Trust-Aware Sequential Decision Making and Rollout Planning for Resilient Multi-Robot Systems

Roee M. Francos; Daniel Garces; Orhan Eren Akgün; Nathaniel D. Bastian; Stephanie Gil

cs.MAAug 26, 2026

Trust-Aware Sequential Decision Making and Rollout Planning for Resilient Multi-Robot Systems

Authors: Roee M. Francos, Daniel Garces, Orhan Eren Akgün, Nathaniel D. Bastian, Stephanie Gil

Organizations: School of Engineering and Applied Sciences, Harvard University, Cambridge, MA 02138 USA · Whiting School of Engineering at the Johns Hopkins University, Baltimore, MD 21218 USA

Abstract

Sequential decision-making in multi-robot systems typically assumes that planning information is reliable and that agents execute the actions anticipated by the planner. Compromised agents can violate both assumptions, creating a mismatch between the planning model and physical execution. We study this problem in online multi-robot routing under localization spoofing. We introduce a distance-constrained spoofing model for monitor-aware adversaries, together with a tiered bipartite matching strategy that maximizes assignment influence while limiting spoofing magnitude. To mitigate such attacks, we develop a trust-aware monitor that combines probabilistic localization trust, calibrated using real GPS spoofing data, with behavioral evidence from task execution to classify agents and remove detected adversaries from subsequent planning. We further show that undetected adversaries can cause rollout to lose its expected cost-improvement behavior by violating planner-execution consistency. Trust-aware removal restores this consistency after detection, enabling stable routing and recovery of rollout's empirical advantage over the base policy. Experiments using real GPS spoofing datasets and San Francisco taxicab demand demonstrate effective detection and resilient routing across varying spoofing capabilities, adversarial fleet sizes, adaptive attacks, monitoring configurations, and rollout horizons.

Figures & tables

Fig. 1: Trust-aware sequential planning framework. Information-integrity observations and behavioral evidence are used to update agent trust classifications and construct a trusted planning state. The planner computes actions using this filtered state, while execution generates new observations and task-level outcomes that are incorporated into subsequent trust updates.

Fig. 2: Localization-spoofing threat models. Unconstrained spoofing permits an adversarial agent to report any location on the graph, whereas monitor-aware distance-constrained spoofing restricts the reported location to lie within graph distance $d_{\max}$ of the true position.

Fig. 3: Trust evidence and online monitoring for resilient routing. Localization trust evaluates the reliability of reported position information, while behavioral trust evaluates request-level execution outcomes. The two evidence branches are fused into an agent classification $\chi_{i}(t)$ . Agents classified as adversarial are removed before subsequent planning, producing the trusted active fleet $\mathcal{L}_{t^{+}}$ and corresponding trusted planning state.

Fig. 4: Calibration of localization trust from real GPS spoofing data. Localization-related features are modeled using class-conditional Gaussian distributions, QDA provides posterior confidence scores, and the resulting scores are represented by class-specific Beta distributions.

Fig. 5: Request-level responsibility attribution for behavioral trust. After a request reaches a terminal event, its assignment history is used to attribute successful service, expiration, and harmful reassignment churn to the agents involved.

Fig. 6: San Francisco road network used for the pickup-and-delivery case study. The environment contains $1026$ intersections and $2300$ directed road segments within a $1500$ m radius region.

Fig. 7: Empirical localization-trust distributions obtained from real GPS spoofing data. Cooperative observations concentrate at higher trust values, while spoofed observations shift toward lower trust. Increasingly stealthy attacks reduce this separation, motivating the use of complementary behavioral evidence.

Fig. 8: Policy cost and localization trust under unmonitored spoofing. Rows correspond to different maximal spoofing ranges distance-constrained attacks, while the left and right columns report policy cost and average team localization trust, respectively.

Fig. 9: Average routing cost for the localization-only, behavioral-only, and fused monitors. Rows vary the adversarial fleet fraction, columns vary the monitoring configuration, and curves vary the spoofing distance.

Fig. 10: Average number of adversarial agents remaining active under the monitor-ablation configurations. The layout matches Fig. 9 .

Fig. 11: Average number of cooperative agents incorrectly removed by the monitor.

Fig. 12: Average number of adversarial agents remaining active for the IA-RA and rollout configurations. Rows vary the initial adversarial fleet size and columns vary the spoofing radius. Monitoring progressively removes adversarial agents from consideration during planning.

Fig. 13: Average number of outstanding requests for the IA-RA and rollout configurations. Adversarial removal reduces the mismatch between simulated and executed service, allowing monitored policies to reduce the accumulated backlog. For sufficiently long lookahead, trust-aware rollout approaches or improves upon the backlog of monitored IA-RA.

Fig. 14: Average cumulative canceled requests. Without monitoring, service failures continue to accumulate because adversarial agents remain represented as cooperative resources. Monitoring can arrest this growth after adversarial removal.

Fig. 15: Average routing policy cost for the IA-RA and rollout configurations. The cost combines current backlog and cumulative cancellations. Trust-aware rollout may therefore retain a larger cost after detection even when its current outstanding-request count has recovered, because early cancellations remain in the cumulative term.

Fig. 16: Average routing policy cost for two rollout configurations with different lookahead lengths of $H=10$ and $H=20$ . The plot shows that the short-horizon case can remain unstable even with monitoring, whereas longer horizons allow the planner to better account for the downstream consequences of current assignments and lead to stable policies.

Fig. 17: Monitored IA-RA and trust-aware rollout with $49$ cooperative agents, one adversarial agent, and $H=30$ . The panels report adversarial agents remaining active, cumulative cancellations, outstanding requests and routing cost. With additional cooperative capacity, trust-aware rollout achieves lower number of outstanding requests and lower policy costs than monitored IA-RA.

Explore similar work

Remote ID Spoofing-Aware Trajectory Planning for Small Unmanned Aerial Systems
Jul 22, 2026Jeremiah Webb, Bryce Bjorkman, Abel Diaz Gonzalez +7Collision Avoidance UAV Navigation
Vanderbilt University, Nashville, TN, USA · The University of Texas at Austin, Austin, TX, USA
Who to Trust in Multi-Robot Systems: Joint Robot and Object Hypothesis Trust Inference via Neural-Symbolic Cross-Validation
Oct 10, 2026Ruiyang Wang, Hao-Lun Hsu, Haocheng Meng +2Multi-Robot Systems Multi-Agent System Security
Resilient Decentralized Ergodic Coverage for Scalable Multi-Robot Systems in Unknown Time-Varying Environments
Apr 5, 2026Maria G. Mendoza, Victoria Marie Tuck, Chinmay Maheshwari +1Multi-Robot Systems Exploration-Exploitation Tradeoff
Department of Mechanical Engineering, University of California, Berkeley, CA 94720, USA · Department of Electrical and Systems Engineering, University of Pennsylvania, Philadelphia, PA 19104, USA · Department of Electrical and Computer Engineering, Johns Hopkins University, Baltimore, MD 21209, USA +1

Jul 22, 2026J/K move · Enter open · S save

Remote ID Spoofing-Aware Trajectory Planning for Small Unmanned Aerial Systems

Jeremiah Webb, Bryce Bjorkman, Abel Diaz Gonzalez, Austin Coursey+6

Vanderbilt University, Nashville, TN, USA · The University of Texas at Austin, Austin, TX, USA

Collision Avoidance UAV Navigation Multi-Agent Planning

Open paper AskPDF arXiv

This work presents a decentralized, spoofing-aware trajectory planning framework for small unmanned aerial systems operating under Remote Identification (RID) location spoofing attacks. Existing planners typically assume RID broadcasts are trustworthy, which can increase the risk of loss of separation and mid-air collisions when spoofing occurs. In contrast, the proposed approach explicitly treats RID information as unverified and incorporates physical-layer observations to assess broadcast credibility. Received signal-strength measurements from neighboring aircraft are used to detect spoofing and probabilistically localize a spoofing agent. The resulting uncertainty is converted into a risk-bounded unsafe region using a chance-constrained formulation and integrated into a per-agent Markov decision process-based planner. This enables real-time, decentralized collision avoidance while preserving mission objectives and scalability. Simulation results in a multi-aircraft package delivery scenario demonstrate reduced near mid-air collision events compared to planners that assume truthful RID data, while maintaining computational efficiency suitable for real-time execution.

Abstract

Explore similar work

Remote ID Spoofing-Aware Trajectory Planning for Small Unmanned Aerial Systems

Who to Trust in Multi-Robot Systems: Joint Robot and Object Hypothesis Trust Inference via Neural-Symbolic Cross-Validation

Resilient Decentralized Ergodic Coverage for Scalable Multi-Robot Systems in Unknown Time-Varying Environments