ for target ${\epsilon }_k$	${\epsilon }_k=8$	4	2	1	$0.5$
US state (each)	1.213	1.984	3.597	6.891	13.516
UK	0.813	1.164	1.933	3.575	6.937

gives the per-source accounting; for each operating budget, the noise multiplier is calibrated per source from its $q_k$ and ${\mathrm{steps}}_k$. The larger UK source requires less noise for the same $\epsilon$ because its much smaller sampling rate yields stronger privacy amplification, despite its larger step count.

3.8. Data Sources and Harmonization

The primary evaluation uses five same-ontology silos: the California, Texas, Florida, New York, and Pennsylvania partitions of US Accidents [5], each holding $40,000$ sampled records. All five share one severity ontology: a traffic-impact scale of 1–4, with values 3–4 taken as the high-severity class; the high-severity class is the minority in each. These states are distinct data governance silos; each record set is held by a separate custodian and cannot be pooled as raw data, even though the states share one ontology, which is exactly why fusing them is a clean, well-posed cross-silo problem rather than a matter of simply concatenating data. Separately, UK STATS19 road safety data [7] ($150,000$ records) provides an out-of-ontology probe; UK severity is an injury scale (fatal or serious mapped to high, or the KSI convention), which is not the same target as the US traffic impact scale. The UK source is therefore never fused as a KSI-equivalent partner; it appears only as a held-out source in the transfer stress test of Section 4.2.

Table 4. Information sources. The five US states share one traffic impact ontology and constitute the primary cross-silo evaluation. The UK source encodes a different (injury) ontology and is used only as an out-of-ontology transfer probe, not as a fusion partner.

Source	Custodian/Native Ontology	Records	Role
us_CA	US California/traffic impact 1–4	40,000	primary
us_TX	US Texas/traffic impact 1–4	40,000	primary
us_FL	US Florida/traffic impact 1–4	40,000	primary
us_NY	US New York/traffic impact 1–4	40,000	primary
us_PA	US Pennsylvania/traffic impact 1–4	40,000	primary
uk	UK/injury severity 1–3 (KSI)	150,000	out-of-ontology probe

summarizes the sources. All sources share a 10-feature schema (

Table 5. Shared 10-feature schema derived from fields common to all sources.

Feature	Description
hour	hour of day (0–23)
day_of_week	weekday, 0 = Monday
is_weekend	weekend indicator
rush_hour	7–9 or 16–18 h indicator
month	month of year (1–12)
weather_bad	adverse weather indicator
is_night	darkness indicator
road_class	major road (motorway or highway) indicator
lat_b, lon_b	location quantile buckets

);

Table 6. Training hyperparameters, fixed across all methods.

Setting	Value
Model	multilayer perceptron (MLP), two hidden layers of width 64, ReLU
Optimizer	stochastic gradient descent, learning rate 0.1
Batch size B	1024
Fusion rounds T	40
Local epochs per round E	2
DP clip norm C	1.0
DP $\delta$	${10}^{-5}$
Per-source ${\epsilon }_k$ sweep	$\{\infty ,8,4,2,1,0.5\}$
Seeds	5 (results as mean with 95% CI)

lists the hyperparameters, which were fixed across methods so that differences reflected the fusion mechanism rather than tuning. These particular sources were selected on three practical grounds. Both are large, publicly available, standardized national crash datasets held by genuinely distinct custodians, which makes the cross-silo governance constraint realistic rather than artificial. The five US states share a single severity ontology, giving a clean, well-posed same-ontology fusion test. And the UK source deliberately encodes a different (injury or KSI) target, supplying the out-of-ontology contrast without which the transfer boundary of Section 4.2 could not be probed; the first evaluation therefore pairs a same-ontology panel with one out-of-ontology probe by design rather than by convenience.

3.9. Methods Compared

Six methods were compared: CEN, a non-private model trained on the pooled data (an upper bound that violates the privacy constraint and is inadmissible in deployment); LOC, with each source’s model evaluated on the pooled test set (a lower bound); FA, with non-private federated averaging; FA-DP, utilizing uniform (size-weighted) private fusion; RWF, the proposed reliability-weighted private fusion; and RWF-A, which is RWF with centered label shift alignment. Comparing RWF-A against RWF isolated the alignment operator alone, because the two share identical weighting, privacy budget, splits, and optimizer settings.

3.10. Metrics and Protocol

Because the target was imbalanced, balanced accuracy (the mean of per-class recall) was the primary metric, with the macro-F1 score as the secondary metric. The per-source privacy budget was swept over ${\epsilon }_k\in \{\infty ,8,4,2,1,0.5\}$ with $\delta ={10}^{-5}$. All experiments used five seeds; central tables report the mean with a 95% confidence interval, and headline comparisons report Cohen’s d (paired, $d_z$) and paired t-tests. Multiple comparisons were corrected with the Holm–Bonferroni procedure within each test family. Cross-silo transfer was measured with a leave-one-source-out (LOSO) protocol. The per-source balanced accuracy quantifies fairness across sources, a loss-threshold membership inference attack quantifies leakage as the ROC AUC, and communication cost is the number of transmitted parameters.

4. Results

All numbers are means over five seeds with 95% confidence intervals. Section 4.1 and Section 4.3 concern the primary same-ontology setting; Section 4.2 reports both the within-US transfer and the out-of-ontology boundary. The full statistical treatment, including Holm–Bonferroni correction, is in Section 4.7.

4.1. Privacy–Utility Trade-off (Same-Ontology Fusion)

Table 7. Privacy–utility: balanced accuracy (mean over five seeds) by method and per-source budget ${\epsilon }_k$. Higher values are better.

Method	${\mathit{\epsilon }}_{\mathit{k}}=\mathit{\infty }$	8	4	2	1	0.5
FA-DP (uniform private)	0.605	0.597	0.597	0.596	0.596	0.596
RWF (proposed)	0.606	0.599	0.599	0.599	0.599	0.599
RWF-A (proposed, aligned)	0.605	0.599	0.599	0.599	0.599	0.599

and Figure 1 report the balanced accuracy across the per-source privacy budget. Under differential privacy, RWF and RWF-A held about a $0.599$ balanced accuracy across ${\epsilon }_k\in \{0.5,\dots ,8\}$, whereas the uniform private baseline FA-DP sat slightly lower at about $0.596$. The advantage is clearer for the macro-F1 score (

Table 8. Privacy–utility: macro-F1 score (mean over five seeds) by method and per-source budget ${\epsilon }_k$.

Method	${\mathit{\epsilon }}_{\mathit{k}}=\mathit{\infty }$	8	4	2	1	0.5
FA-DP (uniform private)	0.556	0.538	0.538	0.537	0.537	0.535
RWF (proposed)	0.569	0.567	0.567	0.567	0.567	0.567
RWF-A (proposed, aligned)	0.567	0.567	0.567	0.567	0.567	0.567

), where the reliability-weighted methods held about $0.567$ against about $0.538$ for FA-DP, because reliability weighting preserved the minority high-severity performance that the uniform baseline sacrificed under noise. The balanced-accuracy differences were small in absolute terms (from $+0.0026$ to $+0.0033$; Section 4.7), and we report them as such rather than emphasizing them.

4.2. Cross-Silo Transfer and the Out-of-Ontology Boundary

Table 9. Cross-silo transfer: leave-one-source-out balanced accuracy (mean over five seeds). $\Delta$ is RWF-A − FA; $d_z$ is the paired Cohen’s d; p is from the paired t-tests. “Holm” marks survival of Holm–Bonferroni correction across the six-test family. The UK row is the out-of-ontology probe.

Held-Out Source	FA	RWF-A	$\Delta$	${\mathit{d}}_{\mathit{z}}$/p	Holm
uk (out-of-ontology)	0.501	0.501	$+0.000$	$0.24$/$0.62$	fails
us_CA	0.613	0.639	$+0.026$	$4.06$/$0.0008$	survives
us_PA	0.601	0.632	$+0.031$	$2.18$/$0.008$	survives
us_NY	0.584	0.612	$+0.028$	$1.91$/$0.013$	fails
us_FL	0.646	0.667	$+0.021$	$1.46$/$0.031$	fails
us_TX	0.655	0.667	$+0.011$	$1.41$/$0.034$	fails

and Figure 2 report the leave-one-source-out balanced accuracy, comparing reliability-weighted fusion (RWF-A) against uniform averaging (FA). Two contrasting results appear. Within the same ontology, transfer to a held-out US state improved under reliability-weighted fusion on every state from $+0.011$ to $+0.031$; the paired effect sizes were large ($d_z$ from $1.4$ to $4.1$). Across ontologies, transfer to the held-out UK source—trained only on US impact severity data—collapsed to chance ($0.501$ versus $0.501$, $\Delta =+0.0004$, $p=0.62$). This is the deliberate boundary of the method: US traffic impact severity and UK injury severity are not the same target, and no amount of fusion over US sources produces a model that transfers to the UK injury target. We report this as a first-class negative result.

Two cautions for interpretation are warranted. First, the within-US improvement was the effect of reliability-weighted fusion over uniform averaging and should not be attributed to alignment. In the pooled same-ontology setting, RWF and RWF-A were numerically identical (

Table 10. Baseline ladder on the five US silos: balanced accuracy and macro-F1 scores (mean ± 95% CI over five seeds). Private methods evaluated at ${\epsilon }_k=4$.

Method	Balanced Accuracy	Macro F1
CEN (non-private, pooled; inadmissible)	$0.624\pm 0.001$	$0.562\pm 0.027$
FA (non-private)	$0.605\pm 0.002$	$0.556\pm 0.008$
RWF (proposed, private)	$0.599\pm 0.000$	$0.567\pm 0.002$
RWF-A (proposed, private)	$0.599\pm 0.000$	$0.567\pm 0.002$
FA-DP (private)	$0.597\pm 0.001$	$0.538\pm 0.003$
LOC (lower bound)	$0.544\pm 0.002$	$0.444\pm 0.007$

), and thus the centered adjustment was inert when there was no cross-ontology prior gap to correct. The alignment was designed for a genuine label shift; within one ontology, there was little to alignment. Second, the within-US gains, though consistent and backed by large effect sizes, did not all survive multiple-comparison correction; after Holm–Bonferroni correction across the six-test family, only the CA and PA comparisons remained significant (Section 4.7). We therefore state the within-US transfer benefit as real but modest.

4.3. Baseline Ladder (Same-Ontology Fusion)

Table 10 reports the method ladder on the five US silos at a fixed operating point (${\epsilon }_k=4$ for private methods). The ordering was as expected: the (inadmissible) centralized upper bound led at $0.624$; private fusion followed within about $0.025$ balanced-accuracy points of it at $0.599$; and local-only training trailed by about $0.055$ at $0.544$. Fusion thus recovered most of the centralized ceiling without pooling any raw data, which is the practical case for a custodian. Regarding the macro-F1 score, the reliability-weighted methods were the best of all, including the centralized model, reflecting their handling of the minority class. RWF and RWF-A were numerically identical here, which shows the clean isolation of the alignment operator; under a shared ontology, alignment added nothing.

4.4. Communication Cost

Figure 3 plots the balanced accuracy against the transmitted parameters. The fusion methods shared the same communication cost ($1,198,560$ parameters); the centralized model used fewer transmitted parameters ($199,760$) only because it pools raw data, which the privacy setting forbids and which is therefore not an admissible operating point. Among admissible methods, private fusion offered the most favourable accuracy for the communication and privacy budget.

4.5. Fairness Across Sources

A negative result is reported here. Figure 4 shows the across-source gap (standard deviation of per-source balanced accuracy). Although reliability-weighted fusion raised the accuracy on the US sources, its across-source gap was slightly larger than that of FA-DP ($0.061\pm 0.001$ versus $0.051\pm 0.001$) because it lifted the already-strong US sources more than it helped the weakest source. Fusion therefore improved the accuracy without improving equity; closing the gap would require a mechanism that explicitly protects the weakest source.

4.6. Membership Inference

A null result is reported here. A loss-threshold membership inference attack yielded an ROC AUC of $0.509\pm 0.001$ for the non-private model and $0.515\pm 0.001$ for the private (${\epsilon }_k=4$) model, both close to the chance value of $0.5$. The attack was evaluated per seed on a balanced probe of 2000 member and 2000 non-member records (a member-versus-non-member ROC over 4000 loss scores), and the reported AUC is the mean over the five seeds. The compact tabular model did not measurably memorize its training records, and thus there was no leakage for differential privacy to remove. We are deliberate about what this does and does not establish: a near-chance attack AUC does not by itself prove privacy—it shows only that this particular attack cannot detect membership, and a stronger attack might—so it is the formal $({\epsilon }_k,\delta )$ guarantee produced by the Rényi accountant, not the empirical attack, that bounds the leakage. Differential privacy is therefore justified here as a formal governance guarantee rather than as a defense against a demonstrated attack, and we are careful not to claim otherwise.

4.7. Significance Summary with Multiple-Comparison Correction

Table 11. Paired tests across five seeds with Holm–Bonferroni correction within each family. Privacy–utility: RWF versus FA-DP macro F1 by ${\epsilon }_k$. Transfer: RWF-A versus FA balanced accuracy by held-out source.

Family	Comparison	Mean Diff.	p	Holm
Privacy–utility	RWF − FA-DP, ${\epsilon }_k=0.5$	$+0.0033$	0.005	survives
Privacy–utility	RWF − FA-DP, ${\epsilon }_k=1$	$+0.0030$	0.012	survives
Privacy–utility	RWF − FA-DP, ${\epsilon }_k=2$	$+0.0030$	0.005	survives
Privacy–utility	RWF − FA-DP, ${\epsilon }_k=4$	$+0.0027$	0.011	survives
Privacy–utility	RWF − FA-DP, ${\epsilon }_k=8$	$+0.0026$	0.018	survives
Privacy–utility	RWF − FA-DP, ${\epsilon }_k=\infty$	$+0.0017$	0.057	fails
Transfer	RWF-A − FA, held us_CA	$+0.0257$	0.0008	survives
Transfer	RWF-A − FA, held us_PA	$+0.0311$	0.008	survives
Transfer	RWF-A − FA, held us_NY	$+0.0280$	0.013	fails
Transfer	RWF-A − FA, held us_FL	$+0.0205$	0.031	fails
Transfer	RWF-A − FA, held us_TX	$+0.0112$	0.034	fails
Transfer	RWF-A − FA, held uk	$+0.0004$	0.62	fails

collects the paired tests for the two families and their Holm–Bonferroni outcomes. In the privacy–utility family (RWF − FA-DP macro F1 across ${\epsilon }_k$), the gains were small in magnitude (from $+0.0017$ to $+0.0033$) but consistent; they survived Holm–Bonferroni correction across the finite-${\epsilon }_k$ budgets, while the ${\epsilon }_k=\infty$ comparison did not. In the transfer family (RWF-A − FA by held-out source), after Holm–Bonferroni correction across the six tests, only the CA ($p=0.0008$) and PA ($p=0.008$) comparisons remained significant; NY, FL, and TX did not survive correction, and the UK probe was far from significant. This tempered outcome is stated plainly in the abstract and Section 5.

4.8. Ablation Study

The comparison design isolated each component. Reliability weighting: Replacing size-proportional weighting (FA-DP) with reliability weighting (RWF) at ${\epsilon }_k=4$ raised the macro-F1 score from $0.538$ to $0.567$ (Holm-significant at every finite budget) and the balanced accuracy from $0.597$ to $0.599$. The benefit was specific to the private regime, where size weighting trusted the noisiest large source too much. Label shift alignment: Adding the centered adjustment (RWF-A) left the same-ontology accuracy unchanged (Table 10), which correctly isolated alignment as inert under a shared ontology. It is designed for cross-ontology prior gaps, and the out-of-ontology probe shows that a prior adjustment alone cannot bridge a genuine target mismatch (Section 4.2). Centering: An uncentered adjustment, applied on top of the class weighting that all methods used, corrected the prior twice. In preliminary runs, this destabilized the training, and thus centering was necessary.

5. Discussion

The results support a disciplined reading. In the clean cross-silo setting—five custodians sharing one ontology—privacy-preserving fusion clearly beat training in isolation ($0.599$ versus $0.544$ balanced accuracy) and recovered most of the inadmissible centralized ceiling ($0.624$), while reliability-weighted fusion additionally attained the best macro-F1 score of any method. This is the paper’s positive contribution, and it is genuine but modest: the reliability-weighting gains under privacy were small in magnitude, and the within-state transfer improvement, though backed by large effect sizes, survived Holm–Bonferroni correction on only two of five states. We state this plainly rather than overselling it.

The most instructive result was a boundary. When the held-out source encoded a genuinely different severity ontology (UK injury severity versus US traffic impact), transfer collapsed to chance. This is not a failure of engineering but a property of the problem; a per-source prior adjustment reconciles a label shift under a shared target and not a change of target. Reporting this openly is, we believe, part of the contribution, because the literature on cross-jurisdiction crash modeling often assumes a common target without testing it. The corresponding methodological lesson is that same-ontology cross-silo fusion and cross-ontology transfer are different problems and must be evaluated separately.

Two further honest findings sharpen the picture. Reliability-weighted fusion raised the accuracy without closing the across-source gap, and thus it improved capability but not equity. And a membership inference attack returned a near-chance AUC. Therefore, on this compact tabular model, differential privacy is a governance guarantee rather than an empirical defense; we deliberately avoided reporting a “privacy defence” against an attack that did not succeed in the first place.

The absolute accuracy ceiling was modest because high-versus-low severity was only weakly predictable from the coarse contextual features shared across sources; even the centralized model reached only $0.624$. Therefore, the ceiling is a property of the shared feature space and not of any method. The contributions are the fusion methodology, the formally accounted privacy, and the honest delineation of where the approach works and where it does not.

Limitations. The primary evaluation used five US state silos and five seeds; a larger institutional panel and more seeds would tighten the small-magnitude estimates. The out-of-ontology probe used a single foreign source. The model was a compact MLP on a harmonized tabular schema. Future work will add more same-ontology custodians, seek a defensible common injury target across countries (which would make cross-national fusion well posed rather than a stress test), study richer shared representations, and analyze the alignment operator theoretically.

6. Alignment with the Sustainable Development Goals

The problem connects to several United Nations Sustainable Development Goals (SDGs). The most immediate link is to SDG 3 (Good Health and Well-being), whose target 3.6 concerns halving deaths and injuries from road traffic accidents. Severity prediction supports faster triage and better emergency resource allocation. The work also serves SDG 11 (Sustainable Cities and Communities) and its target 11.2 on safe transport, and the federated, reliability-weighted fusion represents the kind of resilient, privacy-respecting data infrastructure envisaged by SDG 9 (Industry, Innovation, and Infrastructure).

7. Conclusions

This paper presented a privacy-preserving information fusion framework and evaluated it under a discipline that separates same-ontology cross-silo fusion from cross-ontology transfer. In the primary cross-silo setting (five US state custodians), reliability-weighted fusion retained higher utility under differential privacy than a uniform private baseline at every budget, with a small but Holm-significant macro-F1 score advantage ($0.567$ versus $0.538$), and the private fused model reached a $0.599$ balanced accuracy, within $0.025$ of the inadmissible centralized upper bound ($0.624$) and $0.055$ above training in isolation ($0.544$), while keeping every record local. Privacy was accounted formally with a per-source Rényi accountant after correcting the class-weight sensitivity so that the per-sample sensitivity was exactly the clip norm. This study was equally explicit about its limits. Within-state transfer gains survived Holm–Bonferroni correction on only two of five states; alignment raised the accuracy without closing the across-source gap; a membership inference attack showed no measurable leakage; and most importantly, transfer to an out-of-ontology source (UK injury severity) collapseed to chance, a boundary we reported rather than concealed. These results establish reliability-weighted, formally private cross-silo model fusion as a practical route to accident severity prediction among same-ontology custodians, and they mapped honestly where that route ended.