PaperlayerView exact revision on arXiv

Source-linked AI summary

Autonomy in Check: Governor-Mediated Adaptive Security at the Edge

Ijaz Ahmad, Ijaz Ahmad, Flavio Esposito, Erkki Harjula

arXiv:2609.18338v1cs.CRcs.AI

TL;DR

Adaptive edge-security planners can issue syntactically valid but semantically unsafe actions when observations are incomplete or manipulated. The paper inserts a deterministic governor between an untrusted planner and eBPF enforcement, checking typed intents against explicit invariants. On a Raspberry Pi 5 5G testbed, admission remained sub-millisecond while protected-flow regularity was preserved and oscillation intents were bounded.

  • Problem

    Adaptive planners may produce semantically unsafe enforcement actions from incomplete or manipulated observations, while the enforcement substrate cannot judge mission context.

  • Method

    The paper uses a split-control architecture in which a deterministic governor mediates typed planner intents against safety, resource, temporal-stability, and proportionality invariants before bounded eBPF enforcement.

  • Results

    Governor decisions remained below 130 µs at p99 across nominal and attack scenarios, while policy oscillation led to rejection of 49.7% of injected intents and protected alarm delivery had p99 cadence excess below 7.3 ms with no sequence gaps.

  • Takeaways & Limitations

    Adaptive planners can retain flexibility without receiving direct authority over enforcement state when actuation is mediated, bounded, and auditable.

  • Takeaways & Limitations

    The prototype uses one Raspberry Pi 5 enforcement node, three endpoints, and a 5G uplink; coordinating governor state across multiple enforcement points remains open.

Abstract

from arXiv · show

Adaptive security at the network edge increasingly relies on automated planners, including rule-based controllers, learned policies, and LLM-assisted agents, that translate observations into enforcement actions. Once such a planner can influence live policy state, syntactic validity is not enough. A semantically wrong action, produced from incomplete or manipulated observations, can be faithfully executed by an enforcement substrate that cannot judge mission context. We address this problem by treating the boundary between planner output and kernel enforcement input as the primary security object. We propose a split-control architecture in which an untrusted planner emits typed security intents, a deterministic governor checks each intent against safety, resource, temporal-stability, and proportionality invariants, and only admitted actions are bound to signed receipts and compiled into pre-installed eBPF map updates. The paper formalizes this trust-boundary problem, defines three threat classes, develops the governor admission predicate, and reports an end-to-end prototype. Across rule-based and LLM-assisted planners on a Raspberry Pi 5 testbed connected to the university 5G Test Network, the governor admits, rejects, and bounds intents at microsecond cost without disrupting protected-flow regularity. The contribution is conceptual as much as empirical: adaptive security does not need to trust the author of an action. It needs a mediation boundary that decides whether the action is admissible.

I. INTRODUCTION

Adaptive security planners expand the attack surface because syntactically valid actions can still be semantically unsafe. The paper places a deterministic governor between untrusted planning and enforcement to admit only bounded, auditable actions.

  • I. INTRODUCTION: Adaptive security mechanisms turn the adaptation process itself into an attack surface when automated planners translate observations into enforcement actions.The planners include rule-based, learning-based, and LLM-assisted controllers.
  • I. INTRODUCTION: Manipulated or incomplete observations can cause planners to throttle protected traffic, under-react to attacks, or oscillate between enforcement states.The enforcement substrate faithfully executes the resulting action without judging mission context.
  • I. INTRODUCTION: A split-control architecture lets an untrusted planner emit typed intents while a deterministic governor checks safety, resource, temporal-stability, and proportionality invariants.Only admitted intents proceed to enforcement.
  • I. INTRODUCTION: The paper treats the planner–enforcement boundary as the primary security object and defines context manipulation, policy oscillation, and residual-window exploitation as interface threats.This reframes adaptive edge security as a trust-boundary problem.
  • I. INTRODUCTION: Admitted intents receive HMAC-protected receipts and are compiled into bounded updates over pre-installed enforcement state, with approved actions recorded in an append-only audit log.The planner and a compromised compiler cannot synthesize new policy logic.
  • I. INTRODUCTION: The prototype evaluates rule-based and LLM-assisted planners on a Raspberry Pi 5 connected to the University’s 5G Test Network against static and no-governor baselines.The evaluation covers the three threat classes and measures governor overhead.

II. RELATED WORK

Prior work enables closed-loop control, programmable enforcement, open control ecosystems, AI-driven security, and runtime safety. The paper identifies their shared gap: well-formed planner output is often trusted despite possible semantic unsafety.

  • II. RELATED WORK: Closed-loop and intent-based frameworks automate observe–decide–actuate processes and refine desired outcomes into device-level actions, often assuming a trusted intent source.These foundations support adaptive control across networking and edge-cloud systems.
  • II. RELATED WORK: eBPF provides verifier-checked, low-overhead observability and enforcement, but efficient and well-typed actuation does not establish semantic safety.The enforcement substrate cannot determine whether an update fits the current mission context.
  • II. RELATED WORK: O-RAN and agentic-AI ecosystems increase the importance of mediating planner outputs because open control functions can influence operational state and may be compromised.The concern applies to near-real-time and non-real-time control loops.
  • II. RELATED WORK: Runtime policy mediation, reference monitors, runtime verification, and shielding provide conceptual anchors, but the proposed governor mediates typed intents before they modify live enforcement state.The planner remains outside the trusted computing base, while the governor evaluates Γ over deployment-specific invariants.
  • II. RELATED WORK: The identified gap is that a syntactically valid action can still delay protected traffic, weaken containment, or drive unstable policy changes.The paper therefore separates planning from actuation: the planner proposes, the governor mediates, and eBPF enforces admitted actions.

A. Deployment Context and System Model

The system models a mixed-criticality 5G edge network in which an untrusted planner proposes typed actions and a trusted governor independently decides whether they may affect enforcement state. Three threat classes target this boundary through manipulated context, oscillation, and residual windows.

  • A. Deployment Context and System Model: The target network carries urgent and routine flows across local-edge, MEC, and cloud tiers, with actions ranging from monitoring and rate limiting to escalation or isolation.Urgent flows are delay-sensitive, while routine traffic tolerates more inspection or queuing delay.
  • A. Deployment Context and System Model: The planner proposes a typed security intent and execution tier, the governor checks mission and resource constraints, and a compiler applies approved intents as bounded eBPF updates.The planner may be rule-based, learned, or agentic, but cannot directly modify enforcement state.
  • A. Deployment Context and System Model: The adversary can manipulate telemetry or context, compromise a non-critical endpoint, or inject malicious traffic, producing three interface threats.These capabilities are summarized as context manipulation, policy oscillation, and residual-window exploitation.
  • A. Deployment Context and System Model: The governor’s state includes traffic observations, criticality labels, resource headroom, queue and path state, recent policy history, mission indicators, and an uncertainty signal.The uncertainty signal derives from measurement freshness and cross-source consistency.
  • A. Deployment Context and System Model: The safe action set is computed by the governor rather than the planner, using deployment-specific bounds such as protected-flow service, resource utilization, cooldown, and reserve constraints.A planner can emit a typed intent while the governor independently determines whether it is safe under the actual state.

IV. GOVERNOR-CENTERED DESIGN

The governor bounds planner authority by accepting only a fixed vocabulary of typed security intents. Explicitly named high-impact actions let it apply proportionality checks independently of how intents were generated.

  • A. Bounded Intent Vocabulary: A fixed typed vocabulary replaces free-form policy expressions and arbitrary kernel operations as the planner’s available actuation interface.The vocabulary includes passive observation, bounded rate control, tier escalation, non-critical isolation, human-approval requests, and rollback.
  • A. Bounded Intent Vocabulary: Explicitly naming high-impact actions allows the governor to apply proportionality checks independently of planner intent.This makes action impact visible at the admission boundary.

B. Admission Predicate

The governor admits an intent only when five invariants jointly hold, filtering syntactic, flow-safety, resource, temporal-stability, and proportionality risks before enforcement.

  • B. Admission Predicate: Five conjunctive invariants define admission: syntactic validity, flow safety, resource bounds, temporal stability, and proportionality.The safe action set contains exactly the intents for which Γ(at, xt) = 1.
  • B. Admission Predicate: Syntactic validity is necessary but insufficient because the remaining invariants assess semantic correctness and operational safety.
  • B. Admission Predicate: Restrictive actions cannot affect critical flows without an explicit policy exemption, preventing unauthorized throttling or isolation.
  • B. Admission Predicate: An admitted action must leave sufficient bandwidth headroom for protected services.This resource invariant is expressed as headroom(rt, at) ≥ rmin.
  • B. Admission Predicate: Cooldown enforcement bounds policy oscillation above by 1/∆min, even when an adversary proposes changes faster than that rate.Rejected intents identify the failed invariant and may include a lower-impact alternative for replanning.
  • B. Admission Predicate: As uncertainty rises, proportionality contracts toward lower-impact responses such as monitoring, reapproval, or rollback.

C. Integrity Path to Kernel Enforcement

Approved intents follow an integrity path in which the governor creates a signed record and a privileged compiler verifies it before bounded kernel updates.

  • C. Integrity Path to Kernel Enforcement: The governor emits a signed approval record rather than writing enforcement maps directly.
  • C. Integrity Path to Kernel Enforcement: A privileged compiler verifies the receipt HMAC, translates the intent into bounded kernel operations, and appends the receipt to the audit log.The compiler alone holds eBPF map descriptors and the relevant Linux capabilities.

D. Proposed Split-Control Architecture

The proposed architecture confines autonomy to planning while a trusted pipeline connects observation, governance, receipt-checked compilation, and eBPF enforcement across the edge testbed.

  • D. Proposed Split-Control Architecture: Autonomy is confined to planning, while live actuation authority remains within the trusted base.The architecture uses pre-compiled, pre-verified eBPF programs whose telemetry feeds the user-space state builder.
  • D. Proposed Split-Control Architecture: The planner proposes typed intents, but only the governor admits them; approved actions become bounded eBPF map updates and rejected actions return typed replanning feedback.
  • D. Proposed Split-Control Architecture: The Raspberry Pi 5 testbed connects ESP32 endpoints over wlan0 and reaches the university 5G core through wwan0.The RPi 5 runs the state builder, governor, and planner, with eBPF hooks on wlan0.
  • D. Proposed Split-Control Architecture: Protected alarm traffic uses 20-byte UDP datagrams at 10 Hz, while routine telemetry uses 1 kB bursts at 1 Hz.
  • D. Proposed Split-Control Architecture: Protected-flow service is evaluated from receiver-side cadence because cross-device clock drift invalidated some one-way latency samples.

B. Adversarial Workloads

The evaluation tests the governor under context manipulation, policy oscillation, and residual-window exploitation, comparing governed and ungoverned configurations for safety, cadence, and overhead. Results show that admission control bounds unsafe actuation while preserving protected-flow regularity at sub-millisecond cost.

  • Attack containment: Under T1, suppressing two alarm sources raised u_t to 0.600, indicating that the uncertainty channel responded to manipulated planner context.This value is not a traffic-latency result; it measures the response to context manipulation.
  • Attack containment: Under T2, I4 rejected 49.7% of injected oscillation intents, while under T3 the residual window averaged 2.616 ms with an admitted burst of 1279.2 B.The residual-window exposure was bounded but not eliminated.
  • Governor overhead: p99 governor decision overhead ranged from 76.24 µs to 129.09 µs across nominal and attack runs, remaining below 1 ms.The result held when planner inputs were stochastic or adversarial.
  • Governance tradeoff across configurations: 86.9% of Rule and 48.0% of LLM attack-induced intents reached enforcement, while nominal p99 cadence excess stayed within a 1.5 ms band across configurations.The ungoverned Rule baseline admitted all planner-emitted intents, whereas governed configurations rejected intents before compilation.
  • Planner abuse robustness: In the nominal LLM run, 13 of 51 structured intents were admitted and 38 were rejected before enforcement, including 19 by I1, five by I2, and 14 by I5.The wrapper logged 473 LLM decisions; 422 were non-actuating outputs converted to do_nothing.
  • Planner abuse robustness: Invariant I3 reserved rmin = 6.4 kbps of protected-class headroom, but it did not activate because measured alarm and routine traffic stayed below that floor.I3 is a structural saturation guardrail, whereas I1, I2, I4, and I5 exercised the evaluated planner-governor boundary.

B. Deployment Implications

Deployment requires tuning governor parameters to balance protected-flow safety against adaptation speed, while recognizing that the prototype remains small-scale and larger coordination is unresolved.

  • The prototype uses ∆min = 5 epochs (500 ms) and rmin = 6.4 kbps, providing a 2× reserve over the nominal protected-alarm rate.
  • A larger ∆min makes oscillation attacks harder but slows benign adaptation, whereas a smaller value improves responsiveness while increasing susceptibility to manipulation.
  • A larger rmin preserves more protected-traffic headroom and tightens admission, while a smaller value increases flexibility at the cost of a weaker safety margin.
  • 149 of 300 injected oscillation intents fail the cooldown check, producing near-50% clipping for fadv = 2/∆min.The cooldown parameter can be selected with the protected-flow period and acceptable adaptation rate in mind.
  • The evaluation uses one Raspberry Pi 5 enforcement node and three endpoints, leaving larger-scale replay, multi-gateway cooldown coordination, and saturation testing for future work.

C. Scope and Implications

The governor can mediate evolving planner types without granting them direct control over critical enforcement state, but the prototype leaves multi-point coordination and post-admission timing as practical boundaries.

  • The prototype evaluates a deliberately small deployment with one Raspberry Pi 5 enforcement node, three endpoints, and a 5G uplink.
  • Coordinating governor state across multiple enforcement points remains an open problem for larger deployments.
  • Rule-based, learned, and LLM-assisted planners can remain outside direct enforcement authority while the same governor controls which intents reach critical network state.
  • Admission control rejects unsafe actions and bounds policy-change frequency, but stricter timing requirements also need faster enforcement activation after approval.

VII. CONCLUSION

The paper treats the planner–enforcement boundary as the primary security object and evaluates a governor that preserves protected-flow regularity while rejecting unsafe or oscillatory intents.

  • The security problem includes unsafe enforcement decisions caused by manipulated observations, not only missed threats.
  • p99 cadence excess stays below 7.3 ms with no sequence gaps across baseline runs, while governor-decision p99 remains below 130 µs across nominal and attack scenarios.
  • The governor rejects 49.7% of injected intents under policy oscillation and rejects 38 of 51 structured intents under nominal LLM planning before enforcement.
  • Adaptive security can retain planner flexibility without granting planners direct authority over critical enforcement state.
Loading 2609.18338v1…