Paper deep dive

Defense-in-Depth at the Perception-Reasoning Interface of LLM-Centric Agentic UAV Swarms

Mohammadhossein Homaei, Yousef Emami, Sajad Homayoun, Rahim Taheri, Hao Zhou, Miguel Gutierrez Gaitan, Bo Wei

Year: 2026Venue: arXiv preprintArea: cs.CRType: PreprintEmbeddings: 97

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 89%

Last extracted: 10/5/2026, 4:59:58 AM

Summary

This paper implements and evaluates a five-layer Defense-in-Depth (DID) architecture to secure the perception-reasoning interface of Large Language Model (LLM)-centric Agentic Uncrewed Aerial Vehicle (UAV) swarms. The system protects against Priority Manipulation Attacks (PMA) where adversaries manipulate structured sensor reports to redirect swarm scheduling. The five layers verify report provenance, physical admissibility, consistency with swarm geometry/service history, schedule fairness, and provide a deterministic fallback scheduler. The study derives closed-form bounds for attack detection and demonstrates that while defenses prevent adversary control, they incur significant cumulative cost increases (74-79%) compared to undefended systems, though safety checks reduce attack-induced costs by 37.5%.

Entities (10)

Defense-in-Depth · security-architecture · 98%LLM-Centric Agentic UAV Swarms · system · 95%Priority Manipulation Attack · attack-vector · 92%Perception-Reasoning Interface · system-component · 90%Layer 1 · defense-mechanism · 85%Layer 2 · defense-mechanism · 85%Layer 3 · defense-mechanism · 85%Layer 4 · defense-mechanism · 85%Layer 5 · defense-mechanism · 85%LAUS · architecture · 80%

Relation Signals (9)

Defense-in-Depth → protects → Perception-Reasoning Interface

confidence 95% · We implement and evaluate defense-in-depth at the perception-reasoning interface of LLM-Centric Agentic UAV Swarms.

Priority Manipulation Attack → targets → Perception-Reasoning Interface

confidence 92% · The Priority Manipulation Attack (PMA) ... shows that an adversary can manipulate otherwise plausible observation data ... to redirect swarm behavior

Layer 3 → detects → backlog inconsistencies

confidence 90% · L3 applies queue conservation to detect backlog changes inconsistent with admissible arrivals.

Defense-in-Depth → mitigates → Priority Manipulation Attack

confidence 90% · We implement and evaluate defense-in-depth ... Five layers check the provenance ... physically admissible ... agree with what swarm geometry ... predict

Layer 5 → provides → deterministic fallback

confidence 90% · L5 maintains a tamper-evident audit log and switches to a deterministic scheduler when rejections persist.

Layer 4 → repairs → unfair schedules

confidence 90% · L4 repairs schedules that concentrate service or starve sensors

Layer 2 → validates → physical admissibility

confidence 90% · L2 compares reported path loss and energy with independent predictions from UAV trajectories, sensor positions, and service history.

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Large Language Models (LLMs) increasingly support Uncrewed Aerial Vehicle (UAV) swarm operations such as data collection scheduling, where the model reads structured sensor reports and decides which sensors to visit. An adversary who quietly manipulates those reports can redirect the swarm without modifying the model weights or the UAV. Defenses for this interface have been proposed architecturally but rarely implemented or evaluated. We implement and evaluate defense-in-depth at the perception-reasoning interface of LLM-Centric Agentic UAV Swarms. Five layers check the provenance of a report, whether its values are physically admissible, whether they agree with what swarm geometry and service history predict, whether the resulting schedule starves any sensor, and, when these fail, hand control to a deterministic scheduler that ignores the suspect input. We test each layer against an adversary strong enough to defeat the layer before it. For each of the three input-side layers, we derive in closed form how far a report can be distorted before that layer reacts, fixing each boundary from deployment parameters before any attack data is collected; across thirty matched simulation runs, predicted and measured boundaries agree. Separating attack detection from response is a well-established principle, and we quantify the cost of neglecting this distinction at the perception-reasoning interface. When the system rejects a report, it replaces it with the most recent accepted report. This prevents the adversary from controlling the UAV schedule, but it also increases cumulative cost by 79% and 74% for the two detectors, respectively, compared with the undefended system. The safety check does not detect any attacks, but it nevertheless reduces the attack-induced cost by 37.5%.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

93,844 characters extracted from source content.

Expand or collapse full text

Defense-in-Depth at the Perception-Reasoning Interface of LLM-Centric Agentic UAV Swarms Mohammadhossein Homaei Yousef Emami Sajad Homayoun Rahim Taheri Hao Zhou Miguel Gutiérrez Gaitán Bo Wei Abstract Large Language Models (LLMs) increasingly support Uncrewed Aerial Vehicle (UAV) swarm operations such as data collection scheduling, where the model reads structured sensor reports and decides which sensors to visit. An adversary who quietly manipulates those reports can redirect the swarm without modifying the model weights or the UAV. Defenses for this interface have been proposed architecturally but rarely implemented or evaluated. We implement and evaluate defense-in-depth at the perception-reasoning interface of LLM-Centric Agentic UAV Swarms. Five layers check the provenance of a report, whether its values are physically admissible, whether they agree with what swarm geometry and service history predict, whether the resulting schedule starves any sensor, and, when these fail, hand control to a deterministic scheduler that ignores the suspect input. We test each layer against an adversary strong enough to defeat the layer before it. For each of the three input-side layers, we derive in closed form how far a report can be distorted before that layer reacts, fixing each boundary from deployment parameters before any attack data is collected; across thirty matched simulation runs, predicted and measured boundaries agree. Separating attack detection from response is a well-established principle, and we quantify the cost of neglecting this distinction at the perception–reasoning interface. When the system rejects a report, it replaces it with the most recent accepted report. This prevents the adversary from controlling the UAV schedule, but it also increases cumulative cost by 79% and 74% for the two detectors, respectively, compared with the undefended system. The safety check does not detect any attacks, but it nevertheless reduces the attack-induced cost by 37.5%. Index Terms: Uncrewed aerial vehicles, agentic artificial intelligence, large language model agents, defense-in-depth, perception-reasoning interface, adversarial robustness, UAV swarm security. I Introduction Uncrewed Aerial Vehicle (UAV) swarms coordinate sensing, communication, and decision-making for surveillance, search and rescue, environmental monitoring, disaster response, and infrastructure inspection. Integrating Artificial Intelligence (AI) into this coordination couples perception directly to decision-making, so an attacker who manipulates the information available to the controller can influence subsequent actions, and dependable operation under adversarial conditions becomes a deployment requirement [1]. Agentic AI lets such systems pursue complex goals with limited supervision [2], but this autonomy also broadens the attack surface [3] to prompts, retrieved knowledge, agent memory, tool interactions, and perception inputs, so security must cover the agentic pipeline rather than the Large Language Model (LLM) in isolation. The concern is acute when LLMs schedule data collection, routing, or task allocation inside the control loop. The model does not observe the network directly: it reads a structured report of each sensor’s backlog, residual energy, and link quality without verifying these values, which makes the perception–reasoning interface a critical security boundary. The Priority Manipulation Attack (PMA) reported for the LLM-Centric Agentic AI for UAV Swarm (LAUS) architecture [4] shows that an adversary can manipulate otherwise plausible observation data, without modifying model weights or the physical system, to redirect swarm behavior and substantially increase packet loss. Because such observations remain syntactically valid and physically plausible, schema-based validation may miss the attack, and similar interface-level weaknesses in LLM-assisted robotics, tool protocols, multi-agent collaboration, and agent memory show that defenses at this interface must be evaluated empirically rather than assumed from architectural separation. We protect this interface with a five-layer Defense-in-Depth (DID) architecture that is implemented and evaluated. L1L_1 verifies report provenance, freshness, and physical admissibility. L2L_2 compares reported path loss and energy with independent predictions from UAV trajectories, sensor positions, and service history. L3L_3 applies queue conservation to detect backlog changes inconsistent with admissible arrivals. At the decision level, L4L_4 repairs schedules that concentrate service or starve sensors, while L5L_5 maintains a tamper-evident audit log and switches to a deterministic scheduler when rejections persist. Removing one layer at a time against a fixed attack would leave later layers untested because L1L_1 blocks a transit-only adversary. Instead, each layer is tested against an adversary capable of bypassing all preceding layers (Fig. 1). This includes perception compromise that passes L1L_1, backlog-only manipulation that bypasses L2L_2, and an adversary that remains within all admissible regions, where the defense can only limit damage. For each report-side layer, we derive a closed-form manipulation bound and evaluate detection and damage separately, since preventing schedule control does not necessarily prevent performance degradation. Fig. 1: Adversary capability ladder and corresponding defense layers. Arrows indicate the capability needed to bypass each layer; at 4A_4, no exploitable redundancy remains and evaluation shifts from detection to residual damage. • A DID architecture stated as an operational rather than structural specification, in which each of the five layers is a computable predicate over quantities the pipeline already holds, given with its parameters, its complexity, the adversary class it terminates, and the class it provably does not. • An adversary ladder for the perception-reasoning interface whose four classes follow from the redundancy structure of the pipeline: each class removes the redundancy exploited by the previous layer, and the ladder terminates once no exploitable redundancy remains. • Three closed-form bounds on adversary budget, one per input-side layer, computable from deployment parameters alone: the channel model caps attainable intensity at κ¯=1.324 κ=1.324, and at 1.0191.019 on the realized geometry; the sensing-noise floor places the cross-modal boundary at κℓdet=1.026κ^det_ =1.026; and the queue recursion caps a backlog-only adversary at κ¯q=1.2 κ_q=1.2 once its target is served. Together they place the nominal PMA intensity outside every admissible region and leave a window whose width is quantified rather than asserted. • A calibration protocol and a paired evaluation on a locally hosted open-weight model, reporting cost, attack success, per-layer detection and false-positive rates, detection curves, the clean-condition cost of the stack and latency, with thresholds fixed on seeds disjoint from evaluation and the two uncalibrated bounds specified as operator budgets. I Related Work I-A LLM-Assisted UAV Autonomy and Swarm Coordination LLMs have been increasingly explored for UAV scheduling, resource allocation, and swarm coordination. Emami et al. [5] introduce In-Context Learning-based Data Collection (ICLDC), which uses an LLM to generate UAV data-collection schedules from natural-language task descriptions and a rule-based verifier to prevent unsafe actions. The system achieves lower cumulative packet loss than Deep Q-Network (DQN) and maximum-channel-gain baselines, but its vulnerability to manipulated task descriptions highlights the security risks of LLM-assisted decision-making. Flight Resource Allocation Scheme based on LLM-enabled ICL (FRSICL) [6] extends in-context learning to real-time flight resource allocation by jointly optimizing UAV data-collection schedules and velocity using environmental feedback, achieving effective Age of Information (AoI) performance without extensive Deep Reinforcement Learning (DRL) retraining. For multi-UAV coordination, Role-Adaptive LLM-driven Yoked Navigation (RALLY) [7] combines LLM-assisted semantic reasoning, structured communication, dynamic role switching, and Multi-agent Reinforcement Learning (MARL) to improve collaborative navigation and role assignment. At the system level, LAUS [4] integrates perception, memory, reasoning, planning, and action into a closed-loop LLM-centric architecture for autonomous UAV swarms. However, it also highlights the expanded attack surface of such systems, including PMAs that can alter observations and influence swarm decisions and network performance. Together, these studies demonstrate the potential of LLMs and agentic architectures for adaptive UAV autonomy while highlighting the need to secure the information exchanged between perception and reasoning. I-B Security and Robustness of LLM-Enabled UAV Systems Security and robustness have become important concerns as LLMs are integrated into autonomous UAV systems. Ferrag et al. [8] survey LLM reasoning and agentic AI for autonomous driving and UAV applications, identifying threats including prompt injection, data poisoning, multimodal perturbations, privacy leakage, and vulnerabilities in cooperative agent communication. For aerial Internet of Things (IoT) security, Li et al. [9] develop an LLM-enabled multi-agent intrusion detection framework that uses specialized agents for data processing and adaptive attack classification, achieving over 90% classification accuracy across benchmark datasets; however, it focuses on network-level intrusion detection rather than manipulation of information supplied to an LLM controller. Ayana et al. [10] introduce PrivLLMSwarm, which applies Secure Multi-Party Computation to protect LLM inference for UAV swarm coordination, demonstrating a privacy–utility tradeoff while addressing confidentiality rather than adversarial observation manipulation. For navigation security, Tariq et al. [11] suggest OrbitGuardNet, combining transformers, Graph Neural Networks (GNNs), Kalman-filter residuals, and an LLM to detect and respond to BeiDou spoofing; although it reports high detection performance in controlled simulations and three-UAV flight tests, its evaluation relies on software-injected rather than open-air Radio Frequency (RF) spoofing. Finally, Aero-LLM [12] distributes specialized LLMs across onboard, edge, and cloud platforms for inference, anomaly detection, and forecasting, demonstrating the potential of distributed intelligence for UAV security and mission operations. Overall, these studies address important aspects of LLM security, privacy, intrusion detection, and navigation resilience, but do not specifically protect the structured observations exchanged between UAV perception and LLM reasoning. I-C LLM-Assisted UAV Scheduling and Security Recent studies have applied LLMs to UAV scheduling and autonomous decision-making, while also identifying vulnerabilities at the perception–reasoning interface [5, 4]. However, existing evaluations consider different attack surfaces, including prompt-level attacks and manipulation of agent observations, rather than systematically protecting structured sensor states used for resource scheduling. At lower layers of UAV systems, security has been studied through Global Navigation Satellite System (GNSS) spoofing [13, 14], jamming [15], control-loop attacks [16, 17], and false-data injection [18]. Provenance and trust mechanisms [19, 20, 21] establish trust in devices or data sources, while output-side guardrails [22, 23, 24, 25] constrain unsafe agent actions. Memory-poisoning studies [26, 27, 28] further show that persistent agent state can be exploited. I-D Research Gap The above studies demonstrate significant progress in applying LLMs and agentic AI to UAV scheduling, swarm coordination, navigation, intrusion detection, privacy preservation, and cybersecurity; however, limited work specifically protects the perception–reasoning interface, where structured information describing sensor states, communication links, energy, queues, and other operational variables is provided to the LLM. The PMA and ICLDC show that manipulated observations and task inputs can redirect LLM-assisted UAV decisions. Other studies address intrusion detection, privacy preservation, navigation spoofing, and general LLM robustness [8, 9, 10, 11, 12], but they do not establish a DID mechanism that protects structured state information before it reaches the reasoning process. Moreover, existing approaches do not systematically evaluate how defenses behave as adversarial capabilities increase, such as when an attacker can compromise the perception module, reproduce valid provenance information, or manipulate quantities lacking an independent prediction. This work addresses this gap through an implemented five-layer DID architecture that combines report provenance and physical-admissibility checks, cross-modal consistency analysis, queue-conservation analysis, schedule-level safety checking, and deterministic fallback control, with each layer implemented as a computable predicate using information available within the UAV pipeline. I System Model and Threat Formulation I-A Network and Mission Model A swarm of U UAVs, indexed by =1,…,UU=\1,…,U\, serves N stationary ground sensors, indexed by =1,…,NN=\1,…,N\, over a horizon =1,…,TT=\1,…,T\ of slots of duration Δt t. Sensor n occupies a fixed position cn∈ℝ2c_n ^2 inside a square region of side D, and UAV u occupies pu(t)∈ℝ2p_u(t) ^2 at constant altitude H, subject to ‖pu(t+1)−pu(t)‖≤vmaxΔt\|p_u(t+1)-p_u(t)\|≤ v_ t. The UAVs fly predetermined trajectories whose waypoints bu(t)b_u(t) cover the sensors within a service radius rexcr_exc. Such trajectories may be designed for capacity, coverage, or propulsion energy, and the approach applies to any given trajectory. Writing dn(z)=H2+‖z−cn‖2d_n(z)= H^2+\|z-c_n\|^2 for the separation and θn(z)=180πarctan⁡(H/‖z−cn‖) _n(z)= 180π (H/\|z-c_n\|) for the elevation angle, air-to-ground links follow the probabilistic Line-of-Sight (LoS) model of [29], in which the elevation angle determines the LoS probability PnLoS(z)=11+a0exp⁡(−b0(θn(z)−a0)),P^LoS_n(z)= 11+a_0 \! (\!-b_0\,( _n(z)-a_0) ), (1) with environment coefficients (a0,b0)(a_0,b_0), and the LoS and non-LoS excess losses combine into the average path loss Ln(z)=20log10⁡(4πdn(z)λ)+PnLoS(z)ηLoS+(1−PnLoS(z))ηNLoS, splitL_n(z)=&20 _10\! ( 4π d_n(z)λ )+P^LoS_n(z)\, _LoS\\ &+ (1-P^LoS_n(z) )\, _NLoS, split (2) where λ is the carrier wavelength. The distinction between two evaluation points is load bearing: the reported path loss is evaluated at z=bu(t)z=b_u(t), before any assignment exists, and the link-success mapping at z=pu(t)z=p_u(t), after it. A transmission attempt on link (u,n)(u,n) succeeds with probability ρu,n(t)=Φ⁡(Ln(pu(t)),τ,k1,k2)∈[0,1], _u,n(t)= (L_n(p_u(t));\,τ,k_1,k_2 )∈[0,1], (3) in which Φ is the monotonically decreasing link-success mapping of the LAUS simulator, parameterized by the loss threshold τ and link constants (k1,k2)(k_1,k_2) and calibrated to a target bit error rate BER⋆BER . The state of sensor n is the triple sn(t)=(qn(t),en(t),ℓn(t))s_n(t)=(q_n(t),e_n(t), _n(t)), with backlog qn(t)∈[0,Qmax]q_n(t)∈[0,Q_ ], residual energy en(t)∈[0,E0]e_n(t)∈[0,E_0], and path loss ℓn(t)=minu⁡Ln(bu(t)) _n(t)= _uL_n(b_u(t)). The scheduler never reads sn(t)s_n(t) but the report of (10), which equals sn(t)s_n(t) up to sensing noise in the absence of an adversary. A scheduling action assigns each UAV to exactly one sensor, x⁡(t)=[xu,n(t)]∈0,1U×N,∑n∈xu,n(t)=1∀u,x(t)= [x_u,n(t) ]∈\0,1\^U× N, _n x_u,n(t)=1\;\;∀ u, (4) and X is the set of matrices satisfying this constraint. A visited sensor is served at rate R packets per visit, so the number of packets drained is μn(t)=R[∑uxu,n(t)≥1]×[ζn(t)≤maxu:xu,n(t)=1ρu,n(t)], split _n(t)=R\,&1 [ _ux_u,n(t)≥ 1 ]\\ ×\,&1 [ _n(t)≤ _u:\,x_u,n(t)=1 _u,n(t) ], split (5) where [⋅]1[·] is the indicator and ζn(t)∼⁡[0,1] _n(t) [0,1] is drawn from the environment stream. Queue and energy evolve as qn(t+1) q_n(t+1) =min⁡[qn(t)−μn(t)]++αn(t),Qmax, = \ [q_n(t)- _n(t) ]^++ _n(t),\;Q_ \, (6) en(t+1) e_n(t+1) =[en(t)−ϵtxμn(t)−ϵidle]+, = [e_n(t)- _tx _n(t)- _idle ]^+, (7) with exogenous arrivals αn(t) _n(t). The distinction between the endogenous service term and the exogenous arrival term later determines where the adversary ladder terminates. The realized service μn(t) _n(t), used by two layers, is not a sensor report: it is formed at the serving UAV from its own delivery receipts and reaches the defense over the swarm’s control link rather than the M3→M4M_3\!→\!M_4 edge. This matters because (24) and (28) are affine in μn _n: a class owning M3M_3 that could also report μ~n=κμn−(κ−1)αn μ_n=κ _n-(κ-1) _n alongside a backlog scaled by κ would make the implied arrival equal the true αn _n exactly, rendering Proposition V.3 and Corollary V.1 vacuous. Two events incur cost, a packet dropped through overflow and a failed transmission attempt, so C⁡(t) C(t) =∑n∈([q¯n(t)−Qmax]++νn(t)), = _n ( [\, q_n(t)-Q_ ]^++ _n(t) ), (8) J J =∑t∈C⁡(t), = _t C(t), (9) where q¯n(t)=[qn(t)−μn(t)]++αn(t) q_n(t)=[q_n(t)- _n(t)]^++ _n(t) is the pre-truncation backlog implied by (6) and νn(t) _n(t) counts failed attempts, each charged as one lost packet. The objective is minx⁡(1:T)J _x(1:T)J, and J is the primary metric consistent with [4]. I-B Agentic Decision Pipeline The scheduler is the closed-loop agent of [4], whose decision pipeline decomposes into six modules (Fig. 2): M1M_1 and M2M_2 acquire telemetry and extract features, M3M_3 serializes them into a structured observation, M4M_4 assembles the prompt, M5M_5 reasons and plans, and M6M_6 validates and actuates. The observation produced by M3M_3 is o⁡(t)=(q^n(t),e^n(t),ℓ^n(t))n∈,o(t)= \ ( q_n(t),\; e_n(t),\; _n(t) ) \_n , (10) where a hat denotes a reported quantity, and σ⁡(t)=ser⁡(o⁡(t))σ(t)=ser(o(t)) is the serialized form carried on the M3→M4M_3\!→\!M_4 edge. Reported quantities are measurements, not ground truth, and in the absence of an adversary satisfy ϕ^n(t)=ϕn(t)+νnϕ(t),νnϕ(t)∼⁡(0,(σϕ)2), φ_n(t)= _n(t)+ν^φ_n(t), ν^φ_n(t) (0,( _φ)^2 ), (11) where σℓ _ is the receiver’s path-loss estimation error after averaging over a packet burst and σe _e the readout error of the battery gauge. We take σℓ=0.5 _ =0.5 dB, a sub-decibel receiver accuracy, and σe=0.05 _e=0.05 J, one idle-slot drain. UAV deviation from its waypoint affects the predictor of (23) rather than the measurement and is treated as model mismatch in (43). This noise sets the scale of the L2L_2 residuals, which Proposition V.2 converts into a detection boundary that a noisier receiver moves rather than invalidates, from κℓdet=1.024κ^det_ =1.024 at 0.50.5 dB to 1.0501.050 at 11 dB. Agentic memory retains a rolling window of WmW_m past decision records, ℳ⁡(t)=(σ⁡(t−j),x⁡(t−j),C⁡(t−j))j=1Wm,M(t)= \ (σ(t-j),\;x(t-j),\;C(t-j) ) \_j=1^W_m, (12) where WmW_m sets both the history the prompt carries and the horizon of the cumulative energy residual of (25). An energy drift of ϵε per slot leaves a one-step residual of exactly ϵε but accumulates to WmϵW_mε across the window, whereas under (11) the clean cumulative residual is the difference of two independent gauge readings, with threshold zN2σez_N 2\, _e irrespective of WmW_m. The cumulative branch therefore dominates the one-step branch precisely when Wm>zN2σeϵ,W_m> z_N 2\, _eε, (13) which at a drift of one gauge quantum gives Wm>4.92W_m>4.92, while a 40964096-token context with a 20482048-token reasoning budget leaves room for the directive, the 6060 scalars of an N=20N=20 observation, and about five records; hence Wm=5W_m=5. Module M4M_4 assembles the prompt π⁡(t)=asm⁡(σ⁡(t),ℳ⁡(t),g)π(t)=asm(σ(t),M(t),g) from the serialized observation, the memory and the static mission directive g, M5M_5 maps it to a candidate assignment, and M6M_6 applies the output-side checks of Section V, x~(t)=θ(π⁡(t)),x⁡(t)=M6(x~(t),ℳ⁡(t)), x(t)=G_θ (π(t) ), x(t)=M_6 ( x(t),\;M(t) ), (14) which closes the loop through (5) and (12). A paired comparison measures the defense rather than decoding noise only if the realized policy θ†G _θ is single-valued, π⁡(t)=π′(t)⟹θ†(π⁡(t))=θ†(π′(t)).π(t)=π (t)\; \;G _θ (π(t) )=G _θ (π (t) ). (15) Greedy decoding is necessary but not sufficient on a batched engine, where different batch neighbors may change the floating-point reduction order, so the property is enforced by memoizing π↦x~π x, leaving the seed-indexed environment stream as the only stochasticity in a run. Fig. 2: Pipeline, attack points, and corresponding defense layers. Input-side layers guard observations before M4M_4, output-side layers guard assignments before M6M_6, and governance spans the slot. 1A_1 intercepts M3→M4M_3\!→\!M_4, 2A_2 controls M3M_3, and memA_mem poisons agent memory; memory remains independent of observation-side attacks, enabling the predictors in (23) and (24). I-C Evaluation Metrics Let JclJ^cl be the cumulative cost under clean conditions with no defense. The degradation ratio Γc=⁡[Jc]/⁡[Jcl] _c=E[J_c]/E[J^cl] reduces to unity for a fully mitigated attack; the undefended PMA was reported at 14.2×14.2×, but because the substrate differs we re-evaluate that condition rather than reuse the value. The attack success rate ASRc=1T∑t∈[xc(t)=xadv(t)]ASR_c= 1T _t 1 [x_c(t)=x^adv(t) ] (16) is the fraction of slots in which the adversary’s intended assignment is actuated; unlike Γ , it separates suppressing control of the schedule from limiting its cost. The full U×NU× N matrix must match, so partial diversion is priced by Γ instead, and the statistic is read against the chance level N−U=1.25×10−4N^-U=1.25× 10^-4 of a uniform scheduler: the undefended 0.0660.066 is 528528 times that level and the defended 0.0010.001 is 88 times it, so the detectors remove 98.7%98.7\% of the adversary’s control in excess of chance, more under a coarser null model. Detection rates are computed over perturbed slots and false-positive rates over clean runs at the calibration of (41), and for 2A_2 also as functions of κ. We also report the defense tax Δtax=⁡[Jdefcl]−⁡[Jcl] ^tax=E[J^cl_def]-E[J^cl] and the per-layer latency of (42). IV Adversary Model: A Capability Ladder An adversary is the tuple =⟨ℰ,,,ℬ⟩A= ,K,V,B comprising the pipeline elements ℰE to which it holds read-write access, the key material K it possesses, the subset ⊆L1,…,L5V \L_1,…,L_5\ of deployed layers whose specification it knows, and its perturbation budget ℬB. In every class the physical environment, the trajectories, and the model parameters θ remain unchanged, and only reported values in (10) are altered. The PMA of LAUS promotes a target set ⊂P and suppresses an urgent set ⊂S , with ∩=∅P = , by scaling reported features multiplicatively at intensity κ>1κ>1. Writing δn=+1 _n=+1 for n∈n , δn=−1 _n=-1 for n∈n , and δn=0 _n=0 otherwise, and letting sϕ∈+1,−1s_φ∈\+1,-1\ encode whether an increase in feature ϕφ raises apparent priority, so sq=+1s_q=+1 while se=sℓ=−1s_e=s_ =-1, the operator is ϕ~n(t)=κδnsϕϕ^n(t),ϕ∈Ω⊆q,e,ℓ, φ_n(t)=κ^\, _ns_φ\, φ_n(t), φ∈ \q,e, \, (17) where Ω is the modified feature subset. The budget is ℬ=(κ,Ω,||,||)B=(κ, ,|P|,|S|), and the configuration of LAUS is recovered at κ=3κ=3 with Ω=q,e,ℓ =\q,e, \. The four classes are not an arbitrary enumeration: each removes exactly the asymmetry the preceding layer exploits, so the ladder terminates once no exploitable redundancy remains. 1A_1, channel adversary, has ℰ=M3→M4E=\M_3\!→\!M_4\, =∅K= , =∅V= , Ω=q,e,ℓ =\q,e, \. This instantiates the PMA directly: the adversary intercepts the serialized observation in transit but holds no key issued to M3M_3. 2A_2, compromised perception node, has ℰ=M3E=\M_3\, =kM3K=\k_M_3\, =L1V=\L_1\, Ω=q,e,ℓ =\q,e, \. It authenticates the tampered observation legitimately, so detection must rely on physical redundancy. 3A_3, redundancy-aware adversary, is as 2A_2 with =L1,L2V=\L_1,L_2\ and Ω=q =\q\. The restriction is forced rather than chosen: reported path loss admits an independent prediction from swarm geometry through (1) and (2), reported energy admits one from service history through (7), and backlog admits neither. Backlog is therefore the only feature a signing adversary can touch without contradicting a source it does not control, while remaining bound by the conservation identity of (6) that L3L_3 enforces. 4A_4, policy-aware adaptive adversary, retains the access and key material of 2A_2, has =L1,…,L4V=\L_1,…,L_4\ and requires the induced assignment to stay inside the region enforced at M6M_6. Unlike 3A_3 it takes Ω=q,ℓ =\q, \ and operates within the interval left open by the propositions, since path loss is detected above κℓdetκ^det_ rather than being unusable. Per slot it selects the largest intensity whose residual remains within the assumed threshold and rotates the suppressed sensor it releases so that (34) never binds; energy stays excluded, since (25) accumulates the drift the one-step check tolerates. It solves maxo~∈ℬ⁡[J⁡(o~)]s.t.θ(asm⁡(o~,ℳ,g))∈adm, _ o _B\;E [J( o) ]\;\;s.t.\;\;G_θ (asm( o,M,g) ) _adm, (18) where ℬO_B is the set of observations reachable under the budget. The input-side layers then have little residual evidence to exploit, with L3L_3 rejecting too few slots to trigger a response, and the objective shifts from detection to bounding damage. A secondary adversary memA_mem writes a fabricated decision record into the memory (12) rather than into the observation, testing whether defenses calibrated on observation-side manipulation generalize to a different injection point. V Defense-in-Depth Architecture We replace the block-diagram functions of LAUS with an operational specification in which each layer is a computable predicate over quantities defined above. Each layer is evaluated against the adversary classes that reach it; for L1L_1–L4L_4, layer LiL_i is associated with the class iA_i that defeats the preceding layer. Thus, L4L_4 and L5L_5 are not detectors: against 4A_4 they bound damage. Intensity is the capability measure because a bound on κ both fixes the layer boundary and quantifies the perturbation magnitude. V-A L1L_1: Integrity Gate The gate is the conjunction of two independent tests, which fail against different adversaries, L1(σ(t))=[VrfkM3(σ(t))]×∏n,ϕ[ϕ^n(t)∈[ϕmin,ϕmax]]. splitL_1 (σ(t) )=&1 [Vrf_k_M_3(σ(t)) ]\\ &× _n,φ1 [ φ_n(t)∈[φ ,φ ] ]. split (19) V-A1 Provenance Module M3M_3 emits, alongside the observation, a tag tag⁡(t)=MACkM3(canon⁡(σ⁡(t))‖t‖ctr(t)),tag(t)=MAC_k_M_3 (\,canon(σ(t))\,\|\,t\,\|\,ctr(t)\, ), (20) with canon⁡(⋅)canon(·) a canonical byte encoding of (10) and ctr⁡(t)ctr(t) a strictly monotonic counter. Binding the slot index and counter is necessary, since authenticating the payload alone would let 1A_1 replay a previously valid observation without forging a tag, so verification at M4M_4 rejects stale or already accepted counters regardless of tag validity. Provenance terminates 1A_1 and provides no protection against 2A_2, which signs legitimately; that asymmetry defines the boundary of the first layer. V-A2 Physically Derived Admissibility A schema check cannot distinguish manipulation from a legitimate operating condition, since a backlogged sensor on a degraded link produces in-schema values. The bounds here are derived from the channel model instead, so path loss reported from altitude H over a region of side D must satisfy ℓmin=20log10⁡(4πHλ)+ηLoS,ℓmax=20log10⁡(4πH2+2D2λ)+ηNLoS, split &=20 _10\! ( 4π Hλ )+ _LoS,\\ &=20 _10\! ( 4π H^2+2D^2λ )+ _NLoS, split (21) obtained by evaluating (2) at an overhead sensor under LoS and at the opposite corner under non-LoS; the remaining bounds are QmaxQ_ and E0E_0. Since (21) bounds the state while L1L_1 sees noisy measurements, and reported energy starts at exactly E0E_0, the unwidened bounds reject 2.13%2.13\% of energy and 22.96%22.96\% of path-loss measurements on clean runs. The bounds for each measured feature are therefore widened by zbandσϕz_band _φ. We use zband=3.5z_band=3.5, giving a path-loss interval of [71.692, 98.963][71.692,\,98.963] dB and zero clean rejections. Backlog is a counter and receives no margin. Proposition V.1. Let L1L_1 admit a reported feature only if it lies in its physically derived band. Then a perturbation of the form (17) at intensity κ passes the admissibility test only if κ≤κ¯(t)κ≤ κ(t), where κ¯(t)=min⁡minn∈⁡Qmaxq^n(t),ℓ^n(t)ℓmin,minn∈⁡E0e^n(t),ℓmaxℓ^n(t). κ(t)= \ _n \ Q_ q_n(t),\; _n(t) \,\; _n \ E_0 e_n(t),\; _n(t) \ \. (22) The inner minima identify the most restrictive sensor-level constraint within the promoted and suppressed sets and the outer minimum selects the tighter of the two. Two of the six scaled quantities do not appear in either bound, because suppressing backlog on S and promoting energy on P both drive the reported value toward zero, and a lower bound at zero imposes no finite constraint when κ≥1κ≥ 1. An empty set contributes +∞+∞. Proof. See Appendix A. ∎ Two implications follow. First, admissibility provides a manipulation budget whose worst-case value is computable from deployment parameters. The interval from ℓmin=73.44 =73.44 dB to ℓmax=97.21 =97.21 dB gives the worst-case admissible scaling κ¯≤1.324 κ≤ 1.324, or 1.3801.380 with the measurement margin, while over clean calibration slots (22) has mean 1.0191.019 and maximum 1.0411.041, because observed path loss occupies a small part of the interval; the nominal κ=3κ=3 is thus infeasible by more than a factor of two. In the opening slot, where every sensor reports its full energy, the unwidened bound gives κ¯(0)=1 κ(0)=1 exactly and the deployed band 1.00351.0035. Second, the bound is asymmetric. Promoted backlog and path loss are bounded by QmaxQ_ and ℓmin , suppressed energy and path loss by E0E_0 and ℓmax , but the two directions that drive a value toward zero remain unconstrained: a congested sensor can be made to look idle and a healthy sensor can be made to appear depleted, and both survive L1L_1. When the gate rejects, the offending fields revert to their values in the last accepted observation, and the substitution is recorded, so the loop never stalls. This stale-hold rule is inherited from LAUS and drives the detection cost of Section VI-B. V-B L2L_2: Cross-Modal Consistency Against 2A_2 the observation is authentic and in band, so detection must rest on redundancy between modules, and two features each admit an independent predictor that bypasses M3M_3. The geometric predictor evaluates (2) directly, ℓngeo(t)=minu∈⁡Ln(bu(t)), ^geo_n(t)= _u L_n (b_u(t) ), (23) from the trajectory waypoints bu(t)b_u(t) and the sensor coordinates cnc_n, both fixed at deployment and neither produced by M3M_3, so it is a closed-form function of t that requires no telemetry. The energy predictor is applied over one step rather than integrated from initialization, so error does not accumulate, enmem(t)=[e^n(t−1)−ϵtxμn(t−1)−ϵidle]+,e^mem_n(t)= [ e_n(t-1)- _tx _n(t-1)- _idle ]^+, (24) with e^n(t−1) e_n(t-1) and μn(t−1) _n(t-1) read from memory. Since an adversary could drift reported energy below τcmc _cmc each slot and accumulate an arbitrary offset, the layer also evaluates the cumulative residual rne,cum(t)=|e^n(t)−e^n(t−Wm)+∑j=1Wm(ϵtxμn(t−j)+ϵidle)|.r^e,cum_n(t)= | e_n(t)- e_n(t-W_m)+\!\! _j=1^W_m\!\! ( _tx _n(t-j)+ _idle ) |. (25) The one-step residuals are rnℓ(t)=|ℓ^n(t)−ℓngeo(t)|,rne(t)=|e^n(t)−enmem(t)|,r _n(t)= | _n(t)- ^geo_n(t) |, r^e_n(t)= | e_n(t)-e^mem_n(t) |, (26) and the layer accepts only if these and (25) fall below thresholds obtained from (41) on clean runs. The detection power of L2L_2 against 2A_2 is then a threshold in κ that follows from (11) in closed form. Proposition V.2. Let τcmc _cmc be the (1−α)(1-α) quantile of the clean per-slot residual. Because the layer accepts on the maximum over N sensors, that statistic is the maximum of N half-normal variates under (11), so τcmc=zNσℓ _cmc=z_N _ with zN=Φ−1(12(1+(1−α)1/N))z_N= _N^-1\! ( 12 (1+(1-α)^1/N ) ), where Φ _N is the standard normal distribution function, distinct from the link-success mapping Φ of (3), and zNz_N exceeds the single-scalar quantile z1−αz_1-α. Let the adversary retain ℓ∈Ω ∈ at intensity κ. Then the path-loss residual of (26) exceeds τcmc _cmc, and L2L_2 rejects, for every κ≥κℓdet=max⁡ℓminℓmin−τcmc, 1+τcmcℓmin,κ\;≥\;κ^det_ = \ - _cmc,\;1+ _cmc \, (27) where the first argument governs the promoted set and the second the suppressed set, both at the worst case ℓn=ℓmin _n= . Proof. See Appendix A. ∎ The boundary depends only on the band and the noise scale, so it is known before any run. The analytical zN=3.479z_N=3.479 gives τcmc=1.740 _cmc=1.740 dB and κℓdet=1.024κ^det_ =1.024; the deployed threshold, the calibrated quantile of 1.7871.787 dB plus the 5%5\% margin of Section V-G, is 1.8771.877 dB and gives 1.0261.026, whereas the single-scalar quantile would have given 1.0181.018, below κ=1.02κ=1.02, where measured detection is only 0.7670.767. Together, Proposition V.1 (realized mean 1.0191.019) and Proposition V.2 (all perturbations detected at κ≥1.026κ≥ 1.026) confine an adversary that is admissible and undetected to roughly κ∈[1,1.02]κ∈[1,1.02], a window that closes as σℓ→0 _ → 0 under the model assumptions. Appendix B shows that this boundary is a property of the sensing-noise floor rather than of the multiplicative form of (17), and quantifies through (43) how model mismatch in ℓngeo ^geo_n shifts it. Backlog has no independent measurement, which motivates 3A_3 and a layer exploiting the conservation law governing backlog. V-C L3L_3: Memory-Informed Anomaly Detection Against 3A_3 the observation is authentic, in band, and consistent with every independent predictor. One test remains, and it tests the conservation identity the backlog must satisfy [30] rather than a second measurement of it. Arrivals are unobserved but not unconstrained, so inverting the queue recursion over one step gives the arrival count implied by two consecutive reports, α^n(t−1)=q^n(t)−[q^n(t−1)−μn(t−1)]+, α_n(t-1)= q_n(t)- [ q_n(t-1)- _n(t-1) ]^+, (28) which must lie in [0,αmax][0,α ] for any physically realizable arrival process. Proposition V.3. Let sensor n∈n carry a persistent multiplicative backlog perturbation at intensity κ, so q^n(t′)=κqn(t′) q_n(t )=κ q_n(t ) throughout the window, and suppose neither clamp in (6) is active, that is κqn(t−1)≥μn(t−1)κ q_n(t-1)≥ _n(t-1) and κqn(t)≤Qmaxκ q_n(t)≤ Q_ . Then α^n(t−1)=καn(t−1)−(κ−1)μn(t−1), α_n(t-1)=κ\, _n(t-1)-(κ-1)\, _n(t-1), (29) and the perturbation passes the admissibility test only if κ≤κ¯q(t)=μn(t−1)μn(t−1)−αn(t−1),μn(t−1)>0,αmaxαn(t−1),μn(t−1)=0.κ≤ κ_q(t)= cases _n(t-1) _n(t-1)- _n(t-1),& _n(t-1)>0,\\[6.88889pt] α _n(t-1),& _n(t-1)=0. cases (30) Proof. See Appendix A. ∎ The served branch is the operative one. Since αn≤αmax _n≤α , the bound is at most R/(R−αmax)=24/20=1.2R/(R-α )=24/20=1.2 under Table I, so any intensity above 1.21.2 is rejected the first time a promoted sensor is served; at κ=3κ=3 the implied arrival is 3αn−48≤−363 _n-48≤-36. This bounds 3A_3 by design rather than by calibration: draining μ packets must reduce the reported backlog by μ, whereas an inflated report falls by κμκμ, leaving (κ−1)μ(κ-1)μ packets no non-negative arrival can explain, and an adversary that keeps its target unserved to stay hidden forfeits the objective. When the inner clamp is active the test falls back to the unserved branch, and a field exceeding QmaxQ_ has already been repaired by the band check. The check costs O⁡(N)O(N). Corollary V.1. Let arrivals be drawn independently of the service outcome from a distribution clipped at αmaxα , so that πmax=Pr[αn=αmax]>0 _ = [ _n=α ]>0 and the operator knows αmaxα exactly, and let a promoted sensor carry a persistent perturbation at any κ>1κ>1. Then in every slot the test rejects with probability at least πmaxPr[μn=0] _ [ _n=0], and with probability one whenever μn>0 _n>0 and κ>R/(R−αmax)κ>R/(R-α ). The slots until first rejection are stochastically dominated by a geometric variable whose expectation is finite for every κ>1κ>1. Proof. See Appendix A. ∎ Propositions V.1 and V.2 leave 2A_2 a narrow interval, while Corollary V.1 leaves 3A_3 none: every κ>1κ>1 is detected in finite expected time, so a smaller κ only delays detection. The premise is a modeling choice: the arrival cap is attained and known in the simulator of [4], but under an unbounded arrival law or a loose declared cap πmax→0 _ → 0, and an adversary with κ≤1.2κ≤ 1.2 keeping its target unserved is not detected at all. A second, far more sensitive mechanism operates at the onset slot t0t_0 alone, where only one of the two reports entering (28) is scaled, q^n(t0)=κqn(t0) q_n(t_0)=κ q_n(t_0) but q^n(t0−1)=qn(t0−1) q_n(t_0-1)=q_n(t_0-1), so α^n(t0−1)=καn(t0−1)+(κ−1)[qn(t0−1)−μn(t0−1)]+, α_n(t_0-1)=κ\, _n(t_0-1)+(κ-1) [q_n(t_0-1)- _n(t_0-1) ]^+, (31) whose second term, absent from (29), scales with the standing backlog. Rejection occurs whenever κ>(αmax+q¯)/(αn+q¯)κ>(α + q)/( _n+ q) with q¯=[qn(t0−1)−μn(t0−1)]+ q=[q_n(t_0-1)- _n(t_0-1)]^+, which for an unserved sensor with the initial backlog of 2121 packets gives κ>1.06κ>1.06. An attack present from t=1t=1 has no unperturbed predecessor and does not trigger this transient mechanism, so the evaluation reports onset at t=1t=1 and t=⌈T/3⌉t= T/3 separately. V-D L4L_4: Safety Validator The first statistic is the largest share of assignments captured by any k sensors over a window of W slots, Ψk(t,W)=maxS⊆|S|=k⁡1UW∑t′=t−W+1t∑u∈∑n∈Sxu,n(t′), _k(t;W)= _ subarraycS \\ |S|=k subarray 1UW _t =t-W+1^t\; _u \; _n∈ Sx_u,n(t ), (32) computed on the actuated pattern, rather than on a reported feature, so an observation-side adversary cannot modify it directly. The denominator UWUW makes Ψk _k a share of a fixed budget rather than a rate, since a rate would be biased upward before the window fills and would trigger on 32.7%32.7\% of clean warm-up slots. The pair (k,W)(k,W) must satisfy k<U,W>max⁡R⁡[α],Tb,k<U, W> \ RE[α],\;T_b \, (33) where TbT_b is the trajectory period in slots: for k≥Uk≥ U the k most visited sensors cover the swarm in one slot, and a window shorter than either the revisit period R/⁡[α]R/E[α] or TbT_b saturates Ψk _k regardless of the adversary. These periods are 9.29.2 and 1010 slots, so (k,W)=(2,12)(k,W)=(2,12); under a deterministic reference scheduler the clean-attacked separation for k=2k=2 rises from 4.04.0 pooled standard deviations at W=8W=8 to 15.015.0 at W=12W=12 and 21.921.9 at W=20W=20. Concentration bounds the service any k sensors may capture, but not the service denied to any one sensor. The complementary statistic is the longest interval any sensor has gone unserved, Θ⁡(t,x)=maxn∈⁡(t−ςn(t)), (t;x)= _n (t- _n(t) ), (34) with ςn _n as in (36), evaluated on the proposal so a sensor served now resets to zero and one never visited counts as t+1t+1; it needs no window, since Θ⁡(t)≤t+1 (t)≤ t+1. Both constraints are needed because the attack redistributes rather than concentrates service, changing the identity of the underserved set while leaving concentration nearly unchanged: over the calibration runs the maximum of Ψ2 _2 is 13/3613/36 clean and 14/3614/36 attacked, whereas Θ exceeds 1818 in no clean slot but in 39.5%39.5\% of attacked slots, with its maximum increasing from 1818 to 3030, corresponding to a sensor never served. A validator built on (32) alone would miss this attack. The validator projects the proposal onto the region jointly induced by the two statistics, adm=x∈:Ψk(t,W)≤βk∧Θ⁡(t,x)≤θmax,X_adm= \x : _k(t;W)≤ _k\; \; (t;x)≤ _ \, (35) and enforces it by repair rather than rejection, since a rejected assignment still leaves the swarm to be scheduled. While either constraint is violated, the procedure removes one UAV from the sensor that constraint objects to, the arg-max subset S⋆S attaining Ψk _k in the first case and any served sensor in the second, and reassigns it to n⋆=arg⁡maxn∈ℛu(t)∖S⋆⁡(t−ςn(t)),ℛu(t)=n:‖cn−bu(t)‖≤rexc,ςn(t)=max⁡t′<t:∑uxu,n(t′)≥1. splitn &= _n _u(t) S (t- _n(t) ),\\ R_u(t)&= \n:\|c_n-b_u(t)\|≤ r_exc \,\\ _n(t)&= \t <t: _ux_u,n(t )≥ 1 \. split (36) Reachability and time since last visit come from the deployment configuration and the visit history, not from a reported feature, so a compromised observation cannot steer the repair. Ties break by sensor index, keeping the repair consistent with (15), and it terminates in at most U iterations with cost O⁡(N)O(N). V-E L5L_5: Governance, Audit, and Fallback The governance layer performs no detection; it records events and bounds the duration of an undetected compromise. Each slot appends a record ϱt=(t,H(σ(t)),L1:4 verdicts,x~(t),x(t)) _t=(t,H(σ(t)),L_1:4 verdicts, x(t),x(t)) to a hash-chained log, ht=H(ht−1∥ϱt),h0=H(nonce),h_t=H (h_t-1\,\|\, _t ), h_0=H(nonce), (37) so retrospective alteration of any verdict would invalidate every later digest, which matters when a compromised perception node could otherwise erase the evidence of its own rejections. The kill switch monitors the rejection rate over a sliding window of WgW_g slots. With the per-slot rejection indicator r⁡(t)=[flag1(t)∨flag2(t)∨flag3(t)∨(x~(t)∉adm)],r(t)=1 [flag_1(t) _2(t) _3(t) ( x(t) _adm ) ], (38) the switch replaces the policy output with the fallback once 1Wg∑t′=t−Wg+1tr⁡(t′)>γ⟹x⁡(t)=Πfb(ℳ⁡(t)), 1W_g _t =t-W_g+1^tr(t )>γ\; \;x(t)= _fb (M(t) ), (39) where the fallback is the deterministic scheduler Πfb(ℳ(t))∈argmaxx∈∑u,nxu,n 1[n∈ℛu(t)](t−ςn(t))qˇn, _fb (M(t) )∈ _x _u,nx_u,n\,1 [n _u(t) ]\, (t- _n(t) )\, q_n, (40) with qˇn q_n the backlog in the most recent observation accepted jointly by L1L_1 and L2L_2. It invokes no language model, so prompt manipulation cannot propagate into it; it does not read the live observation, so it does not inherit the corruption that triggered it, unlike any scheduler consuming o~(t) o(t), including the in-context baseline of [5]; and it schedules only reachable sensors. Once triggered, the switch stays in fallback for at least WhW_h slots and readmission requires WhW_h consecutive clean slots, preventing rapid switching near γ. V-F Composition, Precedence, and Complexity Layers L1L_1 to L3L_3 execute before prompt assembly, L4L_4 after inference, and L5L_5 operates across the slot (Algorithm 1). Two precedence rules are not implied by this ordering and must therefore be specified explicitly. Input-side rejection short-circuits inference when the substituted observation reproduces an already evaluated prompt. The joint L1L_1–L2L_2 verdict is also informative: L1L_1 failing with L2L_2 passing is consistent with a transport fault and is handled locally, whereas L1L_1 passing with L2L_2 failing indicates an authenticated but physically inconsistent observation and is escalated to L5L_5. The per-slot computational cost is O⁡(UN+Nlog⁡N)O(UN+N N), dominated by the cross-modal recomputation of (2) over UAV and sensor pairs and the validator’s sorting operation, which Appendix E verifies empirically. Algorithm 1 Defended per-slot control loop 1: input: σ⁡(t),tag⁡(t),ℳ⁡(t)σ(t),tag(t),M(t) 2: if ¬Vrf⁡(σ⁡(t),tag⁡(t)) \,Vrf(σ(t),tag(t)) or band check fails then 3: repair offending fields from last accepted observation; flag1←trueflag_1← true 4: end if 5: compute rℓ,re,re,cumr ,r^e,r^e,cum by (26) and (25) 6: flag2←flag_2← any residual exceeds its threshold 7: flag3←α^n(t−1)∉[0,αmax]flag_3← α_n(t-1)∉[0,α ] for some n 8: if flag1∧¬flag2flag_1 \,flag_2 then 9: proceed with repaired observation ⊳ channel fault 10: else if flag2∨flag3flag_2 _3 then 11: escalate to L5L_5 ⊳ authenticated, inconsistent 12: end if 13: π⁡(t)←asm⁡(σ⁡(t),ℳ⁡(t),g)π(t) (σ(t),M(t),g); x~(t)←θ(π⁡(t))\; x(t) _θ(π(t)) 14: flag4←Ψk(t,W)>βk∨Θ⁡(t,x~(t))>θmaxflag_4← _k(t;W)> _k (t; x(t))> _ 15: x⁡(t)←flag4?Πadm(x~(t))x(t) _4\;?\; _X_adm( x(t)) by (36):x~(t)\;:\; x(t) 16: if 1Wg∑r⁡(t′)>γ 1W_gΣ r(t )>γ by (38) then 17: x⁡(t)←Πfb(ℳ⁡(t))x(t)← _fb(M(t)) by (40) 18: end if 19: append ϱt _t to the chain (37); return x⁡(t)x(t) V-G Threshold Calibration and Latency Accounting Thresholds are calibrated on clean runs rather than tuned against the attack. For a target per-slot false-positive rate α, τcmc=Q1−α(ℛclean), _cmc=Q_1-α (R^clean ), (41) where Q1−αQ_1-α is the empirical quantile and ℛcleanR^clean collects the residuals of (26) from attack-free runs on seeds disjoint from evaluation, so the false-positive rate is a design target rather than a fitted quantity. Because the clean residual is pure sensing noise, the empirical quantile should converge to the analytical zNσℓz_N _ , and it does: 1.7871.787 dB against 1.7401.740 dB. A 5%5\% margin gives the deployed τcmc=1.877 _cmc=1.877 dB. On the evaluation seeds the per-branch rates are 0.00220.0022, 0.00890.0089 and 0.00110.0011 for the geometric, one-step energy and cumulative residuals, respectively, each at or below α=0.01α=0.01. The one-step energy branch is evaluated only when the preceding record was accepted by both L1L_1 and L2L_2, and the cumulative branch only when every record in its window was. Otherwise a substituted anchor makes the residual measure service since the substitution, of order ϵtxR=8.4 _txR=8.4 J rather than σe=0.05 _e=0.05 J, producing a second mode with 3030 of 3131 occurrences between 8.378.37 and 8.578.57 J. The guard does not reduce detection, since L2L_2 rejects every perturbed slot of 2A_2 either way, and lowers the branch false-positive rate from 0.03440.0344 to 0.00110.0011 and the layer union from 0.04560.0456 to 0.01220.0122; replaying the record identity against the ground-truth state gives zero firings over 290290 slots. The concentration bound is specified rather than calibrated, since calibration would merely encode the concentration the unconstrained agent produces. At W=12W=12, Ψ2 _2 lives on the lattice j/36j/36 with maxima 13/3613/36 clean and 14/3614/36 attacked, so no budget both preserves clean operation and constrains the attack; we set β2=15/36=0.4167 _2=15/36=0.4167, which is why concentration never fires. Θ attains exactly 1818 over the calibration runs, so θmax=18 _ =18 is the tightest budget with no calibration-time activation; it is exceeded in 39.5%39.5\% of attacked slots and in 1.0%1.0\% of clean evaluation slots, a clean-condition constraint activation rather than a detector false positive. Alternative starvation budgets trade off attacked and clean repairs: 53.3%53.3\% against 5.8%5.8\% at θmax=14 _ =14, 46.5%46.5\% against 0.83%0.83\% at 1616, and 32.5%32.5\% against 0.00%0.00\% at 2020. With the model co-located, latency has no transport term, Λ⁡(t)=Λpre(|π⁡(t)|)+Λdec(|x~(t)|)⏟inference+∑i=15Δi(t), (t)= _pre (|π(t)| )+ _dec (| x(t)| )_inference\;+\; _i=1^5 _i(t), (42) where Δi _i is the latency added by LiL_i. Each layer performs at most O⁡(UN+Nlog⁡N)O(UN+N N) arithmetic, so the defense overhead is expected to remain small relative to model inference; the measured latency is reported in Section VI. VI Performance Evaluation Across the Adversary Ladder VI-A Testbed, Substrate, and Protocol Three UAVs serve twenty ground sensors over a 100×100100× 100 m2 region at 100100 m altitude for thirty slots under the objective of (9) (Table I). The scenario, mission parameters and cost metric are inherited from the LAUS testbed, while the undefended attacked condition is re-run on the present substrate, a locally hosted open-weight model under greedy, grammar-constrained decoding, so absolute costs are not comparable with LAUS: the studies share the scenario, but not the scheduler. An ablation shows that the decision depends on the generated reasoning trace rather than only on the observation: over ten prompts, removing the reasoning trace changes the actuated assignment in every case, and truncation to one-quarter, one-half, and three-quarters changes it in 70%70\%, 60%60\% and 20%20\% of cases. Every condition is evaluated over Nrun=30N_run=30 paired seeds, each with its exogenous stream drawn once before any action and then indexed rather than consumed. Seeds run in lockstep, with a slot’s prompts dispatched as one batch of fixed width, and decoded assignments are memoized on a hash of the prompt, making π↦x~π x single-valued across conditions; replaying a run from the store reproduced its cost and decision trace exactly. Thresholds are fixed beforehand on disjoint calibration seeds. Each layer is evaluated only against classes that reach it: for 1A_1, no defense, L1L_1, L1L_1 with the fallback, the validator, and the validator with provenance; for 2A_2, L1L_1, L1L_1 with L2L_2, that pair with the fallback, and the full stack; for 3A_3, both configurations reported in Table I; and for the two variants of 4A_4 and memA_mem, the full stack. Clean undefended and defended conditions bracket the grid. Significance uses the Wilcoxon signed-rank test over paired seeds, while the Friedman test assesses differences across all conditions, with percentile bootstrap intervals over 10410^4 resamples, since the attacked cost distribution is asymmetric. The Friedman test over all fifteen conditions gives χ2=353.5χ^2=353.5 on 1414 degrees of freedom (p=7.6×10−67p=7.6× 10^-67). The value p=1.7×10−6p=1.7× 10^-6 is the two-sided floor of the normal approximation at n=30n=30, reached when all thirty paired differences share a sign. TABLE I: Key testbed configuration parameters. Parameter Value UAVs U / sensors N / horizon T 3 / 20 / 30 Region D×D× D / altitude H 100×100100× 100 m2, 100 m Buffer QmaxQ_ / energy budget E0E_0 60 packets / 50 J Service volume R per visit 24 packets Arrival mean / cap αmaxα 2.6 / 4 packets per slot Attack intensity κ 3 Model / revision Qwen3-8B-AWQ / 4da05a8e Quantization / decoding 4-bit AWQ / greedy, grammar-constrained Slot Δt t / speed limit vmaxv_ 5.0 s / 14.0 m/s Memory window WmW_m 5 records Sensing noise σℓ _ / σe _e 0.5 dB / 0.05 J Starvation budget θmax _ 18 slots Kill switch (γ,Wg,Wh)(γ,W_g,W_h) (0.6,5,3)(0.6,5,3) Calibration target α 0.01 Evaluation / calibration seeds 0–29 / 100–119 Hardware / serving RTX 4070, i9-14900K; vLLM 0.27.1 VI-B Results Table I reports the results. Its two central metrics move independently: Γ says how much the mission suffered, the success rate whether the adversary was still choosing the schedule. TABLE I: Per-layer evaluation across the adversary ladder, Nrun=30N_run=30. The ratio Γ is normalized to the clean undefended row, ASR is (16), and p is the two-sided Wilcoxon signed-rank value against the undefended attacked row. The 95% CIs are percentile-bootstrap intervals, and σ is the sample standard deviation. Condition Active layers Mean J σ 95% CI Γ ASR Fallback (%) p Clean, undefended — 39.93 5.86 [37.93, 42.17] 1.00 — 0.0 — 1A_1, undefended — 124.97 19.69 [117.80, 131.93] 3.13 0.066 0.0 — 1A_1 L1L_1 223.97 67.24 [200.63, 248.23] 5.61 0.001 0.0 5.2×10−65.2×10^-6 1A_1 L1,L5L_1,L_5 89.37 32.78 [78.23, 101.30] 2.24 0.002 93.3 1.9×10−41.9×10^-4 1A_1 L4L_4 93.10 26.68 [83.80, 102.73] 2.33 0.069 0.0 1.5×10−51.5×10^-5 1A_1 L1,L4L_1,L_4 165.50 53.11 [146.83, 184.10] 4.14 0.000 0.0 1.0×10−31.0×10^-3 2A_2 L1L_1 126.37 24.28 [117.70, 134.77] 3.16 0.070 0.0 0.810.81 2A_2 L1,L2L_1,L_2 220.07 70.60 [195.27, 245.57] 5.51 0.002 0.0 7.0×10−67.0×10^-6 2A_2 L1,L2,L5L_1,L_2,L_5 89.63 32.53 [78.60, 101.50] 2.24 0.002 93.6 2.0×10−42.0×10^-4 2A_2 L1L_1 to L5L_5 89.63 32.53 [78.60, 101.50] 2.24 0.002 93.6 2.0×10−42.0×10^-4 3A_3 L1,L2L_1,L_2 38.90 7.01 [36.63, 41.53] 0.97 0.001 0.0 1.7×10−61.7×10^-6 3A_3 L1L_1 to L5L_5 40.87 11.82 [37.50, 45.67] 1.02 0.001 1.8 1.7×10−61.7×10^-6 4A_4 surrogate L1L_1 to L5L_5 40.70 6.00 [38.63, 42.87] 1.02 0.000 0.8 1.7×10−61.7×10^-6 4A_4 policy-exact L1L_1 to L5L_5 43.23 15.95 [38.33, 49.40] 1.08 0.001 0.7 1.7×10−61.7×10^-6 memA_mem L1L_1 to L5L_5 38.00 5.75 [36.03, 40.10] 0.95 0.016 0.3 1.7×10−61.7×10^-6 Clean, defended L1L_1 to L5L_5 41.00 7.30 [38.60, 43.73] 1.03 — 0.3 1.7×10−61.7×10^-6 Fig. 3: Detection and response, from Table I over 3030 paired seeds, grouped by adversary class. Within each group, adding a detector drives the attack success rate to the floor while the degradation ratio rises above the undefended baseline. The validator L4L_4, which detects nothing, is the only single layer that lowers Γ against 1A_1. The two 4A_4 bars are the surrogate and policy-exact adversaries, differing by 0.060.06 in Γ after 6,9606,960 queries to the deployed model. Fig. 3 places the two metrics side by side, and the L4L_4-only condition shows the distinction most clearly: the validator detects no attack, yet removes 37.5%37.5\% of the excess cost ⁡[J]−⁡[Jcl]E[J]-E[J^cl], from 85.0485.04 to 53.1753.17 packets, so Γ falls from 3.133.13 to 2.332.33. Over the 900900 evaluation slots, concentration is never violated, while starvation is violated in 5959, so every repair comes from starvation. Adding provenance drives the success rate to zero but raises Γ from 2.332.33 to 4.144.14, significantly above the undefended 3.133.13 (p=1.0×10−3p=1.0× 10^-3), because the stale snapshot costs more than the starvation constraint recovers; relative to L1L_1 alone (Γ=5.61 =5.61), the validator still removes 31.8%31.8\% of the excess. The rows at 0.970.97 and 0.950.95 do not mean the attack improved the mission: Γ is normalized to the clean undefended condition, and relative to the clean defended cost of 41.0041.00 both remain close to unity. VI-B1 Rung one, the channel adversary The undefended condition re-establishes the PMA vulnerability on this substrate, and provenance terminates 1A_1, since without kM3k_M_3 the adversary cannot recompute a tag and the counter binding rejects a replay. The detection rate is unity on every perturbed slot, so what matters is Γ with and without L5L_5. Provenance drives the success rate from 0.0660.066 to 0.0010.001 while Γ rises from 3.133.13 to 5.615.61 (p=5.2×10−6p=5.2× 10^-6): the adversary no longer chooses the schedule, yet mission cost is higher than with no defense. The fallback returns Γ to 2.242.24 at the price of 93.3%93.3\% of slots under fallback control. The pattern recurs at rung two, where cross-modal consistency drives the success rate from 0.0700.070 to 0.0020.002 while Γ rises from 3.163.16 to 5.515.51 (p=7.0×10−6p=7.0× 10^-6). VI-B2 Rung two, the compromised perception node Because 2A_2 signs its own observation, only the admissibility component of L1L_1 can act, and these rows test the asymmetry of Proposition V.1: four of the six scaled quantities are held to a realized intensity of about 1.021.02, while the other two remain unconstrained. At κ=3κ=3 the promoted backlog is scaled by 3.003.00 and the promoted energy by 0.330.33, both unclipped, while the suppressed energy is bounded at 1.001.00 and the promoted path loss at 0.970.97. Damage propagates through the unconstrained directions, so L1L_1 alone is statistically indistinguishable from no defense (Γ=3.16 =3.16 against 3.133.13, p=0.81p=0.81). With reported path loss pinned at the band floor, the residual ℓn−ℓmin _n- persists, at every admissible intensity, which is why the true-positive rate stays at unity. Once L2L_2 is active the terminal layers are redundant for this class: the full stack and L1L_1, L2L_2, L5L_5 give the same cost on every seed. VI-B3 Rung three, the redundancy-aware adversary Confined to backlog, 3A_3 passes L2L_2, and the manipulation the implied-arrival and output-side constraints still permit is not operationally significant. The L3L_3 adversary-caused rejection rate is 0.0330.033 at a realized promoted intensity of only 1.00551.0055, because the unserved branch αmax/αnα / _n of (30) admits no manipulation in the 26%26\% of slots where arrivals reach the cap. Consistent with Corollary V.1, the adversary gains stealth only by reducing the intensity until it produces no measurable damage, so this row confirms the bounds rather than testing them independently (Section VI-E). VI-B4 Rung four, the policy-aware adaptive adversary Since 4A_4 solves (18), the figure of merit is the residual Γ against the undefended value. It is limited by the admissible observation set rather than by (35), which acts on the actuated pattern, since visits to lightly loaded sensors can let heavily loaded queues grow while the pattern stays dispersed. Propositions V.1 and V.2 confine 4A_4 to κ∈[1,1.02]κ∈[1,1.02], about 1.41.4 dB of path-loss distortion, below the 1.741.74 dB at which L2L_2 reacts. Because the model is open-weight, the policy-exact adversary runs a local copy of θG_θ, decoding K=8K=8 candidate observations per slot over the open window and committing the one whose induced assignment has the highest expected one-slot cost, requiring 6,9606,960 decodes and 8.48.4 GPU hours. The difference in mean cost is not statistically significant (p=0.99p=0.99 against the surrogate); the effect is in the tail. On 1414 of 3030 seeds it does strictly less damage, because greedy per-slot optimization inside so narrow a window can raise cost later, while two seeds add +47+47 and +57+57 packets, raising σ from 6.006.00 to 15.9515.95 and Γ only to 1.081.08. On both outliers the validator performs no repair and Θ stays within budget: this is residual capability that remains admissible, rather than capability excluded by the bounds. The governance rule is itself exploitable, since L3L_3 rejects fewer than one perturbed slot in ten while the switch triggers only above γ=0.6γ=0.6 over Wg=5W_g=5 slots, so fallback occupancy stays at 0.7%0.7\%. VI-B5 A different injection point and attack onset The memory-poisoning variant leaves the live observation clean and consistent with both predictors, so no observation-side layer fires and the case is handled on the decision side. The success rate is 0.0160.016, the highest among the full-stack defended adversarial conditions and roughly an order of magnitude above the observation-side classes, yet Γ=0.95 =0.95 and fallback occupancy is 0.3%0.3\%, as in the clean defended condition: the adversary acquires a small share of schedule control without increasing mission cost. The present runs do not distinguish whether the record shifts the choice only among assignments already satisfying (35) or the starvation constraint repairs the difference; they establish that the decision-side constraints bound damage from an injection point they were not calibrated against, and that no layer identifies it. For attack onset (Appendix C), 3A_3 gives the same outcome at both onsets, while for 2A_2 they differ in duration rather than detection, with fallback occupancy falling from 93.6%93.6\% to 57.1%57.1\% and Γ from 2.242.24 to 1.481.48. VI-C Detection Curves and Per-Layer Rates Proposition V.2 predicts the transition, since a promoted sensor’s residual rnℓ=ℓn(1−κ−1)r _n= _n(1-κ^-1) crosses τcmc _cmc at κℓdetκ^det_ , and Fig. 4 tests it. For the onset condition, detection reaches unity at the predicted boundary and rises gradually below it, from 0.1000.100 at κ=1.01κ=1.01 to 0.7670.767 at κ=1.02κ=1.02, because (27) is the worst case for a sensor at the band floor and sensors with larger path loss, and noise, cross earlier; the lower run-average rate reflects slots already operating from a substituted observation. The L1L_1 band rejects 2A_2 at none of the tested intensities, including κ=3κ=3, as Proposition V.1 implies: knowing L1L_1, a rational adversary clips to the band, and once κ>κ¯κ> κ the reported path loss is pinned at the floor and the residual saturates at ℓn−ℓmin _n- . The L3L_3 sweep (Appendix D) shows an onset rejection rate rising from 0.600.60 at κ=1.05κ=1.05 to unity by κ=1.15κ=1.15, bracketing the transient threshold of 1.061.06, and a steady-state rate of at least 0.5860.586. Fig. 4: Detection of 2A_2 by L2L_2 against the boundary κℓdetκ^det_ that Proposition V.2 fixes before any run. The shaded region is the interval Proposition V.1 leaves admissible on the realized geometry. The axis is broken because all rates saturate beyond κ=1.05κ=1.05. Provenance rejects every perturbed slot of 1A_1 at a false-positive rate of 0.0010.001, the L1L_1 band and the concentration constraint never fire, and L4L_4 starvation fires on 0.0680.068 of perturbed slots at a clean rate of 0.0100.010. For the two detectors the aggregate rate conflates a detection, where the current report violates the admissibility condition, with a cascade, where the reference state is itself a substituted observation. Although L2L_2 rejects every perturbed slot of 2A_2, only about one in fifteen rejections is attributable to the current manipulation, because the last accepted report never refreshes under a persistent adversary. This is how a low adversary-caused rejection rate coexists with a success rate of 0.0020.002, while Γ=5.51 =5.51 quantifies the cost of the resulting freeze; the adversary-caused rate of L3L_3 is likewise only 0.0330.033 (Table IV). VI-D Cost of the Architecture and Sensitivity The defense tax is Δtax=1.07 ^tax=1.07 packets, 2.7%2.7\% of the clean cost, of which 0.640.64 packets are attributable to L4L_4 (L4L_4 alone raises the clean cost from 39.9339.93 to 40.5740.57), so the layer that removes 37.5%37.5\% of the attack-induced excess cost accounts for most of the tax, and the stack costs about 1.25%1.25\% of the 85.0485.04 packets the attack adds. Table I decomposes (42): the stack adds 0.12550.1255 ms, 0.0025%0.0025\% of the 55 s period, with L2L_2 contributing the largest latency because it recomputes (2) for every UAV and sensor pair. From N=20N=20 to N=1000N=1000 (Appendix E) the stack grows by 64.2×64.2× compared with the 115.3×115.3× growth of Nlog⁡N N and still consumes only 0.06%0.06\% of the period. The audit chain of (37) matched the stored digests in all 180180 runs deploying L5L_5. TABLE I: Per-layer added latency from (42), averaged over every five-layer condition of Table I. Percentages are of the 55 s control period. Component Mean (ms) % of Δt t Complexity L1L_1 integrity gate 0.0315 0.00063 O⁡(N+|σ|)O(N+|σ|) L2L_2 cross-modal 0.0590 0.00118 O⁡(UN)O(UN) L3L_3 anomaly 0.0051 0.00010 O⁡(N)O(N) L4L_4 validator 0.0287 0.00057 O⁡(Nlog⁡N)O(N N) L5L_5 governance 0.0013 0.00003 O⁡(1)O(1) Stack total 0.1255 0.00251 O⁡(UN+Nlog⁡N)O(UN+N N) Control period Δt t 5000 100 — A key parameter is the knee of the link-success mapping, which determines whether the system is queue limited or link limited. At the nominal 0.620.62, 58.5%58.5\% of assignments succeed, and sweeping the knee (Appendix E) raises Γ monotonically with link quality from 6.46.4 to 52.552.5, showing that the reported conclusions persist over a wide range of link conditions. VI-E Limitations First, (17) is multiplicative in the reported representation, which for path loss is expressed in decibels; the cross-modal boundary is unchanged at τcmc=1.877 _cmc=1.877 dB in either parameterization (Appendix B), but κ¯ κ is a ratio of logarithmic quantities and is a budget on the reported field rather than a physical constraint. Second, only stale-hold repair is tested, so the finding that detection without response is worse than no defense is established for that rule, not for detection in general. Since the fallback of (40) discards the observation at Γ=2.24 =2.24, any repair at least as good as discarding dominates stale-hold (Γ=5.61 =5.61) by a factor of 2.502.50; imputation from ℓngeo ^geo_n is the obvious candidate, since a frozen path loss is wrong by up to 3.133.13 dB against σℓ=0.5 _ =0.5 dB, and remains untested. Third, 3A_3 clips its intensity to the open window, so its null result confirms the bounds rather than testing them; the damage curve against κ is not reported, and the fallback is never run on clean observations over a full horizon, so it is not compared against a deterministic heuristic. Fourth, the realized κ¯=1.019 κ=1.019 reflects a compact geometry: at D=2D=2 km, (21) gives ℓmax=121.48 =121.48 dB and a worst-case ratio of 1.6541.654, and (43) prices predictor mismatch. Fifth, reproducibility is enforced at the harness rather than the decoder: one prompt decoded in two batches with different neighbors agreed for 15731573 tokens before diverging, so a reproduction from an empty memoization store is reproducible in distribution rather than bit for bit. Finally, the onset transient of (31) cannot see a manipulation present from the first slot, Corollary V.1 needs an arrival cap both attained and known, and the reasoning budget is reached in every generation, so a different budget is a different policy. VII Conclusion This work implemented and evaluated a five-layer DID architecture to secure the perception–reasoning interface of an LLM-centric UAV scheduler. Three closed-form bounds were derived to characterize admissible manipulation intensity, with the cross-modal boundary κℓdet=1.026κ^det_ =1.026 matching the measured transition to unit detection. The evaluation shows that detection alone does not guarantee effective protection: provenance and cross-modal checks drive the attack success rate to near zero but can increase degradation when rejected observations are replaced by stale snapshots. The memory-driven fallback and starvation constraint provide recovery, while the full stack defense limits the degradation ratio to 1.021.02 against the redundancy-aware adversary and 1.081.08 against the policy-aware adversary. These results demonstrate the importance of evaluating detection and response separately when designing layered defenses for LLM-assisted UAV control. Appendix A Proofs of the Three Propositions and the Corollary Proposition V.1. Substituting (17) into the band constraint per feature and direction gives, for n∈n , the conditions κq^n≤Qmaxκ q_n≤ Q_ and ℓ^n/κ≥ℓmin _n/κ≥ , since δnsq=+1 _ns_q=+1 scales backlog upward while δnsℓ=−1 _ns_ =-1 scales path loss downward. For n∈n it gives κe^n≤E0κ e_n≤ E_0 and κℓ^n≤ℓmaxκ _n≤ , since δnse _ns_e and δnsℓ _ns_ both equal +1+1 there. The two remaining scaled features are driven downward and satisfy ϕ^n/κ≥0 φ_n/κ≥ 0 for every κ≥1κ≥ 1, so they impose no constraint. Taking the tightest condition yields (22). ■ Proposition V.2. For n∈n the exponent δnsℓ _ns_ is −1-1, so ℓ^n=ℓn/κ _n= _n/κ, and since (23) recovers ℓn _n up to the noise of (11) the residual is rnℓ=ℓn(1−κ−1)r _n= _n(1-κ^-1). Requiring rnℓ>τcmcr _n> _cmc gives κ>ℓn/(ℓn−τcmc)κ> _n/( _n- _cmc), which decreases in ℓn _n and is worst at ℓmin . For n∈n the exponent is +1+1, so ℓ^n=κℓn _n=κ _n, the residual is ℓn(κ−1) _n(κ-1), and the same requirement gives κ>1+τcmc/ℓnκ>1+ _cmc/ _n, which also decreases in ℓn _n and is worst at ℓmin . The larger of the two worst cases yields (27); since ℓmin/(ℓmin−τcmc)=1+τcmc/(ℓmin−τcmc)>1+τcmc/ℓmin /( - _cmc)=1+ _cmc/( - _cmc)>1+ _cmc/ , the promoted-set term always binds, consistent with (43). ■ Proposition V.3. Away from both clamps, (6) reads qn(t)=qn(t−1)−μn(t−1)+αn(t−1)q_n(t)=q_n(t-1)- _n(t-1)+ _n(t-1). Multiplying by κ and substituting into (28) gives α^n(t−1)=κqn(t)−(κqn(t−1)−μn(t−1))=καn(t−1)−(κ−1)μn(t−1) α_n(t-1)=κ q_n(t)-(κ q_n(t-1)- _n(t-1))=κ _n(t-1)-(κ-1) _n(t-1), which is (29). For μn(t−1)>0 _n(t-1)>0 this decreases strictly in κ and becomes negative, hence inadmissible, exactly when κ⁡(μn(t−1)−αn(t−1))>μn(t−1)κ( _n(t-1)- _n(t-1))> _n(t-1). For μn(t−1)=0 _n(t-1)=0 it reduces to καn(t−1)κ _n(t-1), which exceeds αmaxα when κ>αmax/αn(t−1)κ>α / _n(t-1). The binding case gives (30). ■ Corollary V.1. If μn(t−1)=0 _n(t-1)=0 then (29) reduces to α^n=καn α_n=κ _n, which for αn=αmax _n=α exceeds αmaxα at any κ>1κ>1, and clipping makes that draw occur with probability πmax _ . If μn(t−1)=R>0 _n(t-1)=R>0, the served branch of (30) rejects whenever κ>R/(R−αmax)κ>R/(R-α ). The cases are exhaustive, so the per-slot rejection probability is bounded below as stated and the geometric bound follows. The argument uses πmax>0 _ >0 and an exactly known αmaxα ; both are premises, not consequences. ■ Appendix B Parameterization and Predictor Mismatch in L2L_2 Because (17) scales a logarithmic quantity, it might be read as producing the tightness of Proposition V.2 in Section V-B by itself. It does not. Scaling the decibel value by κ raises the linear path loss to the power κ, whereas an additive offset Δ in decibels, the physically natural form, scales it by 10Δ/1010 /10. For such an offset the residual of (26) is |Δ|| | up to sensing noise, so L2L_2 rejects every |Δ|>τcmc=1.877| |> _cmc=1.877 dB, at most a factor of 1.541.54 on the linear scale. The multiplicative boundary expresses the same threshold, since ℓmin(1−1/κℓdet)=τcmc (1-1/κ^det_ )= _cmc exactly by (27), so the cross-modal boundary is a property of the sensing-noise floor. The admissibility bound κ¯ κ of Proposition V.1 is different: a ratio such as ℓmax/ℓmin / changes with the reference level of the decibel scale, so κ¯ κ has no physical meaning on its own and applies only to the multiplicative attack model of (17). An additive adversary is bounded instead by the band slack in decibels and by τcmc _cmc, whichever is tighter. The boundary is also tightest here, because ℓngeo ^geo_n reproduces the true path loss up to sensing noise. Under a predictor with model mismatch of standard deviation σmis _mis, independent of the sensing noise, the residual scale becomes σeff=σℓ2+σmis2 _eff= _ ^2+ _mis^2 and Proposition V.2 applies unchanged with τcmc=zNσeff _cmc=z_N _eff, so κℓdet(σmis)=ℓminℓmin−zNσℓ2+σmis2,κ^det_ ( _mis)= -z_N _ ^2+ _mis^2, (43) which gives κℓdet=1.024κ^det_ =1.024, 1.0561.056, 1.1081.108 and 1.2361.236 at σmis=0 _mis=0, 11, 22 and 44 dB, an admissible offset of 1.741.74, 3.893.89, 7.177.17 and 14.0214.02 dB. This does not by itself widen the adversary’s window in this deployment, because the constraints compose as min⁡κ¯,κℓdet \ κ,κ^det_ \ and the band is tighter: a realized κ¯=1.019 κ=1.019 admits ℓmin(κ¯−1)=1.40 ( κ-1)=1.40 dB of downward distortion, below the 1.741.74 dB at which L2L_2 reacts with an exact predictor, and L2L_2 could bind only for σeff<0.40 _eff<0.40 dB, which σℓ _ alone exceeds. The ordering reverses once the band is loose: at D=2D=2 km the band admits 48.048.0 dB of slack, so L2L_2 binds for every σmis<13.8 _mis<13.8 dB and the window is zNσeffz_N _eff directly. Appendix C Sensitivity to Attack Onset The implied-arrival test of (28) and the inter-slot component of L1L_1 compare consecutive reports, so an attack beginning mid-mission presents a discontinuity that one present from the first slot does not. Table IV reports both onsets for the two classes that reach the full stack. For 3A_3 the rows are similar, which follows from Corollary V.1 rather than from an insensitive test: (31) places the transient threshold at κ>1.06κ>1.06, whereas the realized intensity on the promoted set is 1.00551.0055. For 2A_2 the rows differ in duration rather than detection: the cross-modal layer rejects every attacked slot at both onsets, so the observation is substituted before L3L_3 can act, and occupancy tracks the number of attacked slots, 2929 and 2020 out of 3030, once the dwell time needed to trigger the switch is included. The cost of defending against 2A_2 is thus close to proportional to the duration of the compromise, the quantity the governance layer of Section V-E is designed to bound. TABLE IV: Sensitivity to attack onset under the full stack, 3030 paired seeds per row, with rejection and detection measured on attacked slots only. The L3L_3 column reports the adversary-caused rate; the L2L_2 column reports the total rate, since it is the substitution rather than its cause that drives fallback occupancy. Adversary Onset Γ L2L_2 rej. TPR⁡(L3)TPR(L_3) ASR Fallback 3A_3 t=1t=1 1.02 0.208 0.033 0.001 01.8% 3A_3 t=10t=10 0.99 0.207 0.045 0.003 02.2% 2A_2 t=1t=1 2.24 1.000 0.033 0.002 93.6% 2A_2 t=10t=10 1.48 1.000 0.043 0.000 57.1% Appendix D Detection of 3A_3 Against Attack Intensity Table V separates the two mechanisms of Corollary V.1. The onset rejection rate rises from 0.600.60 at κ=1.05κ=1.05 to unity by κ=1.15κ=1.15, bracketing the transient threshold of 1.061.06 from (31). The steady-state per-slot rate is at least 0.5860.586 at every tested intensity, corresponding under the geometric approximation to an expected time to first rejection below two slots, and no run survived the horizon. The runs cannot characterize the tail, while the geometric model extrapolates it under a per-slot independence that the persistent backlog state does not guarantee, so the rate is reported with an interval: at κ=1.05κ=1.05, [0.546,0.626][0.546,0.626] implies an expected time to rejection in [1.60,1.83][1.60,1.83] slots. TABLE V: Detection of 3A_3 by L3L_3, over twenty calibration seeds with 580580 steady-state comparisons per row and Wilson intervals. Here κ=1κ=1 carries no perturbation and reports the false-positive floor rather than a miss. κ Onset TPR Steady 95% CI [E[slots]] Pr⁡[surv.]† [surv.] 1.00 0.000 0.000 [0.000,0.007][0.000,0.007] — — 1.05 0.600 0.586 [0.546,0.626][0.546,0.626] 1.71 3×10−123× 10^-12 1.10 0.850 0.617 [0.577,0.656][0.577,0.656] 1.62 3×10−133× 10^-13 1.15 1.000 0.648 [0.609,0.686][0.609,0.686] 1.54 2×10−142× 10^-14 1.25 1.000 0.691 [0.653,0.728][0.653,0.728] 1.45 5×10−165× 10^-16 1.50 1.000 0.893 [0.865,0.916][0.865,0.916] 1.12 7×10−307× 10^-30 3.00 1.000 1.000 [0.993,1.000][0.993,1.000] 1.00 00 †Implied by the measured per-slot rate under a geometric model rather than observed, so an extrapolation assuming per-slot independence. No run survived the horizon at any κ>1κ>1. Appendix E Latency Scaling, and Sensitivity to the Link-Success Knee Table VI checks the complexity claim of Section V-F by driving each layer in isolation with synthetic observations of the stated size, 400400 repetitions per point after a warm-up pass, with L5L_5 omitted as O⁡(1)O(1); absolute figures are not comparable with the in-loop timings of Table I, and the sweep establishes the growth. Across a fiftyfold increase in N the stack grows by 64.2×64.2× against the 115.3×115.3× that Nlog⁡N N predicts, because the sort executes in compiled code while per-layer overhead stays roughly constant. Beyond N=200N=200, L2/(UN)L_2/(UN) stays near 0.060.06 µs, so the cross-modal recomputation of (2) rather than the validator’s sort governs asymptotic growth, while L1L_1 stays flat because the tag of (20) is computed once per slot. TABLE VI: Per-layer latency as the field and the swarm grow, in milliseconds on the platform of Table I. Percentages are of the 55 s control period. N U L1L_1 L2L_2 L3L_3 L4L_4 total % Δt t 0020 03 0.0053 0.0244 0.0046 0.0129 0.0472 0.00094 0050 05 0.0039 0.0340 0.0054 0.0154 0.0587 0.00117 0100 10 0.0038 0.0663 0.0075 0.0228 0.1003 0.00201 0200 20 0.0039 0.2075 0.0111 0.0374 0.2599 0.00520 0500 30 0.0041 0.9245 0.0221 0.0541 1.0048 0.02010 1000 50 0.0048 2.9023 0.0405 0.0832 3.0308 0.06062 Table VII sweeps the link-success knee under a deterministic reference scheduler so that the channel parameter varies in isolation. The degradation ratio rises monotonically with link quality, from 6.46.4 to 52.552.5, because a healthy scheduler drives the clean cost toward zero while the attacked cost stays high, so the conclusion of Section VI-B is robust across a factor of eight in Γ . The same sweep yields Γ=13.8 =13.8 at the operating point, close to the published 14.2×14.2× and far above the 3.133.13 of the deployed agent, which indicates that the larger figure reflects a greedier scheduler rather than a stronger attack. TABLE VII: Sensitivity to the link-success knee under the deterministic reference scheduler. TTF is the mean time to first service and L1L_1 rej. the rejection fraction at κ=3κ=3. Link-success knee τ JclJ^cl J1J^A_1 Γ TTF L1L_1 rej. 0.36 79.5 511.7 06.4 9.1 0.18 0.49 46.3 494.6 10.7 6.8 0.09 0.62∗ 34.4 473.5 13.8 5.3 0.04 0.75 22.5 452.9 20.1 4.1 0.03 0.91 08.2 432.6 52.5 3.3 0.02 ∗Operating point used in the evaluation. References [1] Y. Alqudsi and M. Makaraci (2025) UAV swarms: research, challenges, and future directions. Journal of Engineering and Applied Science 72 (1), p. 12. Cited by: §I. [2] R. Sapkota, K. I. Roumeliotis, and M. Karkee (2025) UAVs meet agentic ai: a multidomain survey of autonomous aerial intelligence and agentic uavs. arXiv preprint arXiv:2506.08045. Cited by: §I. [3] A. Dehghantanha and S. Homayoun (2026) SoK: the attack surface of agentic ai–tools, and autonomy. arXiv preprint arXiv:2603.22928. Cited by: §I. [4] Y. Emami, R. Taheri, M. Homaei, M. A. U. Rehman, and M. Shojafar (2026) LLM-centric agentic ai for uav swarms: system-level architecture and perception–reasoning security. IEEE Internet of Things Magazine (), p. 1–12. External Links: Document Cited by: §I, §I-A, §I-C, §I-A, §I-B, §V-C. [5] Y. Emami, H. Zhou, S. Nabavirazavi, and L. Almeida (2025) LLM-enabled in-context learning for data collection scheduling in uav-assisted sensor networks. IEEE Internet of Things Journal 12 (23), p. 51664–51676. External Links: Document Cited by: §I-A, §I-C, §V-E. [6] Y. Emami, H. Zhou, M. Gutiérrez Gaitán, K. Li, and L. Almeida (2026) FRSICL: llm-enabled in-context learning flight resource allocation for fresh data collection in uav-assisted wildfire monitoring. IEEE Internet of Things Journal 13 (10), p. 21613–21622. External Links: Document Cited by: §I-A. [7] Z. Wang, R. Li, S. Li, Y. Xiang, H. Wang, Z. Zhao, and H. Zhang (2025) RALLY: role-adaptive llm-driven yoked navigation for agentic uav swarms. IEEE Open Journal of Vehicular Technology 6 (), p. 2693–2708. External Links: Document Cited by: §I-A. [8] M. A. Ferrag, A. Lakas, N. Tihanyi, and M. Debbah (2026) LLM and ai agents for autonomous systems: a survey of applications, datasets, and security challenges. IEEE Open Journal of Intelligent Transportation Systems 7 (), p. 615–657. External Links: Document Cited by: §I-B, §I-D. [9] H. Li, H. Kang, J. Li, G. Sun, R. Zhang, J. Wang, D. Niyato, W. Ni, and A. Jamalipour (2026) Multi-agent collaborative intrusion detection for low-altitude economy iot: an llm-enhanced agentic ai framework. arXiv preprint arXiv:2601.17817. Cited by: §I-B, §I-D. [10] J. W. Ayana and H. Qiming (2025) PrivLLMSwarm: privacy-preserving llm-driven uav swarms for secure iot surveillance. arXiv preprint arXiv:2512.06747. Cited by: §I-B, §I-D. [11] U. Tariq and K. Shaukat (2026) Mission-aware beidou spoofing defense in uav swarms with llm-assisted context validation. Frontiers in Communications and Networks 7, p. 1760543. Cited by: §I-B, §I-D. [12] B. Dharmalingam, R. Mukherjee, B. Piggott, G. Feng, and A. Liu (2025) Aero-llm: a distributed framework for secure uav communication and intelligent decision-making. arXiv preprint arXiv:2502.05220. Cited by: §I-B, §I-D. [13] D. She, Z. Chen, M. Chang, B. Feng, and J. Bai (2026) Resilience evaluation and recovery strategies for IoT-enabled unmanned system-of-systems under GNSS spoofing attacks. IEEE Internet of Things Journal 13 (13), p. 29708–29722. Cited by: §I-C. [14] X. Geng, K. Tang, Y. Guo, L. Zhang, W. Wu, and T. Ma (2025) A distributed UAV swarm countermeasure method based on GNSS spoofing. IEEE Internet of Things Journal 12 (16), p. 33455–33467. Cited by: §I-C. [15] L. Xiang, F. Wang, W. Xu, T. Zhang, M. Pan, and Z. Han (2024) Dynamic UAV swarm collaboration for multi-targets tracking under malicious jamming: joint power, path and target association optimization. IEEE Transactions on Vehicular Technology 73 (4), p. 5410–5425. Cited by: §I-C. [16] M. Qian, Y. Cheng, B. Jiang, J. Shi, and T. Le (2026) Learning-based security control of unmanned aerial vehicle swarm system with multisource disturbances and cyber attacks. IEEE Transactions on Cybernetics. Note: Early access External Links: Document Cited by: §I-C. [17] X. Zhao, L. Huang, and Y. Liu (2026) Topology-uncertain multi-UAV formation control algorithms against hybrid cyber attacks. IEEE Internet of Things Journal. Note: Early access External Links: Document Cited by: §I-C. [18] U. A. Mughal, A. Elshazly, R. Atat, and M. Ismail (2026) Generalizable topology-aware GNN-based intrusion detection system for UAV swarms. IEEE Internet of Things Journal 13 (1), p. 1569–1580. Cited by: §I-C. [19] F. T. Jaigirdar, B. Tan, C. Rudolph, and C. Bain (2023) Security-aware provenance for transparency in IoT data propagation. IEEE Access 11, p. 55677–55691. External Links: Document Cited by: §I-C. [20] S. Nasiri, H. Seifi, and H. Delkhosh (2024) A secure power system distributed state estimation via a consensus-based mechanism and a cooperative trust management strategy. IEEE Transactions on Industrial Informatics 20 (2), p. 3002–3014. External Links: Document Cited by: §I-C. [21] J. Akram, A. Anaissi, R. S. Rathore, R. H. Jhaveri, and A. Akram (2024) Digital twin-driven trust management in open RAN-based spatial crowdsourcing drone services. IEEE Transactions on Green Communications and Networking 8 (3), p. 1061–1075. External Links: Document Cited by: §I-C. [22] Z. Ravichandran, A. Robey, V. Kumar, G. J. Pappas, and H. Hassani (2026) Safety guardrails for LLM-enabled robots. IEEE Robotics and Automation Letters 11 (4), p. 4649–4656. External Links: Document Cited by: §I-C. [23] Z. Xiang, L. Zheng, Y. Li, J. Hong, Q. Li, H. Xie, J. Zhang, Z. Xiong, C. Xie, C. Yang, D. Song, and B. Li (2025) GuardAgent: safeguard LLM agents via knowledge-enabled reasoning. In Proceedings of Machine Learning Research, Vol. 267, p. 68316–68342. Cited by: §I-C. [24] M. Shamsujjoha, Q. Lu, D. Zhao, and L. Zhu (2025) Swiss cheese model for AI safety: a taxonomy and reference architecture for multi-layered guardrails of foundation model based agents. In IEEE 22nd International Conference on Software Architecture (ICSA), Odense, Denmark, p. 37–48. External Links: Document Cited by: §I-C. [25] R. Safiullin, V. Korzhuk, A. Kerimbay, and R. Patrikeev (2027) A unified experimental evaluation of guardrail mechanisms for LLM agents. In Lecture Notes in Networks and Systems, Vol. 2074, p. 460–469. External Links: Document Cited by: §I-C. [26] A. Yazdinejad and H. Karimipour (2026) Temporal dynamics of memory poisoning in Web3-style LLM agents. IEEE Access 14, p. 76200–76221. External Links: Document Cited by: §I-C. [27] H. Jing, F. Li, Y. Dong, W. Zhou, and R. Liu (2026) Memory poisoning attacks on retrieval-augmented large language model agents via deceptive semantic reasoning. Engineering Applications of Artificial Intelligence 167. External Links: Document Cited by: §I-C. [28] H. Zhang, J. Huang, K. Mei, Y. Yao, Z. Wang, C. Zhan, H. Wang, and Y. Zhang (2025) Agent security bench (ASB): formalizing and benchmarking attacks and defenses in LLM-based agents. In 13th International Conference on Learning Representations (ICLR 2025), p. 88011–88046. Cited by: §I-C. [29] A. Al-Hourani, S. Kandeepan, and S. Lardner (2014) Optimal LAP altitude for maximum coverage. IEEE Wireless Communications Letters 3 (6), p. 569–572. Cited by: §I-A. [30] O. Mogollon Gutierrez, F. Ghasemi, M. Homaei, A. Caro, and M. Avila (2026) Physics-constrained digital twins for sensor integrity in urban pedestrian flow: detecting stealthy false data injection with conformal guarantees. arXiv preprint arXiv:2609.17635. Cited by: §V-C.

Instant research discovery