A privacy-preserving distributed credible evidence fusion algorithm for collective decision-making

In recent years, the development of sensors and ad hoc network techniques has promoted research on distributed inference [19, 10]. As an important branch of distributed inference, collective decision-making [27] asks decentralized agents to collaboratively infer categorical variables of the global environment based on their local observations [9, 16]. For example, based on multi-view 3D data collected by sensors mounted on vehicles or infrastructure, road target categories are detected in a fusion center and then delivered to vehicles to cope with the problem of occluded vehicle vision [5]. A vehicular cooperative perception approach including communication network repair and a vehicle-to-vehicle (V2V) attention module is designed in [28] to reduce the negative impact of lossy communication on the perception task. In these distributed collaborative systems, low-accuracy sensors are widely used to reduce hardware costs, which leads to large measurement uncertainties and makes collective decision-making difficult.

As a common mathematical tool for representing and dealing with such uncertainty, the theory of evidence reasoning (ER) [33] has widely applied to decision-level information fusion such as cyber-attack detection [8, 49], risk analysis [6, 38], multi-criteria decision making [45, 32, 23], social learning [31, 35], clustering and classification [24, 60, 14, 17], and so on. It therefore naturally draws the attention of researchers who focus on distributed evidence fusion. In [29], the belief function is used to estimate the confidence level of the output information from the collaborative perception participants. In [7], the distributed agents transform local explorations into pieces of evidence to perceive the dominant color of a closed square environment by fusing evidence with eight evidence fusion rules with a designed three-step positive feedback iterative modulation-driven mechanism. In [62], the ER is used to recognize vehicle types and construct dynamic maps to extend the perception of road vehicles. All these works are just simple applications of traditional evidence fusion methods to distributed systems.

In fact, the landmark work for distributed evidence fusion is provided by [26], in which the basic fusion rule of ER, i.e., Dempster’s rule (DR), is naturally extended to the distributed systems for the first time. This work directly fuses the evidence of all agents based on the linear average consensus (LAC) algorithm and the commonality function representation of the evidence. It is proven to be equivalent to centralized DR in terms of fusion results and well adapted to both synchronous and asynchronous LAC mechanisms. However, the work does not address the two important issues of the distributed evidence fusion. On the one hand, the DR often produces counterintuitive results when fusing highly conflicting evidence [44, 1] and fails to cope with the cyclic propagation of evidence in networks gracefully. On the other hand, the direct sharing of raw evidence leads to participants’ preference leakage.

To the best of our knowledge, there are two types of available solutions for counterintuitive issue. The first type designs alternative reasoning rules to reassign conflicting terms in various optimization criteria [46, 12, 57]. In [13], DR and cautious rule (CR) are mixed to fuse neighborhood and non-neighborhood evidence, respectively. This strategy is verified to be self-stabilizing and solves the data insect triggered by cyclic propagation, but the idempotent of CR also leads to the fusion result not changing when multiple sources hold the same evidence. Although [18] designed three combinatorial layouts containing DR and CR to solve the data insect problem, the introduced alternative rules still carry inherent flaws. On the one hand, alternative fusion rules often lose commutativity and associativity [53], which are favorable for evidence fusion in a distributed manner. On the other hand, they are often invalid in dealing with high conflicts resulting from sensor failures.

Therefore, another type of solution, so-called credible evidence fusion (CEF), is more favored by researchers in centralized evidence fusion. The CEF retains DR while pre-processing evidence to reduce conflicts according to evidence credibility [39, 58], thus being an extension of Bayesian theory and consistent with human reasoning. Available distributed evidence fusion assigns credibility to information sources based on a priori external factors. For example, in road icing monitoring scenarios, the credibility of evidence is considered to be positively correlated with its propagation distance [18]. In critical infrastructure operational status monitoring, the quality of source historical evidence and the importance of network links are adopted as references for judging source credibility [40]. In [62], a fixed discount factor is imposed on the evidence to avoid high conflict leading to non-convergence of fusion. Although this a priori information-dependent subjective credibility partially solves the high conflict problem, it suffers from poor timeliness, poor access to a priori information, and poor adaptability to real-time data, which leads to potentially low fusion accuracy. Recently, a class of distributed evidence fusion strategies based on anomalous detection can be regarded as a binarized evidence credibility assessment process. Based on the random sample consensus (RANSAC) algorithm, distributed evidence consensus algorithms for DR and CR are proposed in [11]. Also based on the idea of outlier detection, [61] employs the connectivity-based outlier factor (COF) method to remove disturbed evidence. These outlier-detection-based methods require adjusting algorithm parameters to balance false positive and false negative rates, where a high false positive rate leads to the detachment of normal information sources, affecting fusion accuracy, and a high false negative rate treats interfering evidence as normal, leading to fusion failure. Therefore, it is still imperative to investigate methods for credibility calculation in distributed systems. Traditional centralized CEF (CCEF) assesses credibility based on the evidence difference measure matrix (EDMM), which is based on two-by-two comparisons between pieces of evidence and has better adaptability [58, 36, 54]. However, how to construct EDMM and assess evidence credibility in a distributed system is still unresolved.

The privacy protection of raw data is also an important topic for collective decision-making [56, 4]. Although evidence only expresses the occurrence probabilities of events in the publicly available framework of discernment (FoD), they still reflect sideways certain preferences of agent data, such as the business status of enterprises in economic surveys, the content of voters’ votes in social elections, and the details of the combat unit’s missions in military confrontations. Therefore, it is necessary to protect the privacy of agent evidence. Most of the existing distributed evidence fusion solutions require that evidence from neighbors be available, which definitely conflicts with privacy preservation. In other words, distributed CEF with privacy preservation remains an open and interesting problem.

In light of the aforementioned analysis, this paper aims to develop a privacy-preserving distributed credible evidence fusion method for collective decision-making with the premise of protecting agents’ raw evidence data. The main contributions include:

1. 1)

   The privacy-preserving distributed credible evidence fusion (DCEF) problem is proposed for the need to deal with information uncertainty in collective decision-making, in which agents are required to fuse their evidence in a distributed manner and prevent their raw evidence from being known or inferred by others. The distributed fusion result is expected to converge to CCEF, which has shown good engineering adaptability.

2. 2)

   A fully privacy-preserving distributed credible evidence fusion algorithm (PCEF) is designed. It has a three-level consensus: the evidence difference measure (EDM) neighbor consensus, the EDM network consensus, and the fusion network consensus.

3. 3)

   Considering that the unavailability of raw evidence from other agents makes EDMM construction difficult, a privacy-preserving distributed construction strategy for EDMM covering EDM neighbor consensus and EDM network consensus is given, where the EDM neighbor consensus allows neighbors to calculate EDM between pieces of raw evidence without disclosure. The EDM network consensus locates the locally constructed EDMM to each agent and recovers the EDM between non-neighboring agents’ pieces of raw evidence by using a low-rank matrix complementation technique that has rank-adaptive capability.

4. 4)

   A distributed fusion strategy based on differential privacy and credibility compensation is developed to prevent agents’ raw evidence from being inferred during the fusion network consensus, and its capability for privacy preservation is discussed.

This paper is organized as follows: Section 2 analyzes the challenges of DCEF with privacy-preserving; Section 3 presents the details of the PCEF; Section 4 simulates and verifies the effectiveness of PCEF; and the work is finally summarized.

As shown in Fig.1, $N$ distributed agents constitute a distributed system that is modeled as a strongly connected undirected graph. ${\cal G}=\left({\cal V},\varepsilon\right)$, where ${\cal V}=\{1,2,\cdots,N\}$ and $\varepsilon\subset\cal V\times\cal V$ are the set of agents and edges, respectively. Two agents connected by an edge $e=(i,j)\in\varepsilon$ are called neighbors. The set of neighbors of Agent $i$ is expressed as ${\cal N}_{i}=\{j|\left(i,j\right) \in\varepsilon \}$. Let ${\cal A}=[a_{ij}]\in{\mathbb{R}^{N\times N}}$ and ${\cal A}^{i}=[a^{i}_{ij}]\in{\mathbb{R}^{N\times N}}$ be the adjacency matrix of $\cal G$ and the local adjacency matrix of Agent $i$, respectively, with $a_{ij}=a^{i}_{ij}=1$ for $(i,j)\in\varepsilon$ and $a_{ij}=a^{i}_{ij}=0$ for otherwise.

The $N$ agents perform a collective decision-making task in which all complete and mutually exclusive potential decision results form a finite set, FoD [30], written as $\Omega=\{{\hat{A}}_{1},{\hat{A}}_{2},\cdots,{\hat{A}}_{n}\}$. Here, ${\hat{A}}_{i}$ is a potential decision result. During the decision-making process, the agent’s information is uniformly characterized in the FoD space to cope with the heterogeneity and uncertainty of the source data. In the beginning, each of the $N$ agents holds a piece of evidence, also called basic belief assignment (BBA) or mass function, defined on the FoD. Note that Agent $i$’s raw evidence $\bm{m}_{i}$ is a mapping ${m_{i}}:{2^{\Omega}}\to\left[{0,1}\right]$ such that:

and, in general, ${m_{i}}\left(\emptyset\right)=0$.

The communication constraints of agents and the task goals for the collective decision-making task are shown in Fig.1. Agents are required to collaboratively fuse all pieces of evidence. During this process, data sharing is limited to authenticated neighboring agents to prevent exposure of agent preferences. In other words, the raw evidence of an agent is not shared with or inferred by any other agents. As there is no fusion center, agents have to exchange and update data iteratively to reach consensus. The term “consensus” encompasses three aspects: first, the basis for credibility calculation, i.e., the EDMM, is consistent; second, all agents obtain the same fusion result; and third, the fusion result accurately converges to the CCEF. As shown in Fig.2, the CCEF procedure is outlined below at first:

1. 1)

   EDM calculation: Compute EDMs among $N$ pieces of evidence. Here, a commonly used EDM, $Dismp$ [36], is shown:

   $$d_{ij}=DismP(\bm{m}_{i},\bm{m}_{j})\triangleq\frac{{DistP(\bm{m}_{i},\bm{m}_{j})+ConfP(\bm{m}_{i},\bm{m}_{j})}}{{1+DistP(\bm{m}_{i},\bm{m}_{j})ConfP(\bm{m}_{i},\bm{m}_{j})}}$$

   (2)

   where $d_{ij}$ is the EDM between $\bm{m}_{i}$ and $\bm{m}_{j}$, and

   $\displaystyle DistP\left({\bm{m}_{i},\bm{m}_{j}}\right)=\frac{1}{2}{\left({\sum\nolimits_{\scriptstyle{{\hat{A}}_{k}}\in\Omega,\atop\scriptstyle\left|{{{\hat{A}}_{k}}}\right|=1}{{{\left|{BetP_{i}({\hat{A}}_{k})-BetP_{j}({\hat{A}}_{k})}\right|}^{\eta}}}}\right)^{\frac{1}{\eta}}}$

   (3)

   	$\displaystyle ConfP\left(\bm{m}_{i},\bm{m}_{j}\right)$	$\displaystyle=\begin{cases}0&,\text{if }X_{\max}^{\bm{m}_{i}}\cap X_{\max}^{\bm{m}_{j}}\neq\emptyset\\ BetP_{i}\left({X_{\max}^{\bm{m}_{i}}}\right)BetP_{j}\left({X_{\max}^{\bm{m}_{j}}}\right)&,\text{otherwise.}\end{cases}$		(4)
   	$\displaystyle s.t.\quad X_{\max}^{{\bm{m}_{l}}}$	$\displaystyle=\arg\mathop{\max}\limits_{{{\hat{A}}_{k}}\in\Omega}{BetP_{{\bm{m}_{l}}}}({{\hat{A}}_{k}}),l=i,j$

   where $\eta=2$; $DistP$ and $ConfP$ are respectively the probabilistic-based distance and the conflict coefficient. They are calculated by Pignistic probability, i.e., $\bm{BetP}_{i}=[{BetP_{i}({\hat{A}}_{1}),BetP_{i}({\hat{A}}_{2}),\cdots,BetP_{i}({\hat{A}}_{n})}]^{T}$:

   $$BetP_{i}\left({{{\hat{A}}_{k}}}\right)=\mathop{\sum}\limits_{{B}\subset{2^{\Omega}},{{\hat{A}}_{k}}\subseteq B}\frac{1}{{|B|}}{m_{i}}\left(B\right)$$

   (5)

   where $|B|$ is the cardinality of $B$.

2. 2)

   Credibility calculation: Compute the credibility $Cred_{i}$ of $\bm{m}_{i}$:

   $$Cred_{i}=\frac{{\mathop{\min}\limits_{1\leq j\leq N}\sum\nolimits_{k=1,k\neq j}^{N}{{d_{jk}}}}}{{\sum\nolimits_{k=1,k\neq i}^{N}{{d_{ik}}}}}$$

   (6)

3. 3)

   Evidence pre-processing: Furthermore, raw evidence is discounted in a crediability-dependent style to reduce conflicting [59]:

   $$\begin{cases}{{m^{\prime}}_{i}}(A)=Cred_{i}\cdot{m_{i}}(A)&,\text{if }A\neq\Omega\\ {{m^{\prime}}_{i}}(\Omega)=1-\sum\limits_{A\in{2^{\Omega}},{}A\neq\Omega}{{{m^{\prime}}_{i}}(A)}&,\text{otherwise.}\end{cases}$$

   (7)

4. 4)

   Evidence fusion: Fuse all pre-processed evidence to obtain the fusion result $\bm{m}_{\oplus}$:

   $$\bm{m}_{\oplus}=\bm{m}^{\prime}_{1}\oplus\bm{m}^{\prime}_{2}\oplus\cdots\oplus\bm{m}^{\prime}_{N}$$

   (8)

   where $\oplus$ is the DR operator. Since DR follows the associativity, $\oplus$ is shown with $\bm{m}_{i}$ and $\bm{m}_{j}$ as examples:

   $$\left({{m_{i}}\oplus{m_{j}}}\right)\left(A\right)=\begin{cases}0&,\text{if }A=\emptyset\\ \frac{{\sum\limits_{B\cap C=A}{{m_{i}}\left(B\right){m_{j}}\left(C\right)}}}{{1-{\sum_{B\cap C=\emptyset}}{m_{i}}\left(B\right){m_{j}}\left(C\right)}}&,\text{if }A\in 2^{\Omega}\backslash\{\emptyset\}\end{cases}$$

   (9)

As for distributed evidence fusion, available studies reach all-agent consensus on fusion result via LAC [11, 26]:

where $\bm{x}_{i}^{\bm{\omega}}\left(t\right)$ represents the state of Agent $i$ at iteration step $t$; $c_{ij}$ is the Metropolis-Hastings weight [55]:

where $\left|{\mathcal{N}}_{i}\right|$ is the cardinality of ${\mathcal{N}}_{i}$. The $\bm{\omega}_{i}$ is the weight assignment of $\bm{m}_{i}$ [47]. It is another representation of evidence. For $\forall A\in{2^{\Omega}}\backslash\left\{{\emptyset,\Omega}\right\}$, $\omega_{i}\left(A\right)$ is calculated by:

where $Q_{i}\left(A\right):{2^{\Omega}}\to\left[{0,1}\right]$ is the so-called commonality function that is converted by the mass function:

The Eq.(10) will lead to the fact that the states of all agents converge to $\sum\nolimits_{i=1}^{N}{{\bm{\omega}_{i}}}/N$ when ${\cal G}$ is a strongly connected graph. Considering that the fusion of mass functions with DR is equivalent to the addition of weight assignments, i.e., the weight assignment corresponding to the $\bm{m}_{i}\oplus\bm{m}_{j}$ is $\bm{\omega}_{i}+\bm{\omega}_{j}$, so $\sum\nolimits_{i=1}^{N}{{\bm{\omega}_{i}}}/N$ is exactly $1/N$ of the fusion result of all pieces of evidence with DR. Let $\bm{\omega}_{\oplus}\triangleq\sum\nolimits_{i=1}^{N}{{\bm{\omega}_{i}}}$ be the weight assignment of $\bm{m}_{\oplus}$, then:

where $A_{k}^{\bm{\omega}_{\oplus}}$ is the simple mass function [11] corresponding to $\omega_{\oplus}({A_{k}})$, and $r=2^{n}-2$.

According to the analysis of CCEF and existing distributed evidence fusion above, there are several challenges to realizing the collective decision-making task shown in Fig.1:

1. 1)

   In EDM calculation, Eq.(2) asks agents to collect a pair of raw evidence simultaneously, which is hindered by the privacy requirements, i.e., the forbiddings of raw evidence sharing and non-neighbors information sharing.

2. 2)

   In credibility calculation, all EDMs among pieces of evidence are involved in Eq.(6). Therefore, it is essential to ensure that all agents possess identical EDMs.

3. 3)

   In evidence fusion, uniform EDMs mean that evidence credibilities are publicly accessible to all agents, and hence the pre-processed evidence and raw evidence can be derived from each other according to Eq.(7). In other words, taking the pre-processed evidence as the initial state of Eq.(10) is not privacy-preserving.

To address the three challenges of CEF in a fully privacy-preserving distributed network, a method named PCEF that includes EDM neighbor consensus, EDM network consensus, and fusion network consensus is proposed in this section, as shown in Fig.3. In EDM neighbor consensus, neighboring agents compute the EDM between their raw evidence without knowledge of each other’s raw evidence and $BetP$. In EDM network consensus, the EDM of non-neighboring agents’ raw evidence is estimated based on the correlation between the rows of the EDMM and the already-obtained EDMs between neighbors’ raw evidence. The result of this consensus is that each agent holds a complete, all-agent-consistent EDMM, which will be used for credibility computation. In fusion network consensus, differential privacy and credibility compensation are introduced into Eq.(10) for a finite time to protect the privacy of raw evidence and lead all agents to achieve consensus on fusion.