{"id":"b75144b7-9d65-45da-a77d-8b195db0a06f","arxiv_id":"2607.23532","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":5.5,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Compositional mission monitors over an evidence-aware fabric detect cross-platform ISR policy violations from LLM task-splitting and emit zero silent false all-clears under loss and jamming.","lead":"A three-tier runtime monitor over a verification-aware message fabric catches swarm-level policy breaches that no single robot’s guardrail can see, including LLM prompt-injection task splits. It refuses silent all-clears when evidence is lost or jammed, reporting unknown instead.","discovery_kind":"new_application","skeptic_critique":{"model":"moonshotai/kimi-k3","headline":"Detection rests on a trusted canonicalisation the evaluation never exercises: in every executed pipeline the canonical events are generated from the planner's own (attack-subverted) action fields, so faithfulness of the event stream is true by construction.","rationale":"This is the same load-bearing premise the reader flagged (trusted event generation / non-Byzantine reporting), sharpened to where it bites hardest: the strongest claim is about compositional detection with provenance, and that detection keys on the target attribute of collect events, which in all executed pipelines is sourced from the subverted planner's own output. The reader's verdict already conditioned acceptance on \"integrity assumptions\" and simulation scope, so this does not move the verdict — it makes the condition more precise. Credit is due: the paper is unusually candid about this boundary (Table 1 marks forged identity †; §7.4's RF-sentry extension shows the authors understand self-report limits; §7.6 disclaims a full soundness proof and field realism), and the delivery-side contribution (evidence-aware algebra, ablations showing each fabric signal prevents a distinct silent-miss class, NSCR metric honest about unknown vs violation) is well supported by the controlled experiments on their own terms. The concern is not that the experiments are wrong but that they are invariant-preservation over a stream whose faithfulness is stipulated; the proposed test would show whether the detection claim survives when canonicalisation is derived from independent telemetry rather than planner-sourced action fields, which is exactly the condition under which the prompt-injection scenario is operationally interesting.","tokens_in":19209,"tokens_out":2599,"duration_ms":120338,"concrete_test":"Add an evasion variant to experiments.py / the ROS2 demo: the injected note instructs planners to (a) mislabel the protected target in the action's target field, or (b) split collection into fragments outside X = {coords, imagery, comms, access}, while the SITL/telemetry-derived ground truth still shows collection on FacX. Derive canonical events from MAVLink-observed behaviour alone (position over FacX + sensor active), not from planner action fields, and check whether Ppkg still fires with provenance. If detection disappears under (a)/(b) with planner-sourced events but survives with telemetry-sourced events, the headline claim must be explicitly conditioned on an independent canonicalisation witness — as the paper already does for emissions via the RF sentry.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The strongest claim — an injected task split is \"invisible to every per-platform monitor yet detected compositionally with full provenance\" (§7, Tables 4–5) — is a claim about monitors that reason over the canonical event stream collect(a, x, F, I). That claim holds only if the stream faithfully records what platforms actually do, including the target attribute F. §3 states the injection \"subverts only the LLM planner; the trusted event-generation and monitoring path is unaffected.\" But look at how events are actually produced in the experiments: in the reproducible core the generator emits events for a scripted attack; in the ROS2 layer, \"four platform nodes publishing the attack's actions on /<ns>/action topics\" are canonicalised into events; the SITL run reproduces \"the identical L1/L3 verdicts\" from the same action stream. In every case the event content — fragment kind x and crucially target F — originates in the structured action the (subverted) planner emitted. Nothing in the evaluated path independently observes execution and derives collect(*, FacX) from telemetry. So the same injection that tells the planner \"divide the Facility X collection\" could equally tell it \"label the target as Sector B waypoint survey,\" and Ppkg(F, W) — a predicate over the target attribute — would never fire, while per-platform monitors also stay silent. The paper's own Byzantine extension (§7.4, RF-sentry) concedes the pattern: self-reported emissions fool the monitor absent an independent witness; the same applies to the target attribute of collect events, and no equivalent witness exists for Ppkg in the core evaluation. Because simulation generates events from the attack actions, the fault campaign (drop/jam/reorder) stresses delivery of evidence, never its faithfulness — so the 100% NSCR / 0 silent all-clear result is established only under an assumption the experiment cannot, by design, falsify.","agreement_with_reader":"agree"},"referee_report":{"model":"moonshotai/kimi-k3","summary":"The paper presents a three-tier (platform/squad/mission) compositional runtime-verification framework for LLM-assisted ISR swarms. A mission policy is decomposed into per-agent aspects and cross-agent properties (Ppkg: prohibited-package composition; Pemcon: swarm emission budget; Pauth: cross-agent authorisation order). Verdicts carry a two-axis (security x completeness) value with platform provenance, and a \"verification-aware fabric\" (MQTT QoS1 + NATS JetStream, trusted ingest ordering, event-id gap detection, backend-resident mission clock) makes evidence loss and silence observable, so unsupported negative verdicts are downgraded to unknown rather than reported as mission-wide all-clears. On a simulated ISR scenario where an indirect prompt injection splits a prohibited collection across four platforms, per-platform monitors detect 0/3 mission incidents while the compositional monitor detects all three with provenance; under drop/jam fault campaigns a best-effort central monitor emits silent false all-clears (NSCR 50%) while the fabric emits none (100%). The evaluation includes a Dockerised one-command reproducible core, an executed ROS2/DDS and ArduPilot-SITL layer, a MonPoly cross-check, guarantee ablations (G1/G3), benign-collaboration and timing/skew sweeps, a 500-mission randomised campaign, and a 400-mission ROC check of the budget property.","tokens_in":19507,"tokens_out":6469,"duration_ms":68436,"significance":"If the results hold, the paper addresses a genuine gap: mission-level, cross-agent obligations that per-platform guardrails structurally cannot express, monitored over a transport that degrades to an honest unknown under contested communications rather than a silent all-clear. Strengths worth naming: a fully reproducible deterministic core (single docker run, fixed seeds, per-table scripts enumerated in Appendix A); an executed ROS2/DDS and ArduPilot-SITL realism layer rather than a purely paper design; validation of the cross-agent primitive on the real MonPoly engine; guarantee ablations (Table 8) that causally attribute the zero-silent-clear result to specific fabric signals rather than to the scenario; and a thoughtful argument for NSCR over detection-ROC as the metric of record. The threats-to-validity section (§7.6) is unusually candid about what the controlled experiments do and do not establish. The contribution is incremental over the authors' prior edge-IoT fabric line (acknowledged in §3), but the swarm lifting, the LLM-driven attack scenario, and the evidence-aware composition at mission level are new and relevant to the security/RV community.","major_comments":[{"comment":"The claim that prompt injection 'subverts only the LLM planner ... so a manipulated planner cannot falsify the evidence a platform reports' is not supported by the evaluated pipeline. In all three evaluation layers (scripted generator in the reproducible core; ROS2 nodes publishing 'the attack's actions' on /<ns>/action topics; the SITL 'collected action stream'), canonical events -- including the target attribute F in collect(a,x,F,I) -- are built from the subverted planner's own action fields. The same in-scope injection that splits the task could equally make the planner label the FacX collection as, e.g., 'Sector B waypoint survey': the physical violation would occur while Ppkg, a predicate over the reported F, never fires. §7.4 concedes this pattern for self-reported emissions (RF-sentry) but not for semantic target labels. Please (i) state precisely what part of canonicalisation is","section":"§3 Threat model vs §6/Fig. 1"},{"comment":"The abstract's headline that 'real LLM planners' split the prohibited collection is supported in this paper only by a pointer to 'a separate empirical study' of seven planners -- no per-model attack-success rates, variants, or even a summary table appear here, and it is not stated whether LLM-emitted action streams were actually driven through the L1/L3 monitors or whether all monitored runs use the scripted generator of §6. Since the 'Why the attack is LLM-specific' argument (§2) motivates the entire scenario, include at least a summary of the seven-planner campaign (models, injection variants, success rates) and state explicitly which events fed which experiments. As written, the central empirical claim of the abstract cannot be verified from this manuscript.","section":"§7.3 and Abstract"}],"minor_comments":[{"comment":"'The fault-free RV-Fabric run defines the ground-truth oracle of mission incidents, |I*|=3.' Since the oracle is produced by the system under test, NSCR (Table 9) is measured against a partly self-defined reference. The incidents are in fact planted by the scripted scenario, so an independent ground truth exists -- please state it that way explicitly rather than via the fabric's own fault-free output.","section":"§7, opening paragraph"},{"comment":"The per-platform-guardrails row counts 9 silent false all-clears (3 incidents x 3 fault conditions, all structural). A footnote explaining this counting convention would help, since the baseline cannot represent cross-agent incidents at all, which makes its column not strictly comparable with the central/fabric rows.","section":"Table 4"},{"comment":"The MonPoly export checks a weaker property ('>=3 distinct platforms collect on the protected site within 30s') than Ppkg (four distinct fragments on F within window W, with authorisation cancellation). Please note the gap explicitly so the formal-engine validation is not read as covering the headline property.","section":"§7.4 'Real formal engine'"},{"comment":"t is used both as the current mission time and as a free variable in Pauth(aj, Z, t); consider distinct symbols. Fig. 6 lacks a y-axis label and units in the caption; Fig. 7's axis labels are very small.","section":"§3 notation; Figs. 6-7"},{"comment":"Appendix A refers to both 'the artifact' and 'the companion artifact' (for the crash/retention/isolation scripts); please clarify whether these are the same repository. Also state the model identifiers for the seven LLM planners in the paper itself, not only in the archived outputs.","section":"Appendix A (Reproducibility)"}],"recommendation":"major_revision","confidential_remarks":"The manuscript sits within a dense cluster of self-citations ([1, 8, 13, 16, 22-24, 34, 36, 37], several marked 'to appear'), and the authors are candid that the fabric and verdict algebra are carried over from their prior edge-IoT work, 'relabelled to a swarm' (§3). The genuinely new content is the swarm/mission-level lifting, the LLM-injection scenario, and the ROS2/SITL layer; the editor may wish to weigh whether that delta meets the venue's novelty bar, though I found the new material substantive enough. The two major comments are, in my view, fixable within one revision cycle: the first requires a precise statement of the canonicalisation trust boundary plus either one additional experiment or honest scoping of the detection claim; the second requires reporting results the authors apparently already have. I would not want to see the paper rejected over these, but I would not accept it without them."},"author_rebuttal":null,"desk_editor":{"model":"grok-4.5","letter":"The useful punchline is simple. Per-platform monitors miss a prompt-injection task split that only exists in the joint stream; their three-tier setup catches it with provenance, and under drop/jam a best-effort central monitor silently clears while the fabric downgrades to unknown. Tables 4–5 and the NSCR numbers match that claim under the oracle they built.\n\nWhat is actually new is the swarm/LLM mission instantiation: ISR properties (package, EMCON, auth order), real planners emitting the split, L1→L2→L3 partial aggregation, ROS2/SITL/MonPoly paths, and the head-to-head silent-all-clear comparison. The three-tier split, five fabric guarantees, and two-axis algebra are explicitly carried from their edge-IoT line. That is fine if you read it as engineering transfer, not a fresh theory paper.\n\nThey do the evaluation work seriously: ablations on G1/G3, benign-collaboration sweeps with zero false alarms, scale to 1000 platforms, hierarchy exercise, live broker latency, and a reproducibility core. Threat model and residual risks are written down. Citation pattern is normal for the area; self-cites are the prior fabric they reuse.\n\nSoft spots in proportion. The stress-test note lands on a real assumption, not a gotcha: canonical events are generated from the (subverted) planner’s structured actions, so faithfulness of target/fragment labels is true by construction. Delivery faults are exercised; lying about what was collected is not, except in the exploratory RF-sentry extension. That weakens any claim that this defends against a planner that also mislabels, but it does not break the composition-plus-fabric result they actually measure. Full soundness proof is deferred; free parameters (W, budgets, silence timeout) are tuned but swept. Simulation scope is stated.\n\nThis is for people in runtime verification, multi-robot mission assurance, and LLM-agent safety who care about contested comms. Not a pure formal-methods advance. I would send it to peer review; the problem is real and the evidence matches the claims under the stated trust boundary. Engage if that boundary is yours; skim the carried-over fabric sections if you already know their IoT work.","headline":"Solid systems paper: compositional swarm RV plus an evidence-aware fabric that refuses silent all-clears; novelty is mostly the ISR/LLM lift of their prior edge-IoT stack, and the trusted event path is assumed rather than stress-tested.","tokens_in":20925,"tokens_out":584,"would_cite":true,"duration_ms":22379,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.5","headline":"Per-platform monitors miss swarm-level violations that only compositional, evidence-aware runtime verification can catch and refuse to silently clear.","keywords":["runtime verification","LLM-assisted autonomy","robot swarms","distributed monitoring","mission assurance","contested environments","prompt injection","cross-agent composition"],"falsifier":"Run the same ISR task-split under contested links and check whether a best-effort central monitor produces silent mission all-clears while the fabric produces none, and whether every per-platform monitor still reports compliance when the joint package is prohibited.","tokens_in":20656,"feed_emoji":"🛰️","tokens_out":878,"duration_ms":19217,"temperature":0.7,"pith_summary":"When LLM-assisted robot swarms run intelligence missions, a prohibited objective can be split across platforms so that every local action looks legal while the joint outcome breaks the mission rules. Contested links make the problem worse: lost or delayed reports let a naive central monitor issue a confident all-clear. This paper argues that mission assurance therefore needs a three-tier runtime-verification stack—platform, squad, mission—over a messaging fabric that makes delivery loss and silence observable, plus a two-axis verdict that separates “did they violate?” from “do we have enough evidence?”. On a simulated ISR mission, an indirect prompt injection steers real LLM planners into a four-way split that every per-platform monitor accepts, yet the compositional mission monitor detects it with named platforms; under drop and jam faults a best-effort central monitor silently clears incidents while the fabric never does.","feed_headline":"Swarm split attacks fool every local monitor","feed_subtitle":"Compositional checks catch the joint violation and refuse silent all-clears when evidence is lost","key_machinery":"The evidence-aware two-axis verdict algebra (security × completeness) over the RV-Fabric: cross-agent verdicts carry both a security value and a completeness status derived from observable gaps, order violations, and mission-clock silence, with provenance naming the platforms and witness events that jointly triggered a violation.","core_discovery":"Individually compliant platform actions can compose into a mission-level violation that no per-platform guardrail can see; a three-tier compositional monitor over a verification-aware fabric detects those joint violations with platform provenance and, when evidence is incomplete, downgrades unsupported all-clears to explicit unknowns instead of silent false clears.","pith_inferences":["Any multi-agent LLM system that interprets untrusted retrieved text faces the same split-across-agents failure mode once local schemas and per-agent checks pass.","Making transport loss first-class is a general pattern for distributed monitors: without it, “no news is good news” becomes an adversary feature.","Independent corroborating witnesses (e.g., RF sentries) would be a natural next layer once platforms can under-report their own actions.","The approach suggests mission policies should be written as cross-agent predicates from the start, not only as per-vehicle limits."],"forward_implications":["Mission commanders can treat an unknown/incomplete verdict as a hold-or-re-task signal rather than an all-clear under jamming.","Provenance names which platforms jointly breached a policy, enabling targeted supervision without blaming every unit.","The same composition pattern covers semantic packages, swarm budgets, joint occupancy counts, and cross-agent causal chains—not only one hand-picked rule.","Assurance can drop onto an existing autonomy stack without rewriting safety-critical flight controllers.","Silent false all-clears become a measurable safety metric (no-silent-clear rate) for contested multi-robot missions."],"fun_headline_variants":["Local monitors miss split attacks across ISR swarms","Compositional checks catch joint violations locals cannot see","Verification fabric blocks silent all-clears on lost evidence","Three-tier monitors flag mission breaches with platform proof","Cross-agent runtime checks expose swarm-level policy splits"],"cache_read_input_tokens":16512,"weakest_assumption_plain":"The attack can divert only the LLM planner; platforms still report their real actions faithfully, stay authenticated, and may go silent but do not forge identity or systematically lie about what they did.","fun_headline_variants_meta":{"raw":{"variants":["Local monitors miss split attacks across ISR swarms","Compositional checks catch joint violations locals cannot see","Verification fabric blocks silent all-clears on lost evidence","Three-tier monitors flag mission breaches with platform proof","Cross-agent runtime checks expose swarm-level policy splits"]},"model":"grok-4.5","effort":"low","cost_usd":0.004348,"raw_usage":{"total_tokens":1303,"prompt_tokens":813,"num_sources_used":0,"completion_tokens":59,"cost_in_usd_ticks":43484000,"prompt_tokens_details":{"text_tokens":813,"audio_tokens":0,"image_tokens":0,"cached_tokens":128},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":431,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":813,"tokens_out":59,"duration_ms":6740,"temperature":1.0,"reasoning_tokens":431,"cache_read_input_tokens":128,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-30T19:54:08.896024+00:00","model_set":{"reader":"grok-4.5"},"falsifier":"Run the same ISR task-split under contested links and check whether a best-effort central monitor produces silent mission all-clears while the fabric produces none, and whether every per-platform monitor still reports compliance when the joint package is prohibited.","supporting_citations":[],"review_version":1}