=Paper=
{{Paper
|id=Vol-2129/paper6
|storemode=property
|title=Privacy-Preserving Intersection Management for Autonomous Vehicles
|pdfUrl=https://ceur-ws.org/Vol-2129/paper6.pdf
|volume=Vol-2129
|authors=Nadin Kökciyan,Mustafa Erdogan,Tuna Han Salih Meral,Pinar Yolum
|dblpUrl=https://dblp.org/rec/conf/ijcai/KokciyanEMY18
}}
==Privacy-Preserving Intersection Management for Autonomous Vehicles==
https://ceur-ws.org/Vol-2129/paper6.pdf
Privacy-Preserving Intersection Management for Autonomous Vehicles
Nadin Kökciyan1 , Mustafa Erdogan2 , Tuna Han Salih Meral2 , Pınar Yolum2,3 ,
1
King’s College London
2
Bogazici University
3
Utrecht University
nadin.kokciyan@kcl.ac.uk, p.yolum@uu.nl
Abstract through sound and colors. However, with regular cars, there
are no special symbols that can designate their purpose. Thus,
Traffic lights are a common instrument to regulate in junctions, the decision making is done in a simple turn-
the traffic in junctions. However, when a vehicle taking manner that treats every vehicle equally. Ideally, it
has an urgency, it may violate the traffic lights. would be best if the vehicles could communicate with each
Since the other vehicles do not expect this, such vi- other about their emergencies or constraints [Atherton, 2016]
olations lead to road accidents. Connected and au- and automatically reach a decision as to which one should go
tonomous vehicles can coordinate their actions and first. Recent technologies, such as Vehicle-to-X (V2X) make
decide on the priority of passing without the need it possible for vehicles to talk to each other as well as des-
of traffic lights if they can share information about ignated entities on a road [Lu et al., 2014]. Using such a
their current situation. That is, a vehicle with an ur- technology, vehicles could communicate information such as
gency can communicate this with justifications to the purpose of their trip, physical conditions of the vehicle as
others and ask to go first. However, the shared in- well as the external properties of the environment.
formation can potentially yield privacy violations
while helping vehicles attain priority. We propose a While such a communication between autonomous vehi-
privacy-preserving decision making framework for cles could serve to reach a decision, it could also create im-
managing traffic at junctions. The vehicles are rep- portant privacy challenges. For example, a vehicle could re-
resented as autonomous agents that can communi- veal that it is in an emergency because it is carrying the presi-
cate with each other and make priority-based deci- dent and might actually end up passing through a junction be-
sions using auctions. The bids in the auctions are fore others, but disclosing this information could create other
not monetary but contain information that each ve- threats for the vehicle. Or, a stroke patient who has high blood
hicle is willing to declare. Our experiments on real- pressure symptoms could be in hurry to go to hospital. How-
world accident data show that our proposed bidding ever, he might prefer not sharing his health condition with
strategies help vehicles preserve their privacy while other entities because the breach of this information can lead
still enabling them to receive priority at junctions. to loss of insurance or a job. Thus, preserving privacy of the
vehicles while reaching a decision is of utmost importance.
This paper proposes an agent-based approach to realize
1 Introduction privacy-preserving decision making for autonomous vehi-
Traffic accidents are the leading cause of casualties in many cles [Bazzan and Klugl, 2014]. Whenever two vehicles are at
countries. Only in US, approximately 40,000 people died in a junction, the vehicles bid with their information in an auc-
traffic accidents in 2016 [National Safety Council, 2016] and tion to decide which vehicle will go first. The vehicle whose
millions of people have been injured. Most of these acci- bid yields a higher priority gets to pass before the other. Con-
dents happen because human drivers do not obey traffic rules, trary to traditional auctions with monetary bids, here even
or are not aware of the physical conditions of the environ- when a bid does not win the auction, the bidder is at a loss
ment. Autonomous vehicles are expected to reverse this as because some information has been disclosed. To handle this,
they can be designed to follow the rules more strictly than we propose bidding strategies where each vehicle bids incre-
human drivers [Crew, 2015]. However, human drivers also mentally so that private information is only revealed if it will
choose to violate the rules on purpose to address their own help the vehicle in taking a priority. As a result, a vehicle
needs. For example, a driver can choose not to stop at a red that provides enough information to convince the intersection
light at a junction because of a special condition; i.e., she manager for its priority passes first. This enables the vehicles
is in a hurry because of a sick passenger. In many occa- to preserve their privacy while reporting their situation.
sions, if the other drivers were aware of the situation, they The rest of this paper is organized as follows: Section 2 in-
might accommodate it, for example by lending the road to troduces a multiagent model where each autonomous vehicle
that driver. This is widely seen in case of a fire truck or an is represented as an agent that uses auctions to make priority-
ambulance, where the vehicles physically show their purpose based decisions. We explain various parameters and condi-
Property Property Weight Instance Instance Weight
Ambulance 1.0
Vehicle Type (t) 0.25 Car 0.9
Taxi 0.9
Journey as part of work 1.0
Journey of Purpose (p) 0.25 Commuting to/from work 0.8
Riding to/from school 0.8
0-5, 6-10, 66-75, 75+ 0.8
Age Band of Driver (b) 0.25
11-65 1.0
Age of Vehicle (a) 0.25 Numeric Value (0-105) 1.0
Table 1: An Example Set of Properties and Instances
tions that cause accidents. Section 3 develops our approach Manager (IM) who acts as the auctioneer. Each vehicle bids
and bidding strategies. Section 4 evaluates the approach on with information and based on the type of the auction, IM de-
real word accident data. Section 5 provides a discussion on cides on the winner of the auction. The bidder that provides
relevant approaches for junction managements. Finally, Sec- information with the highest priority value wins. Contrary to
tion 6 concludes with directions for future research. existing work, the autonomous vehicles bid information in-
stead of money to preserve privacy. We assume that the IM
represents an authoritative entity, such as traffic patrol and
2 Autonomous Vehicles as a Multiagent is equipped with the necessary security techniques to collect,
System save, and process the bids without compromise.
We propose an agent-based approach where each agent repre- The auctions that have been used before have not taken into
sents an autonomous vehicle [Chen and Cheng, 2010]. Each consideration the privacy of the autonomous vehicles. Since
agent is aware of the properties that are associated with the the vehicles are giving away information as their bids to re-
vehicle and the journey, such as the purpose of the trip or flect their situation, it could very well be that the information
the type of the vehicle. When they arrive at a junction, they they provide contain sensitive information. Thus, it is neces-
need to reach a decision as to which vehicle will pass first. sary to account for privacy in handling decision making.
To do so, each vehicle can put forward its current status to
convince other vehicles of its priority. In order to be able to 2.1 Understanding Accidents
compare the status of two different vehicles, it is best if the To understand road accidents better, we have analyzed the
information can be transformed into a single priority value. Road Safety Data [The UK Government, 2016] published
However, if each vehicle computes this value for itself, there by the UK Government. This dataset contains more than
is no guarantee that they would report it correctly; i.e., each 140,000 road accidents with numerous properties including
vehicle can report a high priority value to pass first. To over- details about the consequential casualties. We show a repre-
come this, it is best if both vehicles can report information sentative subset in Table 1.
about their status and a mediator can compute the priority val- Each property has a name and a sample set of instances.
ues and announce the decision. Such an entity can have fur- The first property is the Vehicle Type with instances of ambu-
ther information about the environment and compute a prior- lance, car and taxi. We associate an instance weight that de-
ity value. Auctions serve as an ideal mechanism for decision notes the importance of each instance. A regular car usually
making through a mediator, where the entities involved (e.g., gives priority to an ambulance, which gets a higher instance
autonomous vehicles) express their priorities independently. weight. The second property is the Journey of Purpose. For
The general idea is that an auctioneer provides a service (e.g., example, a car can be in a hurry because it is late for school.
selling an item) and wants to get the highest possible price. The third property is the Age Band of the Driver. For exam-
On the other hand, the potential bidders want to receive ser- ple, a vehicle may need to pass first because it has an older
vice at the lowest possible price [Weiss, 1999]. For example, driver. The fourth property is the Age of a Vehicle, a value
in an English auction, the buyer with the highest bid wins an between 0 and 105. Older vehicles may have brakes that are
auction and gets the item. not robust and thus may be preferred to lead the road to a
Auctions have been studied before in the context of deci- high-speed car. As seen in Table 1, some properties are about
sion making for autonomous vehicles at junctions and have the vehicle itself (e.g., vehicle type), whereas some proper-
been shown to reduce delays significantly [Carlino et al., ties give information about the passengers in the vehicle (e.g.,
2013]. In that approach, autonomous vehicles bid money to journey of purpose).
measure the value of a trip in terms of the value of time. Ac- In addition to the instances of properties, properties them-
cording to the result of the auction, the driver can cross the in- selves can be associated a weight, to denote that one aspect
tersection or wait. In our work, the bids consist of properties, of the vehicle is more important than a second one. The val-
and the value of a bid is computed by a trusted Intersection ues in this table can be adjusted. Here, we assume that each
Vehicle Type (t) Purpose of Journey (p) Age Band of Driver (b) Age of Vehicle (a)
Vehicle 1 (V1 ) CAR SCHOOL 6 9
[0.76] [0.885] [0.15] [0.452]
Vehicle 2 (V2 ) TAXI PARTOFWORK 9 5
[0.477] [0.879] [0.334] [0.948]
Table 2: Properties for the Two Vehicles in Accident Number 2015331500103
property is equally important and thus assign a value of 0.25. to consider, since a vehicle may choose to keep some proper-
Running Example. A taxi and a car meet at a junction, ties private to preserve its privacy instead of moving first. On
where the car is headed for school and the taxi for work. How the other hand, there is no guarantee that a vehicle will get the
to decide which vehicle will pass first? priority if it shares all its shareable properties. Recall that a
The vehicles (V1 and V2 ) have the properties specified in vehicle only reveals its properties to the IM, which leads the
Table 2 with different privacy values, which will be detailed auction and makes the decision about the winner.
in Section 3. The age band of driver values of the vehicles To preserve privacy, each vehicle needs to prioritise its
are 6 and 9 respectively; the age of the vehicle V1 is 9 and properties according to their privacy needs. Each property
the age of the vehicle V2 is 5. An immediate question is how in Table 1 can be shared by a vehicle, if it meets the privacy
the vehicles will generate the bids regarding the properties of needs of that vehicle. First, a vehicle assigns a privacy value
the vehicles. We study three strategies that vary in how they for each property between 0 and 1. This value shows how
preserve privacy. much a property is private for the vehicle. In Table 2, the pri-
vacy values for each property are specified in brackets. For
2.2 Strategy 1: Bid-All. example, the vehicle type property has a privacy value of 0.76
The simplest strategy is when the vehicles decide to reveal for V1 . Second, a vehicle sets a single privacy threshold value
all their properties in their bids. This type of strategy corre- between 0 and 1. A vehicle can only share a property with
sponds to the Blind auction, where each bidder places a bid other IM entities if the privacy value of that property is below
without considering the bids of others. The auctioneer an- or equal to its threshold. We call such properties shareable
nounces the highest bidder who pays the amount of his bid. properties. According to Table 2 and Figure 1, if the privacy
The Intersection Manager (IM) should make a decision to threshold is set to 0.8 for both of the vehicles, the shareable
compute a priority value for the received bids, and let the ve- properties of V1 are {t, b, a}; and those of V2 are {t, b}. A
hicle with the highest priority value to move first at the junc- shareable property is a candidate property that can be shared.
tion. Note that the priority values can be computed in dif- In other words, a vehicle can decide which shareable property
ferent ways; we propose one such priority function in Equa- to reveal according to the privacy-aware strategy that it em-
tion 1. uv is the priority value of the vehicle v. All the shared ploys. In the following, we propose two such privacy-aware
properties of a vehicle are added to the computation of the strategies.
priority value. wp is the weight of the property p and wp.i is
the weight for the instance of the property p.
3.1 Strategy 2: Bid-Privacy-Aware
X A privacy-aware strategy would be when the vehicles decide
uv = (wp ∗ wp.i ) (1) to reveal only all or some of their shareable properties. Bid-
Privacy-Aware (BPA) strategy again corresponds to the Blind
Figure 1 shows the interactions of two vehicles with IM, auction, but this time the vehicles place a privacy-preserving
when the vehicles employ different bidding strategies. The bid and share some of their shareable properties.
dotted circles and the dotted squares show the possible bids In Figure 1b, the shareable properties of V1 are {t, b, a};
of the two vehicles V1 and V2 . The winner of the auction has whereas V2 can share from {t, b}. When the vehicles fol-
an underlined label. The first two strategies are single-shot low the BPA strategy, IM collects the shareable properties
auctions; whereas the third strategy requires multiple interac- of V1 and V2 . It computes the priority values as 0.675 and
tions with the IM. 0.425 (Equation 1). V1 wins the auction with the highest pri-
In Figure 1a, when the vehicles follow Bid-All strategy, the ority value. In the Bid-All strategy, V2 was the winner when
two vehicles share all their properties (t, p, b, a). According it shared all its properties. In the BPA strategy, V2 lost the
to Equation 1, IM computes the priority values as 0.875 and auction since it preferred not to share some of its properties.
0.925 for V1 and V2 respectively. V2 is the vehicle with the In other words, V2 chose to preserve its privacy by revealing
highest priority value; hence, it wins the auction and moves some of its shareable properties. This is a prime example that
first. This strategy is blind to privacy since all relevant infor- depicts that vehicles might value their privacy more than the
mation is shared without a privacy consideration. utility they will gain by revealing private information.
3 Privacy-aware Strategies 3.2 Strategy 3: Bid-Privacy-Incremental
A vehicle that is willing to share most of its properties might The vehicles could decide when to make a bid regarding what
be in an urgent situation. However, there is a privacy tradeoff properties they could share. If they knew that they would not
(a) Bid-All (c) Bid-Privacy-Incremental
Intersection Manager Intersection Manager
V1 V1 bid? [0]
t p t p
t p
b a b a
b
b a
V2 t p V2
bid? [0.2]
t p t p
b a
b a b a b
(b) Bid-Privacy-Aware
Intersection Manager V1
t p bid? [0.2]
V1
t p a
b a
t
b a
b a
V2
t p
bid? [0.45]
V2 t
t p
b a
b a b
Figure 1: Bidding strategies applied on the running example (Accident Number 2015331500103). The privacy threshold is set to 0.8.
place a higher bid, they could choose not to place a new bid This strategy cannot change the outcome of an auction where
to preserve their privacy. In Bid-Privacy-Incremental (BPI) the vehicles follow Bid-Privacy-Aware strategy. However, it
strategy, each time that IM is waiting for new bids from the can help the vehicles to disclose their shareable properties
vehicles, it broadcasts the priority value of the current high- minimally as shown in this particular example.
est bid. The auction continues with the vehicles that can raise
the highest bid. In this strategy, the vehicles are free to leave 4 Evaluation
an auction if they cannot beat the current highest bid. Differ-
ent from the previous strategies, the auction may terminate in So far we have introduced three strategies: Bid-All, Bid-
several iterations. As before, the vehicle placing the highest Privacy-Aware and Bid-Privacy-Incremental. The first strat-
bid gets the priority in traffic. This strategy corresponds into egy does not consider any privacy concerns of the agents in-
an English auction. volved in an auction. However, the other two strategies can
Assume that V1 is the first vehicle that communicates with be employed by the agents to preserve their privacy. In this
the IM. In Figure 1c, V1 places a bid that consists of b in the section, we first introduce a privacy loss metric and we show
first iteration. Note that in previous strategies, V1 revealed how this metric would be applied to our running example. By
all its shareable properties. Then, IM computes the priority using a real-world dataset, we report the privacy loss results
value of the received bid that is 0.2. IM asks V2 to place a when the agents employ various strategies for different pri-
new bid and announces the current priority value. V2 places vacy thresholds.
a bid that consists of b. IM computes the priority value of the
received bid that is 0.2. IM asks V1 to place a new bid that 4.1 The Privacy Loss Metric
values more than 0.2. V1 makes a bid that consists of a. IM In auctions, the vehicles put their bids by revealing all or
computes the current priority value as 0.45. V2 is not able some of their properties. However, revealing a property re-
to make a better bid since the only property that it can share sults in privacy loss. In Equation 2, we introduce a metric to
is t. In such case, its priority value would become 0.425, measure the privacy loss of a vehicle. P Lv is the privacy loss
which is less than the V1 ’s bid value. V2 leaves the auction value for the vehicle v. The privacy loss is basically the ratio
without placing a new bid, and chooses to keep the property t of the privacy value of shared properties per the privacy value
private. Compared to Bid-Privacy-Aware strategy, the privacy of all properties. In this equation, K is the number of shared
loss for V1 and V2 is minimized. V1 wins the auction by only properties provided by v, N is the number of total proper-
disclosing b and a; V2 loses the auction by only sharing b. ties and Pk is the privacy value of the kth property chosen by
v. In this work, N is set to four as we refer to the auction well they help preserve the privacy of autonomous vehicles.
properties described in Table 1. In each imported accident, there are two vehicles, which are
the vehicle agents in the simulation. Our program reports
K
P the privacy loss results for each agent, and it makes use of
Pk MongoDB to store the experiment results for different pri-
P Lv = k=1
N
∗ 100 (2) vacy thresholds. Our implementation is available online at
our GitHub page2 .
P
Pk
k=1 For each accident, we generate two vehicle agents from
In Table 2, for each vehicle, the privacy values of the prop- the dataset and one IM agent. Each vehicle agent represents
erties are shown. The total privacy value of V1 is 2.247 (i.e., a vehicle involved in the accident from the dataset, and is
the sum of all the privacy values); whereas V2 ’s total privacy equipped with the four auction properties (see Table 1). The
value is 2.638. To compare the different strategies, we refer dataset does not contain any privacy values for such proper-
to Figure 1. In Table 3, we report the privacy loss results of ties. Therefore, the privacy value for each property is gener-
V1 and V2 when the vehicles employ different strategies. In ated randomly, each privacy value is a uniformly distributed
Bid-All strategy, the privacy value of shared properties (the double value between 0 and 1. Note that these privacy values
lost privacy value) is equal to the total privacy. Hence, the are only generated once and used throughout the experiments.
privacy loss is 100% for both of the vehicles. Recall that For each accident in the dataset, the IM agent starts an
the privacy threshold value is set to 0.8 for the running ex- auction with the vehicle agents, where both vehicle agents
ample. In Bid-Privacy-Aware strategy, for V1 , the journey of use either Bid-All (BA), Bid-Privacy-Aware (BPA) or Bid-
purpose (p) is not shared, then the lost privacy value becomes Privacy-Incremental (BPI) strategy. In Bid-All strategy, a
1.362. According to Equation 2, the privacy loss is computed vehicle shares all its properties, leading to a privacy loss of
as 136.2/2.247 = 60.62%. In a similar way, the privacy value 100% at all times. In privacy-aware strategies, the privacy
for V2 is computed as 30.74% (i.e., the properties t and b loss depends on the privacy threshold of the vehicle. If the
are shared). In Bid-Privacy-Incremental strategy, for V1 the vehicle is in an urgent situation, it can choose a high pri-
properties b and a are shared, and the privacy loss becomes vacy threshold to move first at the junction by sharing most
26.79%. For V2 , b is the only shared property and the privacy of its properties. To observe such variations, we run our ex-
loss becomes 12.66%. If we look at the privacy-aware strate- periments with different privacy thresholds: 0.3, 0.5, 0.7, 0.8
gies, both vehicles preserve their privacy better when they and 0.9. For each accident, a privacy loss value is computed
win or lose the auctions that they are involved in. For ex- per vehicle according to the metric in Equation 2. Hence,
ample, when both vehicles employ Bid-Privacy-Incremental we can also compute the average privacy loss value of both
strategy, V2 loses the auction by only revealing one property, vehicles involved in an accident. For the accident number
which results in a low privacy loss value. 2015331500103, the generated privacy values are shown in
Table 2. We report the privacy loss results for this accident in
Figure 2 when the vehicles employ privacy-aware strategies.
th=0.8 P Lv1 P Lv2
The privacy loss values are the same for both strategies when
Bid-All 100% 100% the privacy threshold is 0.3. When this threshold is one of
Bid-Privacy-Aware 60.62% 30.74% 0.5, 0.7 and 0.8, we observe that the privacy loss of Vehicle 2
is less (12.66%) when it uses Bid-Privacy-Incremental strat-
Bid-Privacy-Incremental 26.79% 12.66% egy. Similarly, when the privacy threshold is 0.9, the privacy
loss values are minimized for both vehicles when they pre-
Table 3: Privacy loss results for the two vehicles fer using Bid-Privacy-Incremental strategy instead of Bid-All
and Bid-Privacy-Aware strategies. The main reason for this
is that the vehicles do not disclose their shareable properties
4.2 Results if they realize that they cannot place a better bid.
We use the Road Safety Data [The UK Government, 2016]
with the auction properties discussed in Table 1 and create 0.3 0.5 0.7 0.8 0.9
a real-world multiagent environment. We focus on the road BA 100% 100% 100% 100% 100%
accidents that occurred between two vehicles at junctions.
There are 4563 road accidents where complete information BPA 11.84% 30.1% 54.46% 68.73% 83.98%
about the vehicles and their properties have been revealed. BPI 7.01% 20.57% 42.87% 58.19% 76.2%
We developed a Java-based simulation environment that
can represent the accidents that are of interest from the Table 4: Average privacy loss results when the privacy threshold is
dataset. In our work, we have focused on accidents that have set to different values
all the properties reported for the vehicles. The dataset is
split into databases and collections, which are stored in Mon- In Table 4, we report the average privacy loss results of
goDB1 . Our developed system can represent agents with var- 4563 road accidents from the dataset. We observe that Bid-
ious settings and test different auction strategies to see how
2
https://github.com/PrivacyInInternetOfThings/
1
https://www.mongodb.com/ AuctionBasedTraffic
100
100
PL1 PL1
PL2 PL2
80
80
AvgPL AvgPL
% Privacy Loss
% Privacy Loss
60
60
40
40
20
20
0
0
0.3 {0.5, 0.7, 0.8} 0.9 0.3 {0.5, 0.7, 0.8} 0.9
Privacy Threshold Privacy Threshold
(a) Bid-Privacy-Aware (BPA) (b) Bid-Privacy-Incremental (BPI)
Figure 2: The Privacy Loss of the Vehicles in Accident Number 2015331500103 with different strategies and privacy thresholds. The privacy
loss of Vehicle 1, Vehicle 2 and their average are denoted as PL1, PL2 and AvgPL, respectively.
Privacy-Incremental strategy helps the vehicles to preserve even to large networks. Both approaches show that by agent-
their privacy more in every case. When the vehicles prefer a based signaling, the total amount of time that vehicles stop
low privacy threshold value (i.e., the vehicles are conserva- is reduced significantly. While the main idea of those ap-
tive about privacy), their privacy is preserved more. For ex- proaches is to reduce overall traffic, our focus here is to en-
ample, when the privacy threshold is 0.3, the average privacy able urgent vehicles to express their situation and take prior-
loss is only about 7%. The privacy loss increases when the ity. In doing so, we emphasize the fact that agents’ privacy
vehicles decide to share most of their properties to pass first need to be preserved.
at the junction. For example, when the privacy threshold is Intersection management has been studied extensively
0.8, the average privacy loss is 68.73% in Bid-Privacy-Aware from different angles [Lu et al., 2014]. Zohdy, Ka-
strategy. The vehicles can preserve their privacy better by malanathsharma, and Rakha develop a tool called iCACC
using Bid-Privacy-Incremental strategy. In that case, the pri- to regulate and optimize autonomous vehicles through inter-
vacy loss becomes 58.19%. As a result, vehicles that employ section [Zohdy et al., 2012]. They show that compared to
Bid-Privacy-Incremental strategy achieve the same level of signal control iCACC can minimize delays and fuel usage.
success at passing at intersections, while they enjoy a higher Miculescu and Karaman propose a polling-systems-based al-
level of privacy. gorithm for autonomous vehicles to adjust their speeds when
they arrive in a traffic intersection [Miculescu and Karaman,
5 Related Work 2016]. They show that no accidents happen when the road
length is above certain threshold. In our model, an inter-
Agent-based approaches have been used to study traffic flow. section manager collects information provided by the vehi-
Through multiagent simulations, the effect of traffic jams or cles to compute their priority values; accordingly, it coordi-
speed limits have been studied. Doniec et al. [Doniec et al., nates the traffic. Dresner and Stone propose a mechanism
2008] develop a multiagent model to study the traffic flow for coordinating autonomous vehicles at intersections based
at intersections. They represent the behavior of drivers with on information such as time of arrival and vehicle character-
rules, with an emphasis on capturing an opportunistic behav- istics [Dresner and Stone, 2008]. Similarly, they use an in-
ior, where drivers may prefer to violate norms. Their evalu- tersection manager that grants or rejects the requests of the
ation shows that their proposed behavior models capture real vehicles and give priority to emergency vehicles such as am-
life traffic flow better. In our approach, we facilitate the coor- bulances. However, in our model, we assume that each ve-
dination of agents based on their particular context and infor- hicle can communicate with the intersection manager private
mation, which might be private. Our coordination mechanism information. Another well-known work on intersection man-
preserves the privacy of the vehicles as much as possible. agement is that of Virtual Traffic Lights [Ferreira et al., 2010],
An alternative approach to coordinating traffic is to de- where the vehicles that approach an intersection first choose a
sign intelligent traffic signaling. Choy et al. [Choy et al., leader, who then creates a virtual signal using predefined rules
2003] represent the signaling as a multiagent system, where based on the observable data that the vehicles communicate
each agent is responsible for controlling an intersection. Each such as their speed and location. However, in our approach,
agent employs a fuzzy-neural decision making module to in- we also consider the sensitive information of the passengers
fluence the traffic policy. The agents learn over time how in the vehicle as well. Hence, we want to consider the par-
they should produce the policies. They evaluate their ap- ticular situation in the vehicle (e.g., a patient in the vehicle).
proach on a large traffic network. On a similar line, Abdoos While all discussed approaches are important, they do not ex-
et al. [Abdoos et al., 2014] develop an approach where traf- plicitly consider the privacy of the autonomous vehicles.
fic signals are controlled hierarchically by agents that employ Some approaches focus on using auctions to solve trans-
Q-learning. Using tile coding, the approach is made to scale portation problems in a multiagent setting. Seshadri et al. al-
leviate the traffic congestion and propose a multiagent system to the ambulance being the group leader. It would be interest-
for reducing the node pressure [Seshadri et al., 2017]. They ing to extend our approach to handle such cases and study it
introduce a multi-unit combinatorial auctioning system to al- on the Road Safety Data dataset to measure its applicability
locate the resources and re-route the vehicle agents. Each ve- and effect on possible delays.
hicle submits a bid, which is a binary vector, to change its cur- Another important extension would be adding a seman-
rent path if it wins the auction. In our work, a bid is not a nu- tic layer to the auctions. Currently, each agent views vari-
meric value but it consists of piece(s) of information. Accord- ous dimensions of the information as private with a certain
ing to the internal reasoning of the agent, the agent decides to weight and acts accordingly. However, it is important to
reveal some of its properties. The IM agent is the one that be able to capture what the privacy constraints of the vehi-
gives a value to the bids (i.e., pieces of information received cles are semantically so that at different situations, the agents
from other agents), and makes a decision about which vehi- can assign the privacy values based on environment, context,
cle gets the priority, according to its decision-making mech- and other available information [Kökciyan and Yolum, 2016;
anism. Ito et al. propose a multiagent setting for common Kökciyan and Yolum, 2017]. This would require the agent to
value auctions [Ito et al., 2000]. Each agent is trying to pre- make inferences and decide based on that.
dict an approximate market value of an item to avoid the win- For our proposed approach to be applied in real life, many
ner’s curse. Gerding et al. consider a market where the seller underlying technologies need to be in place. For example, we
employs a single second-price auction [Gerding et al., 2008]. assume that each vehicle reports its bids to the IM and thus
Two types of bidders are involved in an auction. A global IM is the only entity with this information. However, if at
bidder can bid in multiple auctions; whereas, a local bidder is the time of sharing, used communication technology results
only allowed to bid only in a single auction. In this work, the in the information to reach third parties, there would be a vi-
goal is to find the optimal bid (which is the value of an item) olation of privacy. It would be interesting to use a test-bed
under various settings. environment to realize the approach on actual vehicles using
existing communication technologies.
6 Future Directions
Acknowledgments
Intersections can be managed effectively and safely when ve-
hicles can inform others about their situation. However, en- This work was partially supported under grant by the UK En-
suring the privacy of the entities are of utmost importance. gineering & Physical Sciences Research Council (EPSRC)
We show that privacy-preserving bidding strategies can both under grant #EP/P010105/1.
help vehicles preserve their privacy while enabling intersec-
tions to be managed dynamically. References
This work opens up interesting directions for research. [Abdoos et al., 2014] Monireh Abdoos, Nasser Mozayani,
Here, we ran our experiments for specific settings. There are and Ana LC Bazzan. Hierarchical control of traffic signals
more settings that we would like to work on as part of our using q-learning with tile coding. Applied intelligence,
future work. For example, what would happen if each agent 40(2):201–213, 2014.
employs a different strategy when they meet at a junction? [Atherton, 2016] Kelsey D. Atherton. The de-
Or, would it be possible for them to collaborate independently
partment of transportation wants to make cars
to abuse the system? Or, how our proposed strategies would
talk. https://www.popsci.com/department-
work if more than two vehicles meet at a junction? Or, how an
transportation-wants-to-make-cars-talk,
agent can choose a privacy threshold automatically according
2016. last accessed 11/04/2018.
to its previous auction results, the variables of its environ-
ment? In other words, a vehicle can learn how to bid better to [Bazzan and Klugl, 2014] Ana L. C. Bazzan and Franziska
win the auctions by preserving its privacy at the same time. Klugl. A review on agent-based technology for traffic
In some cases, vehicles would need to move in groups (i.e., and transportation. The Knowledge Engineering Review,
vehicle platoons) for various reasons; e.g., people in the vehi- 29(3):375–403, 2014.
cles would be traveling together. This would require groups [Carlino et al., 2013] Dustin Carlino, Stephen D Boyles, and
to go into auctions, rather than the individual vehicles as we Peter Stone. Auction-based autonomous intersection man-
have shown above. However, different vehicles in the group agement. In 16th International IEEE Conference on Intel-
could have different privacy concerns that might not have ligent Transportation Systems, pages 529–534, 2013.
been revealed even to the other vehicles in the group, requir-
[Chen and Cheng, 2010] B. Chen and H. H. Cheng. A re-
ing extended mechanisms to be in place. As a motivating ex-
ample, consider this case: A vehicle v does not want to reveal view of the applications of agent technology in traffic and
any of its properties because it wants to preserve its privacy. transportation systems. IEEE Transactions on Intelligent
Such a vehicle would lose all of the auctions since the other Transportation Systems, 11(2):485–497, 2010.
vehicles would be winners by just sharing at least one prop- [Choy et al., 2003] Min Chee Choy, Dipti Srinivasan, and
erty. Now assume that the vehicle v is part of a group of Ruey Long Cheu. Cooperative, hybrid agent architecture
vehicles and it is ahead of an ambulance, which has a high for real-time traffic signal control. IEEE Transactions on
chance of getting priority at a junction. In such a case, v Systems, Man, and Cybernetics-Part A: systems and hu-
could pass first without revealing any of its properties thanks mans, 33(5):597–607, 2003.
[Crew, 2015] Bec Crew. Driverless cars could re- pressure and auctions. In Intelligent Transportation Sys-
duce traffic fatalities by up to 90report. https: tems (ITSC), 2017 IEEE 20th International Conference on,
//www.sciencealert.com/driverless-cars- pages 1–7. IEEE, 2017.
could-reduce-traffic-fatalities-by-up-to- [The UK Government, 2016] The UK Government. Road
90-says-report, 2015. last accessed 11/04/2018. safety data. https://data.gov.uk/dataset/road-
[Doniec et al., 2008] Arnaud Doniec, René Mandiau, Syl- accidents-safety-data, 2016. last accessed
vain Piechowiak, and Stéphane Espié. A behavioral multi- 11/04/2018.
agent model for road traffic simulation. Engineering [Weiss, 1999] Gerhard Weiss, editor. Multiagent Systems:
Applications of Artificial Intelligence, 21(8):1443–1454, A Modern Approach to Distributed Artificial Intelligence.
2008. MIT Press, Cambridge, MA, USA, 1999.
[Dresner and Stone, 2008] Kurt Dresner and Peter Stone. A [Zohdy et al., 2012] I. H. Zohdy, R. K. Kamalanathsharma,
multiagent approach to autonomous intersection manage- and H. Rakha. Intersection management for autonomous
ment. Journal of artificial intelligence research, 31:591– vehicles using iCACC. In IEEE Conference on Intelligent
656, 2008. Transportation Systems, pages 1109–1114, 2012.
[Ferreira et al., 2010] Michel Ferreira, Ricardo Fernandes,
Hugo Conceição, Wantanee Viriyasitavat, and Ozan K
Tonguz. Self-organized traffic control. In Proceedings of
the seventh ACM international workshop on VehiculAr In-
terNETworking, pages 85–90. ACM, 2010.
[Gerding et al., 2008] Enrico H. Gerding, Rajdeep K. Dash,
Andrew Byde, and Nicholas R. Jennings. Optimal strate-
gies for bidding agents participating in simultaneous vick-
rey auctions with perfect substitutes. Journal of Artificial
Intelligence Research, 32(1):939–982, 2008.
[Ito et al., 2000] T. Ito, N. Fukuta, T. Shintani, and
K. Sycara. BiddingBot: a multiagent support system for
cooperative bidding in multiple auctions. In Proceedings
Fourth International Conference on MultiAgent Systems,
pages 399–400, 2000.
[Kökciyan and Yolum, 2016] Nadin Kökciyan and Pınar
Yolum. Priguard: A semantic approach to detect privacy
violations in online social networks. IEEE Transactions
on Knowledge and Data Engineering, 28(10):2724–2737,
2016.
[Kökciyan and Yolum, 2017] Nadin Kökciyan and Pınar
Yolum. Context-based reasoning on privacy in internet
of things. In Proceedings of the Twenty-Sixth Interna-
tional Joint Conference on Artificial Intelligence, IJCAI-
17, pages 4738–4744, 2017.
[Lu et al., 2014] N. Lu, N. Cheng, N. Zhang, X. Shen, and
J. W. Mark. Connected vehicles: Solutions and challenges.
IEEE Internet of Things Journal, 1(4):289–299, 2014.
[Miculescu and Karaman, 2016] David Miculescu and Ser-
tac Karaman. Polling-systems-based autonomous vehicle
coordination in traffic intersections with no traffic signals.
CoRR, abs/1607.07896, 2016.
[National Safety Council, 2016] National Safety Council.
2017 estimates show vehicle fatalities topped 40,000 for
second straight year. https://www.nsc.org/road-
safety/safety-topics/fatality-estimates,
2016. last accessed 11/04/2018.
[Seshadri et al., 2017] Madhavan Seshadri, Zhiguang Cao,
Hongliang Guo, Jie Zhang, and Ulrich Fastenrath.
Multiagent-based cooperative vehicle routing using node