Paper deep dive
Resilient Multi-Agent Target Localization and Tracking via BAG-Aware Mutual Information Maximization under False Data Injection Attacks
Bibek Adhikari, Samrat Chaulagain, Kamesh Subbarao
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 94%
Last extracted: 10/6/2026, 9:42:16 AM
Summary
This paper presents a resilient multi-agent target localization and tracking framework designed to operate under False Data Injection (FDI) attacks. The method integrates mutual information maximization for navigation, Bayesian Attack Graphs (BAG) for probabilistic detection of compromised agents, and a Linear Quadratic Regulator (LQR) for guiding uncompromised agents to a reachable set for recovery. Trust-gating mechanisms exclude data from compromised agents, ensuring robust tracking performance in adversarial environments.
Entities (7)
Relation Signals (6)
Bayesian Attack Graph → detects → False Data Injection
confidence 96% · Bayesian attack graph (BAG) based attack detection for probabilistic identification of the compromised agents
False Data Injection → threatens → Multi-agent Network
confidence 95% · Cooperative multi-agent networks deployed for target localization and tracking remain critically vulnerable to malicious cyberattacks... FDI attacks represent a threat where adversaries inject malicious data
Particle Filter → estimates → Target State
confidence 94% · A particle filter is employed in the system to represent the target belief and estimate the target state based on the measurements
Mutual Information Maximization → optimizes → target localization
confidence 94% · The proposed method combines information-based navigation for target search... Mutual information is evaluated between the target state and range measurement.
Linear Quadratic Regulator → guides → Uncompromised Agents
confidence 93% · guiding attack-immune agents toward a dynamically constructed recovery set... using a Linear Quadratic Regulator (LQR).
Trust-Gating → filters → Compromised Sensing Information
confidence 92% · The framework preserves the network localization capability after an attack by trust-gating compromised sensing information
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Cooperative multi-agent networks deployed for target localization and tracking remain critically vulnerable to malicious cyberattacks, since a single compromised agent can corrupt the centralized target belief and mislead the estimation process across the entire network. This paper presents a resilient multi-agent target localization and tracking framework under a limited agent sensing range and false-data injection (FDI) attacks. The proposed method combines information-based navigation for target search and posterior target state uncertainty reduction, Bayesian attack graph (BAG) based attack detection for probabilistic identification of the compromised agents, and reachable set-guided recovery that guides the uncompromised agents to relocalize the target when the sole localizing agent is attacked. The framework preserves the network localization capability after an attack by trust-gating compromised sensing information and guiding attack-immune agents toward a dynamically constructed recovery set representing the new target belief using a Linear Quadratic Regulator (LQR). Simulation validates that the proposed framework maintains a robust tracking performance under FDI attacks, demonstrating the potential for resilient autonomy in safety-critical applications.
Tags
Links
- Source: https://arxiv.org/abs/2610.03930v1
- Canonical: https://arxiv.org/abs/2610.03930v1
Trouble viewing inline? Open PDF directly →
Full Text
35,563 characters extracted from source content.
Expand or collapse full text
Resilient Multi-Agent Target Localization and Tracking via BAG-Aware Mutual Information Maximization under False Data Injection Attacks The authors gratefully acknowledge the support from ARO Grant W911NF-23-1-0174 Bibek Adhikari Samrat Chaulagain Kamesh Subbarao Address: Department of Mechanical and Aerospace Engineering, The University of Texas at Arlington, Arlington, TX 76019 USA (e-mail: bibek.adhikari@mavs.uta.edu, sxc9808@mavs.uta.edu, subbarao@uta.edu). Abstract Cooperative multi-agent networks deployed for target localization and tracking remain critically vulnerable to malicious cyber attacks, since a single compromised agent can corrupt the centralized target belief and mislead the estimation process across the entire network. This paper presents a resilient multi-agent target localization and tracking framework under a limited agent sensing range and false-data injection (FDI) attacks. The proposed method combines information-based navigation for target search and posterior target state uncertainty reduction, Bayesian attack graph (BAG) based attack detection for probabilistic identification of the compromised agents, and reachable set-guided recovery that guides the uncompromised agents to relocalize the target when the sole localizing agent is attacked. The framework preserves the network’s localization capability after an attack by trust-gating compromised sensing information and guiding attack-immune agents toward a dynamically constructed recovery set representing the new target belief using a Linear Quadratic Regulator (LQR). Simulation validates that the proposed framework maintains a robust tracking performance under FDI attacks, demonstrating the potential for resilient autonomy in safety-critical applications. keywords Multi-Agent Network, Target Tracking, Mutual Information Maximization, Bayesian Attack Graph, Particle Filter, False Data Injection 1 Introduction Cooperative multi-agent network have advanced in autonomous systems in the field of localization and tracking. In recent years, such networks have been employed in applications such as autonomous surveillance (Patrinopoulou et al., 2022), environmental monitoring (Kravari et al., 2025), and threat localization and neutralization (Saeed et al., 2020). Target tracking through a multi-agent network enables the system to share information among agents via a centralized or decentralized framework. Localization under an agent’s sensing range constraint introduces complexity to the network, requiring the target position to be inferred cooperatively from the combination of presence and absence of observations. Under these conditions, agents must actively coordinate their movement to gradually reduce a shared uncertainty of the target state, scanning the area until enough observations are obtained to localize the target with certainty. Particle filter-based approach for cooperative localization is a well-suited framework for systems with unknown target motion models and nonlinear measurements, relying solely on weighted information about the target state (Hoffmann and Tomlin, 2010). However, when these systems are deployed in adversarial environments, they become vulnerable to cyber-physical attacks such as sensor tampering, false data injection, and Denial-of-Service (DoS) attacks (Duo et al., 2022). In particular, FDI attacks represent a threat where adversaries inject malicious data into the system, often by taking control of certain agents or by tampering with their communication channels, resulting in invalid measurements. The system with centralized belief is highly vulnerable to these attacks, especially since a single compromised agent can corrupt the entire distribution of the target state, which propagates to other agents in the network. In particle-filter estimation of the target state under FDI attacks, the attacked agents’ target estimates could be treated as trusted positions, leading the entire network to pursue the ghost target. The situation is further complicated if the sole initial localizing agent is attacked by the malicious target. To mitigate cyber-physical attacks, recent research has focused on secure estimation and resilient filtering strategies that aim to detect and isolate compromised nodes (Chen et al., 2019). Bayesian attack graphs provide a probabilistic framework for modeling the propagation of cyber attacks across a network by exploiting dependencies among nodes and have been used for security assessment and inference of compromise in networked systems (Frigault and Wang, 2008; Muñoz-González et al., 2019). Recent work has further developed BAG-based MMSE monitoring and attack detection under imperfect observations (Kazeminajafabadi and Imani, 2023), as well as BAG-aware resilient target tracking in multi-agent systems (Chaulagain and Subbarao, 2026). The rest of the paper is formulated as follows. Section 2 presents the objective and problem statement, while Section 3 presents modeling and analysis of the graph network, target, sensing agent, and measurement model. Section 4 formulates the methodology of the work. The simulation and experimental setups are described in Section 5, and the paper concludes in Section 6. 2 Problem Statement The paper addresses a multi-agent network tasked with localizing and tracking a dynamic intruder target in a bounded search space. The agents are equipped with a sensor of limited measuring range. A particle filter is employed in the system to represent the target belief and estimate the target state based on the measurements from the sensing agents. The mutual information between the target and the sensor observation is used to navigate inside the search space to localize the target. The control objective of the system is to compute a control input that arranges agents’ positions, maximizing the mutual information, which leads to future observations that minimize the target uncertainty. The paper further addresses a resilient cooperative localization and tracking of the target in the presence of false data injection into the localizing agent through the target. The challenge arises when the sole localizing agent gets compromised, providing biased or inconsistent observation, jeopardizing the system’s particle belief. The mission objective is to localize the target under the influence of FDI while preventing the attack from degrading the system’s performance, and continue to preserve a bounded posterior belief around the moving target, corresponding to persistent tracking. The contribution of the paper is a unified resilient framework that combines mutual information-based target localization, Bayesian attack graph-based compromise detection, and reachable-set-guided recovery for robust relocalization and tracking. 3 System Modeling and Analysis The global coordinate system is a fixed reference frame represented as I=OI,XI,YI,ZII=\O_I,X_I,Y_I,Z_I\. 3.1 Target Model Let T=[xTyTx˙Ty˙T]⊤x_T= bmatrixx_T&y_T& x_T& y_T bmatrix be the state of the target in inertial frame in the search domain X, such that Tx_T ∈ X, whose model is represented as: ˙T(t)=TT(t)+TT(t), x_T(t)=A_T\>x_T(t)+B_T\> ν_T(t), (1) with T=[0010000100000000]∈ℝ4×4,T=[00001001]∈ℝ4×2,A_T= bmatrix0&0&1&0\\ 0&0&0&1\\ 0&0&0&0\\ 0&0&0&0 bmatrix ^4× 4, _T= bmatrix0&0\\ 0&0\\ 1&0\\ 0&1 bmatrix ^4× 2, where TA_T and TB_T are the system and input matrix of the target model, respectively, at time t, and T ν_T is the random acceleration disturbance such that T∼(,T)∈ℝ2 ν_T (0, _ ν_T ) ^2 is modeled as the zero-mean Gaussian noise with covariance T _ ν_T. The position of the target is denoted in the inertial frame as T=[xTyT]⊤p_T= bmatrixx_T&y_T bmatrix . A prior distribution of the target p(T(0))p(x_T(0)) is known, around which the search domain is created. 3.2 Sensing Agent Model Consider a set of A sensing agents localizing the target and let i=[xiyix˙iy˙i]⊤∈ℝ4x_i= bmatrixx_i&y_i& x_i& y_i bmatrix ^4 be the state of ithi^th agent in inertial frame with dynamics given as: ˙i(t)=i(t)+i(t), x_i(t)=Ax_i(t)+Bu_i(t), (2) where A and B are the system and input matrices of sensing agents respectively, and i(t)u_i(t) is the control input of ithi^th agent at time t with =[0010000100000000],=[00001001],i(t)=[axiayi],A= bmatrix0&0&1&0\\ 0&0&0&1\\ 0&0&0&0\\ 0&0&0&0 bmatrix,B= bmatrix0&0\\ 0&0\\ 1&0\\ 0&1 bmatrix,u_i(t)= bmatrixa_x_i\\ a_y_i bmatrix, where axia_x_i and ayia_y_i are the acceleration control inputs. The position of the ithi^th agent is denoted in the inertial frame as i=[xiyi]⊤p_i= bmatrixx_i&y_i bmatrix , whereas its heading is denoted as ψi _i about the ZIZ_I axis. 3.3 Measurement Model Let iz_i be the measurement made by the ithi^th sensing agent, measuring the range from the agent to the target, and its bearing. The measurements of the target are obtained only when the target lies within the sensor’s maximum range. The range measurement is represented as: zir(k) z^r_i(k) =‖i(k)−T(k)‖+ϵir(k), =\|p_i(k)-p_T(k)\|+ε^r_i(k), (3) ϵr ε^r ∼(0,σr2). (0,σ^2_r). (4) The bearing measurement from the agent to the target is expressed as: ziθ(k) z^θ_i(k) =arctan(yT(k)−yi(k)xT(k)−xi(k))+ϵiθ(k), = ( y_T(k)-y_i(k)x_T(k)-x_i(k) )+ε^θ_i(k), (5) ϵθ ε^θ ∼(0,σθ2), (0,σ^2_θ), (6) where ϵir(k)ε^r_i(k) and ϵiθ(k)ε^θ_i(k) are the range and bearing measurement noise of ithi^th sensing agent respectively at time step k, with the Gaussian distribution of zero-mean and variance σr2σ^2_r and σθ2σ^2_θ respectively. The aggregate measurement for ithi^th sensing agent at time step k is represented as i(k)=[zir(k)ziθ(k)]⊤∈ℝ2z_i(k)= bmatrixz^r_i(k)&z^θ_i(k) bmatrix ^2. The particle-wise likelihood used for belief update incorporates both range and bearing measurements, which is the probability of the current measurement conditioned on the nthn^th particle being the true target state. Assuming independent measurement noise, the likelihood of the nthn^th particle for the ithi^th agent is expressed as: Lin(k)=p(i(k)|T=~Tn(k)),L^n_i(k)=p(z_i(k)|x_T= x_T^n(k)), (7) where ~Tn x_T^n denote the state of the particle. 3.4 False Attack Injection Model The attack is triggered when an agent breaches the target’s attack range (RatkR_atk). It is assumed that the target’s attack range is smaller than the agents’ sensing range. Once an agent is compromised, false data is injected into its sensor, which is additive to its true measurement. The measurement of the compromised agent is modeled as: zi,atkr(k)=zir(k)+αi(k),z^r_i,atk(k)=z^r_i(k)+ _i(k), (8) where αi(k)∼(b,σα2) _i(k) (b,σ^2_α) denotes the false-data injected into compromised agent, with mean b and variance σα2σ^2_α. 4 Methodology 4.1 Mutual Information Maximization Mutual information is evaluated between the target state and range measurement. The measurement entropy is approximated using a discretized grid zr∈[zminr,zmaxr]z^r∈[z^r_min,z^r_max] with spacing Δzr z^r. The optimal control input to plan the next agent state is calculated by optimizing mutual information represented as: mi⋆(k)=argmaxmi∈iI(T;zir(k)∣k−1r),u_m_i (k)= _u_m_i _iI\! (x_T;z^r_i(k) ^r_k-1 ), (9) with I(T;zir(k)∣k−1r)=H(zir(k)∣k−1r)−H(zir(k)∣T,k−1r),I(x_T;z^r_i(k) ^r_k-1)=H(z^r_i(k) ^r_k-1)-H(z^r_i(k) _T,Z^r_k-1), (10) where k−1r=r(0),…,r(k−1)Z^r_k-1=\z^r(0),...,z^r(k-1)\ represents the range measurement history up until k. The entropy of measurement given the measurement history and entropy of measurement given the target state and measurement history are respectively expressed as: H(zir(k)∣k−1r) H(z^r_i(k) ^r_k-1) =−∑zir∈((∑n=1Nwn(k)lni(k)). =- _z^r_i∈ Z^r ( ( _n=1^Nw^n(k)\,l^n_i(k) ). (11) ⋅log(∑n=1Nwn(k)lni(k)))Δzr, · ( _n=1^Nw^n(k)\,l^n_i(k) ) ) z^r, H(zir(k)∣T(k),k−1r) H(z^r_i(k) _T(k),\,Z^r_k-1) =−∑zir∈(∑n=1N(wn(k)lin(k). =- _z^r_i∈ Z^r ( _n=1^N (w^n(k)\,l_i^n(k). (12) ⋅log(lin(k))))Δzr, · \; (l_i^n(k) ) ) )\, z^r, where lin=p(zir|T=~Tn)l^n_i=p(z^r_i|x_T= x_T^n) is the particle-wise measurement likelihood used for control step utilizing range measurement, and wnw^n is the weight of the nthn^th particle. The derivation of the respective entropy terms are presented in our earlier work (Adhikari and Subbarao, 2025). 4.2 Localization of target The differential Gaussian entropy of the target state conditioned on the measurement history is used to quantify the uncertainty of the target probability distribution, which is expressed as: H(∣kr)=12log((2πe)ddet(k)),H(x_T ^r_k)= 12 \! ((2π e)^d ( _k) ), (13) where e and d denote the Euler’s number and dimension of the target state respectively, and represents the posterior covariance estimated from the particle belief. The posterior belief of the target state increasingly concentrates as the agents receive informative observations, leading to a decrease in posterior differential Gaussian entropy. Once the entropy drops below a predetermined threshold corresponding to an acceptable degree of uncertainty, the target can be deemed localized, and converging to a constant value below the threshold signifies the active tracking of the target. Subsequent measurements are then used to maintain a bounded posterior belief around the target state, corresponding to persistent tracking. 4.3 Bayesian Attack Graph Network To capture cyber-attack propagation over the multi-agent network, Bayesian attack graph is employed. The BAG is represented by a tuple, represented as: BAG=(,ℰ,,),G_BAG=(V,E,T,P), where, =1,2,…,AV=\1,2,…,A\ is the set of sensing agents, ℰ⊆×E ×V is the set of directed edges, T denotes the node types, and P denotes the exploit probabilities. An edge (i,j)∈ℰ(i,j) indicates that compromise of agent i can lead to compromise of agent j. Each agent has binary compromise state sj(k)∈0,1s_j(k)∈\0,1\, and the network state is (k)=[s1(k)s2(k)⋯sA(k)]⊤∈0,1A.s(k)= bmatrixs_1(k)&s_2(k)&·s&s_A(k) bmatrix ∈\0,1\^A. (14) A subset c⊆V_c is vulnerable to direct external attack, where each j∈cj _c is assigned external exploit probability ρj _j. Each edge (i,j)∈ℰ(i,j) is assigned internal exploit probability ρij _ij. Nodes are classified as AND or OR types. The BAG evolves as the binary-state Markov process, and the conditional probability of node j depends on its node type and the previous compromise state (k−1)s(k-1). Once compromised, a node is assumed to remain compromised for the rest of the mission. To infer the hidden compromise states, binary monitoring observations are introduced. Let yj(k)∈0,1y_j(k)∈\0,1\ denote the monitoring output for agent j, where yj(k)=1y_j(k)=1 indicates a detected compromise. The exploit probability calculation and observation model follows (Chaulagain and Subbarao, 2026). Compromised agents may be missed with probability qmissq_miss, while healthy agents do not generate false alarms. The joint observation vector is (k)=[y1(k)y2(k)⋯yA(k)]⊤.y(k)= bmatrixy_1(k)&y_2(k)&·s&y_A(k) bmatrix . Let =[1,2,…,2A]∈0,1A×2A = bmatrixs^1,s^2,…,s^2^A bmatrix∈\0,1\^A× 2^A (15) denote the set of all possible network compromise configurations. The posterior and predictive belief vectors are defined as: k|k(i) _k|k(i) =p((k)=i∣(1:k)), =p (s(k)=s^i (1:k) ), (16) k|k−1(i) _k|k-1(i) =p((k)=i∣(1:k−1)), =p (s(k)=s^i (1:k-1) ), for i=1,2,…,2Ai=1,2,…,2^A. The state transition matrix k∈ℝ2A×2AM_k ^2^A× 2^A is (k)ij=p((k)=si∣(k−1)=sj),(M_k)_ij=p (s(k)=s^i (k-1)=s^j ), (17) which gives the predictive update k|k−1=kk−1|k−1. _k|k-1=M_k _k-1|k-1. (18) Given (k)y(k) at time k, the likelihood vector is (k((k)))i=p((k)∣(k)=i), (T_k(y(k)) )_i=p (y(k) (k)=s^i ), (19) and the posterior update is k|k=k((k))∘k|k−1‖k((k))∘k|k−1‖1, _k|k= T_k (y(k) ) _k|k-1\|T_k (y(k) ) _k|k-1\|_1, (20) where ∘ denotes the Hadamard (element-wise) product and ∥⋅∥1\|·\|_1 denotes the ℓ1 _1-norm. The optimal minimum mean-square-error estimate of the compromise state is ^MMSE(k)=round(k|k), s^MMSE(k)=round ( _k|k ), (21) where the round(⋅)(·) maps each entry to the nearest binary value (Kazeminajafabadi and Imani, 2023). This estimate defines the trust variable used in the resilient particle-filter update as: γi(k)=1,s^iMMSE(k)=0,0,s^iMMSE(k)=1. _i(k)= cases1,& s_i^MMSE(k)=0,\\ 0,& s_i^MMSE(k)=1. cases (22) 4.4 Target Reachable Region Approximation Once the BAG detects an attack at time kdk_d a recovery set is initialized using the last trusted target-belief mean prior to the detected compromise. The last trusted instant is estimated retrospectively from the stored range-residual history of the compromised agent as: ri(k)=|zir(k)−z¯ir(k)|,kt=maxk<kd:ri(k)<rth, -5.69046ptr_i(k)= |z^r_i(k)- z^r_i(k) |, k_t= \k<k_d:r_i(k)<r_th\, (23) where ri(k)r_i(k) denotes the residual of ithi^th agent, rthr_th is the residual threshold, and z¯r z^r is the estimated range measurment from the particle mean. Assuming the target speed is bounded by vTmaxv_T^max, the feasible post-attack target reachable position is represented by a reachable set as: ℛ(k)=T∈ℝ2:‖T−(kt)‖≤R0+((k−kt)vTmaxΔt),R(k)= \p_T ^2:\|p_T- μ(k_t)\|≤ R_0+ ((k-k_t)v_T t ) \, (24) where (kt) μ(k_t) denotes the target-belief mean, and R0R_0 is the initial recovery radius reflecting uncertainty at the last trusted instant. A new set of particles is generated inside a set representing the feasible target position post attack detection. 4.5 Linear Quadratic Regulator Guidance A LQR guidance law is used when an agent is outside an informative sensing configuration, particularly during particle-sparse event and recovery-set entry phase. During particle-sparse event, agents’ lookahead state is the particle-belief mean. For recovery-set entry phase, recovery agents are guided into the set with particle-belief mean being the lookahead point. Once sufficient local particle support is observed, the agents switch from LQR guidance to mutual-information-maximizing search within the recovery region. Similarly, during this phase, the desired state for compromised agents is selected to move the agent away from the target attack region. The guidance law is represented as: gi(k)=−g(i(k)−d,i(k)),u_g_i(k)=-K_g (x_i(k)-x_d,i(k) ), (25) where di=[xdiydix˙diy˙di]⊤x_d_i= bmatrixx_d_i&y_d_i& x_d_i& y_d_i bmatrix is the desired state composed of lookahead position dip_d_i and zero desired velocity, and gK_g is LQR feedback gain obtained from discrete-time LQR design. The inter-agent and agent-target collision is avoided using the collision avoidance constraint (Adhikari and Subbarao, 2025). 4.6 Trust-Gated Particle Filter Update Following attack detection, the particle filter update is conditioned on the agent’s trust status. Measurements from trusted agents are used to evaluate the likelihood, while those from compromised agents are excluded. As a result, posterior weight updates and particle resampling rely only on trusted agents, thereby preventing the corrupted data from degrading the target belief and enabling relocalization and tracking of the target using trusted agents. The normalized particle weights are updated as: wn(k)=wn(k−1)∏i=1A(Lin(k))γi(k).w^n(k)=w^n(k-1) _i=1^A(L_i^n(k)) _i(k). (26) Algorithm 1 Multi-Agent Target Localizaton 1: Inputs: Search Space X, BAGG_BAG, initial BAG belief Π1|0 _1|0, initial agent states i(0)x_i(0), entropy threshold HthH_th. 2: for k=1,2,…k=1,2,… do 3: if zir(k)≤Ratkz_i^r(k)≤ R_atk then 4: initiate attack 5: Propagate attack using BAG 6: Obtain sensor measurements: i(k)z_i(k) 7: Observe cyber monitoring output (k)y(k) 8: BAG update: Πk|k _k|k using Eq. (20) 9: BAG prediction: Πk+1|k _k+1|k using Eq. (18) 10: BAG attack detection: s^MMSE(k) s^MMSE(k) using Eq. (21) 11: Assign trust: γi(k) _i(k) using Eq. (22) 12: Update particle weights: wn(k)w_n(k) using Eq. (26) 13: Compute posterior entropy: H(T|kr)H(x_T|Z^r_k) using Eq. (13) 14: if H(T|kr)<HthH(x_T|Z^r_k)<H_th for τ consecutive steps then 15: Declare target localized 16: Continue posterior update for target tracking 17: if attack detected then 18: Estimate ktk_t using Eq. (23) 19: Construct ℛ(k)R(k) using Eq. (24) 20: if i is a compromised agent then 21: Control update: gi(k)u_g_i(k) using Eq. (25) with d,i(k)←i(0)p_d,i(k) _i(0) 22: Agent control update: 23: if sufficient local particle available then mi(k)u_m_i(k) using Eq. (9) 24: else gi(k)u_g_i(k) using Eq. (25) with 25: if attack detected then d,i(k)←(kt)p_d,i(k)← μ(k_t) 26: else d,i(k)←(k)p_d,i(k)← μ(k) 5 Simulation and Results A planar multi-agent target localization framework is adopted within a bounded search space, where four agents (1-4 from left to right) are initialized inside the domain to localize and track the target. The communication topology used in this paper is shown in Fig. 1. In the associated BAG, Agent 2 and Agent 3 are designated as AND nodes with zero external vulnerability, thereby making them attack-immune throughout the mission. Whereas Agent 1 and Agent 4 are OR nodes, also labeled as attack-prone agents, with external attack vulnerability as well as internal attack propagation through communication channels, effectively making them both prone to attack in case either is compromised. 4213ρ1=0.5 _1=0.5ρ2=0 _2=0ρ3=0 _3=0ρ4=0.5 _4=0.5ρij=0.2,∀i,j∈|(i,j)∈ℰ _ij=0.2,\ ∀\,i,j (i,j) Figure 1: Communication network of the four-agent system. Double-circled agents denote AND nodes, while single-circled agents denote OR nodes. Particles representing the target belief are generated inside the search space. The simulation parameters are shown in Table 1. Figure 2 represents the mission evolution of multi-agent target localization. Figure 2(a) illustrates the initial setup of the framework, where agents are navigating inside the search space to maximize the mutual information. The initial localization of the target is seen in Fig. 2(b), where Agent 4 localizes the target. It is further observed from the Fig. 2(c) that, after the target is localized, the false data is injected into the localizing agent, resulting in the spread of the particle belief over time. Figure 2(d) displays the recovery-set formation after the BAG detection, which bounds the target. Since BAG detects the FDI into Agent 4 and Agent 1, measurements from these respective agents are trust-gated during particle filter update. Post-set creation, the compromised agent goes outside the target’s attacking range, and the attack-immune agents are commanded into the set to relocalize the target as seen in Fig. 2(e). The framework enables mutual information maximization once it observes the particles inside the observing range of the sensing agent, and if not, the guidance law is used to guide the agent to the particle-belief mean. The relocalization of the target is observed in Fig. 2(f), where both attack-immune agents relocalize the intruder as seen from the shrinkage of the particle-belief. To evaluate the system’s performance, a Monte Carlo study was conducted over multiple randomized target initial positions. The runs were separated into two classes: Class-I, where an attack-immune agent localizes the target initially, and no further recovery set is created or required, and Class-I, where an attack-prone agent localizes the target initially, and a recovery set is created to relocalize the target. Out of 250250 Monte Carlo runs, 146146 runs were Class-I, 104104 runs were Class-I, and none of them were unsuccessful, denoting a robust localization framework, within the tested simulation conditions. The final median target-localization times for Class-I and Class-I were 39s39\,s and 52s52\,s respectively. To validate the effectiveness of the proposed framework, a comparison is drawn against a conventional mutual-information-based target localization framework without BAG-based attack detection and the subsequent steps it enables. For each class, the root-mean-square error (RMSE) of the target position and the posterior differential Gaussian entropy of the target belief were aggregated using the median. Figure 5 illustrates that the target-position RMSE for Class-I converges to approximately 0m0\,m, faster than for Class-I, which is consistent with the shorter median target-localization time. Similarly, Fig. 5 illustrates that the median posterior differential Gaussian entropy of the particle-belief converges to a constant value below the entropy threshold faster for Class-I compared to Class-I, as the recovery set is created in Class-I, which expands the entropy post-attack and re-shrinks the belief, thereby requiring more time for relocalization. Additionally, Fig. 5 and 5 compare proposed framework against conventional approach, under which the entropy is observed to remain relatively low despite the high RMSE, indicating that the agents chase a corrupted target belief with unwarranted confidence while the true target escapes. Figure 5 illustrates the posterior differential Gaussian entropy of target state belief with time relative to initial target-localization, obtained by shifting the Monte Carlo run so the initial localization instant is set to t=0st=0\,s. The plot examines the uncertainty evolution of the target estimate after the first localization across two outcome classes. For Class-I the entropy decreases significantly at the instant of the first localization of the target and then converges to a constant value signifying target localization. Similarly, for Class-I, the posterior entropy drops at the time of first localization via attack-prone agents, which spikes back due to the FDI to the sole localizing agent. The entropy then decays to a constant value post-relocalization of the target via attack-immune agents during the recovery phase, signifying the relocalization of the target. (a) t = 5 secs (b) t = 14 secs (c) t = 17 secs (d) t = 22 secs (e) t = 25 secs (f) t = 35 secs Figure 2: Mission evolution for target localization using MAN under FDI-attacks: (a) Target search, (b) Initial target localization, (c) FDI attack onset, (d) Recovery-set generation, (e) Post-set recovery maneuver, and (f) Cooperative relocalization. The colored circles represent the agents, and surrounding dashed circles indicate their maximum sensing ranges. Figure 3: Median target-position RMSE Figure 4: Median posterior differential Gaussian entropy of target belief Figure 5: Posterior differential Gaussian entropy of target-state belief against the relative time for initial target localization Table 1: Simulation parameters Parameter Symbol Value Number of particles N 15001500 Target accel input cov T _ ν_T 2I_2 Meas. range std dev σr _r 0.20m0.20\,m Meas. bearing std dev σθ _θ 3∘3 FDI attack std dev σα _α 2m2\,m FDI attack mean b 15m15\,m Maximum sensor range zmaxz_max 10m10\,m Agent max speed vmaxv_max 1.5m/s1.5\,m/s Target max speed vTmaxv_T_max 0.5m/s0.5\,m/s Agent max accel amaxa_max 0.75m/s20.75\,m/s^2 MI grid step Δzr z^r 0.25m0.25\,m MI time step dtdt 1 s Differential entropy threshold HthH_th 0 LQR state error penalty Q diag([10,10,5,5])diag([10,10,5,5]) LQR control effort penalty R 0.520.5\,I_2 6 Conclusions The paper presented a resilient multi-agent target localization and tracking framework operating under limited agents’ sensing range and FDI attacks. The proposed framework combined mutual information-based navigation and target search, BAG-based attack detection, and reachable set guided recovery to localize the target, and continued target tracking. The result illustrated that the proposed framework maintained localization performance even after the FDI attack on the system. Monte Carlo analysis presented two distinct localization classes: a scenario in which an attack-immune agent localized the target initially, achieving lower median localization time, compared to the scenario where an attack-prone agent localized the target initially, necessitating recovery set formation and relocalization of the target through the attack-immune agent, resulting in higher localization time, and establishing that BAG-based detection is necessary for relocalization under FDI attacks. These results illustrate the effectiveness of the proposed framework and support its relevance for the resilient target-localization applications. Future work includes incorporating sUAV dynamics for the agent to track a dynamic target and extending the framework to a decentralized system with communication constraints. References Adhikari and Subbarao (2025) B. Adhikari and K. Subbarao Optimizing multi-agent network for target localization using mutual information maximization. In AIAA SCITECH 2025 Forum, p. . External Links: Document, https://arc.aiaa.org/doi/pdf/10.2514/6.2025-2611 Cited by: §4.1, §4.5. Chaulagain and Subbarao (2026) S. Chaulagain and K. Subbarao Resilient collaborative target tracking using bag-aware distributed kalman filtering under stealthy fdi attacks. In AIAA SCITECH 2026 Forum, p. . External Links: Document, https://arc.aiaa.org/doi/pdf/10.2514/6.2026-0666 Cited by: §1, §4.3. Chen et al. (2019) Y. Chen, S. Kar, and J. M. F. Moura Resilient distributed estimation: sensor attacks. IEEE Transactions on Automatic Control 64 (9), p. 3772–3779. External Links: Document Cited by: §1. Duo et al. (2022) W. Duo, M. Zhou, and A. Abusorrah A survey of cyber attacks on cyber physical systems: recent advances and challenges. IEEE/CAA Journal of Automatica Sinica 9 (5), p. 784–800. External Links: Document Cited by: §1. Frigault and Wang (2008) M. Frigault and L. Wang Measuring network security using bayesian network-based attack graphs. In 2008 32nd Annual IEEE International Computer Software and Applications Conference, Vol. , p. 698–703. Cited by: §1. Hoffmann and Tomlin (2010) G. M. Hoffmann and C. J. Tomlin Mobile sensor network control using mutual information methods and particle filters. IEEE Transactions on Automatic Control 55 (1), p. 32–47. External Links: Document Cited by: §1. Kazeminajafabadi and Imani (2023) A. Kazeminajafabadi and M. Imani Optimal monitoring and attack detection of networks modeled by bayesian attack graphs. Cybersecurity 6 (1), p. 22. Cited by: §1, §4.3. Kravari et al. (2025) K. Kravari, M. Roussi, K. Ladomenou, A. Thysiadou, and M. Chalaris Intelligent agent-based control of distributed sensor networks for environmental monitoring and disaster prediction. Engineering Proceedings 104 (1). External Links: ISSN 2673-4591, Document Cited by: §1. Muñoz-González et al. (2019) L. Muñoz-González, D. Sgandurra, M. Barrère, and E. C. Lupu Exact inference techniques for the analysis of bayesian attack graphs. IEEE Transactions on Dependable and Secure Computing 16 (2), p. 231–244. Cited by: §1. Patrinopoulou et al. (2022) N. Patrinopoulou, I. Daramouskas, D. Meimetis, V. Lappas, and V. Kostopoulos A multi-agent system using decentralized decision-making techniques for area surveillance and intruder monitoring. Drones 6 (11). External Links: ISSN 2504-446X, Document Cited by: §1. Saeed et al. (2020) I. A. Saeed, A. Selamat, M. F. Rohani, O. Krejcar, and J. A. Chaudhry A systematic state-of-the-art analysis of multi-agent intrusion detection. IEEE Access 8 (), p. 180184–180209. Cited by: §1.