Defense-in-Depth at the Perception-Reasoning Interface of LLM-Centric Agentic UAV Swarms

Mohammadhossein Homaei; Yousef Emami; Sajad Homayoun; Rahim Taheri; Hao Zhou; Miguel Gutierrez Gaitan; Bo Wei

cs.CROct 2, 2026

Defense-in-Depth at the Perception-Reasoning Interface of LLM-Centric Agentic UAV Swarms

Authors: Mohammadhossein Homaei, Yousef Emami, Sajad Homayoun, Rahim Taheri, Hao Zhou, Miguel Gutierrez Gaitan, Bo Wei

Abstract

Large Language Models (LLMs) increasingly support Uncrewed Aerial Vehicle (UAV) swarm operations such as data collection scheduling, where the model reads structured sensor reports and decides which sensors to visit. An adversary who quietly manipulates those reports can redirect the swarm without modifying the model weights or the UAV. Defenses for this interface have been proposed architecturally but rarely implemented or evaluated. We implement and evaluate defense-in-depth at the perception-reasoning interface of LLM-Centric Agentic UAV Swarms. Five layers check the provenance of a report, whether its values are physically admissible, whether they agree with what swarm geometry and service history predict, whether the resulting schedule starves any sensor, and, when these fail, hand control to a deterministic scheduler that ignores the suspect input. We test each layer against an adversary strong enough to defeat the layer before it. For each of the three input-side layers, we derive in closed form how far a report can be distorted before that layer reacts, fixing each boundary from deployment parameters before any attack data is collected; across thirty matched simulation runs, predicted and measured boundaries agree. Separating attack detection from response is a well-established principle, and we quantify the cost of neglecting this distinction at the perception-reasoning interface. When the system rejects a report, it replaces it with the most recent accepted report. This prevents the adversary from controlling the UAV schedule, but it also increases cumulative cost by 79% and 74% for the two detectors, respectively, compared with the undefended system. The safety check does not detect any attacks, but it nevertheless reduces the attack-induced cost by 37.5%.

Figures & tables

Fig. 1: Adversary capability ladder and corresponding defense layers. Arrows indicate the capability needed to bypass each layer; at

\mathcal{A}_{4}

, no exploitable redundancy remains and evaluation shifts from detection to residual damage.

Fig. 2: Pipeline, attack points, and corresponding defense layers. Input-side layers guard observations before

M_{4}

, output-side layers guard assignments before

M_{6}

, and governance spans the slot.

\mathcal{A}_{1}

intercepts

M_{3}\!\rightarrow\!M_{4}

\mathcal{A}_{2}

controls

M_{3}

, and

\mathcal{A}_{\mathrm{mem}}

poisons agent memory; memory remains independent of observation-side attacks, enabling the predictors in ( 23 ) and ( 24 ).

Parameter	Value
UAVs $U$ / sensors $N$ / horizon $T$	3 / 20 / 30
Region $D\times D$ / altitude $H$	$100\times 100$ m 2 , 100 m
Buffer $Q_{\max}$ / energy budget $E_{0}$	60 packets / 50 J
Service volume $R$ per visit	24 packets
Arrival mean / cap $\alpha^{\max}$	2.6 / 4 packets per slot
Attack intensity $\kappa$	3

TABLE I: Key testbed configuration parameters.

Condition	Active layers	Mean $J$	$\sigma$	95% CI	$\Gamma$	ASR	Fallback (%)	$p$
Clean, undefended	—	39.93	5.86	[37.93, 42.17]	1.00	—	0.0	—
$\mathcal{A}_{1}$ , undefended	—	124.97	19.69	[117.80, 131.93]	3.13	0.066	0.0	—
$\mathcal{A}_{1}$	$L_{1}$	223.97	67.24	[200.63, 248.23]	5.61	0.001	0.0	$5.2{\times}10^{-6}$
$\mathcal{A}_{1}$	$L_{1},L_{5}$	89.37	32.78	[78.23, 101.30]	2.24	0.002	93.3	$1.9{\times}10^{-4}$
$\mathcal{A}_{1}$	$L_{4}$	93.10	26.68	[83.80, 102.73]	2.33	0.069	0.0	$1.5{\times}10^{-5}$
$\mathcal{A}_{1}$	$L_{1},L_{4}$	165.50	53.11	[146.83, 184.10]	4.14	0.000	0.0	$1.0{\times}10^{-3}$

TABLE II: Per-layer evaluation across the adversary ladder,

N_{\mathrm{run}}=30

. The ratio

\Gamma

is normalized to the clean undefended row, ASR is ( 16 ), and

p

is the two-sided Wilcoxon signed-rank value against the undefended attacked row. The 95% CIs are percentile-bootstrap intervals, and

\sigma

is the sample standard deviation.

Fig. 3: Detection and response, from Table II over

30

paired seeds, grouped by adversary class. Within each group, adding a detector drives the attack success rate to the floor while the degradation ratio rises above the undefended baseline. The validator

L_{4}

, which detects nothing, is the only single layer that lowers

\Gamma

against

\mathcal{A}_{1}

. The two

\mathcal{A}_{4}

bars are the surrogate and policy-exact adversaries, differing by

0.06

\Gamma

after

6{,}960

queries to the deployed model.

Fig. 4: Detection of

\mathcal{A}_{2}

L_{2}

against the boundary

\kappa^{\mathrm{det}}_{\ell}

that Proposition V.2 fixes before any run. The shaded region is the interval Proposition V.1 leaves admissible on the realized geometry. The axis is broken because all rates saturate beyond

\kappa=1.05

Component	Mean (ms)	% of $\Delta t$	Complexity
$L_{1}$ integrity gate	0.0315	0.00063	$O(N+\|\sigma\|)$
$L_{2}$ cross-modal	0.0590	0.00118	$O(UN)$
$L_{3}$ anomaly	0.0051	0.00010	$O(N)$
$L_{4}$ validator	0.0287	0.00057	$O(N\log N)$
$L_{5}$ governance	0.0013	0.00003	$O(1)$
Stack total	0.1255	0.00251	$O(UN+N\log N)$

TABLE III: Per-layer added latency from ( 42 ), averaged over every five-layer condition of Table II . Percentages are of the

5

s control period.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Adversary	Onset	$\Gamma$	$L_{2}$ rej.	$\mathrm{TPR}(L_{3})$	ASR	Fallback
$\mathcal{A}_{3}$	$t=1$	1.02	0.208	0.033	0.001	0 1.8%
$\mathcal{A}_{3}$	$t=10$	0.99	0.207	0.045	0.003	0 2.2%
$\mathcal{A}_{2}$	$t=1$	2.24	1.000	0.033	0.002	93.6%
$\mathcal{A}_{2}$	$t=10$	1.48	1.000	0.043	0.000	57.1%

Appendix

TABLE IV: Sensitivity to attack onset under the full stack,

30

paired seeds per row, with rejection and detection measured on attacked slots only. The

L_{3}

column reports the adversary-caused rate; the

L_{2}

column reports the total rate, since it is the substitution rather than its cause that drives fallback occupancy.

$\kappa$	Onset TPR	Steady	95% CI	$\mathbb{E}[$ slots $]$	$\Pr[\text{surv.}]^{\dagger}$
1.00	0.000	0.000	$[0.000,0.007]$	—	—
1.05	0.600	0.586	$[0.546,0.626]$	1.71	$3\times 10^{-12}$
1.10	0.850	0.617	$[0.577,0.656]$	1.62	$3\times 10^{-13}$
1.15	1.000	0.648	$[0.609,0.686]$	1.54	$2\times 10^{-14}$
1.25	1.000	0.691	$[0.653,0.728]$	1.45	$5\times 10^{-16}$
1.50	1.000	0.893	$[0.865,0.916]$	1.12	$7\times 10^{-30}$

Appendix

TABLE V: Detection of

\mathcal{A}_{3}

L_{3}

, over twenty calibration seeds with

580

steady-state comparisons per row and Wilson intervals. Here

\kappa=1

carries no perturbation and reports the false-positive floor rather than a miss.

$N$	$U$	$L_{1}$	$L_{2}$	$L_{3}$	$L_{4}$	total	% $\Delta t$
00 20	0 3	0.0053	0.0244	0.0046	0.0129	0.0472	0.00094
00 50	0 5	0.0039	0.0340	0.0054	0.0154	0.0587	0.00117
0 100	10	0.0038	0.0663	0.0075	0.0228	0.1003	0.00201
0 200	20	0.0039	0.2075	0.0111	0.0374	0.2599	0.00520
0 500	30	0.0041	0.9245	0.0221	0.0541	1.0048	0.02010
1000	50	0.0048	2.9023	0.0405	0.0832	3.0308	0.06062

Appendix

TABLE VI: Per-layer latency as the field and the swarm grow, in milliseconds on the platform of Table I . Percentages are of the

5

s control period.

∗ Operating point used in the evaluation.
Link-success knee $\tau$	$J^{\mathrm{cl}}$	$J^{\mathcal{A}_{1}}$	$\Gamma$	TTF	$L_{1}$ rej.
0.36	79.5	511.7	0 6.4	9.1	0.18
0.49	46.3	494.6	10.7	6.8	0.09
0.62 ∗	34.4	473.5	13.8	5.3	0.04
0.75	22.5	452.9	20.1	4.1	0.03
0.91	0 8.2	432.6	52.5	3.3	0.02

Appendix

TABLE VII: Sensitivity to the link-success knee under the deterministic reference scheduler. TTF is the mean time to first service and

L_{1}

rej. the rejection fraction at

\kappa=3

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 508 papers

LLM-Centric Agentic AI for UAV Swarms: Architecture, Enabling Technologies, and Open Problems
Jul 5, 2026Yousef Emami, Rahim Taheri, Mohammadhossein Homaei +2Multi-Agent LLM Systems AI Agent Security
Senior Member, IEEE
Say the Mission, Execute the Swarm: Agent-Enhanced LLM Reasoning in the Web-of-Drones
May 5, 2026Andrea Iannoli, Lorenzo Gigli, Luca Sciullo +2Aerial Robotics Multi-Robot Systems
Department of Computer Science and Engineering University of Bologna Bologna, Italy
LLM-Enabled UAV Dispatch: A System-Level Survey and Taxonomy
Oct 7, 2026Xiao Han, Aoyang Quan, Xiangyu Zhao +2LLM Agent Orchestration
School of Computer Science, Zhejiang University of Technology, China

Jul 5, 2026J/K move · Enter open · S save

LLM-Centric Agentic AI for UAV Swarms: Architecture, Enabling Technologies, and Open Problems

Yousef Emami, Rahim Taheri, Mohammadhossein Homaei, Muhammad Atif Ur Rehman+1

Senior Member, IEEE

Multi-Agent LLM Systems AI Agent Security Multi-Robot Coordination Multi-Agent System Security Agentic AI

Open paper AskPDF arXiv

Uncrewed Aerial Vehicle (UAV) swarms have significant potential for applications such as Search and Rescue (SAR) and environmental monitoring, but their real-world deployment is limited by a lack of situational awareness, intermittent connectivity, and significant cybersecurity risks. Agentic Artificial Intelligence (AI) represents a shift from standalone Large Language Model (LLM) toward closed-loop cognitive architectures that integrate perception, memory, reasoning/planning, and action to enable adaptive, goal-directed swarm behavior. Within this framework, Agentic AI provides a unifying structure for autonomous and adaptive swarm operations while expanding the system attack surface compared to conventional AI systems. This paper proposes LLM-Centric Agentic AI for UAV Swarms (LAUS) and reviews key enabling technologies such as onboard and edge computing, 5G/6G connectivity, multimodal intelligence, and cybersecurity mechanisms, and analyzes threats such as Priority Manipulation Attacks (PMA) that can distort decision-making and degrade network performance. Finally, it identifies open research challenges, including hallucination-resistant reasoning, onboard LLM deployment under SWaP constraints, and standardized security benchmarks for perception-reasoning attacks in agentic UAV systems.

Abstract

AI Agent Security

Explore similar work

LLM-Centric Agentic AI for UAV Swarms: Architecture, Enabling Technologies, and Open Problems

Say the Mission, Execute the Swarm: Agent-Enhanced LLM Reasoning in the Web-of-Drones

LLM-Enabled UAV Dispatch: A System-Level Survey and Taxonomy