cs.ROOct 20, 2026

Safe Multi-Robot Collaboration With Uniform Exclusion Using Trust

Authors: Thomas Kaminsky, Áron Vékássy, Hammad Izhar, Angelia Nedić, Stephanie Gil

Organizations: School of Engineering and Applied Sciences, Harvard University, Cambridge, USA · School of Electrical, Computer, and Energy Engineering, Arizona State University, Tempe, USA

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Robot swarms coordinate through directed, time-varying local communication links, some of which may be compromised to allow the transmission of arbitrary malicious data. We provide an algorithm that acts as a wrapper around robot communication---when a robot seeks to update its state using data from some incoming links, our wrapper provides a subset of trusted links whose data can be safely incorporated. It selects these links by testing a stream of trust values---data collected from an anomaly detector on each robot---using Safe Anytime-Valid Inference. We require only that the detector be better than chance. This wrapper ensures safe and performant autonomy by providing two powerful statistical guarantees: it uniformly excludes all compromised links for all time with high user-chosen probability, but nevertheless quickly learns to trust legitimate links. Both guarantees are vital to secure generic tasks, but no previous work provides them simultaneously without restrictive assumptions on connectivity structure or the number of compromised links that are not guaranteed in practice. We study our Safe Wrapper's performance in hardware for two contrasting tasks---neural implicit mapping and heading consensus---deploying on 3 LoCoBots and 8 GoPiGos, respectively. We provide simulations using trust values sampled from hardware to validate that our approach scales well to swarms of hundreds of robots.

Figures & tables

Figure 1: Learned Neural Map Without vs. With Our Approach . (Top) Our environment. A victim lies in the bottom right of the scene, accessible via two paths. An injection attacker learns a model of the environment offline, adding a fictitious obstacle (orange plus) and obscuring a hazard (blue minus). (Bottom Left) With no attack, the hazard is present in the neural reconstruction, and the direct path is unblocked. (Bottom Middle) With the injection attacker overwriting one agent’s updates with its malicious model, the resulting neural reconstruction includes the blockade, and the hazard is desaturated and blends into the wall. (Bottom Right) With our safe wrapper, malicious network weights are uniformly excluded, yielding a reconstruction close to the nominal case.
Figure 2: Schematics of attack types and our safe wrapper. (Top Left) An Injection (FDI) attacker compromises links by sending messages from the same ID as a legitimate robot. (Bottom Left) A Sybil attacker sends messages from multiple unique IDs, creating many fictitious robots to gain disproportionate influence. (Right) Our safe wrapper uses a stream of trust values and Anytime-Valid Confidence Sequences [ 10 ] to uniformly exclude malicious data while still eventually learning to trust all legitimate links.
Figure 3: Snapshots of Heading Consensus Under Baselines vs. Our Approach. (Left) Without our wrapper, all robots quickly agree on the malicious heading, causing a crash. (Middle) The trust-based baseline [ 18 ] still converges to a heading near the malicious goal since it initially trusts malicious messages. (Right) Our approach robustly identifies and uniformly excludes all malicious messages and reaches consensus within the convex hull of the initial legitimate robot headings.
  ClassificationStrong Conn.Compromised
Methodγ\boldsymbol{\gamma}Last Miscl.FirstLast FailTrusted
Safe Wrapper (Ours)0.0151.131.229.40.0
0.0540.320.619.80.0
0.1034.516.515.60.0
0.2029.211.711.50.0
Baseline [ 18 ]–24.21.70.570.3
Table 1: Time to perfect classification and strong connectivity for a real swarm. Each entry is the mean over 3535 hardware trials with 55 legitimate robots and 99 malicious agents ( 33 malicious robots, each with 22 Sybil identities), with the recorded trust observations of every trial replayed through both detectors. All times are in trust samples per link. Last Miscl. : the number of samples after which no link is misclassified, i.e. every compromised link is untrusted and every legitimate link is trusted. First / Last Fail : the mean number of samples per legitimate link when the subgraph of trusted legitimate links first becomes strongly connected, and when it last fails to be. Compromised Trusted : (compromised link, sample) pairs after which the link was trusted, per trial. The Safe Wrapper trusted no compromised link at any sample in any trial.
Figure 4: Consensus heading reached under each detector across 35 trials. Each of the 35 recorded trials was replayed twice from the same sequence of trust samples, once with the Safe Wrapper (ours; blue) and once with a baseline [ 18 ] (red). Each line from the origin is the heading the fleet converged to in one trial. The convex hull of the legitimate robots’ initial headings is given in light blue. The initial headings of the compromised robots are given in grey.
Figure 5: Histograms of Trust Values Collected in Consensus Hardware Experiments . We collected all trust values recorded over the consensus experiments, yielding a dataset of NL=34,193N_{\mathcal{L}}=34{,}193 legitimate trust values and NC=68,514N_{\mathcal{C}}=68{,}514 malicious trust values.
  LL
  125102550100250500
MM10.025.940.648.357.165.572.483.990.9
20.027.438.446.259.266.972.684.290.2
50.026.538.448.558.166.673.682.490.0
100.027.039.747.558.266.073.683.590.2
250.025.539.246.856.964.572.982.689.9
Table 2: Time to perfect classification and strong connectivity for simulated swarms. Each entry is the mean over 100100 trials of 5,0005{,}000 timesteps, for LL legitimate and MM malicious robots. At every timestep, one trust value is collected on every possible link (i.e., over the fully connected graph). Trust observations are resampled for all links i.i.d. from the empirical distributions in Figure 5 , and each link is tested at significance level γ=0.05\gamma=0.05 . (A) The number of samples after which no link is misclassified: every compromised link is untrusted and every legitimate link is trusted. (B) The number of samples after which the subgraph of trusted legitimate links is strongly connected. No compromised link was trusted at any timestep in any trial.
Figure 6: False Positive Rate for one malicious link versus Anomaly Detector Quality . We compare different trust values used for sampling, with Bernoulli(0.5)\text{Bernoulli}(0.5) being the limiting chance-level detector. We run 5,000 trials of 500,000 steps and record the proportion of trials where a compromised link is ever trusted. Even in the hard 0.50.5 case, the false positive rate remains below half of the significance level. For trust values with reasonable accuracy, no false positives are recorded.
Figure S1 : Learned UDON Neural Map Without vs. With Our Approach . (Top) We employ here the same injection attacker as Figure 1 . However, rather than independently adding and removing objects, we overwrite an area of the scene with a mundane object to obscure an interesting area from view. (Bottom Middle) We see that the attacked model learns a map with the mundane object. (Bottom Right) With our Safe Wrapper, the learned model correctly learns the interesting object.
Figure S2 : The ten randomly generated Erdős–Rényi graphs ( p=0.7p=0.7 ) used in our consensus experiments. We randomly generated these graphs once before the experiments started and cycled between them for each communication step.
Figure S3 : A schematic of our GoPiGo3 robot platforms used for distributed consensus experiments.
Figure S4 : A schematic of the robot platforms used for Neural Implicit Mapping experiments ( Figures 1 and S1 ).
AlgorithmUpdate RuleVulnerability to Malicious MessagesSafety Guarantee
Asynchronous Leader Election [ 29 ]Propagating information on the leader’s identity in its current connected component [Figs. 1, 2 and 3].Malicious robots can claim they are the elected leaders, as the algorithm assumes truthfulness from all robots.All elected leaders will be legitimate w.p. 1−γ.1-\gamma.
C-SLAM [ 30 ]iSAM2 [ 31 ] and some bookkeeping [Algorithms 1, 2 and 3].Malicious robots can inject false map information, ruining reconstruction.The output map will be free from malicious influence w.p. 1−γ.1-\gamma.
Decentralized Trajectory Planning [ 32 ]Passing a token containing trajectory information for all robots, inserting plans while owning the token [Algorithm 1].Malicious robots can add or remove arbitrary trajectories from the token.Malicious robots have no influence on the planned trajectories w.p. 1−γ.1-\gamma.
Distributed MPC [ 33 ]Distributed optimization with a stopping criterion [Algorithm 3].One malicious message can terminate the algorithm by triggering the stopping condition [Set Di,t=1D^{i,t}=1 ].Malicious robots have no influence on the solution w.p. 1−γ.1-\gamma.
Distributed Optimization [ 34 ]Distributed optimization with gradient tracking [Algorithm 2].A malicious robot can manipulate both its own cost function and the shared gradient tracking variables.Convergence to the optimal solution a.s.
Distributed Task Allocation [ 35 ]Distributed auction and consensus steps [Algorithms 1 and 2].If ever included, a malicious robot can outbid all the others on all tasks as the algorithm assumes truthful bids.Malicious robots have no influence on task allocation w.p. 1−γ.1-\gamma.
Table S1 : A Sample of Viable Distributed Algorithms for our Safe Wrapper
  Weight spaceMesh space
Configuration∥θ∥\|\theta\|dθnomd_{\theta}^{\mathrm{nom}}dθmald_{\theta}^{\mathrm{mal}}CnomC^{\mathrm{nom}}R5nomR_{5}^{\mathrm{nom}}CmalC^{\mathrm{mal}}R5malR_{5}^{\mathrm{mal}}
    (cm)(%)(cm)(%)
References
Nominal, three honest agents601.60.0000.9120.00100.03.8476.7
Injected malicious model1321.70.9120.0003.8482.00.00100.00
Data injection at p=0.90p=0.90
Table S2 : Weight- and mesh-space distance to the nominal and injected maps. In the data-injection runs, each message on the attacked link is overwritten by the malicious model with probability p=0.90p=0.90 . All quantities are measured at the end of a C-ADMM optimization, against two references: the nominal map built by the three honest robots with no attacker present, and the malicious model the attacker injects. dθ∙=∥θ−θ∙∥/max⁡(∥θ∥,∥θ∙∥)d_{\theta}^{\bullet}=\|\theta-\theta_{\bullet}\|/\max(\|\theta\|,\|\theta_{\bullet}\|) is a symmetric relative distance. C∙C^{\bullet} is the Chamfer distance, the mean of accuracy and completion over 2×1052\times 10^{5} surface samples per mesh, and R5∙R_{5}^{\bullet} is the fraction of reference points within 55 cm. Undefended, the honest robots converge to the injected model: dθnom=0.912d_{\theta}^{\mathrm{nom}}=0.912 exactly matches the reference separation, and 99.4%99.4\% of the malicious mesh lies within 55 cm. Applying our safe wrapper restores the map rather than the parameters: the secured run remains at dθnom=0.508d_{\theta}^{\mathrm{nom}}=0.508 in weight space but only 2.302.30 cm from the nominal mesh with 96.6%96.6\% completion.
  LL
  125102550100250500
MM10.026.234.539.244.547.453.556.761.2
20.026.734.437.843.747.952.658.261.9
50.026.634.538.443.947.752.257.060.3
100.026.233.938.843.748.351.556.561.5
250.026.733.539.343.647.752.755.460.5
Table S3 : Time to perfect classification and strong connectivity for simulated swarms on a fixed sparse topology. The LL legitimate robots form a line, with bidirectional links between consecutive robots, and each of the MM malicious robots is linked to every legitimate robot; there are no links between malicious robots. The topology is fixed across timesteps. Each entry is the mean over 100100 trials of 5,0005{,}000 timesteps. Trust observations are resampled for all links i.i.d. from the empirical distributions in Figure 5 , and each link is tested at significance level γ=0.05\gamma=0.05 . (A) The number of samples after which no link is misclassified: every compromised link is untrusted and every legitimate link is trusted. (B) The number of samples after which the subgraph of trusted legitimate links is strongly connected. Across all trials, a compromised link was trusted at only a single timestep (one link, at t=27t=27 , in one trial with L=500L=500 , M=100M=100 ); the two times coincide because, on a line, strong connectivity of the trusted subgraph requires every legitimate link to be trusted.
  LL
  125102550100250500
MM10.0129.0201.5252.3307.4357.1396.4447.1488.8
20.0134.6202.1250.4303.2353.4387.2446.6491.8
50.0139.8216.2251.7313.9354.6392.6446.0485.6
100.0127.3206.0249.2312.7354.3391.5445.0485.5
250.0129.6209.3251.4317.5353.6388.7446.9478.2
Table S4 : Time for the safe wrapper to classify every link correctly, and to trust a strongly connected subgraph, in simulated swarms. Each entry is the mean over 100100 trials of 5,0005{,}000 timesteps, for LL legitimate and MM malicious robots on a directed Erdős–Rényi communication graph ( p=0.2p=0.2 ), redrawn every timestep. Trust observations are resampled i.i.d. from the empirical distributions measured in the heading-consensus hardware experiments with a Sybil attacker, and each link is tested with a Confidence Sequence at significance γ=0.05\gamma=0.05 against the threshold 0.50.5 . (A) Time after which no link is misclassified: every compromised link is untrusted and every legitimate link is trusted. (B) Time after which the subgraph of trusted legitimate links is strongly connected whenever the legitimate communication graph is (timesteps at which the legitimate robots’ own graph is not strongly connected are not counted). Times are one plus the last timestep at which the condition fails, and 00 if it never fails (as for L=1L=1 , where every link is compromised). No compromised link was trusted at any timestep in any trial.
More in this topic

Resilient Multi-Robot Coordination

See all 12 papers

Explore similar work

CardsList
Oct 10, 2026

Who to Trust in Multi-Robot Systems: Joint Robot and Object Hypothesis Trust Inference via Neural-Symbolic Cross-Validation

Multi-robot systems (MRS) offer significant advantages over single-robot platforms by enabling information sharing and coordination for different tasks in complex environments. However, reliable cooperation critically depends on inferring trust over both information sources and their reported hypotheses, particularly under partial observability and potential adversarial interference. Existing approaches frequently depend on pre-established trust relationships or side-channel information, which may not be available or reliable in realistic MRS deployments. This work introduces NeST-Bayes, a neural-symbolic framework that jointly infers robot and hypothesis trust using only inter-robot observation consistency, without requiring preassigned robot trust, reputation information, or side-channel identity signals. NeST-Bayes infers instantaneous trust evidence scores for robots and object hypotheses by reasoning over ego-centric relational graphs constructed from cross-robot observation consistency. These evidence scores are accumulated over time through Bayesian updates of Beta-distributed trust beliefs to maintain temporally consistent trust estimates. Extensive evaluations show that NeST-Bayes achieves the highest mean object precision and robot recall across all benchmark settings, and the highest robot precision and object recall in most settings, compared to trust-based methods. Under aggressive optimized attacks, it achieves 98.8% robot precision with 93.8% recall and 98.3% object precision with 95.4% recall. In an occlusion-rich Webots warehouse, it maintains 92.5% robot precision with 92.0% recall and 97.3% object precision with 85.0% recall. These results demonstrate joint improvements in the reliability and coverage of retained information.

Ruiyang Wang, Hao-Lun Hsu, Haocheng Meng +2

Multi-Robot SystemsMulti-Agent System SecurityNeuro-Symbolic Reasoning
AskPDF
Sep 8, 2026

Seeing is Not Believing: Breaking the Physical-to-Digital Trust Boundary in Robotics

In multi-robot collaboration, task handovers rely on downstream verifiers performing remote attestation, which inspects sensor telemetry to ensure a robot's physical behavior strictly matches its assigned task. But can this telemetry be trusted? We show that it often cannot. In this paper, we uncover a severe vulnerability in Robot Operating System (ROS) 2: by modifying a single environment variable, an adversary can execute a pre-built hook to covertly intercept and inject both telemetry and control signals before they are published. Consequently, adversaries can hijack a robot to perform dangerous tasks while spoofing downstream verifiers with synthesized fake telemetry. Worse still, by exploiting the widespread reliance on third-party Docker containers and auxiliary tools, attackers can distribute compromised packages embedded with these malicious hooks to launch such attacks easily. On a physical Franka Emika robotic arm running Secure ROS 2, our attack injects fabricated telemetry in real time with only around 3 ms of jitter, preserving temporal synchronization and hardware integrity while achieving an 87% success rate even against an AI-based detector. We have responsibly disclosed these findings to the ROS 2 development team. We prepared a demo video available at https://youtu.be/ExeiGqUrnhQ.

Leming Shen, Shikai Geng, Yuanqing Zheng +1

University College London · The Hong Kong Polytechnic University

CybersecuritySoftware SecurityRemote Attestation
AskPDF
Jun 28, 2026

SPACE: Swarm Pheromone Fields for Adaptive Collision-Aware Exploration

Massive robot swarms can explore unknown environments quickly, but adding robots eventually stops helping. Doorways and dense traffic create congestion, increasing inter-robot contacts and reducing the value of each additional robot. We study this safety-efficiency tradeoff for ground swarms of tens to hundreds of robots. We present SPACE, Swarm Pheromone Fields for Adaptive Collision-Aware Exploration. Inspired by ant foraging, SPACE maintains a shared environmental field with an attractive frontier pheromone, a repellent explore pheromone, and a fast robot-density field. Robots use local field guidance on a synchronized shared map. We evaluate SPACE on real building floorplans, namely sixteen home layouts from the HouseExpo dataset and eight campus floors from the KTH dataset, with swarms of up to two hundred and fifty-six robots. At congested swarm sizes, SPACE attains the lowest inter-robot contact rate on HouseExpo and lies on the empirical Pareto frontier on KTH, together with handed lane formation at sizes where Lane has fewer contacts. Relative to a greedy nearest-frontier planner, SPACE reduces the contact rate by four to seventeen times while keeping coverage time within about two percent. The results indicate that, at this scale, coordination mainly improves safety rather than coverage time.

Haohua Que, Haojia Gao, Mingkai Liu +3

Department of Electronic Engineering, Tsinghua University, Beijing, China. · Tsinghua Shenzhen International Graduate School (SIGS), Tsinghua University, Shenzhen, China. · School of Software and Microelectronics, Peking University, Beijing, China.

Robot Collision AvoidanceSwarm RoboticsMulti-Robot ExplorationMulti-Robot CoordinationRobot SafetyFrontier-Based Exploration+2
AskPDF