cs.ROOct 20, 2026
SaveSafe Multi-Robot Collaboration With Uniform Exclusion Using Trust
Organizations: School of Engineering and Applied Sciences, Harvard University, Cambridge, USA · School of Electrical, Computer, and Energy Engineering, Arizona State University, Tempe, USA
Abstract
Robot swarms coordinate through directed, time-varying local communication links, some of which may be compromised to allow the transmission of arbitrary malicious data. We provide an algorithm that acts as a wrapper around robot communication---when a robot seeks to update its state using data from some incoming links, our wrapper provides a subset of trusted links whose data can be safely incorporated. It selects these links by testing a stream of trust values---data collected from an anomaly detector on each robot---using Safe Anytime-Valid Inference. We require only that the detector be better than chance. This wrapper ensures safe and performant autonomy by providing two powerful statistical guarantees: it uniformly excludes all compromised links for all time with high user-chosen probability, but nevertheless quickly learns to trust legitimate links. Both guarantees are vital to secure generic tasks, but no previous work provides them simultaneously without restrictive assumptions on connectivity structure or the number of compromised links that are not guaranteed in practice. We study our Safe Wrapper's performance in hardware for two contrasting tasks---neural implicit mapping and heading consensus---deploying on 3 LoCoBots and 8 GoPiGos, respectively. We provide simulations using trust values sampled from hardware to validate that our approach scales well to swarms of hundreds of robots.
Figures & tables
Figure 1: Learned Neural Map Without vs. With Our Approach . (Top) Our environment. A victim lies in the bottom right of the scene, accessible via two paths. An injection attacker learns a model of the environment offline, adding a fictitious obstacle (orange plus) and obscuring a hazard (blue minus). (Bottom Left) With no attack, the hazard is present in the neural reconstruction, and the direct path is unblocked. (Bottom Middle) With the injection attacker overwriting one agent’s updates with its malicious model, the resulting neural reconstruction includes the blockade, and the hazard is desaturated and blends into the wall. (Bottom Right) With our safe wrapper, malicious network weights are uniformly excluded, yielding a reconstruction close to the nominal case.
Figure 2: Schematics of attack types and our safe wrapper. (Top Left) An Injection (FDI) attacker compromises links by sending messages from the same ID as a legitimate robot. (Bottom Left) A Sybil attacker sends messages from multiple unique IDs, creating many fictitious robots to gain disproportionate influence. (Right) Our safe wrapper uses a stream of trust values and Anytime-Valid Confidence Sequences [ 10 ] to uniformly exclude malicious data while still eventually learning to trust all legitimate links.
Figure 3: Snapshots of Heading Consensus Under Baselines vs. Our Approach. (Left) Without our wrapper, all robots quickly agree on the malicious heading, causing a crash. (Middle) The trust-based baseline [ 18 ] still converges to a heading near the malicious goal since it initially trusts malicious messages. (Right) Our approach robustly identifies and uniformly excludes all malicious messages and reaches consensus within the convex hull of the initial legitimate robot headings.
| Classification | Strong Conn. | Compromised | |||
| Method | Last Miscl. | First | Last Fail | Trusted | |
| Safe Wrapper (Ours) | 0.01 | 51.1 | 31.2 | 29.4 | 0.0 |
| 0.05 | 40.3 | 20.6 | 19.8 | 0.0 | |
| 0.10 | 34.5 | 16.5 | 15.6 | 0.0 | |
| 0.20 | 29.2 | 11.7 | 11.5 | 0.0 | |
| Baseline [ 18 ] | – | 24.2 | 1.7 | 0.5 | 70.3 |
Table 1: Time to perfect classification and strong connectivity for a real swarm. Each entry is the mean over hardware trials with legitimate robots and malicious agents ( malicious robots, each with Sybil identities), with the recorded trust observations of every trial replayed through both detectors. All times are in trust samples per link. Last Miscl. : the number of samples after which no link is misclassified, i.e. every compromised link is untrusted and every legitimate link is trusted. First / Last Fail : the mean number of samples per legitimate link when the subgraph of trusted legitimate links first becomes strongly connected, and when it last fails to be. Compromised Trusted : (compromised link, sample) pairs after which the link was trusted, per trial. The Safe Wrapper trusted no compromised link at any sample in any trial.
Figure 4: Consensus heading reached under each detector across 35 trials. Each of the 35 recorded trials was replayed twice from the same sequence of trust samples, once with the Safe Wrapper (ours; blue) and once with a baseline [ 18 ] (red). Each line from the origin is the heading the fleet converged to in one trial. The convex hull of the legitimate robots’ initial headings is given in light blue. The initial headings of the compromised robots are given in grey.
Figure 5: Histograms of Trust Values Collected in Consensus Hardware Experiments . We collected all trust values recorded over the consensus experiments, yielding a dataset of legitimate trust values and malicious trust values.
| 1 | 2 | 5 | 10 | 25 | 50 | 100 | 250 | 500 | ||
| 1 | 0.0 | 25.9 | 40.6 | 48.3 | 57.1 | 65.5 | 72.4 | 83.9 | 90.9 | |
| 2 | 0.0 | 27.4 | 38.4 | 46.2 | 59.2 | 66.9 | 72.6 | 84.2 | 90.2 | |
| 5 | 0.0 | 26.5 | 38.4 | 48.5 | 58.1 | 66.6 | 73.6 | 82.4 | 90.0 | |
| 10 | 0.0 | 27.0 | 39.7 | 47.5 | 58.2 | 66.0 | 73.6 | 83.5 | 90.2 | |
| 25 | 0.0 | 25.5 | 39.2 | 46.8 | 56.9 | 64.5 | 72.9 | 82.6 | 89.9 | |
Table 2: Time to perfect classification and strong connectivity for simulated swarms. Each entry is the mean over trials of timesteps, for legitimate and malicious robots. At every timestep, one trust value is collected on every possible link (i.e., over the fully connected graph). Trust observations are resampled for all links i.i.d. from the empirical distributions in Figure 5 , and each link is tested at significance level . (A) The number of samples after which no link is misclassified: every compromised link is untrusted and every legitimate link is trusted. (B) The number of samples after which the subgraph of trusted legitimate links is strongly connected. No compromised link was trusted at any timestep in any trial.
Figure 6: False Positive Rate for one malicious link versus Anomaly Detector Quality . We compare different trust values used for sampling, with being the limiting chance-level detector. We run 5,000 trials of 500,000 steps and record the proportion of trials where a compromised link is ever trusted. Even in the hard case, the false positive rate remains below half of the significance level. For trust values with reasonable accuracy, no false positives are recorded.
Figure S1 : Learned UDON Neural Map Without vs. With Our Approach . (Top) We employ here the same injection attacker as Figure 1 . However, rather than independently adding and removing objects, we overwrite an area of the scene with a mundane object to obscure an interesting area from view. (Bottom Middle) We see that the attacked model learns a map with the mundane object. (Bottom Right) With our Safe Wrapper, the learned model correctly learns the interesting object.
Figure S2 : The ten randomly generated Erdős–Rényi graphs ( ) used in our consensus experiments. We randomly generated these graphs once before the experiments started and cycled between them for each communication step.
Figure S3 : A schematic of our GoPiGo3 robot platforms used for distributed consensus experiments.
Figure S4 : A schematic of the robot platforms used for Neural Implicit Mapping experiments ( Figures 1 and S1 ).
| Algorithm | Update Rule | Vulnerability to Malicious Messages | Safety Guarantee |
| Asynchronous Leader Election [ 29 ] | Propagating information on the leader’s identity in its current connected component [Figs. 1, 2 and 3]. | Malicious robots can claim they are the elected leaders, as the algorithm assumes truthfulness from all robots. | All elected leaders will be legitimate w.p. |
| C-SLAM [ 30 ] | iSAM2 [ 31 ] and some bookkeeping [Algorithms 1, 2 and 3]. | Malicious robots can inject false map information, ruining reconstruction. | The output map will be free from malicious influence w.p. |
| Decentralized Trajectory Planning [ 32 ] | Passing a token containing trajectory information for all robots, inserting plans while owning the token [Algorithm 1]. | Malicious robots can add or remove arbitrary trajectories from the token. | Malicious robots have no influence on the planned trajectories w.p. |
| Distributed MPC [ 33 ] | Distributed optimization with a stopping criterion [Algorithm 3]. | One malicious message can terminate the algorithm by triggering the stopping condition [Set ]. | Malicious robots have no influence on the solution w.p. |
| Distributed Optimization [ 34 ] | Distributed optimization with gradient tracking [Algorithm 2]. | A malicious robot can manipulate both its own cost function and the shared gradient tracking variables. | Convergence to the optimal solution a.s. |
| Distributed Task Allocation [ 35 ] | Distributed auction and consensus steps [Algorithms 1 and 2]. | If ever included, a malicious robot can outbid all the others on all tasks as the algorithm assumes truthful bids. | Malicious robots have no influence on task allocation w.p. |
Table S1 : A Sample of Viable Distributed Algorithms for our Safe Wrapper
| Weight space | Mesh space | ||||||
| Configuration | |||||||
| (cm) | (%) | (cm) | (%) | ||||
| References | |||||||
| Nominal, three honest agents | 601.6 | 0.000 | 0.912 | 0.00 | 100.0 | 3.84 | 76.7 |
| Injected malicious model | 1321.7 | 0.912 | 0.000 | 3.84 | 82.0 | 0.00 | 100.00 |
| Data injection at | |||||||
Table S2 : Weight- and mesh-space distance to the nominal and injected maps. In the data-injection runs, each message on the attacked link is overwritten by the malicious model with probability . All quantities are measured at the end of a C-ADMM optimization, against two references: the nominal map built by the three honest robots with no attacker present, and the malicious model the attacker injects. is a symmetric relative distance. is the Chamfer distance, the mean of accuracy and completion over surface samples per mesh, and is the fraction of reference points within cm. Undefended, the honest robots converge to the injected model: exactly matches the reference separation, and of the malicious mesh lies within cm. Applying our safe wrapper restores the map rather than the parameters: the secured run remains at in weight space but only cm from the nominal mesh with completion.
| 1 | 2 | 5 | 10 | 25 | 50 | 100 | 250 | 500 | ||
| 1 | 0.0 | 26.2 | 34.5 | 39.2 | 44.5 | 47.4 | 53.5 | 56.7 | 61.2 | |
| 2 | 0.0 | 26.7 | 34.4 | 37.8 | 43.7 | 47.9 | 52.6 | 58.2 | 61.9 | |
| 5 | 0.0 | 26.6 | 34.5 | 38.4 | 43.9 | 47.7 | 52.2 | 57.0 | 60.3 | |
| 10 | 0.0 | 26.2 | 33.9 | 38.8 | 43.7 | 48.3 | 51.5 | 56.5 | 61.5 | |
| 25 | 0.0 | 26.7 | 33.5 | 39.3 | 43.6 | 47.7 | 52.7 | 55.4 | 60.5 | |
Table S3 : Time to perfect classification and strong connectivity for simulated swarms on a fixed sparse topology. The legitimate robots form a line, with bidirectional links between consecutive robots, and each of the malicious robots is linked to every legitimate robot; there are no links between malicious robots. The topology is fixed across timesteps. Each entry is the mean over trials of timesteps. Trust observations are resampled for all links i.i.d. from the empirical distributions in Figure 5 , and each link is tested at significance level . (A) The number of samples after which no link is misclassified: every compromised link is untrusted and every legitimate link is trusted. (B) The number of samples after which the subgraph of trusted legitimate links is strongly connected. Across all trials, a compromised link was trusted at only a single timestep (one link, at , in one trial with , ); the two times coincide because, on a line, strong connectivity of the trusted subgraph requires every legitimate link to be trusted.
| 1 | 2 | 5 | 10 | 25 | 50 | 100 | 250 | 500 | ||
| 1 | 0.0 | 129.0 | 201.5 | 252.3 | 307.4 | 357.1 | 396.4 | 447.1 | 488.8 | |
| 2 | 0.0 | 134.6 | 202.1 | 250.4 | 303.2 | 353.4 | 387.2 | 446.6 | 491.8 | |
| 5 | 0.0 | 139.8 | 216.2 | 251.7 | 313.9 | 354.6 | 392.6 | 446.0 | 485.6 | |
| 10 | 0.0 | 127.3 | 206.0 | 249.2 | 312.7 | 354.3 | 391.5 | 445.0 | 485.5 | |
| 25 | 0.0 | 129.6 | 209.3 | 251.4 | 317.5 | 353.6 | 388.7 | 446.9 | 478.2 | |
Table S4 : Time for the safe wrapper to classify every link correctly, and to trust a strongly connected subgraph, in simulated swarms. Each entry is the mean over trials of timesteps, for legitimate and malicious robots on a directed Erdős–Rényi communication graph ( ), redrawn every timestep. Trust observations are resampled i.i.d. from the empirical distributions measured in the heading-consensus hardware experiments with a Sybil attacker, and each link is tested with a Confidence Sequence at significance against the threshold . (A) Time after which no link is misclassified: every compromised link is untrusted and every legitimate link is trusted. (B) Time after which the subgraph of trusted legitimate links is strongly connected whenever the legitimate communication graph is (timesteps at which the legitimate robots’ own graph is not strongly connected are not counted). Times are one plus the last timestep at which the condition fails, and if it never fails (as for , where every link is compromised). No compromised link was trusted at any timestep in any trial.