PaperlayerView exact revision on arXiv

Source-linked AI summary

Sybil-Resilient Multi-Drone Exploration of Indoor and Confined Spaces

Shyaam Mahesh, Aditya B Prakash, Rubal Sagwal, Avinash Gautam

arXiv:2610.33906v1cs.RO

TL;DR

Coordinated drone exploration relies on trusting identities and their shared maps, leaving it vulnerable to Sybil attacks that misdirect exploration and fabricate map data. The paper tests five attackers and five onboard-sensing defences in simulation. The results show that restoring exploration is easier than removing false map data, while binding observed bodies to identities addresses fakes placed beside real drones.

  • Problem

    Sybil identities can claim frontiers and send fabricated scans, causing honest drones to leave space unexplored and record walls that are not there.

    Source: §I · p. 1

  • Method

    The paper evaluates five increasingly sophisticated Sybil attackers and five layered defences that audit map data, check presence, confirm bodies, quarantine unconfirmed identities, and bind bodies to identities.

    Source: §I · p. 1, §V · p. 4, §VII · p. 7

  • Results

    The audit restores 99.4–99.8% explored space, but strong and stealth attackers leave 3,000 to 4,800 false cells per honest map after the audit; binding bodies to identities reduces shadow-attack false cells to 57, versus 58 for an honest team.

    Source: §VI · pp. 4–5

  • Takeaways & Limitations

    Attack damage depends on layout, and confirming a body’s presence is not enough when a fake can claim a real drone’s nearby position.

    Source: §VI · p. 5, §VII · p. 7

    The evaluation is simulated, assumes known poses and drone detectability, and excludes attackers that lie under their own identity.

    Source: §VII · p. 7

Abstract

from arXiv · show

When a team of drones explores a building together, each drone tells the others which frontier it is going to and shares the map it has built. This avoids duplicated effort, but it also means that the team trusts every identity from which it receives messages. In a Sybil attack, one compromised drone creates fake identities, and these fake teammates claim frontiers and send fabricated scans, so the real drones leave parts of the building unexplored and end up with walls in their maps that do not exist. We study five such attackers, including one that seals off the openings between floors, and five levels of defence that need no security infrastructure, only the drones' own sensors and maps: an audit of received map data against what a drone sees itself, a check that a body is present where an identity claims to be, trust only for identities whose body has been seen, a quarantine for identities that no drone has observed, and a rule that binds each observed body to one identity. Tests in simulation cover 70 maps of seven kinds, from offices and tunnels to three-storey buildings and caves. Without a defence, one compromised drone leaves on average up to 25% of a map unexplored (45% in offices), and the floor-sealing attacker cuts the explored part of a three-storey building to 82.3%, or 34.6% on the worst map. The quarantine brings exploration back to the level of an unattacked team in every setting, and in most settings it also brings the false data back to that level. The exceptions are two colluding attackers, fakes placed next to real drones, three of the ten caves and a team of 16 drones, and binding bodies to identities fixes the last three. Over 2,350 missions, an honest drone was revoked by a teammate only twice.

I. Introduction

Coordinated exploration avoids duplicated effort by sharing frontier plans and maps, but depends on trusting every identity and its data. The paper introduces Sybil attackers, onboard-sensing defences, and a 70-map evaluation.

Introduction

  • A Sybil attacker uses fake identities to claim frontiers and send fabricated scans, leaving space unexplored and false walls in honest maps.The attack can end a mission early without collisions or lost messages.Source: §I · p. 1
  • The paper evaluates five Sybil attackers, including one that places fake walls across openings between floors.The five attackers increase in skill; the floor-sealing attacker targets openings between floors.Source: §I · p. 1
  • Five defence levels use onboard sensing, culminating in a rule that binds each observed body to one identity.The stated approach relies on drones’ own sensors and maps rather than security infrastructure.Source: §I · p. 1
  • The evaluation covers 70 maps of seven kinds and examines how space layout affects attack damage and where stronger defences fall short.The paper also identifies why auditing map content alone is not enough.Source: §I · p. 1

II. Related Work

Prior work provides frontier-based team exploration, robust mapping, Sybil detection, trust systems, and resilient consensus. This paper distinguishes its approach by checking shared map data against a receiving drone’s own observations.

II. Related Work

  • Frontier-based exploration underlies most multi-robot systems, while robust mapping rejects measurements and loop closures that disagree.Those robust mapping methods address perceptual aliasing and sensor outliers, not adversaries controlling several identities with deliberately consistent data.Source: §II · p. 1
  • IsoRank detects Sybil identities from broadcast-position geometry, whereas this paper checks map data and claims against what the receiver sees.The approaches use different signals and could be combined, but the paper reports no quantitative comparison with IsoRank.Source: §II · pp. 1–2
  • Prior swarm defences include blockchain voting, behaviour-based blocklists, distributed ledgers, and neighbour-weighted or outlier-rejecting consensus.Those consensus methods protect scalar or low-dimensional quantities; the paper’s audit uses each honest drone’s sensors to check portions of a shared 3D map.Source: §II · p. 2
  • The paper uses the Beta reputation system, with first-hand contradictions—not ratings—as its evidence.The trust evidence is a mismatch between what a drone was told and what it later saw.Source: §II · p. 2

III. System Model

The system models eight drones exploring procedural 3D worlds, sharing map updates, positions, and frontier claims. Identities are unsigned, and the open team does not know how many teammates to expect.

III. System Model

  • The study uses four 48 × 32 m world families with 0.2 m voxels, plus three families for vertical and confined exploration.The main study uses ten seeds per family; calibration seeds are kept out of results.Source: §III · p. 2
  • Each of eight drones maps with a depth camera and up/down range sensors, selects frontiers by size per distance, and plans paths with breadth-first search.The main study assumes known own-pose and point-motion dynamics; key conditions are also repeated with quadrotor dynamics.Source: §III · p. 2
  • Drones share map updates and broadcast identity, position, and frontier claims; a claimed frontier within 6 m is avoided for 15 s.Each map cell records which identity reported it, allowing later checking or rollback.Source: §III · p. 2
  • An identity is an unsigned message number, and the open team may gain or lose members without knowing how many teammates to expect.The experiments exclude impersonation: an identity already used by an honest drone cannot be taken over.Source: §III · p. 2
  • Fig. 1 depicts office, warehouse, forest, and tunnel worlds from above, with obstacle height colors and launch points marked.The three depicted seeds are examples of the world families.Source: Figure 1 · p. 2

IV. Threat Model

The threat model gives one compromised drone multiple fake identities that choose their reported positions, frontier claims, and scans. Five attacker variants progress from conspicuous fakes to fakes positioned beside real drones.

IV. Threat Model

  • One compromised drone explores honestly under its real identity while creating up to k fake identities that exist only as messages.The collusion test uses two compromised drones; the study does not test a compromised drone lying under its own identity.Source: §IV · p. 2
  • The attacker chooses each fake’s reported position, frontier, and scan using its own map and received messages, but cannot see observations that others have not shared.The attacker is assumed to know exactly how the defences work.Source: §IV · p. 2
  • Weak fakes appear together near the attacker and send random scans, while strong fakes join gradually, report plausible rooms, and relabel 80% of forwarded real map data.Once most of the team revokes a fake, the strong attacker replaces it.Source: §IV · pp. 2–3
  • Fig. 2 shows three-storey buildings, atrium buildings, and caves, with floors separated to reveal shafts or the central void.The cave rendering shows rock below 4.4 m so passages are visible from above.Source: Figure 2 · p. 3
  • Stealth fakes visit only places no honest drone can currently see, so their claimed empty positions cannot be checked.Source: §IV · p. 3
  • Targeted fakes claim frontiers with the most unexplored space behind them and report a wall about 1 m beyond the frontier.The attack can target openings such as shafts or doorways into large unexplored areas.Source: §IV · p. 3
  • Shadow fakes report positions 0.3 m from real drones, so a presence check finds a body there even though it belongs to someone else.An adaptive placement at or slightly ahead of a real drone’s broadcast position is not tested.Source: §IV · p. 3

V. Defences

The defence stack adds rules incrementally, moving from auditing reported map cells to checking identity presence, quarantining unconfirmed identities, and binding observed bodies to identities.

First-hand audit (D1)

  • An identity is revoked when the estimated probability that its map error rate exceeds 2% is greater than 0.99.A mismatch counts only when neither the drone nor an already trusted identity supports the reported value nearby, and the drone has seen at least 70% of the surrounding area.Source: §V · p. 3

Vouching and presence (D2); Physical evidence (D3)

  • D2 revokes identities when the probability of body absence exceeding half is greater than 99%; D3 requires a body sighting before trust and separately tests reported walls.D2 vouches for an identity after checking at least 2,000 cells with at most 1% wrong; D3 visits areas reported only by untrusted identities, but at lower priority.Source: §V · p. 3

Quarantine (D4)

  • D4 ignores maps and frontier claims from unconfirmed identities until a body is seen directly or two observed witnesses report seeing it.Confirmation establishes that a body was where the identity claimed, not that the body sent its messages—the gap exploited by the shadow attacker.Source: §V · pp. 3–4

One body, one identity (D5)

  • D5 links each observed body to the nearest-claiming identity; other identities claiming that body count as missing and can be revoked.The link persists for the mission, but binding a body to the wrong identity can make an honest drone count as missing.Source: §V · p. 4

Parameters

  • Only the 2% audit threshold was set on calibration maps; other parameters were hand-picked on maps that may include evaluation maps, then frozen.For D5, permanent binding left 45–61 false cells per honest map, versus 118–3,253 with 5-second expiry; neither revoked an honest drone, so permanent binding was kept.Source: §V · p. 4

VI. Simulation Results

The quarantine D4 restores exploration to the unattacked level across the main study, and in most settings also reduces false map data to that level. Damage and residual false data depend on environment and attacker, with D5 addressing several cases that defeat D4.

Damage without a defence

  • Eight weak fakes leave 45% of office and 35% of tunnel space unexplored, but 12% in warehouses and 8% in forests.The attack can let the team explore almost as fast initially, then stop early because remaining space appears explored.Source: §VI · p. 4, Figure 3 · p. 5

Effect of the defences

  • D1 alone restores explored space to 99.4–99.8%; only quarantine brings false data to unattacked-mission levels (56–63 versus 58–63 cells), while tunnels retain 116–135 versus 107.Source: §VI · p. 4

Cost of the defences

  • Under attack, 90% exploration takes 164 s with D4 and 213 s with D3; without an attacker, D3 and D4 take 153 s and 155 s, versus 134 s without defence.D3 sends drones to verify fake reports; D4 ignores those reports.Source: §VI · p. 4

Collusion

  • With two colluding attackers, D4 restores exploration to 99.7% but leaves 1,386 false cells per honest map.The authors suggest each attacker may vouch for the other's fakes, meeting the quorum of two, but have not isolated this mechanism.Source: §VI · pp. 4–5, Table IV · p. 6

Fakes next to real drones

  • D5 reduces shadow-attacker false cells to 57, matching the honest-team median of 58, after D4 leaves 782.The shadow attacker places fakes 0.3 m from real drones, allowing the presence check to find a body at the claimed position.Source: §VI · p. 5, Table V · p. 6

Three-storey buildings

  • D4 restores exploration to 99.8% in three-storey buildings, while the targeted attacker leaves a 34.6% worst-map result and 72,000 false cells per honest map.The targeted attacker reduces median explored space from 96.3% under the strong attacker to 83.4%.Source: §VI · pp. 5–6

Atrium buildings and caves

  • In caves, D4 leaves residual false data on three of ten maps, while D5 reduces those maps to 36, 29 and 33 cells.D5's cave median is 33 false cells, against 34 for the honest team; it also matches the honest level in three-storey and atrium buildings.Source: §VI · pp. 6–7

Flight dynamics

  • With rigid-body dynamics, D4 and D5 preserve full exploration, honest-level false cells, and no honest-drone revocations; 8 drones crash in 6 of 60 missions.The authors caution that the point-mass and dynamics explored-space means should not be read as a difference between models because outcomes vary strongly by map.Source: §VI · p. 7

VII. Conclusion

The paper evaluates five Sybil attackers and five onboard-sensing defences for coordinated 3D drone exploration. Across 2,350 missions, it finds that body-to-identity binding addresses cases where quarantine falls short, while simulation assumptions and collusion bound the results.

VII. Conclusion

  • The five defences progress from auditing received maps and checking for a body to confirming identities, quarantining unconfirmed data, and binding each observed body to one identity.Source: §VII · p. 7
  • Binding each observed body to one identity brings false cells to 57 per map for shadow fakes and clears the three caves and 16-drone case where quarantine fell short.The 57-cell result is reported as the honest-team level.Source: §VII · p. 7
  • The audit restores 99.4–99.8% explored space, but self-consistent fake scans leave 3,000–4,800 false cells per honest map after audit and 1,100–1,800 after D3.Source: §VII · p. 7
  • Results are simulation-based, assume known poses and drone detection, and do not cover compromised drones lying under their own identities; collusion can satisfy the quarantine quorum.The paper identifies collusion as its main remaining gap.Source: §VII · p. 7
Loading 2610.33906v1…