$Z^2$-ACT: End-to-End Verifiable Agentic Intent Control for Open 6G RAN

Sunder Ali Khowaja; Kapal Dev; George C. Alexandropoulos

cs.CRAug 21, 2026

$Z^2$ -ACT: End-to-End Verifiable Agentic Intent Control for Open 6G RAN

Authors: Sunder Ali Khowaja, Kapal Dev, George C. Alexandropoulos

Organizations: School of Computer Science, Dublin City University, Dublin, Ireland · Department of Computer Science, Munster Technological University, Cork, Ireland · Department of Informatics and Telecommunications, National and Kapodistrian University of Athens, Athens, Greece

Abstract

With the progression in open and disaggregated 6G radio access networks, it is expected that the system will be able to host multi-vendors. In order to host multi-vendors, it is essential that AI-assisted control loops remain safe, verifiable, and auditable under concurrent operator intents and untrusted model inputs. The existing studies address the agentic coordination, formal intent constraints, zero-trust prompt verification and cryptographic accountability in isolation, which leaves pre-realization safety, continuous semantic verification and cross-domain audit incomplete when used individually. In this regard, we propose zero-knowledge auditable control and zero-trust verifiable agentic intent architecture ( $Z^2$ -ACT), which integrates the aforementioned four primitives across the non-real-time and near-real-time RICs. We encode the typed Intent Contracts as operator goals while the large language model inputs are only admitted after a practical adversarial intent check. The skill sequences in the proposed study are released only when a self-management gate is satisfied while every successful commit is recorded as a binding commitment with a zero-knowledge proof. Our experimental evaluation on public ColO-RAN measurements compares the full architecture against targeted ablations and a conventional reinforcement-learning baseline. A live large language model is used in the non-real-time path to translate operator intents into Intent Contracts; we report translation accuracy, the rate of invalid or hallucinated contracts, non-real-time latency, and behavior under adversarial or misleading intents. Near-real-time control remains trace-driven on the public KPM sequences. Results indicate improved actuation filtering and attack resilience at modest latency and signaling cost inside the near-real-time envelope.

Figures & tables

Property	[ 6 ]	[ 9 ]	[ 11 ]	[ 12 ]	$Z^{2}$ -ACT
Formal pre-actuation Intent Contract	—	$\checkmark$	—	—	$\checkmark$
Continuous zero-trust check on LLM-bound inputs	—	—	$\checkmark$	—	$\checkmark$
Gated skill sequencing / self-management under Near-RT constraints	$\checkmark$	—	—	—	$\checkmark$
Multi-vendor conflict handling (priority + scope)	$\Delta$	$\Delta$	—	—	$\checkmark$
Post-realization ZK commitment + proof (no raw telemetry exposure)	—	—	—	$\checkmark$	$\checkmark$
End-to-end intent $\rightarrow$ verified realization $\rightarrow$ audit chain	—	—	—	—	$\checkmark$

TABLE I: Comparison with the existing approaches (

\checkmark

= addressed;

\Delta

= partial; — = not addressed). It should be noted that the ”Partial”

\Delta

indicates that the cited work discusses the issue or provides a related mechanism, but does not close the property into aa single intent-to-realization pipeline.

Z^{2}

-ACT claim is the chain, not the invention of each block in isolation.

Fig. 1: Real-world O-RAN Deployment View: Existing approaches vs $Z^{2}$ -ACT

Fig. 2: Proposed $Z^{2}$ -ACT Architectural Layer

Configuration	SLA Satisfaction	AMR	RU (mean PRB)
$Z^{2}$ -ACT	0.91	0.95	0.62
No-Contract	0.83	0.94	0.64
No-ZT	0.85	0.03	0.63
No-Gate	0.86	0.94	0.66
RL baseline	0.81	0.02	0.63

TABLE II: Quantitative comparison across ablations (mean over episodes and seeds).

Metric	Value
Translation Accuracy	0.78
Invalid / Hallucinated Output Rate	0.18
Mean Non-RT Latency (sec)	1.0
p95 Non-RT Latency (sec)	2.5
Adversarial-Intent Rejection Rate (After Evaluator)	0.85

TABLE III: Non-RT LLM Translation and Efficiency Results

Configuration	Mean $L_{i}$ (s)	p95 $L_{i}$ (s)	Fraction $L_{i}\leq L_{max}$	E2MV (bytes/s)
$Z^{2}$ -ACT	0.018	0.030	0.99	1.15 $\times$ baseline
No-Contract	0.017	0.028	0.99	1.14 $\times$ baseline
No-ZT	0.010	0.016	1.00	1.05 $\times$ baseline
No-Gate	0.012	0.020	1.00	1.22 $\times$ baseline
RL baseline	0.008	0.014	1.00	1.00 $\times$ baseline

TABLE IV: Latency and control plane overhead under near-RT constraints (mean over episodes and seeds).

Configuration	Audit Verification Success	Episodes with SO	Overlaps resolved by priority rule	Release predicate well-defined after serialization
$Z^{2}$ -ACT	1.00	0.35	0.96	0.98
No-Contract	N/A	0.35	0.62	0.82
No-ZT	N/A	0.35	0.94	0.96
No-Gate	N/A	0.35	0.68	0.78
RL baseline	N/A	0.35	0.08	0.55

TABLE V: Auditability and multi-vendor conflict resolution (mean over episodes and seeds).

Adversarial Intent Threshold $\theta$
$\theta$ setting	SLA satisfaction	AMR	Fraction $L_{i}\leq L_{max}$	Mean $L_{i}$ (s)
Permissive	0.92	0.88	1.00	0.016
Nominal	0.91	0.95	0.99	0.018
Restrictive	0.88	0.98	0.99	0.020
Gate Risk Limit $\alpha$
$\alpha$ setting	SLA satisfaction	AMR	Fraction $L_{i}\leq L_{max}$	E2MV (rel.)

TABLE VI: Sensitivity analysis for the threshold

\Theta

vector parameters.

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 510 papers

May 4, 2026

Executor-Side Progressive Risk-Gated Actuation for Agentic AI in Wireless Supervisory Control

Agentic artificial intelligence (AI) shows promise for automating O-RAN wireless supervisory control, but translated intents still require an executor-side decision before live network actuation. Existing control flows lack explicit semantics for whether an intent should commit, gate for evidence, or reject under stale telemetry, concurrent policies, deadline and bandwidth limits, and rollback constraints. We propose Progressive Risk-Gated Actuation (PRGA), an executor-side contract for risk-gated wireless intent execution. PRGA structures each intent into executable local triage (C0), on-demand coordination evidence (C1), and post-hoc provenance support (C2), with C2 kept off the online safety path. A deterministic two-stage policy checks expiry, freshness, rollback-handle validity, local conflict, blocking preconditions, and planner-executor risk divergence from C0, then retrieves C1 only for gated intents when deadline and bandwidth budgets allow; evidence-mandatory gates reject when required C1 is unavailable. On two 3GPP-parameterized energy-saving and slice-SLA benchmarks, PRGA reduces time-to-first-safe-action by 23.3-27.4% and per-commit control-plane bytes by 52.7-54.2% against a decision-identical eager full-evidence cost-overlay comparator, thereby isolating retrieval-cost accounting; remains non-inferior within a pre-declared 0.5 percentage-point unsafe-action margin against an invariant-respecting static-threshold comparator; and rejects 100% of injected over-threshold stale inputs in the stale-state fault campaign. On these benchmarks, PRGA improves supervisory responsiveness and control-plane efficiency within the evaluated unsafe-action boundary.

Zhenyu Liu, Yi Ma, Rahim Tafazolli

6GIC, Institute for Communication Systems, University of Surrey, Guildford, United Kingdom, GU2 7XH

Safety-Critical Control AI Agent Safety Wireless Communications Open Radio Access Network Runtime Assurance Intent-Based Networking

Ask PDF

Feb 27, 2026

Agentic AI-RAN: Enabling Intent-Driven, Explainable and Self-Evolving Open RAN Intelligence

Open RAN (O-RAN) exposes rich control and telemetry interfaces across the Non-RT RIC, Near-RT RIC, and distributed units, but also makes it harder to operate multi-tenant, multi-objective RANs in a safe and auditable manner. In parallel, agentic AI systems with explicit planning, tool use, memory, and self-management offer a natural way to structure long-lived control loops. This article surveys how such agentic controllers can be brought into O-RAN: we review the O-RAN architecture, contrast agentic controllers with conventional ML/RL xApps, and organise the task landscape around three clusters: network slice life-cycle, radio resource management (RRM) closed loops, and cross-cutting security, privacy, and compliance. We then introduce a small set of agentic primitives (Plan-Act-Observe-Reflect, skills as tool use, memory and evidence, and self-management gates) and show, in a multi-cell O-RAN simulation, how they improve slice life-cycle and RRM performance compared to conventional baselines and ablations that remove individual primitives. Security, privacy, and compliance are discussed as architectural constraints and open challenges for standards-aligned deployments. This framework achieves an average 8.83% reduction in resource usage across three classic network slices.

Zhizhou He, Yang Luo, Xinkai Liu +4

5G/6GIC, Institute for Communication Systems (ICS), University of Surrey, Guildford, UK · 6G Research Center, Khalifa University, Abu Dhabi, UAE

Network Slicing Wireless Communications Open Radio Access Network Wireless Resource Allocation Agentic AI Self-Evolving Agents

Ask PDF

Feb 15, 2026

Toward Autonomous O-RAN: A Multi-Scale Agentic AI Framework for Real-Time Network Control and Management

Open Radio Access Networks (O-RAN) promise flexible 6G network access through disaggregated, software-driven components and open interfaces, but this programmability also increases operational complexity. Multiple control loops coexist across the service management layer and RAN Intelligent Controller (RIC), while independently developed control applications can interact in unintended ways. In parallel, recent advances in generative Artificial Intelligence (AI) are enabling a shift from isolated AI models toward agentic AI systems that can interpret goals, coordinate multiple models and control functions, and adapt their behavior over time. This article proposes a multi-scale agentic AI framework for O-RAN that organizes RAN intelligence as a coordinated hierarchy across the Non-Real-Time (Non-RT), Near-Real-Time (Near-RT), and Real-Time (RT) control loops: (i) A Large Language Model (LLM) agent in the Non-RT RIC translates operator intent into policies and governs model lifecycles. (ii) Small Language Model (SLM) agents in the Near-RT RIC execute low-latency optimization and can activate, tune, or disable existing control applications; and (iii) Wireless Physical-layer Foundation Model (WPFM) agents near the distributed unit provide fast inference close to the air interface. We describe how these agents cooperate through standardized O-RAN interfaces and telemetry. Using a proof-of-concept implementation built on open-source models, software, and datasets, we demonstrate the proposed agentic approach in two representative scenarios: robust operation under non-stationary conditions and intent-driven slice resource control.

Hojjat Navidan, Mohammad Cheraghinia, Jaron Fontaine +5

IDLab, Department of Information Technology at Ghent University - imec, Ghent, Belgium · Department of Electrical and Computer Engineering, Princeton University, USA

Multi-Agent Orchestration Language Model-Based Control Network Slicing Wireless Communications Open Radio Access Network Intent-Based Networking+1

Ask PDF

Abstract

AI Agent Security

Explore similar work

Executor-Side Progressive Risk-Gated Actuation for Agentic AI in Wireless Supervisory Control

Agentic AI-RAN: Enabling Intent-Driven, Explainable and Self-Evolving Open RAN Intelligence

Toward Autonomous O-RAN: A Multi-Scale Agentic AI Framework for Real-Time Network Control and Management