PaperlayerView exact revision on arXiv

Source-linked AI summary

$Z^2$-ACT: End-to-End Verifiable Agentic Intent Control for Open 6G RAN

Sunder Ali Khowaja, Kapal Dev, George C. Alexandropoulos

arXiv:2608.21049v1cs.CRcs.AIcs.NI

TL;DR

Open, disaggregated 6G O-RAN needs safe, verifiable, and auditable AI-assisted control for concurrent intents and untrusted inputs, but existing mechanisms remain fragmented. Z2-ACT composes four primitives across non-real-time and near-real-time RICs, and reports improved service behavior and attack resilience at modest in-envelope latency and signaling cost.

  • Problem

    Existing studies address agentic coordination, formal intent constraints, zero-trust verification, and cryptographic accountability in isolation rather than as one end-to-end intent-to-realization chain.

  • Method

    Z2-ACT integrates typed Intent Contracts, adversarial-intent verification, self-management-gated skill sequencing, and commitment-bound zero-knowledge audit across the non-real-time and near-real-time RICs.

  • Results

    Z2-ACT improves service-level behavior and attack resilience over ablations and a conventional RL baseline, while its latency and signaling cost remain inside the Near-RT timing envelope.

  • Takeaways & Limitations

    The full composition provides a unified architecture for safe, verifiable, and auditable multi-vendor AI-assisted O-RAN control without modifying standard E2 or O1 interfaces.

  • Takeaways & Limitations

    The evaluation is trace-driven, emulates multi-vendor behavior, uses a constructed adversarial-prompt catalogue, and varies one threshold at a time.

Abstract

from arXiv · show

With the progression in open and disaggregated 6G radio access networks, it is expected that the system will be able to host multi-vendors. In order to host multi-vendors, it is essential that AI-assisted control loops remain safe, verifiable, and auditable under concurrent operator intents and untrusted model inputs. The existing studies address the agentic coordination, formal intent constraints, zero-trust prompt verification and cryptographic accountability in isolation, which leaves pre-realization safety, continuous semantic verification and cross-domain audit incomplete when used individually. In this regard, we propose zero-knowledge auditable control and zero-trust verifiable agentic intent architecture ($Z^2$-ACT), which integrates the aforementioned four primitives across the non-real-time and near-real-time RICs. We encode the typed Intent Contracts as operator goals while the large language model inputs are only admitted after a practical adversarial intent check. The skill sequences in the proposed study are released only when a self-management gate is satisfied while every successful commit is recorded as a binding commitment with a zero-knowledge proof. Our experimental evaluation on public ColO-RAN measurements compares the full architecture against targeted ablations and a conventional reinforcement-learning baseline. A live large language model is used in the non-real-time path to translate operator intents into Intent Contracts; we report translation accuracy, the rate of invalid or hallucinated contracts, non-real-time latency, and behavior under adversarial or misleading intents. Near-real-time control remains trace-driven on the public KPM sequences. Results indicate improved actuation filtering and attack resilience at modest latency and signaling cost inside the near-real-time envelope.

I. INTRODUCTION

Open, disaggregated O-RAN enables multi-vendor innovation but introduces unsafe interactions among agentic controllers and untrusted intents. Z2-ACT addresses the resulting gap by chaining four verification and accountability primitives from operator intent to audited realization.

  • Open, disaggregated O-RAN separates software and hardware, standardizes interfaces, and opens the control plane to multi-vendor applications.
  • Agentic controllers increase control-plane failure risks because they replace isolated decision-makers while handling concurrent policies, slice configurations, and radio resources.
  • Existing approaches address agentic coordination, intent contracts, zero-trust verification, or zero-knowledge accountability separately without providing one intent-to-realization path.
  • The study evaluates whether composing four primitives can provide pre-realization safety, adversarial-intent checking, multi-vendor conflict handling, and cross-domain auditability under real-time constraints.
  • Z2-ACT unifies contract-governed intent translation, zero-trust verification, agentic skill sequencing, and commitment-bound zero-knowledge audit across O-RAN control layers.

II. FUNDAMENTALS OF AGENTIC CONTROL IN O-RAN

Agentic O-RAN control uses goal-driven, multi-timescale planning and bounded skills rather than fixed state-to-action mappings. Its benefits require additional mechanisms to validate intents, manage conflicts, verify inputs, and preserve cryptographic provenance.

  • Agentic O-RAN controllers decompose goals into action sequences, observe outcomes, and update states across multiple time scales.
  • The agentic-control building blocks include plan-act-observe-reflect cycles, bounded tool-use skills, multi-horizon memory and evidence, and self-management gates.
  • Non-real-time agents interpret intents and produce structured plans, while near-real-time agents execute shorter skill sequences and assess plan validity under latency budgets.
  • Agentic control still requires external validation, conflict handling, prompt-injection protection, and cryptographically verifiable provenance across administrative domains.
  • Intent Contracts: Intent contracts formally encode operator goals and constraints such as resource ceilings, temporal scope, throughput or latency bounds, slice identifiers, and permitted skills.
  • Intent Contracts: Intent contracts validate individual intents but do not independently detect or resolve overlapping-resource conflicts among concurrent contracts from different vendors.

B. Zero-Trust Prompting

Z2-ACT places zero-trust verification within a unified architecture that connects operator intents, agentic control, skill release, and auditable realization across RIC layers.

  • B. Zero-Trust Prompting: The near-real-time verifier treats every LLM-bound input that can influence skill sequencing as potentially adversarial.LLM reasoning for translating operator intent into Intent Contracts remains confined to the non-real-time RIC.
  • B. Zero-Trust Prompting: Prompts are decomposed into imperative actions and descriptive measurements or topologies before an adversarial-intent score is computed.Inputs are forwarded only when they pass the calibrated threshold; otherwise they are blocked or sanitized.
  • B. Zero-Trust Prompting: A lightweight xApp implements zero-trust prompting inside the near-real-time control budget without executing a large model there.Prior open-testbed studies are cited as reporting high detection accuracy under O-RAN latency requirements.
  • C. Zero-Knowledge Accountability: Zero-knowledge accountability creates commitments and proofs for cross-domain audit without exposing key-performance measurements or model internals.The evidence and trust plane is separated from real-time control so cryptographic processing does not affect near-real-time latency.
  • IV. Z2-ACT ARCHITECTURE: The architecture combines agentic multi-timescale control, intent contracts, zero-trust prompting, and zero-knowledge accountability in one layer.The integration is intended to provide pre-realization safety, continuous adversarial-intent checking, multi-vendor conflict handling, and cross-domain auditability.
  • IV. Z2-ACT ARCHITECTURE: At the non-real-time RIC or SMO layer, a dual-agent pipeline translates natural-language operator intent into the formal contract IC = (G, R, S, T, A).The contract contains goal predicates, hard resource ceilings, spatial scope, temporal validity, and authorized skills.
  • IV. Z2-ACT ARCHITECTURE: The near-real-time verifier passes input only when α(P) ≤ θ, after which a self-management gate evaluates release conditions before E2 dispatch.Successful commits are asynchronously accompanied by a cryptographic commitment and zero-knowledge proof stored in a content-addressable repository.

A. System Model and Formulation

The formulation models operator goals as machine-checkable Intent Contracts and admits finite skill sequences only after contract, zero-trust, and gate checks.

  • System model: The controller observes a network state vector s_i at each fixed near-real-time decision epoch.The state includes key-performance measurements arriving over the E2 interface.
  • Intent Contract: The dual-agent non-real-time pipeline maps operator input and network state, (I, s_i), to a machine-checkable Intent Contract.The contract is written as IC = (G, R, S, T, A).
  • Intent Contract: Intent Contracts contain goal predicates G, hard resource ceilings R, spatial scope S, validity interval T, and authorized skill catalogue A.A contract is rejected when no tuple satisfies the live RAN configuration.
  • Admissibility: A decision d_i is an ordered skill sequence whose resulting state must satisfy goals, resource ceilings, spatial scope, and temporal validity.Each skill maps the current state through its parameter set.
  • Admissibility: Contract admissibility is declarative for (d_i, IC) and does not yet incorporate timing, uncertainty, or concurrent load.The self-management gate addresses additional runtime quantities beyond declarative admissibility.
  • Zero-trust admission: LLM-derived inputs undergo zero-trust checking before admissibility evaluation, and only inputs with α(P) ≤ θ reach the skill sequencer.The verifier separates descriptive telemetry or topology from imperative requested actions; α(P) is an idealized detection score, not a claimed calibrated probability.
  • Gate feasibility: The gate defines a feasible region over six runtime quantities and admits a decision only when it lies inside that region.The active threshold vector is Θ = (θ, α, β, γ, τ, S, R), and the release predicate governs realization.
  • Audit and latency: A successful release produces a Pedersen commitment and zero-knowledge proof, while near-real-time latency sums verifier, gate, and E2 dispatch times.The cryptographic evidence path is separate from the control latency, and the latency components are directly measured on the target platform.

B. Invariants and Derived Properties

The architecture derives realization and audit invariants under explicit soundness, enforcement, and cryptographic assumptions, while using priority and scope locks for concurrent contracts.

  • Assumptions: The stated invariants rely on sound contract translation, adequate α(P) performance, correct gate enforcement, and valid commitment and proof properties.These are external assumptions rather than results established independently by the formulation.
  • Release invariant: A skill sequence reaches the E2 interface only when Release(d_i, IC) returns True.Sequences violating the contract, failing zero-trust admission, or lying outside the gate region are not applied to the RAN.
  • Audit invariant: Proof verification implies the existence of a decision-evidence pair satisfying the release predicate at release time.Verification does not reveal the decision or evidence digest, allowing stakeholders to check correctness without recovering raw measurements.
  • Conflict handling: Concurrent contracts are prioritized by safety and compliance, then service-level recovery, then efficiency-oriented objectives.When scopes overlap, a scope lock is used so the lower-priority contract is considered after the higher-priority one.

C. Provisioning policies

Provisioning policies adapt thresholds, filter unreliable memory entries, and keep commitment processing asynchronous relative to near-real-time control.

  • Adaptive thresholds: Threshold vector Θ is tightened when uncertainty or resource-budget usage remains above a hysteresis band for dwell time W_d.Each component is adjusted by a fixed step under the stated runtime rule.
  • Memory provisioning: A decision enters long-term memory only when observed and predicted key-performance measurements are within tolerance ε_KP.Entries beyond ε_KP are discarded automatically, while nearest-neighbour retrieval grows logarithmically with stored entries.
  • Audit provisioning: Pedersen commitments and Groth16 proofs are generated asynchronously at the non-real-time cadence.Their processing time is excluded from near-real-time latency, preserving the bound L_i ≤ L_max.

V. EVALUATION SETUP

The evaluation measures Z2-ACT under realistic multi-cell, multi-slice O-RAN conditions using publicly available data and deliberately trace-driven, open-loop settings.

  • The evaluation measures Z2-ACT under realistic multi-cell, multi-slice O-RAN conditions using publicly available data.
  • Recorded ColO-RAN state vectors are replayed in order, so each control decision does not modify subsequent states.

A. Datasets and Trace Preparation

The study uses public ColO-RAN traces, prepared intents, and adversarial telemetry prompts to evaluate contract generation, verification, gating, and multi-vendor conflict handling.

  • The ColO-RAN dataset provides per-cell and per-slice throughput, latency, physical-resource-block usage, and related counters for mixed traffic.
  • Each operator intent is paired with the observed state when the intent is assumed to arrive.
  • A live language model proposes contract fields, while deterministic schema and feasibility checks accept, repair, or reject proposals.
  • The evaluator rejects contracts that invent catalogue entities or contradict hard constraints in the observed state.
  • Near-real-time control receives accepted contracts and A1 plans, then applies zero-trust admission, gating, scope locks, and zero-knowledge evidence during trace replay.
  • Synthetic vendors generate potentially intersecting decisions, while harmful instructions are embedded in otherwise normal telemetry and tested with and without verification.
  • The evaluation compares complete Z2-ACT with No-Contract, No-ZT, and other configurations across SLA satisfaction, attack mitigation, audit verification, latency, signaling, and resource usage.

D. Implementation

The implementation combines Python trace replay and control logic with a non-real-time Llama 2 7B translation stage, while experiments use public trace-driven episodes.

  • Python implements trace replay and Z2-ACT control logic, including pure-function gating and priority/scope-lock logic.
  • Non-real-time intent-to-contract translation uses Llama 2 7B with 4-bit quantization, followed by deterministic evaluator and schema checks.
  • The experiments report Z2-ACT results on traces driven from a publicly available dataset and compare configurations on identical episodes and intents.

A. Quantitative Comparison and Ablation Study

Across ablations and a conventional reinforcement-learning baseline, Z2-ACT improves service quality and attack mitigation, while its near-real-time latency remains within the timing envelope at limited overhead.

  • Removing contracts, zero-trust verification, or the self-management gate reduces SLA satisfaction, while the RL baseline yields the lowest score.
  • 0.78 translation accuracy and 0.18 invalid or hallucinated output rate are reported for the non-real-time LLM stage.
  • 0.018 seconds mean latency, 0.030 seconds 95th-percentile latency, and 0.99 of epochs within the bound are reported for Z2-ACT.
  • Removing the verifier lowers mean latency to 0.010 seconds and the 95th percentile to 0.016 seconds, showing the verifier and gate dominate latency.
  • The added overhead is limited and does not offset the reported safety benefits.

D. Auditability and Multi-vendor Conflict Resolution

Z2-ACT combines commitment-bound zero-knowledge audit with priority-based scope locking to verify realized decisions and manage concurrent multi-vendor conflicts. Ablations and the RL baseline show weaker overlap resolution and release-predicate validity.

  • Auditability: Z2-ACT evaluates auditability and multi-vendor behavior using commitments, zero-knowledge proofs, and episodes with intersecting vendor scopes.The evaluation records proof-condition satisfaction and counts overlapping spatial proposals across synthetic vendors.
  • Conflict resolution: 0.62 of overlaps were resolved by the intended rule in No-Contract, while the release predicate remained well-defined in 0.82 of overlapping episodes.
  • Conflict resolution: 0.68 of overlaps were resolved by the intended rule in No-Gate, while the release predicate remained well-defined in 0.78 of overlapping episodes.Disabling the gate removes rate, scope, and risk limits on concurrent commits.
  • Conflict resolution: 0.94 of overlaps were resolved by the intended rule in No-ZT, while the release predicate remained well-defined in 0.96 of overlapping episodes.No-ZT produced results closer to Z2-ACT than the other reported ablations.
  • Integrity checks: Tampered commitments or proofs and replayed proofs with mismatched epoch indices or contract hashes must be rejected, returning verification 0.The checks use the binding commitment and SNARK against public inputs H(IC) and i.
  • Sensitivity analysis: Restricting threshold coordinates increases actuation filtering or reduces admitted commits while the Near-RT bound remains satisfied in the reported sensitivity analysis.For θ, AMR rises from 0.88 to 0.98 while SLA satisfaction declines from 0.92 to 0.88; the Near-RT-bound fraction remains at or above 0.99.

F. Discussion on Trade-offs

Z2-ACT improves safety, attack resilience, and auditability relative to ablations and an RL baseline at modest latency and signaling cost. The evaluation remains trace-driven and open-loop, so released actions do not alter subsequent radio states or reveal counterfactual SLA evolution.

  • Performance trade-offs: Z2-ACT achieves SLA satisfaction 0.91 and AMR 0.95, compared with 0.81 and 0.02 for the RL baseline.Removing the contract, verifier, or gate reduces SLA satisfaction by several points.
  • Performance trade-offs: Z2-ACT records mean Li 0.018 seconds, 95th-percentile Li 0.030 seconds, and 0.99 of epochs inside the Near-RT bound.The reported resource usage remains in the 0.62-0.66 band.
  • Performance trade-offs: The reported safety, attack-resilience, and auditability gains carry modest latency and signaling costs while remaining inside the Near-RT timing constraints.
  • Limitations: The open-loop, trace-driven design prevents released actions from changing subsequent radio states, so SLA differences measure actuation filtering on shared traces rather than counterfactual RAN evolution.The paper proposes live E2 experiments or a validated state-transition model as extensions.
  • Architecture: The architecture composes agentic control, Intent Contracts, zero-trust prompting, and zero-knowledge accountability across non-real-time and near-real-time RICs without modifying E2 or O1 interfaces.
  • Evaluation findings: Evaluation on public ColO-RAN traces with fixed adversarial prompts and emulated multi-vendor behavior shows stronger service-level behavior and attack resilience than ablations and the RL baseline.Audit verification succeeds for every Z2-ACT proof, and priority-based scope locks resolve the majority of spatial conflicts.
  • Limitations: The study emulates multi-vendor behavior, uses a constructed adversarial-prompt catalogue, and varies one threshold at a time.The authors identify interoperability trials and broader adaptive prompt sets as future work.
Loading 2608.21049v1…