Defense layers protect drone swarms from fake sensor reports
Defense-in-Depth at the Perception-Reasoning Interface of LLM-Centric Agentic UAV Swarms
Cryptography and SecurityMultiagent Systems
Summary
Drone groups rely on language AI models to decide which sensors to check, but fake sensor data can trick them and change their behavior. The authors built and tested five defense layers that check if sensor reports are real, plausible, and consistent before deciding. If a report looks wrong, control switches to a backup system that ignores the fake data. These layers detect attacks well but sometimes make the drone schedule less efficient, showing a trade-off between safety and performance.
What this means in practice
- •For drone operators: Integrate layered defense checks to improve drone swarm resilience against false sensor data in mission planning.
- •For security engineers: Design multi-layer detection systems that catch adversarial manipulation in autonomous scheduling based on sensor inputs.
Authors
Mohammadhossein Homaei, Yousef Emami, Sajad Homayoun, Rahim Taheri, Hao Zhou, Miguel Gutierrez Gaitan, Bo Wei
Abstract
Large Language Models (LLMs) increasingly support Uncrewed Aerial Vehicle (UAV) swarm operations such as data collection scheduling, where the model reads structured sensor reports and decides which sensors to visit. An adversary who quietly manipulates those reports can redirect the swarm without modifying the model weights or the UAV. Defenses for this interface have been proposed architecturally but rarely implemented or evaluated. We implement and evaluate defense-in-depth at the perception-reasoning interface of LLM-Centric Agentic UAV Swarms. Five layers check the provenance of a report, whether its values are physically admissible, whether they agree with what swarm geometry and service history predict, whether the resulting schedule starves any sensor, and, when these fail, hand control to a deterministic scheduler that ignores the suspect input. We test each layer against an adversary strong enough to defeat the layer before it. For each of the three input-side layers, we derive in closed form how far a report can be distorted before that layer reacts, fixing each boundary from deployment parameters before any attack data is collected; across thirty matched simulation runs, predicted and measured boundaries agree. Separating attack detection from response is a well-established principle, and we quantify the cost of neglecting this distinction at the perception-reasoning interface. When the system rejects a report, it replaces it with the most recent accepted report. This prevents the adversary from controlling the UAV schedule, but it also increases cumulative cost by 79% and 74% for the two detectors, respectively, compared with the undefended system. The safety check does not detect any attacks, but it nevertheless reduces the attack-induced cost by 37.5%.