Safe Multi-Robot Collaboration With Uniform Exclusion Using Trust

3 min read

The Safe Wrapper sits between a robot and its incoming communication links and decides which links to listen to. Each robot runs an anomaly detector on each link and gets a stream of “trust values”; for a Sybil attacker these can come from the wireless channel, for an injection attacker from the link’s transmission rate. The wrapper tests each stream with Safe Anytime-Valid Inference (e-processes and confidence sequences) and admits a link only once the test says it is legitimate. Two guarantees follow: with a probability the user picks, every compromised link is excluded for the whole run, not just eventually; and every legitimate link is trusted almost surely, with error probabilities falling exponentially fast up to log factors. The detector only has to be better than chance. Because the wrapper acts on links, not on the task, any algorithm that tolerates a finite number of dropped links can be wrapped unchanged.

Findings

  • Hardware: heading consensus on 8 GoPiGos against a Sybil attacker, where malicious identities outnumber the honest robots, and neural implicit mapping on 3 LoCoBots against a data-injection attacker.
  • In consensus, the unsecured team agrees on the attacker’s heading and crashes. A trust-based baseline that does not exclude uniformly over time still converges near the malicious heading, because it trusts malicious messages at the start. The wrapper ends inside the convex hull of the honest robots’ initial headings (18 runs with the wrapper, 17 with the baseline).
  • In mapping, the reconstructed meshes show no hallucinated geometry from the injected data.
  • Simulations with trust values resampled from the hardware runs scale to 500 robots. The number of malicious robots has little effect on the time to perfect classification, and dense graphs can even reach a connected honest subgraph sooner.

Limits

  • The set of compromised links is fixed for the run. Attackers that start and stop break the uniform separability the test relies on (authors).
  • Security rests on trust values that are hard to falsify. A detector the attacker can manipulate voids the guarantee (authors).
  • Each robot collects evidence on every link by itself. Sharing trust between robots is left for future work (authors).
  • An honest robot that is excluded at first is simply ignored for a while, so the cost is slower convergence, not wrong values. How long “a while” is depends on the detector’s quality.

Relevance

This is the Gil group’s line from spoof-resilient networks and confidence-boosted trust taken to a time-uniform guarantee. It drops the bound on the number of liars that W-MSR-style consensus and reputation consensus need, which matters for Sybil attacks where the liars are the majority. It belongs in comparison-byzantine-defences next to the blocklist protocol: both use physical evidence, but here the evidence is per link and statistical. See byzantine-fault-tolerance and robust-robotics.