Connected and autonomous vehicles (CAVs) increasingly rely on vehicle-to-everything (V2X) communication and distributed sensing infrastructures to support cooperative driving and intelligent transportation services. While these capabilities improve traffic efficiency and safety, they also expand the attack surface of vehicular networks and expose in-vehicle communication systems such as the Controller Area Network (CAN) bus to a wide range of cyber threats. Machine learning-based anomaly detection has emerged as a promising approach for identifying malicious CAN traffic patterns; however, conventional centralized learning requires large-scale data aggregation from vehicles, which raises privacy and scalability concerns. Federated learning (FL) enables collaborative model training across distributed vehicles without requiring the exchange of raw in-vehicle data, making it attractive for privacy-preserving vehicular security applications. Nevertheless, FL systems remain vulnerable to adversarial participants that manipulate local training data or model updates to poison the global model during aggregation. In this work, we present a systematic robustness evaluation of federated anomaly detection in connected vehicular networks under adversarial conditions. The study compares six aggregation strategies, including Federated Averaging (FedAvg), coordinate-wise Median, Trimmed Mean, Krum, Multi-Krum, and Geometric Median (GeoMed), within a non-IID federated CAN bus anomaly detection setting. The evaluation covers label-flipping attacks, gradient-scaling attacks, and a feature-triggered backdoor attack. In addition, the analysis examines malicious client participation, attack-strength variation, learning-rate sensitivity, Trimmed Mean beta sensitivity, multi-seed reliability, and server-side aggregation time. The results show that FedAvg is vulnerable under strong adversarial manipulation, while Trimmed Mean is sensitive to the selected trimming fraction. Median and GeoMed provide strong robustness against gradient-scaling attacks, whereas Multi-Krum achieves the strongest resistance to label-flipping and backdoor attacks. These findings demonstrate that no single aggregation strategy is optimal across all threat models. Instead, robust aggregation for federated CAV anomaly detection should be selected according to the expected attack type, reliability requirement, and computational overhead.
Uddin et al. (Wed,) studied this question.