发表机构
National Institute of Standards and Technology, USA; Michigan Technological University, USA（美国国家标准与技术研究院; 密歇根理工大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
研究自动驾驶多供应商感知融合的隐私保护问题，提出Sarus框架，利用同态加密，将检测编码为高斯矩向量加密传输，服务器在加密域聚合，实验表明其能有效聚合互补检测，提高覆盖率，实现实时隐私保护融合。
AI 中文摘要
协作感知使自动驾驶车辆能够通过聚合多个代理和传感平台的检测输出，通常是在多供应商部署中的共享融合服务，来提高态势感知能力。然而，在推理时共享此类输出会暴露专有模型行为和敏感环境信息，引发重大隐私和安全问题。本文提出了Sarus，这是一个通过同态加密（HE）实现多供应商感知融合的隐私保护框架，能够在不泄露单个供应商输出的情况下进行聚合。每个供应商将检测编码为共享空间格上的紧凑高斯矩向量，并将加密后的有效载荷传输到融合服务器，该服务器直接在加密域中对其进行聚合。然后对融合结果进行解密，并通过逐类合并重建为最终检测结果。我们分析了计算复杂度，表明供应商有效载荷构建的线性缩放以及服务器端与占用箱数\(B\)和供应商数\(V\)的\(O(BV)\)融合，而后处理缩放为\(O(B + \sum_{c\in \mathcal{C}} B_c^2)\)，其中\(\mathcal{C}\)表示对象类集，\(B_c\)是类\(c\)的占用箱数。实验表明，在实践中只有来自HE的有界常数因子开销的线性缩放，解密主导后处理成本。在KITTI数据集上使用相机（YOLOv8）和激光雷达（PointPillars，PV-RCNN）检测器的实验表明，Sarus通过有效聚合互补检测提高了场景级覆盖率，特别是在单个模态退化的距离相关区域。这些结果表明当联合利用统计压缩和空间稀疏性时，隐私保护的多供应商感知融合对于实时部署是可行的。
英文摘要
Cooperative perception enables autonomous vehicles (AVs) to improve situational awareness by aggregating detection outputs from multiple agents and sensing platforms, often via a shared fusion service in multi-vendor deployments. However, sharing such outputs at inference time exposes proprietary model behavior and sensitive environmental information, creating significant privacy and security concerns. In this paper, we present Sarus, a privacy-preserving framework for multi-vendor perception fusion via homomorphic encryption (HE), enabling aggregation without revealing individual vendor outputs. Each vendor encodes detections as compact Gaussian moment vectors over a shared spatial lattice and transmits encrypted payloads to a fusion server, which aggregates them directly in the encrypted domain. The fused result is then decrypted and reconstructed into final detections through class-wise bin merging. We analyze the computational complexity, showing linear scaling for vendor payload construction and $O(BV)$ server-side fusion with the number of occupied bins $B$ and vendors $V$, while postprocessing scales as $O(B + \sum_{c\in \mathcal{C}} B_c^2)$, where $\mathcal{C}$ denotes the set of object classes and $B_c$ is the number of occupied bins for class $c$. Experiments demonstrate linear scaling in practice with only a bounded constant-factor overhead from HE, with decryption dominating postprocessing cost. Experiments on the KITTI dataset using camera (YOLOv8) and LiDAR (PointPillars, PV-RCNN) detectors show that Sarus improves scene-level coverage by effectively aggregating complementary detections, particularly in distance-dependent regimes where individual modalities degrade. These results indicate that privacy-preserving multi-vendor perception fusion is feasible for real-time deployment when statistical compression and spatial sparsity are jointly exploited.
