{"id":"951b3269-8ed7-463d-afd0-7c972c7477d9","arxiv_id":"2501.03496","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":5,"one_line_summary":"A unified detection scheme combining dual-watermarking KL divergence, convergence-rate envelopes, and trusted-agent reasoning is proposed for multi-agent systems under communication, Byzantine, and hybrid attacks.","lead":"This paper proposes three attack detection algorithms for multi-agent systems, aimed at communication-layer attacks, agent-layer Byzantine attacks, and hybrid attacks. The authors claim their detectors work during both transient and steady stages, unlike earlier observer-based methods.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Lemma 1 in Section III-B is false for sign-indefinite state ranges, so Proposition 3 and Algorithm 2's detection guarantee are unsupported.","rationale":"The paper's central claim is that all three detectors carry theoretical guarantees in both transient and steady stages. The most load-bearing link is Lemma 1: without it, Proposition 3 cannot be established, and without Proposition 3, Algorithm 2's Byzantine detector has no no-false-alarm proof; Algorithm 3 then inherits the gap. The reader identified this same link, and my independent check confirms the lemma is false exactly in the sign-indefinite regime the paper explicitly allows in Assumption 3 and Proposition 1. The counterexample is not exotic: velocity and acceleration components in the connected-vehicle example change sign. While Theorem 1's use of infinite watermarking parameter limits and the unproven iff in Proposition 1 are additional weaknesses, they are secondary to a false lemma that invalidates the agent-layer detector. A corrected proof could not simply patch the constant: for intervals containing zero, taking Γ=-Ω within the interval makes the right side zero while the left side is positive, so any inequality of the claimed form must fail. Since no such restriction or repair appears in the manuscript, the REJECT verdict is unchanged.","tokens_in":23524,"tokens_out":7837,"duration_ms":75133,"concrete_test":"Evaluate Lemma 1 at n=1, ϱ1=-1, ϱ2=1, Γ=-1, Ω=1. If the claimed inequality (23) fails, the lemma is false. Then re-derive Proposition 3 and Algorithm 2's line-3 condition without invoking Lemma 1, or prove from Assumption 3 and the system model that all admissible signals satisfy ϱ1 > 0. No such proof appears in the manuscript; the vehicle model's velocity and acceleration components can clearly be negative.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that Algorithm 2 detects Byzantine attacks with a theoretical guarantee rests on Lemma 1 in Section III-B, which states that for vectors with components in [ϱ1, ϱ2], ∥Γ∥+∥Ω∥ ≤ sqrt((ϱ1^2+ϱ2^2)/ϱ1^2)∥Ω+Γ∥. The proof uses 2nϱ1^2 ≤ Σ(Γ_i^2+Ω_i^2), which is only valid when ϱ1 > 0. Assumption 3 explicitly permits ε1 < 0 < ε2, and Proposition 1 even treats that case. In the platoon model, position, velocity, and acceleration components routinely change sign, so the relevant relative-error vectors are not confined to a positive interval. A direct counterexample is n=1, ϱ1=-1, ϱ2=1, Γ=-1, Ω=1: the left side is 2, while sqrt((1+1)/1)·∥0∥ = 0, contradicting (23). Since Proposition 3 is derived from Lemma 1 and supplies the no-false-alarm condition for Algorithm 2, and Algorithm 3 inherits Algorithm 2's flags in steps 9-13 and 19-22, the agent-layer and hybrid detection guarantees are unsupported as written. The mismatch between the lemma's constant sqrt((ϱ1^2+ϱ2^2)/ϱ1^2) and the implementation's sqrt(ε2^2/(ε1^2+ε2^2)) further indicates the derivation was not verified.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a three-part detection framework for multi-agent systems against communication-layer attacks, agent-layer (Byzantine) attacks, and hybrid attacks, with the stated goal of remaining effective during both transient and steady stages. For the communication layer, each agent transmits two differently watermarked versions of its state and the receiver uses a KL-divergence test after de-watermarking. For the agent layer, a convergence-rate envelope τ(k) is used as a threshold on inter-agent error growth, and a trusted-agent/two-hop scheme is then layered on top for hybrid attacks. The paper claims theoretical guarantees for all three algorithms and validates them on a platooning example. The central proof machinery is Lemma 1 in Section III-B, which is used to establish the no-false-alarm condition for the agent-layer detector and, through it, the hybrid detector.","tokens_in":23860,"tokens_out":9098,"duration_ms":82685,"significance":"If the proposed framework were sound, it would be a useful contribution: it addresses a genuine limitation of observer/consensus-based detectors during transients, it proposes a novel dual-watermarking message structure for communication-layer detection, and the trusted-agent hybrid scheme aims at a weaker graph condition than prior two-hop detectors. The paper also includes a Monte Carlo platooning simulation and makes explicit claims about parameter roles (watermark variances, threshold, envelope parameters), which is valuable. However, the load-bearing theoretical results are not established. Lemma 1 is false in the sign-indefinite regime explicitly allowed by Assumption 3, Proposition 1's 'if and only if' characterization is incorrect, and Proposition 3's proof does not derive the claimed inequality. Since Algorithm 2 and Algorithm 3 inherit these results, the main guarantees of the paper are unsupported. The communication-layer Theorem 1 also rests on unverified analytic inequalities. These issues are central, not local presentation problems.","major_comments":[{"comment":"Lemma 1 is false when ϱ1 < 0, a case permitted by Assumption 3 since ε1 may be negative. The proof uses 2nϱ1^2 ≤ Σ(Γ_i^2 + Ω_i^2), which requires ϱ1 > 0. A direct counterexample is n=1, ϱ1=-1, ϱ2=1, Γ=-1, Ω=1: the left side of (23) is 2 while ∥Ω+Γ∥=0. Proposition 3 derives its key bound (24) from Lemma 1, and Algorithm 2's detection test in its line 3, as well as Theorem 2's agent-layer and hybrid guarantees, rest on Proposition 3/4. Therefore the agent-layer and hybrid detection guarantees are unsupported as stated. There is also a constant mismatch: Lemma 1 gives the factor sqrt((ϱ1^2+ϱ2^2)/ϱ1^2), whereas Algorithm 2 and Proposition 3 use sqrt((ε1^2+ε2^2)/ε2^2) or its reciprocal; these are not algebraically equivalent, and no justification is given for replacing one by the other.","section":"Section III-B, Lemma 1, Eq. (23)"},{"comment":"The claimed 'if and only if' characterization of E(y^a_{ijl}(k)) ∈ [ε1, ε2] is incorrect for ε1 < 0 < ε2 because the allowed interval for Λ depends on Ξ. For example, take ε1=-1, ε2=1, Ξ=0.5, and Λ=0.8; these satisfy the stated conditions Ξ∈[-1,1] and Λ∈[ε1,ε2], yet at x=1 the expected received value is 1.3, outside [−1,1]. The endpoint conditions used in the proof are not sufficient when stated as independent intervals for Ξ and Λ; the feasible set for Λ is an interval that shrinks with |Ξ|. Since Proposition 1 is presented as the formal model of stealthy communication-layer attacks, this must be corrected, and any subsequent claims about which attacks remain within normal range need to be revisited.","section":"Section III-A, Proposition 1, Eq. (2)"},{"comment":"The proof of (24) does not actually derive the claimed bound. After invoking Lemma 1 and the path decomposition (25), the argument states that if inequality (26) holds for each path segment, then (27) follows; but (26) is essentially the same multiplicative bound as (24) applied to a single edge, and the proof does not show how the triangle-inequality sum in (25) can be transformed term-by-term into the multiplicative factor (τ(k)+δ). The statement 'if (26), we have (27)' is an assumption of the desired result, not a proof. Consequently, even setting aside the falsity of Lemma 1, the no-false-alarm guarantee of Algorithm 2 is not established by the text.","section":"Section III-B, Proposition 3, proof of Eq. (24)"},{"comment":"The proof of Theorem 1 contains unverified analytic steps that are load-bearing for the communication-layer detector. Equation (12) is an identity for the Gaussian density (the integral equals one), and the proof then asserts the existence of positive constants ξ11, ξ12, ξ31 'bounded away from zero' without construction or proof of uniformity in the attack parameters Ξ, Λ, the state x, and the watermark variances. The inequalities in (13), (14), and (16) replace the actual PDFs by Gaussian bounds using these constants, but no justification is supplied for the direction of the inequalities or for the constants being uniform enough to make the limits in (15), (17), (20), and (22) valid. Thus the claim that D_KL → +∞ for every case in TABLE I is not rigorously established.","section":"Section III-A, Theorem 1 proof, Eqs. (11)-(22)"}],"minor_comments":[{"comment":"In Algorithm 3, line 5 and in Eq. (29), the second de-watermarked value is written as y*_2ij(k) = M1(k)(y^a_2ij(k) - F2(k)); it should use M2(k), not M1(k). The same typo appears in Eq. (30) of the Theorem 2 proof, where y*_2im(k) is incorrectly assigned M1(k); as written, the two de-watermarked streams are not equal in the attack-free case, contrary to the claim immediately following Eq. (30).","section":"Section III-C, Algorithm 3, line 5 and Eq. (29)"},{"comment":"The notation for the noise-attenuation gain is inconsistent: Assumption 4 uses ai(k) ∈ [µ1 k^{-Λ}, µ2 k^{-Λ}], but the control protocol in Section II-B writes ai(k) as a time-varying scalar with no relation to the later Assumption 4 parameters. Please clarify whether these are the same gain and how the envelope parameters Mr, δ, and ϕ in Algorithm 2 are to be chosen in terms of the system data.","section":"Section II-B, system model and Section III-B, Algorithm 2"},{"comment":"The illustrative communication-layer attack matrices in the simulation, such as Ξ125(k) with diagonal entries 8.3 sin(k) and 2.4 sin(k), have magnitudes larger than 1, which lies outside the stealth interval Ξ ∈ [-1,1] stated in Proposition 1. If these attacks are not stealthy, the simulation may be testing an easier regime than the one characterized in the theoretical analysis; please either adjust the attack parameters to respect Proposition 1 or explicitly state that the detector is being tested beyond the stealthy class.","section":"Section IV, Fig. 8 attack parameters"},{"comment":"The limit condition in (6), lim_{σ_F1,σ_F2→+∞, λ1,λ2→+∞} D_KL = +∞, is written as a simultaneous limit with ratio conditions σ_F1/σ_F2→0 and λ1/λ2→0. This needs a precise definition of the limit order or a parametrization; otherwise the statement is ambiguous, especially because the proof treats σ_F variances and λ values in different cases separately.","section":"Section III-A, Theorem 1 statement"}],"recommendation":"reject","confidential_remarks":"The paper addresses a worthwhile problem and has some original elements, particularly the dual-watermarking message set and the envelope-based transient detector. However, the core theoretical support for the agent-layer and hybrid results fails exactly in the sign-indefinite regime that the paper explicitly allows: Lemma 1 is false, and Proposition 3's proof does not close the gap. The communication-layer proof also has unverified inequalities. These are not localized typos; they undermine the claimed guarantees of Algorithms 2 and 3 and, to a lesser extent, the formal characterization in Proposition 1. I do not see a repair that stays within the current scope, because the envelope detector's no-false-alarm condition depends on a norm inequality that simply does not hold for sign-indefinite error vectors. The authors may be able to salvage parts of the framework by restricting the state range or by proving a different inequality, but that would be a substantial revision rather than a minor adjustment."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is worth a look because the core idea is genuinely new: each agent sends two differently watermarked state values, and a KL-divergence test on the unwrapped pair detects communication-layer attacks without waiting for consensus to converge. That is a real advance over observer-based detectors, which are blind during transients. The envelope-based Byzantine detector, with its tunable tolerance for small misbehavior, is also a sensible departure from MSR-style isolation. The hybrid trusted-agent framework is a reasonable combination, and the simulation study, while not exhaustive, shows the mechanisms behaving as intended.\n\nNow the soft spots, and they are load-bearing. Lemma 1 in Section III-B is false as stated. The proof uses 2nϱ1^2 ≤ Σ(Γ_i^2+Ω_i^2), which only holds when ϱ1 > 0, but Assumption 3 explicitly allows ε1 < 0 < ε2, and Proposition 1 even treats that case. Your counterexample n=1, ϱ1=-1, ϱ2=1, Γ=-1, Ω=1 is correct: the left side is 2, the right side is 0. Proposition 3 and Algorithm 2 rest on this lemma, and Algorithm 3 inherits their flags, so the agent-layer and hybrid detection guarantees are unsupported as written. The mismatch between the lemma's constant sqrt((ϱ1^2+ϱ2^2)/ϱ1^2) and the implementation's sqrt(ε2^2/(ε1^2+ε2^2)) suggests the derivation was not checked against the algorithm.\n\nThere are smaller issues. Proposition 1's \"if and only if\" is also wrong: with ε1=-1, ε2=1, Ξ=0.5, Λ=0.2 satisfies the output bound but falls outside the claimed interval for Λ. Theorem 1's asymptotic conditions, lim σ_F1/σ_F2 = 0 and lim λ1/λ2 = 0, are not satisfied by the finite simulation parameters, so the simulation does not actually instantiate the theorem. No code or full parameter set is provided, which would help.\n\nTo be fair, the envelope and thresholds are design choices, not fitted to attack data, so the detection claims are not circular. And the paper's own remarks acknowledge some limitations, like the trade-off between resilience and detection accuracy.\n\nWho gets value? Researchers working on watermarking-based detection and Byzantine-resilient MAS, especially those interested in transient-stage behavior. The dual-watermarking idea is worth building on. But the current version's theoretical guarantees do not hold as written. I would not cite it yet, but I would send it to review: the core concept is repairable, and a serious referee could help the authors fix the lemma and re-run the experiments under conditions that match the theorems. A desk reject would lose a genuinely interesting direction.\n\nRecommendation: send to peer review, with a clear request to correct Lemma 1 (or restrict the state range), fix Proposition 1, and provide reproducible simulations that satisfy the stated theoretical conditions.","headline":"A worthwhile idea—dual-watermarked message sets for transient-stage attack detection—but the agent-layer guarantee rests on a false lemma, so the theory needs real repair before the paper can be accepted.","tokens_in":24411,"tokens_out":1476,"would_cite":false,"duration_ms":15541,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper proposes a unified attack-detection framework for leader-following multi-agent systems that detects communication-layer, agent-layer, and hybrid attacks during both the transient and steady stages, without waiting for consensus…","keywords":["multi-agent systems","attack detection","watermarking","Kullback-Leibler divergence","Byzantine attack","hybrid attack","transient stage","connected vehicle platoon"],"falsifier":"Take the one-dimensional case with $\\Gamma=1$, $\\Omega=-1$, so both entries lie in $[-1,1]$; Lemma 1 would claim $2 \\le \\sqrt{2}\\|0\\| = 0$, a contradiction, which shows the inequality is false for the very range Assumption 3 permits.","tokens_in":23293,"feed_emoji":"🛡️","tokens_out":16259,"duration_ms":122989,"temperature":0.7,"pith_summary":"The paper aims to give a multi-agent system a single attack-detection framework that works both before and after consensus is reached, the transient and steady stages. For communication-layer attacks it has each transmitter send two watermarked state values per message and uses the KL divergence between the de-watermarked values as the test statistic; under the paper's ratio conditions, an attacked edge produces an unbounded divergence. For agent-layer Byzantine attacks it tests each neighbor's reported state against a decreasing envelope that matches the system's convergence rate, flagging only attackers that would break convergence. For hybrid attacks it combines both detectors with two-hop trusted-agent voting, and the paper claims this needs weaker graph conditions and less transmitted information than existing two-hop schemes. The reason to care is that in applications such as connected-vehicle platoons, attacks often arrive during the transient phase, when conventional consensus- or observer-based detectors are blind.","feed_headline":"Attack detectors that work before consensus forms","feed_subtitle":"Three mechanisms detect communication, Byzantine, and hybrid attacks during both transient and steady stages.","key_machinery":"The argument is carried by three objects. (i) The watermarked message set, $\\{y_{1ij}(k), y_{2ij}(k)\\}$, in which multiplicative watermarks $M_1^{-1}(k)$, $M_2^{-1}(k)$ and additive watermarks $F_1(k)$, $F_2(k)$ are applied to two copies of the same transmitted value; after the receiver removes the watermark, the KL divergence $D_{\\mathrm{KL}}(y^*_{1ij}\\|y^*_{2ij})$ is compared against a threshold. (ii) The convergence envelope $\\tau(k)=M_r e^{-\\lambda_{\\min} k (1-\\phi)}$ with offset $\\delta$, which upper-bounds the neighbor tracking error in a healthy system and supplies the threshold in Algorithm 2. (iii) The flag pair $\\{\\varphi_{ij1}(k), \\varphi_{ij2}(k)\\}$ and the trusted-agent rule, which decide whether an edge or an agent is attacked and resolve ambiguity in hybrid scenarios. Theorem 1's ratio conditions on $(\\sigma^2_{F_1}, \\sigma^2_{F_2})$ and $(\\lambda_1, \\lambda_2)$ make the communication detector's statistic diverge; Lemma 1 supplies the norm ratio bound that Proposition 3 uses to convert the leader-follower envelope into a neighbor-based condition.","core_discovery":"On its own terms, the paper establishes three detection results. First, a watermarking scheme with two different watermarks per edge makes the Kullback-Leibler divergence between the two recovered messages tend to infinity under any communication-layer attack, provided the watermark variances and shifts satisfy the ratio conditions in Theorem 1, so the edge is detectable without waiting for an observer to converge. Second, an envelope detector using the convergence rate $\\tau(k)=M_r e^{-\\lambda_{\\min} k (1-\\phi)}$ and an offset $\\delta$ characterizes the normal evolution of neighbor errors; an agent is declared Byzantine only when its error leaves this envelope, which the paper argues realizes a trade-off between detection accuracy and resilience. Third, a flag-based protocol over two-hop trusted agents (Algorithm 3) distinguishes an attacked communication edge from an attacked agent and detects their combination, under the graph condition of at least $L+P+1$ directed two-hop paths between neighboring agents. The central promise is that all three mechanisms are valid in the transient stage as well as the steady stage.","pith_inferences":["One extension the authors leave implicit is that a corrected norm inequality for two-sided state bounds would let the same envelope detector handle systems whose states cross zero, such as bidirectional platoons.","A quantitative design question the paper does not resolve is how to choose watermark variances under a fixed false-alarm constraint; the ratio conditions give detectability but not an optimal energy allocation.","The flag-based trusted-agent voting could be adapted to event-triggered or asynchronous communication, where discrete verdicts rather than continuous signals are exchanged.","The framework is detection-only; integrating a resilient controller that reacts to the flags would complete the defense loop, a natural but unstated next step."],"forward_implications":["Communication-layer attacks become detectable from the first time step, so a vehicle platoon or reconfiguring formation need not wait for consensus before raising an alarm.","The agent-layer detector tolerates misbehavior that does not disturb convergence, which reduces false isolation and preserves network connectivity with fewer redundant edges than robust-only schemes.","For hybrid attacks, the flag-based trusted-agent protocol distinguishes an attacked edge from an attacked agent, enabling layer-specific countermeasures rather than broad isolation.","The graph condition of at least $L+P+1$ directed two-hop paths between neighboring agents relaxes the $2L+1$ requirement of prior two-hop detection and cuts the transmitted information to watermarked data plus two flags.","The watermark parameter ratios in Theorem 1 give a concrete design rule: choose $\\sigma^2_{F_1}/\\sigma^2_{F_2}\\to 0$ and $\\lambda_1/\\lambda_2\\to 0$ to make the detector's divergence unbounded under attack."],"supporting_citations":[{"why":"supplies the watermarking plus KL-divergence detection idea that Algorithm 1 adapts to multi-agent communication.","marker":"[1]"},{"why":"introduced physical watermarking against replay attacks, the basis for the additive watermark in the message set.","marker":"[17]"},{"why":"the consensus-based KL divergence detector that Algorithm 1 improves by working in the transient stage.","marker":"[38]"},{"why":"provides the discrete-time linear multi-agent model and the noise-attenuation control protocol in (1).","marker":"[49]"},{"why":"derives the convergence-rate envelope of leader-following consensus that Algorithm 2 turns into a neighbor-based threshold.","marker":"[50]"},{"why":"is the two-hop communication detection scheme whose graph requirement and information load Algorithm 3 claims to reduce.","marker":"[37]"},{"why":"introduced the W-MSR resilient consensus algorithm that the agent-layer detector positions itself against.","marker":"[39]"},{"why":"is the source of the (L,P)-local attack model in Assumption 2 and the Byzantine attack setting.","marker":"[40]"}],"fun_headline_variants":["Detect attacks without waiting for consensus","Three attacks, one detector, both stages","Watermark and envelope catch MAS attacks early","Unified detection for transient and steady attacks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is Lemma 1, a norm inequality for vectors whose entries lie in $[\\varrho_1, \\varrho_2]$; its proof requires $\\varrho_1 > 0$, but Assumption 3 explicitly permits state bounds with $\\varepsilon_1 < 0 < \\varepsilon_2$, so the lemma does not cover the system's admissible signals and the agent-layer detector's theoretical guarantee in Proposition 3 is not established.","fun_headline_variants_meta":{"raw":{"variants":["Detect attacks without waiting for consensus","Three attacks, one detector, both stages","Watermark and envelope catch MAS attacks early","Unified detection for transient and steady attacks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000291,"raw_usage":{"total_tokens":1694,"prompt_tokens":930,"completion_tokens":764,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":546,"completion_tokens_details":{"reasoning_tokens":710}},"tokens_in":546,"tokens_out":764,"duration_ms":7457,"temperature":1.0,"reasoning_tokens":710,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T21:53:21.555426+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take the one-dimensional case with $\\Gamma=1$, $\\Omega=-1$, so both entries lie in $[-1,1]$; Lemma 1 would claim $2 \\le \\sqrt{2}\\|0\\| = 0$, a contradiction, which shows the inequality is false for the very range Assumption 3 permits.","supporting_citations":[{"cited_title":"Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs,","cited_arxiv_id":null,"evidence_quote":"supplies the watermarking plus KL-divergence detection idea that Algorithm 1 adapts to multi-agent communication."},{"cited_title":"Secure control against replay attacks,","cited_arxiv_id":null,"evidence_quote":"introduced physical watermarking against replay attacks, the basis for the additive watermark in the message set."},{"cited_title":"Resilient synchronization of distributed multi-agent systems under attacks,","cited_arxiv_id":null,"evidence_quote":"the consensus-based KL divergence detector that Algorithm 1 improves by working in the transient stage."},{"cited_title":"Consensus seeking in a network of discrete-time linear agents with communication noises,","cited_arxiv_id":null,"evidence_quote":"provides the discrete-time linear multi-agent model and the noise-attenuation control protocol in (1)."},{"cited_title":"On convergence rate of leader-following consensus of linear multi- agent systems with communication noises,","cited_arxiv_id":null,"evidence_quote":"derives the convergence-rate envelope of leader-following consensus that Algorithm 2 turns into a neighbor-based threshold."},{"cited_title":"Secure consensus with distributed detection via two-hop communication,","cited_arxiv_id":null,"evidence_quote":"is the two-hop communication detection scheme whose graph requirement and information load Algorithm 3 claims to reduce."},{"cited_title":"An overview on multi-agent consensus under adversarial attacks,","cited_arxiv_id":null,"evidence_quote":"is the source of the (L,P)-local attack model in Assumption 2 and the Byzantine attack setting."}],"review_version":1}