Defense-in-Depth at the Perception-Reasoning Interface of LLM-Centric Agentic UAV Swarms

Mohammadhossein Homaei; Yousef Emami; Sajad Homayoun; Rahim Taheri; Hao Zhou; Miguel Gutierrez Gaitan; Bo Wei

cs.CROct 2, 2026

Defense-in-Depth at the Perception-Reasoning Interface of LLM-Centric Agentic UAV Swarms

Authors: Mohammadhossein Homaei, Yousef Emami, Sajad Homayoun, Rahim Taheri, Hao Zhou, Miguel Gutierrez Gaitan, Bo Wei

Abstract

Large Language Models (LLMs) increasingly support Uncrewed Aerial Vehicle (UAV) swarm operations such as data collection scheduling, where the model reads structured sensor reports and decides which sensors to visit. An adversary who quietly manipulates those reports can redirect the swarm without modifying the model weights or the UAV. Defenses for this interface have been proposed architecturally but rarely implemented or evaluated. We implement and evaluate defense-in-depth at the perception-reasoning interface of LLM-Centric Agentic UAV Swarms. Five layers check the provenance of a report, whether its values are physically admissible, whether they agree with what swarm geometry and service history predict, whether the resulting schedule starves any sensor, and, when these fail, hand control to a deterministic scheduler that ignores the suspect input. We test each layer against an adversary strong enough to defeat the layer before it. For each of the three input-side layers, we derive in closed form how far a report can be distorted before that layer reacts, fixing each boundary from deployment parameters before any attack data is collected; across thirty matched simulation runs, predicted and measured boundaries agree. Separating attack detection from response is a well-established principle, and we quantify the cost of neglecting this distinction at the perception-reasoning interface. When the system rejects a report, it replaces it with the most recent accepted report. This prevents the adversary from controlling the UAV schedule, but it also increases cumulative cost by 79% and 74% for the two detectors, respectively, compared with the undefended system. The safety check does not detect any attacks, but it nevertheless reduces the attack-induced cost by 37.5%.

Figures & tables

Fig. 1: Adversary capability ladder and corresponding defense layers. Arrows indicate the capability needed to bypass each layer; at

\mathcal{A}_{4}

, no exploitable redundancy remains and evaluation shifts from detection to residual damage.

Fig. 2: Pipeline, attack points, and corresponding defense layers. Input-side layers guard observations before

M_{4}

, output-side layers guard assignments before

M_{6}

, and governance spans the slot.

\mathcal{A}_{1}

intercepts

M_{3}\!\rightarrow\!M_{4}

\mathcal{A}_{2}

controls

M_{3}

, and

\mathcal{A}_{\mathrm{mem}}

poisons agent memory; memory remains independent of observation-side attacks, enabling the predictors in ( 23 ) and ( 24 ).

Parameter	Value
UAVs $U$ / sensors $N$ / horizon $T$	3 / 20 / 30
Region $D\times D$ / altitude $H$	$100\times 100$ m 2 , 100 m
Buffer $Q_{\max}$ / energy budget $E_{0}$	60 packets / 50 J
Service volume $R$ per visit	24 packets
Arrival mean / cap $\alpha^{\max}$	2.6 / 4 packets per slot
Attack intensity $\kappa$	3

TABLE I: Key testbed configuration parameters.

Condition	Active layers	Mean $J$	$\sigma$	95% CI	$\Gamma$	ASR	Fallback (%)	$p$
Clean, undefended	—	39.93	5.86	[37.93, 42.17]	1.00	—	0.0	—
$\mathcal{A}_{1}$ , undefended	—	124.97	19.69	[117.80, 131.93]	3.13	0.066	0.0	—
$\mathcal{A}_{1}$	$L_{1}$	223.97	67.24	[200.63, 248.23]	5.61	0.001	0.0	$5.2{\times}10^{-6}$
$\mathcal{A}_{1}$	$L_{1},L_{5}$	89.37	32.78	[78.23, 101.30]	2.24	0.002	93.3	$1.9{\times}10^{-4}$
$\mathcal{A}_{1}$	$L_{4}$	93.10	26.68	[83.80, 102.73]	2.33	0.069	0.0	$1.5{\times}10^{-5}$
$\mathcal{A}_{1}$	$L_{1},L_{4}$	165.50	53.11	[146.83, 184.10]	4.14	0.000	0.0	$1.0{\times}10^{-3}$

TABLE II: Per-layer evaluation across the adversary ladder,

N_{\mathrm{run}}=30

. The ratio

\Gamma

is normalized to the clean undefended row, ASR is ( 16 ), and

p

is the two-sided Wilcoxon signed-rank value against the undefended attacked row. The 95% CIs are percentile-bootstrap intervals, and

\sigma

is the sample standard deviation.

Fig. 3: Detection and response, from Table II over

30

paired seeds, grouped by adversary class. Within each group, adding a detector drives the attack success rate to the floor while the degradation ratio rises above the undefended baseline. The validator

L_{4}

, which detects nothing, is the only single layer that lowers

\Gamma

against

\mathcal{A}_{1}

. The two

\mathcal{A}_{4}

bars are the surrogate and policy-exact adversaries, differing by

0.06

\Gamma

after

6{,}960

queries to the deployed model.

Fig. 4: Detection of

\mathcal{A}_{2}

L_{2}

against the boundary

\kappa^{\mathrm{det}}_{\ell}

that Proposition V.2 fixes before any run. The shaded region is the interval Proposition V.1 leaves admissible on the realized geometry. The axis is broken because all rates saturate beyond

\kappa=1.05

Component	Mean (ms)	% of $\Delta t$	Complexity
$L_{1}$ integrity gate	0.0315	0.00063	$O(N+\|\sigma\|)$
$L_{2}$ cross-modal	0.0590	0.00118	$O(UN)$
$L_{3}$ anomaly	0.0051	0.00010	$O(N)$
$L_{4}$ validator	0.0287	0.00057	$O(N\log N)$
$L_{5}$ governance	0.0013	0.00003	$O(1)$
Stack total	0.1255	0.00251	$O(UN+N\log N)$

TABLE III: Per-layer added latency from ( 42 ), averaged over every five-layer condition of Table II . Percentages are of the

5

s control period.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Adversary	Onset	$\Gamma$	$L_{2}$ rej.	$\mathrm{TPR}(L_{3})$	ASR	Fallback
$\mathcal{A}_{3}$	$t=1$	1.02	0.208	0.033	0.001	0 1.8%
$\mathcal{A}_{3}$	$t=10$	0.99	0.207	0.045	0.003	0 2.2%
$\mathcal{A}_{2}$	$t=1$	2.24	1.000	0.033	0.002	93.6%
$\mathcal{A}_{2}$	$t=10$	1.48	1.000	0.043	0.000	57.1%

Appendix

TABLE IV: Sensitivity to attack onset under the full stack,

30

paired seeds per row, with rejection and detection measured on attacked slots only. The

L_{3}

column reports the adversary-caused rate; the

L_{2}

column reports the total rate, since it is the substitution rather than its cause that drives fallback occupancy.

$\kappa$	Onset TPR	Steady	95% CI	$\mathbb{E}[$ slots $]$	$\Pr[\text{surv.}]^{\dagger}$
1.00	0.000	0.000	$[0.000,0.007]$	—	—
1.05	0.600	0.586	$[0.546,0.626]$	1.71	$3\times 10^{-12}$
1.10	0.850	0.617	$[0.577,0.656]$	1.62	$3\times 10^{-13}$
1.15	1.000	0.648	$[0.609,0.686]$	1.54	$2\times 10^{-14}$
1.25	1.000	0.691	$[0.653,0.728]$	1.45	$5\times 10^{-16}$
1.50	1.000	0.893	$[0.865,0.916]$	1.12	$7\times 10^{-30}$

Appendix

TABLE V: Detection of

\mathcal{A}_{3}

L_{3}

, over twenty calibration seeds with

580

steady-state comparisons per row and Wilson intervals. Here

\kappa=1

carries no perturbation and reports the false-positive floor rather than a miss.

$N$	$U$	$L_{1}$	$L_{2}$	$L_{3}$	$L_{4}$	total	% $\Delta t$
00 20	0 3	0.0053	0.0244	0.0046	0.0129	0.0472	0.00094
00 50	0 5	0.0039	0.0340	0.0054	0.0154	0.0587	0.00117
0 100	10	0.0038	0.0663	0.0075	0.0228	0.1003	0.00201
0 200	20	0.0039	0.2075	0.0111	0.0374	0.2599	0.00520
0 500	30	0.0041	0.9245	0.0221	0.0541	1.0048	0.02010
1000	50	0.0048	2.9023	0.0405	0.0832	3.0308	0.06062

Appendix

TABLE VI: Per-layer latency as the field and the swarm grow, in milliseconds on the platform of Table I . Percentages are of the

5

s control period.

∗ Operating point used in the evaluation.
Link-success knee $\tau$	$J^{\mathrm{cl}}$	$J^{\mathcal{A}_{1}}$	$\Gamma$	TTF	$L_{1}$ rej.
0.36	79.5	511.7	0 6.4	9.1	0.18
0.49	46.3	494.6	10.7	6.8	0.09
0.62 ∗	34.4	473.5	13.8	5.3	0.04
0.75	22.5	452.9	20.1	4.1	0.03
0.91	0 8.2	432.6	52.5	3.3	0.02

Appendix

TABLE VII: Sensitivity to the link-success knee under the deterministic reference scheduler. TTF is the mean time to first service and

L_{1}

rej. the rejection fraction at

\kappa=3

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 508 papers

Jul 5, 2026

LLM-Centric Agentic AI for UAV Swarms: Architecture, Enabling Technologies, and Open Problems

Uncrewed Aerial Vehicle (UAV) swarms have significant potential for applications such as Search and Rescue (SAR) and environmental monitoring, but their real-world deployment is limited by a lack of situational awareness, intermittent connectivity, and significant cybersecurity risks. Agentic Artificial Intelligence (AI) represents a shift from standalone Large Language Model (LLM) toward closed-loop cognitive architectures that integrate perception, memory, reasoning/planning, and action to enable adaptive, goal-directed swarm behavior. Within this framework, Agentic AI provides a unifying structure for autonomous and adaptive swarm operations while expanding the system attack surface compared to conventional AI systems. This paper proposes LLM-Centric Agentic AI for UAV Swarms (LAUS) and reviews key enabling technologies such as onboard and edge computing, 5G/6G connectivity, multimodal intelligence, and cybersecurity mechanisms, and analyzes threats such as Priority Manipulation Attacks (PMA) that can distort decision-making and degrade network performance. Finally, it identifies open research challenges, including hallucination-resistant reasoning, onboard LLM deployment under SWaP constraints, and standardized security benchmarks for perception-reasoning attacks in agentic UAV systems.

Yousef Emami, Rahim Taheri, Mohammadhossein Homaei +2

Senior Member, IEEE

Multi-Agent LLM Systems AI Agent Security Multi-Robot Coordination Multi-Agent System Security Agentic AI

Ask PDF

May 5, 2026

Say the Mission, Execute the Swarm: Agent-Enhanced LLM Reasoning in the Web-of-Drones

Large Language Models (LLMs) are increasingly explored as high-level reasoning engines for cyber-physical systems, yet their application to real-time UAV swarm management remains challenging due to heterogeneous interfaces, limited grounding, and the need for long-running closed-loop execution. This paper presents a mission-agnostic, agent-enhanced LLM framework for UAV swarm control, where users express mission objectives in natural language and the system autonomously executes them through grounded, real-time interactions. The proposed architecture combines an LLM-based Agent Core with a Model Context Protocol (MCP) gateway and a Web-of-Drones abstraction based on W3C Web of Things (WoT) standards. By exposing drones, sensors, and services as standardized WoT Things, the framework enables structured tool-based interaction, continuous state observation, and safe actuation without relying on code generation. We evaluate the framework using ArduPilot-based simulation across four swarm missions and six state-of-the-art LLMs. Results show that, despite strong reasoning abilities, current general-purpose LLMs still struggle to achieve reliable execution - even for simple swarm tasks - when operating without explicit grounding and execution support. Task-specific planning tools and runtime guardrails substantially improve robustness, while token consumption alone is not indicative of execution quality or reliability.

Andrea Iannoli, Lorenzo Gigli, Luca Sciullo +2

Department of Computer Science and Engineering University of Bologna Bologna, Italy

Aerial Robotics Multi-Robot Systems Swarm Robotics Language Model-Based Control LLM Agent Planning LLM Agent Reliability

Ask PDF

Oct 7, 2026

LLM-Enabled UAV Dispatch: A System-Level Survey and Taxonomy

Unmanned aerial vehicle (UAV) dispatch is beginning to move beyond isolated path planning and optimization-driven resource allocation toward system-level coordination supported by semantic reasoning and LLM-based interfaces. This survey provides a unified characterization of LLM-enabled UAV dispatch systems that bridges semantic intent, symbolic decision-making, and physical UAV execution. Rather than treating LLMs as standalone add-ons, we conceptualize them as a cross-layer semantic orchestration layer connecting human instructions, external solvers, and distributed control modules. We organize the literature into four representative dispatch paradigms: pipeline dispatch, global assignment dispatch, decentralized agentic dispatch, and divide-and-conquer dispatch. For each paradigm, we analyze its decision logic, system structure, control flow, representative methods, and potential LLM roles. We further examine how LLMs support semantic parsing, retrieval-grounded planning, solver orchestration, local agent reasoning, multi-agent coordination, safety assessment, and human-facing explanation. We discuss the implications of these paradigms for scalability, robustness, coordination burden, and verification requirements, and identify open challenges including latency-aware reasoning, grounding reliability, physical feasibility guarantees, edge deployment, privacy protection, and distributed consistency. This survey provides a system-level taxonomy and design perspective for integrating LLMs into safety-critical UAV dispatch systems.

Xiao Han, Aoyang Quan, Xiangyu Zhao +2

School of Computer Science, Zhejiang University of Technology, China

LLM Agent Orchestration

Ask PDF

Abstract

AI Agent Security

Explore similar work

LLM-Centric Agentic AI for UAV Swarms: Architecture, Enabling Technologies, and Open Problems

Say the Mission, Execute the Swarm: Agent-Enhanced LLM Reasoning in the Web-of-Drones

LLM-Enabled UAV Dispatch: A System-Level Survey and Taxonomy