PaperlayerView exact revision on arXiv

Source-linked AI summary

Defense-in-Depth at the Perception-Reasoning Interface of LLM-Centric Agentic UAV Swarms

Mohammadhossein Homaei, Yousef Emami, Sajad Homayoun, Rahim Taheri, Hao Zhou, Miguel Gutierrez Gaitan, Bo Wei

arXiv:2610.03319v1cs.CRcs.MA

TL;DR

Structured sensor-report manipulation can redirect LLM-centric UAV schedulers, while systematic empirical evaluation of interface defenses is limited. This work implements a five-layer defense and derives bounds for input-side manipulation. The full stack limits degradation against two stronger adversaries, while stale-report replacement can worsen cost despite suppressing schedule control.

  • Problem

    Prior work has not systematically evaluated defenses for structured observations supplied to LLM controllers as adversarial capabilities increase.

    Source: D. Research Gap · p. 3

  • Method

    The paper implements five layers spanning report checks, schedule safety, and deterministic fallback, and derives closed-form bounds for input-side manipulation.

    Source: §IV · p. 5, §VII · p. 12

  • Results

    The full stack limits the degradation ratio to 1.02 against the redundancy-aware adversary and 1.08 against the policy-aware adversary.

    Source: §VII · p. 12

  • Takeaways & Limitations

    The results support evaluating attack detection and response separately when designing layered defenses for LLM-assisted UAV control.

    Source: §VII · p. 12

    Only stale-hold repair is tested, so the finding that detection without response is worse than no defense is established for that rule, not detection in general.

    Source: E. Limitations · p. 12

Abstract

from arXiv · show

Large Language Models (LLMs) increasingly support Uncrewed Aerial Vehicle (UAV) swarm operations such as data collection scheduling, where the model reads structured sensor reports and decides which sensors to visit. An adversary who quietly manipulates those reports can redirect the swarm without modifying the model weights or the UAV. Defenses for this interface have been proposed architecturally but rarely implemented or evaluated. We implement and evaluate defense-in-depth at the perception-reasoning interface of LLM-Centric Agentic UAV Swarms. Five layers check the provenance of a report, whether its values are physically admissible, whether they agree with what swarm geometry and service history predict, whether the resulting schedule starves any sensor, and, when these fail, hand control to a deterministic scheduler that ignores the suspect input. We test each layer against an adversary strong enough to defeat the layer before it. For each of the three input-side layers, we derive in closed form how far a report can be distorted before that layer reacts, fixing each boundary from deployment parameters before any attack data is collected; across thirty matched simulation runs, predicted and measured boundaries agree. Separating attack detection from response is a well-established principle, and we quantify the cost of neglecting this distinction at the perception-reasoning interface. When the system rejects a report, it replaces it with the most recent accepted report. This prevents the adversary from controlling the UAV schedule, but it also increases cumulative cost by 79% and 74% for the two detectors, respectively, compared with the undefended system. The safety check does not detect any attacks, but it nevertheless reduces the attack-induced cost by 37.5%.

I. INTRODUCTION

LLM-controlled UAV schedulers can be redirected by plausible manipulations of structured sensor reports, yet prior work has not systematically evaluated layered protection at this interface. This work implements a five-layer defense and tests it against progressively stronger adversaries.

I. INTRODUCTION

  • The five-layer defense checks report provenance and admissibility, cross-modal and queue consistency, schedule safety, and deterministic fallback against persistent rejections.Each layer is tested against an adversary capable of bypassing the preceding layers.Source: §I · p. 1
  • Three closed-form bounds characterize manipulation limits for the input-side layers, placing nominal PMA intensity outside admissible regions and quantifying the remaining window.The contribution also specifies a calibration protocol and paired evaluation with thresholds fixed on seeds separate from evaluation.Source: §I · p. 2

A. LLM-Assisted UAV Autonomy and Swarm Coordination

  • Prior LLM-UAV work covers data-collection scheduling, resource allocation, and multi-UAV coordination, but also identifies vulnerabilities to manipulated task descriptions and observations.ICLDC, FRSICL, RALLY, and LAUS are among the systems discussed.Source: A. LLM-Assisted UAV Autonomy and Swarm… · p. 2

B. Security and Robustness of LLM-Enabled UAV Systems

  • Related security work addresses intrusion detection, privacy, navigation spoofing, and distributed intelligence, but not structured observation manipulation at the LLM controller interface.Source: B. Security and Robustness of… · p. 2

C. LLM-Assisted UAV Scheduling and Security

D. Research Gap

  • Prior work does not systematically evaluate defenses as adversarial capabilities increase; this paper addresses that gap with five computable interface-defense layers.The layers combine provenance and admissibility, cross-modal consistency, queue conservation, schedule checking, and deterministic fallback.Source: D. Research Gap · p. 3

A. Network and Mission Model

The mission model represents UAVs serving stationary sensors over discrete time slots, with predetermined trajectories and sensor reports informing scheduling. Its cost accounts for packet overflow and failed transmission attempts.

A. Network and Mission Model

  • U UAVs serve N stationary ground sensors over T slots, with UAV motion constrained by a maximum displacement per slot.Sensors occupy fixed positions in a square region, and UAVs fly at constant altitude.Source: A. Network and Mission Model · p. 3
  • Predetermined UAV trajectories cover sensors within a service radius, while air-to-ground path loss and link success are modeled from geometry and channel conditions.Reported path loss is evaluated at trajectory waypoints before assignment; link success is evaluated at the UAV position after assignment.Source: A. Network and Mission Model · p. 3
  • The scheduler receives reports of each sensor’s backlog, residual energy, and path loss, while a visit drains packets and queue and energy states evolve over time.Without an adversary, reports equal sensor state up to sensing noise.Source: A. Network and Mission Model · p. 3
  • Mission cost J counts packets dropped through overflow and failed transmission attempts, with backlog dynamics separating service from exogenous arrivals.Realized service is formed at the serving UAV from delivery receipts and reaches the defense over the swarm control link, not the report edge.Source: A. Network and Mission Model · pp. 3–4

B. Agentic Decision Pipeline

The agent pipeline serializes telemetry into a structured observation, assembles a prompt with memory and mission instructions, and turns the model’s assignment into an actuated schedule. Reports are measurements with noise, while the evaluation memoizes outputs to isolate environment randomness.

B. Agentic Decision Pipeline

  • Six modules acquire telemetry, extract and serialize features, assemble the prompt, reason and plan, then validate and actuate the assignment.Defense checks guard observations before M4 and assignments before M6.Source: B. Agentic Decision Pipeline · p. 4, Figure 2 · p. 4
  • The serialized report is a measurement rather than ground truth, with stated path-loss and energy readout noise setting the scale for L2 residuals.At 0.5 dB path-loss noise, the reported cross-modal detection boundary is κdetℓ = 1.024; at 1 dB it is 1.050.Source: B. Agentic Decision Pipeline · p. 4
  • Agentic memory retains a rolling window of past decision records, which also sets the horizon for cumulative energy-residual checks.A one-gauge-quantum drift accumulates across the memory window, whereas the clean cumulative residual compares independent gauge readings.Source: B. Agentic Decision Pipeline · p. 4
  • The paired evaluation memoizes prompt-to-assignment outputs because greedy decoding alone does not prevent batch neighbors from changing outputs on a batched engine.This leaves the seed-indexed environment stream as the only run stochasticity.Source: B. Agentic Decision Pipeline · p. 4

C. Evaluation Metrics

The evaluation distinguishes schedule control from mission cost and models adversaries by their access, keys, knowledge of defenses, and perturbation budget. Its capability ladder progresses from transit manipulation toward attacks constrained by remaining system redundancy.

C. Evaluation Metrics

  • Attack success rate measures slots in which the intended full assignment is actuated, while Γ measures cumulative cost relative to clean undefended cost.A uniform scheduler’s chance level is 1.25 × 10^-4; the reported undefended and defended attack success rates are 0.066 and 0.001, respectively.Source: C. Evaluation Metrics · pp. 4–5

IV. ADVERSARY MODEL: A CAPABILITY LADDER

  • The adversary is modeled by the pipeline elements it can access, key material, known defense layers, and perturbation budget; the physical environment and model parameters remain unchanged.Source: §IV · p. 5
  • The PMA multiplicatively scales selected reported features to promote target sensors and suppress urgent sensors, with LAUS’s configuration using κ = 3.Source: §IV · p. 5
  • The capability ladder progresses from transit interception without a key to a compromised perception node that can authenticate tampered observations.Source: §IV · p. 5
  • Because path loss and energy have independent predictors but backlog does not, the redundancy-aware adversary is restricted to changing backlog while remaining bound by queue conservation.Source: §IV · p. 5
  • The policy-aware adversary keeps assignments within the enforced region and uses backlog and path-loss manipulation within the interval left open by the bounds.It selects the largest per-slot intensity that remains within the assumed threshold and rotates the suppressed sensor it releases.Source: §IV · p. 5

V. DEFENSE-IN-DEPTH ARCHITECTURE

The architecture specifies each defense layer as a computable predicate and evaluates it against adversaries that defeat earlier layers. L1 checks report integrity and physically derived bounds, whose distortion limits are asymmetric.

V. DEFENSE-IN-DEPTH ARCHITECTURE

  • L1–L4 are evaluated against the adversary class that defeats the preceding layer; L4 and L5 bound damage rather than detect attacks.Each layer is specified as a computable predicate, and intensity quantifies the perturbation magnitude.Source: §V · p. 5

A. L1: Integrity Gate

  • The integrity gate combines independent tests that fail against different adversaries, while provenance checks reject stale or already accepted counters even when a tag is valid.Authenticating the payload alone would permit replay; provenance stops A1 but not an adversary that signs legitimately.Source: A. L1: Integrity Gate · p. 5, 1) Provenance · p. 5

2) Physically Derived Admissibility:

  • Physically derived bounds avoid treating legitimate in-schema conditions as proof of integrity, but unwidened bounds reject 2.13% of energy and 22.96% of path-loss measurements on clean runs.Widening measured-feature bounds by 3.5 noise standard deviations gives a path-loss interval of [71.692, 98.963] dB and zero clean rejections; backlog receives no margin.Source: 2) Physically Derived Admissibility · pp. 5–6
  • The worst-case admissible scaling is at most 1.324, or 1.380 with measurement margin, while the nominal attack intensity κ = 3 is infeasible by more than a factor of two.The bound is asymmetric: manipulation toward zero can leave congested sensors looking idle or healthy sensors appearing depleted, and both directions survive L1.Source: 2) Physically Derived Admissibility · p. 6

A. L1: Integrity Gate

  • When the gate rejects a report, offending fields revert to their values in the last accepted observation, and the substitution is recorded so the loop does not stall.This stale-hold rule is inherited from LAUS and drives detection cost.Source: 2) Physically Derived Admissibility · p. 6

B. L2: Cross-Modal Consistency

L2 addresses authentic, in-band reports by checking them against independent predictors based on swarm geometry and service history. Its path-loss residual yields a closed-form detection boundary and leaves a narrow interval of admissible, undetected perturbations.

B. L2: Cross-Modal Consistency

  • Against A2, L2 relies on redundancy: path loss has a geometric predictor, while energy is predicted over one step and checked with a cumulative residual.The geometric predictor uses deployment waypoints and sensor coordinates; the layer compares residuals with thresholds obtained from clean runs.Source: B. L2: Cross-Modal Consistency · p. 6
  • The path-loss boundary is set from the clean residual distribution using the maximum across N sensors, making its quantile larger than a single-scalar quantile.Under the stated model, the boundary is known before a run and the admissible, undetected window closes as σℓ approaches zero.Source: B. L2: Cross-Modal Consistency · p. 6
  • The deployed L2 threshold is 1.877 dB and gives κdetℓ = 1.026; together with L1’s realized mean bound of 1.019, this confines admissible and undetected attacks to roughly κ ∈ [1, 1.02].A single-scalar quantile would give 1.018, below κ = 1.02, where measured detection is only 0.767.Source: B. L2: Cross-Modal Consistency · p. 6
  • Backlog lacks an independent measurement, motivating L3’s use of the conservation law governing backlog.Source: B. L2: Cross-Modal Consistency · p. 6

C. L3: Memory-Informed Anomaly Detection

L3 uses queue conservation to test whether reported backlog changes imply physically possible arrivals. Its detection guarantee depends on a known, attained arrival cap and service conditions.

C. L3: Memory-Informed Anomaly Detection

  • The test inverts the queue recursion over one step to infer arrivals from consecutive backlog reports, which must fall within [0, αmax].Source: C. L3: Memory-Informed Anomaly Detection · p. 7
  • When a promoted sensor is served, any intensity above 1.2 is rejected the first time; inflated backlog falls by κµ rather than µ, leaving packets no non-negative arrival can explain.An adversary that keeps its target unserved to stay hidden forfeits the objective.Source: C. L3: Memory-Informed Anomaly Detection · p. 7
  • Every persistent promoted-backlog perturbation with κ > 1 is detected in finite expected time under the stated arrival and service assumptions.The test rejects with probability at least πmax Pr[µn = 0] each slot, and with probability one when µn > 0 and κ exceeds R/(R − αmax).Source: C. L3: Memory-Informed Anomaly Detection · p. 7
  • The guarantee relies on a known, attained arrival cap; with an unbounded arrival law or loose cap the bound weakens, and κ ≤ 1.2 can remain undetected if its target is unserved.Source: C. L3: Memory-Informed Anomaly Detection · p. 7
  • A separate onset-slot test can reject earlier: for an unserved sensor with initial backlog 21 packets, it triggers above κ = 1.06, but not for an attack already present from t = 1.Source: C. L3: Memory-Informed Anomaly Detection · p. 7

D. L4: Safety Validator

L4 repairs proposed schedules using service-concentration and time-since-visit checks, evaluated on the actuated pattern rather than reported features. Both checks are needed because service redistribution can leave concentration nearly unchanged while some sensor goes unserved.

D. L4: Safety Validator

  • The concentration statistic measures the largest share of assignments captured by any k sensors over a window, and its denominator makes it a share of a fixed budget.Using a rate instead would trigger on 32.7% of clean warm-up slots.Source: D. L4: Safety Validator · p. 7
  • With (k, W) = (2, 12), the clean-attacked separation for k = 2 rises from 4.0 pooled standard deviations at W = 8 to 15.0 at W = 12 and 21.9 at W = 20.The selected window exceeds both the 9.2-slot revisit period and the 10-slot trajectory period.Source: D. L4: Safety Validator · p. 7
  • Concentration alone misses redistributed starvation: Ψ2 reaches 13/36 on clean runs and 14/36 on attacked runs, while Θ exceeds 18 in 39.5% of attacked slots and never in clean slots.Θ reaches 30 under attack, corresponding to a sensor never served.Source: D. L4: Safety Validator · p. 7
  • L4 projects the proposal onto the region satisfying both statistics and repairs violations by moving a UAV from an objected-to sensor to another assignment.Reachability and visit history come from deployment configuration and history, and the repair terminates in at most U iterations at cost O(N).Source: D. L4: Safety Validator · pp. 7–8

E. L5: Governance, Audit, and Fallback

L5 records verdicts in a tamper-evident log and switches to a deterministic fallback when rejection rates cross a threshold. The composition rules specify how input checks, escalation, and schedule repair interact.

E. L5: Governance, Audit, and Fallback

  • A hash-chained log records each slot’s time, observation hash, L1–L4 verdicts, and observations, making later digest changes expose retrospective alteration.The kill switch monitors rejections over a sliding window.Source: E. L5: Governance, Audit, and Fallback · p. 8
  • The fallback uses the backlog from the most recent observation accepted by L1 and L2, ignores live input and the language model, and schedules only reachable sensors.After activation, it remains active for at least Wh slots and requires Wh consecutive clean slots for readmission.Source: E. L5: Governance, Audit, and Fallback · p. 8

F. Composition, Precedence, and Complexity

  • Input-side checks run before prompt assembly, L4 repairs schedules after inference, and L5 operates across the slot; the joint L1–L2 verdict determines local handling or escalation.An L1 failure with L2 passing is treated as a transport fault, whereas an L1 pass with L2 failing indicates an authenticated but inconsistent observation.Source: F. Composition, Precedence, and… · p. 8
  • Per-slot computation is O(UN + N log N), dominated by cross-modal recomputation over UAV–sensor pairs and validator sorting.Appendix E verifies the complexity empirically.Source: F. Composition, Precedence, and… · p. 8

G. Threshold Calibration and Latency Accounting

The thresholds are set using clean calibration runs and fixed before evaluation on disjoint seeds. The evaluation reports branch false-positive rates, attack-condition activations, and paired-seed test results.

G. Threshold Calibration and Latency Accounting

  • The geometric, one-step energy, and cumulative residual false-positive rates were 0.0022, 0.0089, and 0.0011, respectively, each at or below α = 0.01.The deployed τcmc was 1.877 dB, using a 5% margin over the 1.787 dB empirical quantile.Source: G. Threshold Calibration and Latency… · p. 8
  • The residual guard lowered the branch false-positive rate from 0.0344 to 0.0011 and the layer union from 0.0456 to 0.0122 without reducing detection of A2.The one-step branch runs only after L1 and L2 acceptance, and the cumulative branch only when every record in its window was accepted.Source: G. Threshold Calibration and Latency… · p. 8
  • At θmax = 18, starvation repair activated in 39.5% of attacked slots and 1.0% of clean evaluation slots, while concentration never fired.Alternative starvation budgets trade off attacked and clean repairs: 53.3% versus 5.8% at θmax = 14, 46.5% versus 0.83% at 16, and 32.5% versus 0.00% at 20.Source: G. Threshold Calibration and Latency… · p. 9
  • Each layer performs at most O(UN + N log N) arithmetic, and the defense overhead is expected to remain small relative to model inference.Measured latency is reported in Section VI.Source: G. Threshold Calibration and Latency… · p. 9

A. Testbed, Substrate, and Protocol

  • Thirty paired seeds used fixed exogenous streams, memoized assignments, and thresholds calibrated on disjoint seeds; the Friedman test across fifteen conditions gave χ2 = 353.5 on 14 degrees of freedom (p = 7.6 × 10−67).The testbed shares a scenario with LAUS but uses a different scheduler, so absolute costs are not comparable.Source: A. Testbed, Substrate, and Protocol · p. 9

B. Results

Across the adversary ladder, input-side detectors can reduce attack success while increasing mission degradation, whereas the detection-free L4 validator lowers attack-induced cost against A1. The later rungs test how much damage remains when adversaries adapt to earlier defenses.

1) Rung one, the channel adversary:

  • Provenance drives A1’s attack success rate from 0.066 to 0.001 while Γ rises from 3.13 to 5.61; fallback returns Γ to 2.24 with 93.3% of slots under fallback control.The adversary cannot recompute a tag without kM3, and counter binding rejects replay.Source: 1) Rung one, the channel adversary · p. 9

2) Rung two, the compromised perception node:

B. Results

  • Fig. 3 shows that L4 detects no attacks yet reduces excess cost by 37.5%, from 85.04 to 53.17 packets, and lowers Γ from 3.13 to 2.33 against A1.Across 900 evaluation slots, starvation was violated in 59 slots and concentration was never violated, so every repair came from starvation.Source: B. Results · p. 9, Figure 3 · p. 10

3) Rung three, the redundancy-aware adversary:

  • Against A3, the L3 adversary-caused rejection rate is 0.033 at realized promoted intensity 1.0055, where the manipulation permitted by the constraints produces no measurable damage.The result confirms the derived bounds rather than testing them independently.Source: 3) Rung three, the redundancy-aware… · p. 10

4) Rung four, the policy-aware adaptive adversary:

  • A4 is confined to κ ∈[1, 1.02], about 1.4 dB of path-loss distortion, below L2’s 1.74 dB reaction point.The policy-exact adversary’s mean cost difference from the surrogate was not statistically significant (p = 0.99); its effect was in the tail, including two seeds with +47 and +57 packets.Source: 4) Rung four, the policy-aware… · pp. 10–11

5) A different injection point and attack onset:

The evaluation shows that decision-side constraints bound damage from a memory-poisoning injection that evades observation-side detection, while stale-report substitution can make detection costly. The full stack keeps degradation near unity against the tested redundancy-aware and policy-aware adversaries, with results qualified by the reported scope and limitations.

5) A different injection point and attack onset:

  • Memory poisoning leaves live observations consistent with both predictors, so no observation-side layer fires; the decision-side constraints bound damage without identifying the injection.The success rate is 0.016, while Γ = 0.95 and fallback occupancy is 0.3%, as in the clean defended condition.Source: 5) A different injection point and… · p. 11

C. Detection Curves and Per-Layer Rates

  • L2 detection reaches unity at the predicted boundary, rising from 0.100 at κ = 1.01 to 0.767 at κ = 1.02; L1 rejects none of the tested A2 intensities, including κ = 3.For L3, onset rejection rises from 0.60 at κ = 1.05 to unity by κ = 1.15; L4 starvation fires on 0.068 of perturbed slots at a clean rate of 0.010. Under persistent A2, only about one in fifteen L2 rejections reflects the current manipulation, while Γ = 5.51 quantifies freeze cost.Source: C. Detection Curves and Per-Layer Rates · p. 11

D. Cost of the Architecture and Sensitivity

  • The defense tax is 1.07 packets, or 2.7% of clean cost, while the stack adds 0.1255 ms latency and consumes 0.06% of the control period at N = 1000.L4 accounts for 0.64 packets of the tax; sweeping link quality from 6.4 to 52.5 raises Γ monotonically, while the reported conclusions persist across that range.Source: D. Cost of the Architecture and… · pp. 11–12

E. Limitations

  • The reported-field manipulation budget is not a physical constraint, and only stale-hold repair was tested, so the detection-without-response result is specific to that rule.The compact realized geometry yields κ̄ = 1.019; the A3 damage curve is unreported, the clean full-horizon fallback is not compared with a deterministic heuristic, and the onset transient cannot detect manipulation present from the first slot.Source: E. Limitations · p. 12

VII. CONCLUSION

  • The full stack limits the degradation ratio to 1.02 against the redundancy-aware adversary and 1.08 against the policy-aware adversary.The conclusion also reports that the cross-modal boundary κdetℓ = 1.026 matches the measured transition to unit detection.Source: §VII · p. 12

APPENDIX A PROOFS OF THE THREE PROPOSITIONS AND THE

The appendix derives detection boundaries and examines how predictor mismatch, attack onset, attack intensity, and link quality affect the defenses.

APPENDIX A PROOFS OF THE THREE PROPOSITIONS AND THE

  • The propositions derive admissible scaling conditions from physical feature bands and residual-based detection, with the queue bound relying on πmax > 0 and exactly known αmax.The cross-modal threshold proof uses the worst case at ℓmin; the queue proof distinguishes served and unserved branches.Source: Appendix A · p. 12

APPENDIX B PARAMETERIZATION AND PREDICTOR MISMATCH IN L2

  • The multiplicative admissibility bound applies only to that attack model; additive offsets are bounded by band slack and the cross-modal threshold, while band slack remains tighter in this deployment despite predictor mismatch.With a looser band at D = 2 km, the ordering reverses and L2 binds for σmis < 13.8 dB.Source: Appendix B · pp. 12–13

APPENDIX C SENSITIVITY TO ATTACK ONSET

  • A3 onset results are similar because its realized promoted intensity is 1.0055, below the transient threshold of κ > 1.06; A2 occupancy tracks attacked-slot duration.For A2, L2 rejects attacked slots at both onsets, and occupancy includes the dwell time needed to trigger fallback.Source: Appendix C · p. 13, Table IV · p. 13

APPENDIX D DETECTION OF A3 AGAINST ATTACK INTENSITY

  • Onset rejection rises from 0.60 at κ = 1.05 to unity by κ = 1.15, while steady-state rejection is at least 0.586 at every tested intensity.The geometric approximation gives an expected time to first rejection below two slots; the authors caution that persistent backlog weakens the independence assumption.Source: Appendix D · p. 13

LINK-SUCCESS KNEE

  • The degradation ratio rises from 6.4 to 52.5 across link quality; at the operating point, Γ = 13.8 is near 14.2× published and above the deployed agent’s 3.13.The sweep uses a deterministic reference scheduler to vary the channel parameter in isolation.Source: LINK-SUCCESS KNEE · pp. 13–14, Table VII · p. 14
Loading 2610.03319v1…