Foundation models, including large language models (LLMs), are increasingly used for human-in-the-loop (HITL) cyber-physical systems (CPS) because foundation model-based AI agents can potentially interact with both the physical environments and human users. However, the unpredictable behavior of human users and AI agents, in addition to the dynamically changing physical environments, leads to uncontrollable nondeterminism. To address this urgent challenge of enabling agentic AI-powered HITL CPS, we propose a reactor-model-of-computation (MoC)-based approach, realized by the open-source Lingua Franca (LF) framework. We also carry out a concrete case study using the agentic driving coach as an application of HITL CPS. By evaluating the LF-based agentic HITL CPS, we identify practical challenges in reintroducing determinism into such agentic HITL CPS and present pathways to address them.
Figures & tables
Fig. 1: Challenges faced by an agentic driving coach as an agentic AI-powered HITL CPS. (a) The agent delivers an instruction to the driver too late (at time t+5 ). (b) The agent’s instruction is incorrect, although delivered timely at time t .
Fig. 2: HITL CPS depicting the interaction between the three key components, (a) agentic coach, (b) human driver, and (c) physical plant that includes the environment and car.
Fig. 3: Our proposed reactor model implemented using Lingua Franca, targeting the stop sign scenario, consists of four key reactors: (a) Coach , (b) Driver , (c) Car , and (d) Environment . Coach includes two sub-reactors: (e) LLMInference and (f) Planner .
Driver behavior
Behavior Types
Details
Accelerator
Coasting
a=−0.1m/s2
Cruise
a=0.1m/s2
Normal Acceleration
a=2m/s2
Strong Acceleration
a=4m/s2
Brake
Gentle braking
a=−3.0m/s2
Emergency braking
a=−9.0m/s2
TABLE I: Abstracted driver behaviors used in our agentic driving coach model. a represents the acceleration of the car.
Notation
Description
vn
Velocity of the car at time n
vn+1
Velocity of the car at time n+1
sn
Displacement of the car at time n
sn+1
Displacement of the car at time n+1
a
Net acceleration of the car
Δt
Time interval between two consecutive time steps
TABLE II: Notations used in the Equations ( 2 ) and ( 3 ).
Control Signal
Description
NONE
No intervention & driver
behavior remains within velocity bounds.
WARNING
Driver behavior deviates
from velocity bounds.
ACTUATE
Safety limits are violated &
the system triggers actuation.
TABLE III: Control signals generated by the LLM for mode transitions in the Planner reactor.
Fig. 4: The Planner reactor as a modal model where transitions are triggered by control signals defined in TABLE III .
Fig. 5: An example structured prompt provided for LLMInference to generate a control signal (denoted as TOKEN) and a driving instruction for the stop sign scenario.
Fig. 6: Three scenarios to evaluate the implementation of the proposed approach. (a) Stop sign, (b) Speed changing, and (c) Lane changing.
Fig. 7: Evaluation results illustrating velocity vs. displacement and time for three Llama 3 models (1B, 8B, 70B) in a stop sign scenario. Blue lines show car velocity; solid/dashed red lines show safety bounds of car velocity. Red X marks deadline violations in LLMInference . Green and orange triangles indicate coach instructions and actuation commands, respectively.
Fig. 8: Evaluation results with Llama 3 (8B vs. 70B) in speed and lane change scenarios, illustrated by velocity vs. displacement and time.
Cyberattacks on operational technology are increasingly causing costly downtime and physical damage, exposing the limitations of traditional rule-based monitoring in industrial IoT environments. While Large Language Models (LLMs) have strong semantic reasoning abilities to assist in decision support, their hallucinatory nature presents unacceptable safety liabilities for closed-loop control. This paper introduces a neuro-agentic control framework, a novel architecture that couples an LLM-based planner (i.e., such as Gemini 2.5 Flash-Lite) with a pre-trained Time-Series Foundation Model (TimesFM), to achieve physics-grounded autonomous defense. The paper introduces a Counterfactual Physics Injection'' mechanism that simulates the impact of LLM-proposed interventions within the numerical latent space of the foundation model before actuation, while allowing the system to reject hallucinatory or unsafe actions. Evaluated on an industrial dataset (e.g., the Secure Water Treatment (SWaT)) in the context of stochastic attack scenarios, the framework exhibited better performance compared to LSTM and TCN baselines. The Neuro-Agentic Loop prevented five breaches (33.3%) below the threshold versus LSTM (26.7%) and TCN (13.3%), with zero physically invalid (hallucinated) actions executed. These results demonstrate the efficacy of using foundation models as deterministic Sentinels'' to safeguard agentic AI in critical infrastructure.
Saroj Gopali, Bipin Chhetri, Deepika Giri +2
Department of Computer Science1, Texas Tech University1 · Cumberland University2 · Advanced Academic Programs Science3, Johns Hopkins University3
Multi-agent systems powered by large foundation models (LFMs) are increasingly deployed to control industrial robots through natural language, creating deployments in which security failures produce physical consequences. We analyse this threat landscape through Cobot-Claw, a deployed four-agent system for UR3e robotic arm control, and identify five attack classes specific to agentic cyber-physical systems. We propose ZTPM, a Zero Trust Policy Model comprising 25 typed primitives across five enforcement domains with Physical Impact Tiers as a runtime policy dimension. An empirical evaluation across 60 execution traces on two LFM backends provides initial evidence that actuation parameter selection is model-dependent and non-deterministic, motivating the need for policy-level enforcement at the physical actuation boundary.
Tharindu Ranathunga, Kavishka Fernando, Susan Rea
Nimbus Centre, Munster Technological University, Cork, Ireland
Large Language Models produce a controllability gap in safety-critical engineering: even low rates of undetected constraint violations render a system undeployable. Current orchestration paradigms suffer from sycophantic compliance, context attention decay, and stochastic oscillation during self-correction. We introduce the Convergent AI Agent Framework (CAAF), which transitions agentic workflows from open-loop generation to closed-loop fail-safe determinism via three pillars: (1) Recursive Atomic Decomposition with physical context firewalls; (2) Harness as an Asset, formalizing domain invariants into machine-readable registries enforced by a deterministic Unified Assertion Interface; and (3) Structured Semantic Gradients with State Locking for monotonic non-regression. This paper makes two core claims. First, an industrialization thesis: once domain invariants are formalized as an executable Harness, the Harness itself becomes a first-class enterprise asset that compounds in value as foundation models commoditize, and CAAF's ability to deliver its reliability on commodity-tier models makes fully self-hosted, on-premises deployment architecturally feasible for regulated sectors where cloud APIs are not an option. Second, an architectural claim supported by ablation: CAAF's three pillars address complementary failure surfaces and none alone closes the controllability gap at commodity cost. The paper contributes entirely at the orchestration and industrialization layer. Evidence across two complementary benchmarks, three-tier UAI ablations, multi-agent baselines, and a closed-source commodity family replicated by two independent open-weight families, is reported in the body.