FedHSQA: Robust Aggregation in Hierarchical Federated Learning via Anomaly Scoring-Based Adaptive Quantization for IoV

Abstract

Hierarchical Federated Learning (HFL) for the Internet of Vehicles (IoV) leverages roadside units (RSU) to construct a low-latency, highly scalable multilayer cooperative training framework. However, with the rapid growth in the number of vehicle nodes, this framework faces two major challenges: (i) communication inefficiency under bandwidth-constrained conditions, where uplink congestion imposes significant burden on intra-framework communication; and (ii) interference from untrustworthy vehicle nodes, which disrupts model training and affects convergence. Therefore, in order to achieve secure aggregation while alleviating the communication bottleneck problem, we design a hierarchical three-layer federated learning framework with Gradient Quantization (GQ) and secure aggregation, called FedHSQA, which further integrates anomaly scoring to enhance robustness against untrustworthy vehicle nodes. Specifically, FedHSQA organizes IoV devices into three layers based on their respective roles: the cloud service layer, the RSU layer, and the vehicle node layer. During each non-initial communication round, the cloud server at the cloud layer computes anomaly scores for vehicle nodes using a Kullback–Leibler (KL) divergence-based multilayer perceptron (MLP) model. These anomaly scores are used to design a secure aggregation algorithm (ASA) that is robust to anomalous behavior. The anomaly scores and the aggregated global model are then transmitted to the RSU. To further reduce communication overhead and maintain model utility, FedHSQA introduces an adaptive GQ method based on the anomaly scores (ASQ). Unlike conventional vehicle node-side quantization, ASQ is performed at the RSU layer. It calculates the Jensen–Shannon (JS) distance between each vehicle node’s anomaly distribution and the target distribution, and adaptively adjusts the quantization level to minimize redundant gradient transmission. We validate the robustness of FedHSQA against anomalous nodes through extensive experiments on three real-world datasets. Compared to classical aggregation algorithms and GQ methods, FedHSQA reduced the average network traffic consumption by approximately 30 times while improving the average accuracy of the aggregation model by about 5.3%.

1. Introduction

With the rapid advancement of Intelligent Transport Systems (ITS), the Internet of Vehicles (IoV) emerges as the critical system for enabling efficient communication, collaborative sensing, and intelligent decision-making among vehicle nodes by improving traffic flow prediction and accelerating the deployment of autonomous driving and related applications [1,2,3,4,5]. In the IoV system, vehicle nodes collect and process large volumes of local data continuously by being equipped with sensors and onboard computing units. These data carry significant value and computational potential for training high-performance machine learning models. However, concerns over privacy protection, communication overhead, and bandwidth limitations discourage vehicle nodes from sharing raw data, resulting in data silos that constrain the scalability of IoV systems. To enable data fusion and knowledge sharing without compromising privacy, recent studies introduce Hierarchical Federated Learning (HFL) into the IoV system [6,7,8,9,10]. The HFL framework divides IoV devices into multiple layers based on their geographic location and functional roles. Under the HFL framework, each vehicle node trains machine learning models locally and transmits model updates to the roadside unit (RSU), which forwards aggregated updates to the cloud-based cloud server. This process facilitates efficient and privacy-preserving collaborative learning, helps overcome the problem of data silos, and supports the practical deployment of intelligent IoV applications. However, as the HFL framework scales across large IoV systems, the frequent transmission of model updates from numerous vehicle nodes significantly increases uplink communication overhead, introduces latency, and slows global model convergence [11,12,13,14,15]. Therefore, reducing the communication burden of the HFL framework for IoV while maintaining model performance becomes a critical challenge that demands urgent attention. To this end, some studies introduce the Gradient Quantization (GQ) method into the HFL framework for IoV, aiming to reduce uplink data transmission and alleviate bandwidth bottlenecks by compressing local model gradients and discarding redundant information [16,17,18,19,20]. GQ method effectively reduces the volume of data uploaded in each communication round, thereby improving the overall system efficiency to a certain extent. However, existing GQ methods still face a key limitation: most adopt undifferentiated quantization strategies during compression, which may discard critical gradient information and ultimately affect the accuracy of the aggregated model. To address this issue, recent works explore mechanisms such as clustering and head node communication to enhance the adaptability and robustness of quantization strategies [21,22,23]. Nevertheless, these approaches typically overlook the heterogeneity in data distribution across vehicle nodes, especially in the presence of anomalous nodes (e.g., due to malicious attacks) [24,25,26]. As a result, they fail to effectively identify and handle anomalous model updates, thereby degrading the performance of the aggregated model in complex traffic environments with heterogeneous data distributions. As a result, these methods fall short of fully addressing the key challenges faced by the HFL framework in IoV scenarios.

Therefore, in order to achieve secure aggregation while alleviating the communication bottleneck problem, we design a hierarchical three-layer federated learning framework with gradient compression and secure aggregation based on anomalous vehicle node scores, called FedHSQA. FedHSQA enhances the aggregation model’s ability to identify and defend against anomalous vehicle nodes by integrating anomaly detection mechanisms while ensuring communication efficiency, providing a new solution for achieving an efficient and reliable HFL framework for IoV. Specifically, during non-initial communication rounds, the cloud server in FedHSQA performs anomaly scoring on vehicle nodes using an MLP model before aggregating the model updates uploaded by RSUs. It uses Kullback–Leibler (KL) divergence as the loss function to measure anomaly severity and applies the resulting scores to weighted aggregation [27], the secure aggregation algorithm of FedHSQA, called ASA. Once the scores are generated, the cloud server sends the score vector to the RSU along with the updated aggregated model parameters. To address limited communication resources and client heterogeneity, FedHSQA designs an adaptive GQ method based on anomaly scoring, called ASQ. Each vehicle node constructs a single-node distribution from its own score, computes the Jensen–Shannon (JS) distance to the target distribution [28], and maps the result to its adaptive quantization level. A larger distance indicates a higher probability of anomaly and results in a lower quantization level; a smaller distance preserves more information. ASQ enables adaptive adjusted communication compression, effectively reducing communication costs while increasing the robustness to the abnormal vehicle nodes in the IoV system. The main contributions of this paper are as follows:

• We propose a three-layer HFL framework for IoV, called FedHSQA, which integrates GQ and anomaly detection for vehicle nodes.
• We propose a secure aggregation algorithm based on anomaly scoring, called ASA, which adopts KL divergence as the loss function to improve the robustness of the aggregation process against anomalous vehicle nodes.
• We propose an anomaly score-based GQ method, called ASQ, which resolves the impact of anomalous data on the global model by calculating the JS distance and mapping it to adaptive quantization levels.
• We validate the effectiveness of FedHSQA under various parameter settings on several datasets. Experimental results show that compared to the classical aggregation algorithms and quantization methods, FedHSQA exhibits strong robustness to anomalous vehicle nodes under the HFL framework for IoV.

2. Related Work

2.1. Hierarchical Federated Learning

Federated learning (FL) typically assumes a direct connection between clients and the server in theoretical designs [29]. However, in practical deployments, training devices often adopt a layered framework. To bridge this gap, existing studies have proposed the HFL framework, which introduce intermediate layers (e.g., clusters or RSU) to coordinate devices across different layers and enhance system scalability. Although the layered framework offers structural advantages, it still encounters several challenges. These include model synchronization across multiple layers, convergence difficulties caused by data heterogeneity, and the trade-off between communication efficiency and privacy protection.

Considering that non-independent and identically distributed (non-IID) data on clients can lead to asynchronous model bias across multiple levels and degrade global convergence, MTGC [30] introduces a multi-timescale gradient correction mechanism. This method incorporates two control variables to correct gradient bias from clients to clusters and from clusters to the global model, respectively. Theoretical analysis proves that its convergence upper bound is independent of data heterogeneity, thereby improving convergence stability in heterogeneous environments. However, MTGC overlooks practical issues such as communication delays and system asynchrony, which limits its adaptability in complex network settings. To alleviate network congestion caused by large-scale client participation, IKC [31] optimizes the traditional K-center algorithm by introducing a device scheduling mechanism and designing a lightweight mini-model with only one convolutional layer to reduce communication cost. Although IKC maintains stable performance under varying client participation ratios, its scheduling policy remains static and lacks adaptive responsiveness to changes in client states. To achieve dynamic resource allocation and client scheduling, TP-DDPG [32] constructs a two-stage reinforcement learning framework that combines client selection via the DDPG algorithm with bandwidth allocation using SCABA. This approach effectively reduces training delay and mitigates the impact of dropped clients, demonstrating strong scheduling capability in dynamic scenarios. Beyond scheduling, some studies focus on aggregation strategies to improve system adaptability to non-IID data. FedGau [33] introduces Gaussian modeling to compute aggregation weights and employs the Bhattacharyya distance to measure data distribution differences between clients and clusters, as well as between clusters and the cloud. This enables dynamic adjustment of aggregation weights to address slow convergence caused by data heterogeneity. However, the need to solve a nonlinear optimization problem in each round increases the computational burden on clients. Incentive mechanisms have also been explored. HiFi-Gas [34] combines HFL with reward design, dividing total rewards into data quality and model contribution components to encourage clients to upload high-quality data and improve global model accuracy. However, the method does not address the risk of malicious clients forging data to manipulate rewards, posing potential security threats. To enhance privacy protection, HDP [35] introduces a super-node layer and applies a Gaussian mechanism for differential privacy on uploaded gradients. It also allows clients in different regions to adopt customized privacy levels, improving the flexibility of the privacy strategy. Nevertheless, the method lacks a detailed analysis of system robustness under dynamic and heterogeneous conditions, such as client dropouts and bandwidth fluctuations. Addressing the impact of client dynamics on training stability, HIST [36] proposes partitioning the global model into several non-overlapping sub-models, which are independently trained using edge servers (cells). The method employs AirComp to accelerate intra-cell aggregation and decouple communication latency from fluctuations in client numbers, thereby enhancing system scalability and stability.

2.2. Gradient Quantization

With the development of AI technology, the increasing scale of models deployed by clients in FL has significantly raised the number of gradients generated during local training. The frequent transmission of massive gradients not only consumes substantial bandwidth but also causes severe communication delays. To address this issue, existing studies propose GQ methods that compress gradient representations and reduce transmission bit counts by mapping high-precision floating-point values to predefined fixed-point levels, thereby alleviating uplink bandwidth pressure. Among these methods, QSGD [37]—which is a stochastic quantization method with convergence guarantees—combines normalization, segmentation, and stochastic rounding strategies to effectively reduce communication overhead in distributed SGD. It also enables a tunable trade-off between communication cost and training efficiency via an adjustable quantization level s. Building on this, DQN-GradQ [38] introduces a reinforcement learning framework that jointly optimize training time and quantization error. By leveraging a DDQN network, the method accelerates convergence and allows clients to dynamically select quantization bit levels based on their local states, thus, enabling more flexible communication control strategies. TTM [39] proposes an optimization strategy at the system level that jointly adjusts quantization levels and bandwidth allocation, aiming to minimize total training time. The method also characterizes the trade-off between the number of communication rounds and the delay of a single round. To address device heterogeneity, AdaGQ [18] extends QSGD by introducing a dynamic quantization strategy based on gradient variation. It assigns lower quantization levels to slower devices and higher levels to faster ones, thereby mitigating the straggler effect. Unlike the aforementioned approaches, FedDQ [40] builds on stochastic uniform quantization and adopts a reverse design perspective. It introduces an adaptive mechanism in which the quantization level decreases with the number of training rounds, effectively reducing redundant high-precision communication in later stages and improving overall training efficiency. In addition, LGC [40] breaks the single-node compression paradigm by introducing a lightweight self-encoder that learns shared structural information across multiple client nodes, thereby further improving compression efficiency without compromising model accuracy.

2.3. Secure Aggregation for IoV

In the HFL scenarios for the IoV, vehicle nodes collect large volumes of environmental and driving data through onboard sensors to support various intelligent tasks such as object detection and traffic flow prediction. These data often contain sensitive and private information, making them prime targets for potential attackers. Although FL avoids centralized sharing of raw data to a certain extent, malicious participants can still infer private information from model updates through techniques such as inference attacks.

To defend against such threats, SAFELearn [41] proposes a secure aggregation scheme that eliminates the need for a trusted third party. The cloud server can access only the aggregated values of vehicle node model updates, not the individual updates themselves, effectively mitigating active inference attacks. To improve aggregation efficiency, LightSecAgg [42] designs a lightweight secure aggregation protocol that combines a novel key exchange mechanism with a mask calculation and elimination strategy. This approach significantly reduces communication cost while ensuring security and maintains strong robustness against dynamic changes in vehicle node participation. To address the issue of limited communication resources in IoV, PEDA [43] integrates Additive Secret Sharing (ASS), Homomorphic Encryption (HE), and asymmetric encryption (e.g., RSA) to construct a privacy-enhanced federated aggregation framework. It further reduces communication overhead and enhances the defense of vehicle nodes against malicious participants through the Randomized Group Participation (RPGP) policy applied in the RSU layer. Considering the trustworthiness of aggregation nodes in layered frameworks, SADA [44] introduces the Schnorr multi-signature mechanism to ensure the verifiability of local aggregation updates uploaded by RSUs. This approach enhances the reliability of local aggregation results without incurring high computational overhead. To counter intelligent jamming attacks, RA-FRL [45] proposes a secure communication mechanism based on federated reinforcement learning. It trains an intelligent policy to dynamically select secure communication channels for vehicle nodes, effectively avoiding communication risks caused by intelligent jammers. In addition, to address the difficulty traditional intrusion detection systems (IDS) face in identifying unknown (zero-day) attacks, Zero-X [46] constructs a novel security detection framework for IoV by combining blockchain with Open-Set FL (Open-Set FL). This framework enables the joint identification and classification of both known (N-day) and unknown (zero-day) attacks.

3. Model System

In the presence of abnormal vehicle nodes participating in HFL, we designed a hierarchical three-layer framework for the IoV, called FedHSQA, to alleviate the communication bottleneck while achieving secure aggregation, as shown in Figure 1. FedHSQA incorporates gradient compression and secure aggregation across three layers: the vehicle node layer, the RSU layer, and the cloud service layer. In the vehicle node layer, each vehicle node $v_i$, $i=1,2,\dots ,N$, performs local model training by collecting traffic information. In the RSU layer, each RSU $u_j$, $j=1,2,\dots ,M$, serves as an intermediate device that receives model updates from vehicle nodes within its service domain, performs anomaly scoring, applies GQ, and uploads the quantized updates to the cloud. In the cloud service layer, the cloud server C conducts anomaly scores for all participating vehicle nodes and performs weighted aggregation of the global model based on these scores. The server then distributes both the anomaly scores and the aggregated global model to each RSU. Each vehicle node maintains a local dataset $D_i$, which consists of a set of input–output pairs:

$$D_i{=\left\{\right(\mathrm{x}}_i^{\left(1\right)}{,\mathrm{y}}_i^{\left(1\right)}{),(\mathrm{x}}_i^{\left(2\right)}{,\mathrm{y}}_i^{\left(2\right)}),\dots {,(\mathrm{x}}_i^{\left(k\right)}{,\mathrm{y}}_i^{\left(k\right)}\left)\right\},$$

(1)

where ${\mathrm{x}}_i^{\left(k\right)}\in R^d$ denotes the k-th input sample and ${\mathrm{y}}_i^{\left(k\right)}\in \{1,2,\dots ,Y\}$ denotes its corresponding class label. Communication rounds are indexed by t, and the cloud server maintains the global model parameters $W^t$ at each round. The specific training process of FedHSQA is detailed in Section 3.1, Section 3.2, Section 3.3 and Section 3.4.

3.1. Global Models Distribution

Before each communication round, the cloud server C determines whether it is the first round. If $t=0$, it broadcasts the initialized model parameters $W^0$ to all RSUs $u_j$, which then forward the model to their associated vehicle nodes $v_i$. If $t>0$, the cloud server first uses the model updates uploaded by clients from the previous round to compute anomaly scores $s_i$ for each vehicle node using the anomaly detection model MLP. The scores are normalized into a distribution vector:

$$q=\mathrm{Softmax}({\mathrm{s}}_1,{\mathrm{s}}_2,\dots ,{\mathrm{s}}_N).$$

(2)

Subsequently, the target distribution p is constructed, and the KL dispersion is computed to optimize the MLP model and derive aggregation weights for each vehicle node. The cloud server then sends the updated global model parameters $W^t$ along with the anomaly scores q to the RSUs. Each RSU stores the scores vector locally and forwards only the model parameters to its connected vehicle nodes.

3.2. Local Model Training

Each vehicle node $v_i$ performs local training on its dataset $D_i$ after receiving the global model, and obtains the local model update:

$$\nabla w_i=w_i^{t+1}-W^t.$$

(3)

Considering the potential presence of untrustworthy or anomalous clients in IoV, all vehicle nodes transmit their model updates in full precision to ensure the accuracy of anomaly detection in the cloud server. In other words, $\nabla w_i$ is not subjected to any local compression. These updates are then transmitted to the corresponding RSUs $u_j$.

3.3. Adaptive Gradient Quantization

In the proposed quantization method based on anomaly scoring (ASQ), the RSU adopts different compression strategies depending on whether the current communication round is the first. If it is the first round, the RSU applies the QSGD method to compress the model updates of all vehicle nodes using a fixed, uniform quantization level. In subsequent rounds, the RSU $u_j$ determines an adaptive quantization level b for each vehicle node $v_i$ based on its anomaly score $s_i$, which is computed by the MLP model in the cloud server in the previous round. The score is projected onto the interval $[b_{min},b_{max}]$ using a JS dispersion-based mapping function. The ASQ method is then applied to compress the model update $\nabla w_i$. The compressed gradients are uploaded to the cloud server for global aggregation.

3.4. Model Secure Aggregation

In the proposed aggregation algorithm based on anomaly scores, the cloud server first receives the quantized gradients uploaded by all RSUs and downscales them into fixed-dimensional feature vectors. These features serve as input to the MLP model, which generates a new round of anomaly scores s for each vehicle node. Next, the cloud server constructs a probability distribution q from the anomaly scores s and derives a dispersion metric with respect to a target distribution p. The resulting loss value is used to update the parameters of the MLP model. Simultaneously, the aggregation weight ${\alpha }_i$ for vehicle node $v_i$ is redefined based on its’ anomaly score. The cloud server then performs weighted aggregation to update the global model. The objective of federated aggregation is to minimize the following global loss function:

$$\underset{W}{min}f\left(W\right)={\displaystyle \frac{1}{N}}{\sum }_{i=1}^N{f}_i\left(W\right),$$

(4)

where $f_i\left(W\right)$ denotes the local objective function of the vehicle node $v_i$ on its dataset. This communication and aggregation process is iterated in each training round until the global model reaches a predefined aggregation accuracy.

4. Scheme Design

4.1. Anomaly Scoring-Based Security Aggregation

To enhance the robustness of HFL for the IoV against abnormal vehicle nodes, FedHSQA introduces an anomaly-scoring-based secure aggregation (ASA) approach. This method conducts anomaly scores on the gradient updates uploaded by RSUs using an MLP model deployed in the cloud service layer. Based on the anomaly scoring results, it assigns adaptive aggregation weights to different gradients to reduce the influence of anomalous vehicle nodes on the aggregation process. The detailed procedures are presented in Section 4.1.1, Section 4.1.2, Section 4.1.3, Section 4.1.4 and Section 4.1.5.

4.1.1. Calculating Anomaly Score

In each communication round, the cloud server deployed in the cloud service layer uses a MLP model to define a scoring function that extracts potential anomalies from each gradient update. The output anomaly scores vector is shown as:

$$s=MLP\left(AnomalyScore\right(\nabla w\left)\right),$$

(5)

where $\nabla w$, $\nabla w=[\nabla w_1,\nabla w_2,\dots ,\nabla w_N]$, denotes the model update from vehicle node $v_i$ uploaded via RSU $u_j$, and s,$s=[s_1,s_2,\dots ,s_N]$, represents the anomaly score of the corresponding vehicle node. A higher score indicates a greater likelihood that vehicle node $v_i$ is anomalous. To help the MLP capture anomaly-relevant features, the $AnomalyScore(.)$ function applies Layer-wise Mean Pooling (LMAP) to $\nabla w_i$, $\nabla w_i=\{\nabla w_i^{\left(1\right)},\nabla w_i^{\left(2\right)},\dots ,\nabla w_i^{\left(l\right)}\}$, averaging gradients at each layer to produce a low-dimensional feature vector $z_i$, shown as:

$$z_i=[mean(\nabla w_i^{\left(1\right)}),mean(\nabla w_i^{\left(2\right)}),\dots ,mean(\nabla w_i^{\left(l\right)})].$$

(6)

Z-score normalization is then applied to $z_i$ to obtain the normalized vector ${\widehat{z}}_i$, shown as:

$${\widehat{z}}_i={\displaystyle \frac{z_i-{\mu }_z}{{\sigma }_z}},$$

(7)

where ${\mu }_z={\displaystyle \frac{1}{N}}{\sum }_{i=1}^N{z}_i$ denotes the mean and ${\sigma }_z=\sqrt{{\displaystyle \frac{1}{N}}{\sum }_{i=1}^N(z_i-{\mu }_z)}$ the standard deviation across all vehicle nodes. Therefore, the  function is shown as:

$${\widehat{z}}_i=AnomalyScore(\nabla w_i)={\displaystyle \frac{z_i-{\mu }_z}{{\sigma }_z}}.$$

(8)

It should be noted that the scoring function is not initialized during the first round of communication, as the MLP model has to learn gradually based on historical communication data. Therefore, in the first round, the system uniformly performs a standard weighted average aggregation without any intervention from the scoring mechanism. After the first communication round is completed, the parameter server collects the gradient updates uploaded by all RSUs. It performs LMAP to apply dimensionality reduction, thereby constructing the input feature space for the MLP-based anomaly scorer. The scorer is initialized using the Kaiming Uniform initialization strategy and updated once after each communication round to compute anomaly scores for the next round.

4.1.2. Anomaly Probability Distribution

ASA applies SoftMax normalization to the anomaly scores vector s, transforming it into an anomaly probability distribution vector q, shown as:

$$q_i={\displaystyle \frac{{exp}^{s_i}}{{\sum }_i^N{exp}^{s_i}}},\mathrm{for}i=1,2,\dots k.$$

(9)

This distribution reflects the scoring function’s estimation of the likelihood of each vehicle node being anomalous. It serves as the output distribution for the supervised signal during training.

4.1.3. Designing Target Distribution

Vehicle nodes may conceal their anomaly status to gain more computational resources. To address this, ASA allows RSUs to infer anomaly labels and transmit them to the cloud server. Specifically, let the label vector be $y=[y_1,y_2,\dots ,y_N]$, where each element $y_i\in \{0,1\}$ indicates whether vehicle node $v_i$ is judged as anomalous.

Considering that the label information may be incomplete or delayed, ASA employs a smoothing strategy to construct a pseudo-label distribution, shown as:

$$p_k=(1-ϵ)·{\displaystyle \frac{\mathbb{I}[k\in \mathcal{A}]}{\left|\mathcal{A}\right|}}+ϵ·{\displaystyle \frac{1}{K}},$$

(10)

where $\mathcal{A}$ denotes the set of vehicle nodes judged as anomalous by the RSU, $ϵ\in [0,1]$ is the smoothing coefficient, $\mathbb{I}[k\in \mathcal{A}]$ is the indicator function that returns 1 if node $v_i$ is marked anomalous and 0 otherwise, and N is the total number of vehicle nodes. This smoothing strategy assigns non-zero probability to all vehicle nodes while preserving the guidance provided by the anomaly labels. It improves the generalization ability of the scoring function in weakly supervised scenarios. To evaluate the impact of the smoothing coefficient $ϵ$ on the aggregation model, we design a corresponding set of ablation experiments in the Section 5.5.

4.1.4. Training the MLP Model

ASA uses the pseudo-label distribution p as the supervised target and trains the MLP model by minimizing the KL divergence between the predicted anomaly distribution and the target distribution $q_i$ of $p_i$ vehicle node $v_i$, shown as:

$${\mathcal{L}}_{\mathrm{KL}}(p\Vert q)=\sum _{i=1}^N{p}_{i}log\left({\displaystyle \frac{p_i}{q_i}}\right).$$

(11)

KL-based training encourages the MLP model to assign higher probabilities of anomalies to vehicle nodes labeled anomalous, thus, improving the ability of ASA to accurately identify them.

4.1.5. Calculating Aggregation Weight

ASA inverts the aggregation weight of vehicle node $v_i$ based on the output distribution $q_i$. Meanwhile, in order to reduce the influence of anomalous vehicle nodes, the inverse anomaly weight is defined as:

$${\alpha }_i=1-q_i.$$

(12)

Therefore, the aggregation weight of vehicle node $v_i$ is:

$${\tilde{\alpha }}_i={\displaystyle \frac{{\alpha }_i}{{\sum }_{i=1}^N{\alpha }_i}}.$$

(13)

Finally, ASA aggregates and updates the global model at the $t+1$ communication round according to the weighted average within the cloud server based on the weights of different vehicle nodes:

$$W^{t+1}=W^t-\eta ·{\sum }_{i=1}^N{\tilde{\alpha }}_k·\nabla w_i.$$

(14)

4.2. Anomaly Scoring-Based Adaptive Quantization

In the HFL framework for IoV, to reduce uplink bandwidth pressure while preserving the utility of the aggregation model, FedHSQA designs an anomaly scoring-based GQ method (ASQ). Specifically, considering the risk of tampering or injection attacks on vehicle nodes, performing quantization directly at the client side may be bypassed by malicious participants. To address this, FedHSQA adopts a two-stage communication compression strategy. Each vehicle node $v_i$ uploads its locally trained gradient update $\nabla w_i$ in full precision to the corresponding RSU $s_i$, which then performs adaptive quantization based on the anomaly score $s_i$ feedback from the MLP model deployed in the cloud service layer. Considering that the MLP model is not yet initialized in the first communication round, the system defaults to using the QSGD method with the 8-bit uniform quantization in the round. The detailed procedure is shown in Section 4.2.1, Section 4.2.2, Section 4.2.3 and Section 4.2.4.

4.2.1. Designing Anomaly Distribution

The RSU $u_j$ receives the anomaly probability distribution vector q from the cloud service layer, shown as:

$$q=[q_1,q_2,\dots ,q_N],$$

(15)

where, $q_i\in [0,1]$ indicates that vehicle node $v_i$ is determined to be anomalous. This distribution is generated by the MLP model based on the full-precision gradient updates $\nabla w$ uploaded in each communication round.

4.2.2. Calculating Anomaly Metric

To characterize the deviation between each vehicle node’s uploaded gradient update and the expected distribution, the RSU $u_j$ computes the $JS$ scatter as an anomaly indicator, shown as:

$$JS(p\Vert q)={\displaystyle \frac{1}{2}}{D}_{\mathrm{KL}}(p\Vert m)+{\displaystyle \frac{1}{2}}{D}_{\mathrm{KL}}(q\Vert m),$$

(16)

where $m={\displaystyle \frac{1}{2}}(p+q)$, and p denotes the target distribution constructed in the same manner as in the cloud service layer. A higher $J{S}_i$ scatter indicates a greater deviation of vehicle node $v_i$ from the expected anomaly distribution. Accordingly, the RSU $u_j$ assigns a higher quantization degree, i.e., fewer bits are used for gradient representation.

4.2.3. Calculating Quantization Level

After receiving the $JS$ scatter value, the RSU $u_j$ applies a linear scaling function $LinearMapping\left(\right)$ to map it to the quantization bit level b for vehicle node v, where $b=[b_1,b_2,\dots ,b_N]$. This value defines the quantization level used by the vehicle node $v_i$. The $LinearMapping\left(\right)$ function is shown as:

$$\begin{array}{c}{\mathrm{b}}_i=LinearMapping\left(J{S}_i\right)\hfill \\ =b_{max}-(b_{max}-b_{min})·{\displaystyle \frac{J{S}_i-J{S}_{min}}{J{S}_{max}-J{S}_{min}}}\hfill \end{array},$$

(17)

where the lower and upper quantization bounds are $b_{min}=1$ and $b_{max}=8$, respectively. In practice, 8-bit decentralized training is generally sufficient to achieve minimal accuracy loss [47]. To evaluate the specific impact of the quantization range on the aggregated model, we also design a corresponding ablation experiment in the Section 5.5.

4.2.4. Adaptive Gradient Quantization

At the t-th communication round, the RSU $u_j$ quantized the full-precision gradient $\nabla w$ uploaded by each vehicle node using the quantization level b obtained in the previous step. The quantization function is shown as:

$$\begin{array}{c}\nabla {\widehat{w}}_i=Q_{b_i}(\nabla w_i)\stackrel{\Delta }{=}\{q_{b_i}(\nabla w_i^{\left(1\right)}),q_{b_i}(\nabla w_i^{\left(2\right)}),\dots ,q_{b_i}(\nabla w_i^{\left(l\right)})\}\hfill \end{array},$$

(18)

where $q_{b_i}(\nabla w_i^{\left(l\right)})$ denotes the quantized gradient value obtained by applying quantization level $b_i$ to $\nabla w_i$. The quantization result is further shown as:

$$\begin{array}{c}{q}_{b_i}(\nabla w_i^{\left(l\right)})={∥\nabla w_i∥}_2·sign(\nabla w_i^{\left(l\right)})·h_i\left(b\right)\hfill \end{array},$$

(19)

where $sign(·)$ denotes the sign function, and $h_i\left(b\right)$ is a stochastic scaling factor determined by a random variable that follows a Bernoulli distribution:

$$\begin{array}{c}{h}_i\left(b\right)=\left\{\begin{array}{c}{b}_i/b,\varphi \\ b_{i+1}/b,\phi \end{array}\right.\hfill \end{array},$$

(20)

the probability $\varphi$ that the gradient of vehicle node $v_i$ is quantized to value $b_i$ is shown as:

$$\begin{array}{c}\varphi =1-p(r_i^l,b)\hfill \end{array},$$

(21)

and the probability $\phi$ of quantization to value $b_{i+1}$ is:

$$\phi =p(r_i^l,b)=r_i^l·b-b_i,$$

(22)

where $r_i^l$ denote the normalized coordinate of the gradient value, shown as:

$$r_i^l={\left|q(\nabla w_i^{\left(l\right)}\right|)/\phantom{\left|q(\nabla w_i^{\left(l\right)}\right|)∥q(\nabla w_i)∥}∥q(\nabla w_i)∥}_2$$

(23)

This quantization process adaptively adjusts the compression level for each vehicle node based on its anomaly score, enabling more efficient and robust communication. The specific flow of the FedHSQA framework is shown in Algorithm 1.

Algorithm 1 FedHSQA—The Hierarchical Three-Layer Federated Learning Framework for IoV

1: Input: Vehicle nodes $v_i$, RSUs $u_j$, Initial model $W^0$, Scoring network $f_{MLP}$, Rounds T, Epochs E, LR $\mu$, Quantization levels $[b_{min},b_{max}]$   2: Output: Final model $W^T$   3: /* Cloud Server Layer */   4: for $t=1$ to T do   5:     for each vehicle nodes $v_i$ do   6:         Receive global model $W^t$ from RSU   7:     end for    8:     Compute scores $s_i\leftarrow f_{MLP}(\nabla {\widehat{w}}_i)$   9:     Normalize: $q_i\leftarrow \mathrm{Softmax}\left(s_i\right)$ 10:    Compute pseudo-labels $p_i$ 11:    Compute KL loss: ${\mathcal{L}}_{KL}={\sum }_i{p}_{i}log{\displaystyle \frac{p_i}{q_i}}$ 12:    Update $f_{MLP}$ to minimize ${\mathcal{L}}_{KL}$ 13:    Set weight: ${\alpha }_i={\displaystyle \frac{1-q_i}{{\sum }_i(1-q_i)}}$ 14:    Aggregate: $W^{t+1}=W^t-{\sum }_i{\alpha }_i\nabla {\widehat{w}}_i$ 15:    Send $W^{t+1}$ and $q_i$ to RSUs 16: end for 17: /* RSU Layer */ 18: for each vehicle nodes $v_i$ do 19:    Receive full-precision $\nabla w_i$ 20:    Compute pseudo-labels $p_i$ 21:    Compute ${\mathrm{JS}}_i=\mathrm{JS}(p_i\parallel q_i)$ 22:    Set $b_i=b_{max}-(b_{max}-b_{min})·{\displaystyle \frac{{\mathrm{JS}}_i-{\mathrm{JS}}_{min}}{{\mathrm{JS}}_{max}-{\mathrm{JS}}_{min}}}$ 23:    Quantize $\nabla w_i$ using ASQ with $s_k$ 24:    Upload $\nabla {\widehat{w}}_i$ to server 25:    Send $W^{t+1}$ to vehicle nodes 26: end for 27: /* vehicle node Layer */ 28: for epoch $e=1$ to E do 29:    $w_i\leftarrow w_i-\mu ·\nabla \mathcal{L}(w_i;{\mathcal{D}}_i)$ 30: end for 31: Compute update: $\nabla w_i=w_i-W^t$ 32: Send $\nabla w_i$ to RSU

5. Experiment

In this section, we analyze the key components of the FedHSQA framework in terms of framework feasibility, aggregation performance, and compression effectiveness. First, for feasibility validation, we evaluate the anomaly detection performance of FedHSQA in the presence of anomalous vehicle nodes using AUC-ROC and AUC-PR as metrics. Then, to assess the effectiveness of the ASA aggregation strategy, we compare its performance in terms of average test accuracy and training loss against three mainstream aggregation algorithms: FedAvg, FedProx, and FedMOON. Finally, we introduce three classical gradient compression methods—QSGD, SignSGD, and TernGrad—as baselines to compare the performance of the ASQ method across different datasets and summarize its overall compression effectiveness in terms of communication overhead, using AUC-ROC and AUC-PR as evaluation measures.

5.1. Experimental Setup

Simulation Scenario: We built an HFL framework for IoV in the PyCharm environment. The overall system consists of a cloud server, 5 RSUs, and 50 vehicle nodes. Each RSU manages 10 vehicle clients, including 7 normal nodes and 3 anomalous nodes, simulating an environment with abnormal interference. Datasets: We adopt three widely used image classification datasets: MNIST [48], CIFAR10 [49], and SVHN [50]. These correspond to tasks involving low-dimensional grayscale images, natural color images, and street-view house number recognition, respectively, covering diverse sensing environments from simple to complex. Aggregation Algorithms: To evaluate the performance of the ASA aggregation strategy under the FedHSQA framework, we used three mainstream FL aggregation algorithms—FedAvg, FedProX, and FedMOON—as baselines for comparison [29,51,52]. Quantization methods: In communication compression experiments, we selected three classical gradient compression methods—QSGD, SignSGD, and TernGrad—as baseline methods to assess the effectiveness of the proposed ASQ quantization method [37,53,54].

5.2. Framework Feasibility Analysis

To evaluate the impact of anomalous vehicle nodes on the FedHSQA framework for IoV, we assessed anomaly detection performance on three datasets—MNIST, CIFAR10, and SVHN—using AUC-ROC and AUC-PR as evaluation metrics. The experimental results are shown in Figure 2.

As shown above, all three datasets exhibit an overall upward trend in both metrics, indicating that FedHSQA continuously improves the identification of anomalous nodes as communication rounds progress. In particular, SVHN and CIFAR10 show faster rises with lower fluctuations, reflecting strong convergence and stability. In contrast, MNIST displays slightly more volatility, suggesting slower performance improvement in tasks with relatively simple feature structures. By the 100th communication round, the SVHN dataset achieves approximately 0.99 in AUC-ROC and 0.95 in AUC-PR, while CIFAR10 reaches about 0.98 and 0.92, respectively. In comparison, MNIST attains an AUC-PR of around 0.85, which is slightly lower than the other two datasets. Overall, the comparison of final scores and convergence rates indicates that the FedHSQA framework exhibits stronger robustness when handling perceptual tasks with more complex and feature-rich inputs. Detailed results are presented in

Table 1. Anomaly detection performance of the FedHSQA framework over communication rounds.

Metric	Dataset	20	40	60	80	100	Peak
AUC-ROC	MNIST	0.6132	0.7473	0.9924	0.9519	0.9135	75
	CIFAR10	0.5993	0.7535	0.9662	0.9661	0.9951	62
	SVHN	0.6297	0.8645	0.9673	0.9938	0.9895	64
AUC-PR	MNIST	0.4422	0.6451	0.7773	0.8880	0.6728	86
	CIFAR10	0.5403	0.8438	0.9480	0.9243	0.9132	84
	SVHN	0.5220	0.8528	0.8898	0.9812	0.9156	92

, where “Peak” indicates the earliest round achieving maximum precision.

5.3. Model Performance Analysis

To further evaluate the robustness of the ASA aggregation algorithm under the FedHSQA framework in the presence of anomalous nodes, we introduced 30% anomalous vehicle nodes in each training round and uniformly adopt QSGD as the quantization method. The global model performance of different aggregation algorithms is tested on three public datasets. The corresponding test accuracy and training loss curves are shown in Figure 3.

Overall, FedHSQA outperforms the baseline methods across all datasets. Its test accuracy curve exhibits lower fluctuation and faster convergence, indicating enhanced training stability. Meanwhile, its training loss declines rapidly in the early rounds and stabilizes at the lowest level in the later rounds, demonstrating good convergence behavior. Taking CIFAR10 as an example, FedHSQA consistently maintains over 75% test accuracy after the 30th round, whereas FedAvg and FedProX hover around 68–70% with slower convergence. Notably, on the MNIST dataset, the test accuracy curves of all aggregation algorithms show frequent fluctuations. The accuracy of FedAvg drops below 50% at one point, indicating its vulnerability to anomalous client interference. In contrast, FedHSQA maintains accuracy between 90% and 95%, with fluctuations within ±5%, and significantly lower training loss, which eventually stabilizes at 0.03. On the SVHN dataset, the test accuracy of FedHSQA remains significantly higher than that of other methods, consistently fluctuating around 90%, while its training loss converges rapidly. These results highlight FedHSQA strong capability for anomaly isolation and resistance to adversarial interference. Thus, FedHSQA not only achieves faster convergence in the initial communication rounds but also maintains higher accuracy and lower training error during long-term training, fully demonstrating the robustness and practicality of its aggregation mechanism in IoV scenarios with anomalous vehicle nodes. Detailed results are summarized in

Table 2. Test accuracy and training loss over communication rounds.

Dataset	Method	20 (Acc/Loss)	40 (Acc/Loss)	60 (Acc/Loss)	80 (Acc/Loss)	100 (Acc/Loss)
MNIST	FedAvg	0.9032/0.0573	0.9429/0.0526	0.9528/0.0500	0.8363/0.0472	0.6263/0.0452
	FedProX	0.9014/0.0574	0.8971/0.0501	0.8943/0.0461	0.9142/0.0437	0.8789/0.0424
	FedMOON	0.7819/0.0523	0.8045/0.0467	0.8349/0.0445	0.8994/0.0443	0.9118/0.0417
	FedHSQA	0.9700/0.0389	0.9781/0.0325	0.9821/0.0292	0.9847/0.0272	0.9833/0.0286
CIFAR10	FedAvg	0.6106/0.9238	0.6460/0.8465	0.6581/0.8177	0.6753/0.8015	0.7000/0.8005
	FedProX	0.6074/0.9095	0.6669/0.8157	0.6762/0.7731	0.6446/0.7461	0.7001/0.7212
	FedMOON	0.6167/0.9193	0.6384/0.8417	0.7065/0.8135	0.7020/0.8043	0.7008/0.7937
	FedHSQA	0.6702/0.8412	0.7152/0.6662	0.7580/0.5702	0.7396/0.5155	0.7935/0.4748
SVHN	FedAvg	0.8246/0.3911	0.8716/0.3555	0.8642/0.3459	0.8690/0.3388	0.8609/0.3399
	FedProX	0.8264/0.3991	0.8176/0.3544	0.8703/0.3334	0.9004/0.3198	0.8423/0.3135
	FedMOON	0.8470/0.3820	0.8757/0.3529	0.8771/0.3436	0.8647/0.3417	0.8874/0.3369
	FedHSQA	0.8994/0.3485	0.9108/0.2937	0.9091/0.2604	0.9187/0.2436	0.9236/0.2272

.

5.4. Quantization Effectiveness Analysis

(1) To evaluate the effectiveness of the ASQ GQ method under the FedHSQA framework, we compare its performance with three classical GQ methods—QSGD, TernGrad, and SignSGD—under the ASA aggregation algorithm across three datasets: MNIST, CIFAR10, and SVHN. AUC-ROC and AUC-PR are used as evaluation metrics for anomaly detection performance. The results are shown in Figure 4.

The results show that ASQ outperforms the baseline methods in most communication rounds. Particularly during the mid-to-late training stages (rounds 40–100), ASQ achieves higher AUC-ROC and AUC-PR values than the other methods, indicating that it maintains strong anomaly detection capabilities even after model convergence. Additionally, ASQ exhibits smoother and more stable curves compared to TernGrad and SignSGD, suggesting that its compression process is more effective in preserving anomaly-relevant information. On the MNIST and SVHN datasets, ASQ maintains an AUC-ROC consistently above 0.95 and an AUC-PR around 0.85, surpassing QSGD and the other comparative methods. For CIFAR10, although all four methods produce similar final results, ASQ demonstrates a faster improvement during the first 60 rounds, indicating its advantage in convergence acceleration. Overall, ASQ demonstrates strong capability in filtering anomalous gradients and maintains high detection performance even under low-bit compression. These results validate its practical value in communication-constrained HFL scenarios. Detailed results are presented in

Table 3. Anomaly detection performance of different quantization methods over communication rounds.

Dataset	Method	20 (ROC/PR)	40 (ROC/PR)	60 (ROC/PR)	80 (ROC/PR)	100 (ROC/PR)
MNIST	QSGD	0.4896/0.4134	0.6545/0.7126	0.8592/0.7032	0.9344/0.8258	0.9647/0.8236
	TernGrad	0.5073/0.4948	0.7604/0.6413	0.8468/0.6791	0.8999/0.7793	0.9740/0.7761
	SignSGD	0.4796/0.4094	0.6445/0.7086	0.8492/0.6992	0.9032/0.8218	0.9547/0.8196
	ASQ	0.6132/0.4422	0.8169/0.6813	0.9924/0.7773	0.9519/0.8880	0.9135/0.6728
CIFAR10	QSGD	0.5478/0.4198	0.6678/0.8063	0.9160/0.7399	0.9180/0.8627	0.9928/0.8540
	TernGrad	0.4927/0.4414	0.8614/0.6421	0.9349/0.6853	0.9099/0.8414	0.9238/0.7920
	SignSGD	0.5699/0.4101	0.8542/0.7522	0.8525/0.8055	0.9657/0.8741	0.9968/0.8898
	ASQ	0.5993/0.5403	0.7535/0.8438	0.9315/0.8166	0.9661/0.9243	0.9725/0.9132
SVHN	QSGD	0.6074/0.5740	0.5740/0.7910	0.8982/0.8564	0.9508/0.8645	0.9186/0.9515
	TernGrad	0.5376/0.3436	0.7899/0.6661	0.9224/0.6955	0.9549/0.7405	0.9728/0.8279
	SignSGD	0.5676/0.5056	0.7788/0.7721	0.9462/0.9462	0.9256/0.8260	0.9999/0.9961
	ASQ	0.6297/0.5220	0.8675/0.8119	0.9673/0.8898	0.9704/0.9311	0.9995/0.9667

.

(2) To further evaluate the compression capability of ASQ under the FedHSQA framework, we record the communication overhead on the MNIST, CIFAR10, and SVHN datasets over the first 100 communication rounds. Figure 5a shows the communication volume in the uncompressed setting, while Figure 5b shows the communication volume with ASQ compression applied.

As shown in the histograms, ASQ significantly reduces the number of bits transmitted in each communication round, and this reduction remains consistent across all datasets. While the original communication volume increases linearly with the number of rounds, the growth in compressed communication volume slows down substantially, indicating that ASQ maintains a stable compression advantage over long-term training. Furthermore, the compression patterns across all three datasets are similar, confirming the generality and robustness of ASQ under different input distributions. By comparing specific values at the 100th communication round, we observe that ASQ reduces the raw communication volume to approximately $2.8\times 10^8$ bits for MNIST, $3.0\times 10^8$ bits for CIFAR10, and $2.8\times 10^8$ bits for SVHN. Aggregating statistics across all rounds, ASQ achieves an average compression rate of approximately 30× on all three datasets. Detailed results are presented in

Table 4. Model performance across communication rounds.

Metric	Dataset	20	40	60	80	100
Uncompressed	MNIST	$1.8\times {10}^9$	$3.6\times {10}^9$	$5.4\times {10}^9$	$7.2\times {10}^9$	$9.0\times {10}^9$
	CIFAR10	$1.8\times {10}^9$	$3.6\times {10}^9$	$5.4\times {10}^9$	$7.2\times {10}^9$	$9.0\times {10}^9$
	SVHN	$1.8\times {10}^9$	$3.6\times {10}^9$	$5.4\times {10}^9$	$7.2\times {10}^9$	$9.0\times {10}^9$
Compressed	MNIST	$5\times {10}^7$	$1.1\times {10}^8$	$1.7\times {10}^8$	$2.2\times {10}^8$	$2.8\times {10}^8$
	CIFAR10	$5.5\times {10}^7$	$1.2\times {10}^8$	$1.8\times {10}^8$	$2.4\times {10}^8$	$3.0\times {10}^8$
	SVHN	$5\times {10}^7$	$1.1\times {10}^8$	$1.7\times {10}^8$	$2.2\times {10}^8$	$2.8\times {10}^8$

.

5.5. Ablation Experiments

(1) In order to investigate the effect of the hyperparameter smoothing coefficient $ϵ$ on the weight distribution of the ASA aggregation, we set $ϵ=\{0.1,0.3,0.5\}$, respectively, and compare the Test Accuracy and Training Loss of the FedHSQA framework on the MNIST dataset. The experimental results are shown in Figure 6.

The experimental results show that at the early stage of training (within the first 10 rounds), all three sets of smoothing coefficient settings can converge quickly, with the test accuracy exceeding 85% and the training loss dropping to less than 0.2, indicating that the ASA algorithm has a good convergence potential under different $ϵ$ settings. However, in the middle and late stages (rounds 20–100), the model performance diverges: when $ϵ$ = 0.3, the test accuracy is maintained in the range of 90–95%, and the training loss stabilizes below 0.15, which shows the best convergence and stability; when $ϵ$ = 0.5, although the overall accuracy is relatively high, there is a large fluctuation in rounds 60–90, with the accuracy dropping below 60%, and the fluctuation of the training loss is obvious. This shows that the large smoothing factor weakens the ability to respond to abnormal scoring differences and is prone to cause aggregation bias; when $ϵ$ = 0.1, although the early convergence is faster, the late accuracy fluctuates sharply, and the training loss is always higher than that of the other two groups, showing that the aggregation weights are skewed to the extremes and are susceptible to abnormal perturbations. Finally, among the three settings, $ϵ$ = 0.3 has the highest test accuracy and the lowest training loss; $ϵ$ = 0.5 has the most significant fluctuation in accuracy; and $ϵ$ = 0.1 has the weakest robustness. Therefore, the setting of the smoothing coefficient has a significant effect on the convergence speed and stability of the model.

(2) To further evaluate the impact of the upper and lower bounds settings of the JS mapping function, which is the range of quantization levels $(b_{min},b_{max})$, on the global model performance in the ASQ method, we set $(b_{min},b_{max})$ to be $(2,8)$, $(4,8)$, $(6,8)$, and $(1,16)$, respectively, and conducted experiments on MNIST, CIFAR10, and SVHN datasets. The focus was on analyzing the metrics of compression degree, communication overhead and average quantization bit. The average quantization bits represent the average number of bits used for each floating-point model parameter after compression; the communication overhead refers to the total number of bits transmitted by each vehicle node to upload the gradient in each communication round; and the compression degree is defined as the “number of uncompressed bits/number of transmitted bits”, where smaller values indicate higher compression ratios. The experimental results are shown in

Table 5. Impact of quantization level ranges on aggregation models.

Dataset	Range	Highest Accuracy	Compression Degree	Communication Overhead (Bit)	Average Quantization Bit
MNIST	(2, 8)	95.08%	0.46	38,116,540	7.00
	(4, 8)	95.98%	0.46	38,116,540	7.00
	(6, 8)	98.63%	0.40	38,661,060	8.00
	(1, 16)	99.33%	0.25	70,787,860	13.00
CIFAR10	(2, 8)	82.37%	0.46	38,156,860	7.00
	(4, 8)	82.85%	0.46	38,156,860	7.00
	(6, 8)	85.58%	0.40	43,607,840	8.00
	(1, 16)	87.89%	0.25	70,862,740	13.00
SVHN	(2, 8)	90.69%	0.46	38,156,860	7.00
	(4, 8)	90.87%	0.46	38,156,860	7.00
	(6, 8)	92.25%	0.40	43,607,840	8.00
	(1, 16)	95.97%	0.25	79,584,308	13.00

.

The experimental data show that as $b_{min}$ increases, the mapping output of ASQ tends to be more centralized, and the regulation space of anomaly scoring at the quantization level is reduced, making the number of bits allocated to each client more stable. Taking SVHN as an example, when the quantization range is increased from $(4,8)$ to $(6,8)$, the average quantization bit increases from 7 to 8, and the communication overhead increases slightly, but the compression degree increases to 0.40, indicating that the high-starting point compression strategy effectively mitigates the information loss caused by the low bit quantization, and reduces the client-side differences caused by the large span of the levels. A similar trend is observed on MNIST and CIFAR10, where the model accuracy increases with $b_{min}$, further confirming the judgment that too few quantization bits, while improving the compression rate, can limit the model performance. Furthermore, the control experiment $(b_{min},b_{max})=(1,16)$ of our setup achieves the optimal accuracy across datasets, but the average quantization bit is as high as 13, almost doubling the communication overhead. Due to the large level span in this setting, the ASQ mapping tends to average the bit allocation, which weakens the adaptive compression capability and significantly increases the communication overhead. Therefore, under the premise of fixing $b_{max}=8$, moderately increasing $b_{min}$ helps to improve the robustness of the model while taking into account the communication efficiency, which is a better strategy for setting the compression level.

6. Conclusions and Future Work

In this paper, we propose a three-layer HFL framework for IoV, called FedHSQA, which integrates a secure aggregation algorithm (ASA) and an adaptive level quantization method (ASQ). Experimental results on three public datasets demonstrated that FedHSQA effectively reduces communication overhead while enhancing the robustness of the global model against untrusted vehicle nodes. Despite its promising experimental performance, FedHSQA still presents several directions for future exploration:

First, its scalability requires further investigation. As the number of vehicle nodes and RSUs increases, the cloud server must process more model updates and scoring computations, leading to increased aggregation overhead. Future work will explore the introduction of multi-level hierarchical aggregation trees and cluster-based group aggregation strategies to improve computational efficiency and support large-scale deployment.

Second, in computation resource-constrained environments, FedHSQA may encounter challenges such as the high computational cost of the anomaly scoring model and the additional computation burden introduced by using ASQ-based communication compression. To alleviate the pressure on IoV devices, our future work will consider integrating lightweight anomaly scorers with asynchronous communication mechanisms, enabling delayed local updates to reduce real-time computational demands.

Finally, due to the highly dynamic connectivity of IoV environments, unstable communication links may impair model synchronization and aggregation. To enhance system robustness, future efforts will focus on designing asynchronous or delay-tolerant aggregation mechanisms and deploying FedHSQA on more realistic simulation platforms to obtain results with higher practical relevance.