A team of drones explores a building with frontier-based exploration: each drone announces the frontier it is heading for and shares its occupancy map. One compromised drone runs fake identities that claim frontiers and send fabricated scans, so the real drones skip parts of the building and end up with walls that do not exist. The paper studies five attackers (random scans, slow trust-building, hiding from every camera, sealing the openings between floors, and fakes placed right next to real drones) against five stacked defences that need no security infrastructure. D1 audits received map data against what the drone sees itself and revokes an identity once a Beta test shows, with 99% confidence, that its contradiction rate is above 2%. D2 checks for a body where an identity claims to be. D3 trusts only identities whose body has been seen. D4 quarantines data from identities no drone has observed. D5 binds each observed body to one identity.
Findings
- 70 simulated maps of seven kinds (offices, tunnels, warehouses, forests, caves, three-storey buildings and more), 2,350 missions in all.
- Without a defence, one compromised drone leaves up to 25% of a map unexplored on average, 45% in offices and 35% in tunnels, against 12% in open warehouses and 8% in forests. The floor-sealing attacker cuts exploration of a three-storey building to 82.3%, or 34.6% on the worst map.
- The audit alone restores 99.4 to 99.8% of the explored space, but self-consistent fakes still leave 3,000 to 4,800 false cells per honest map, 1,100 to 1,800 after D3, and about 40,000 in tunnels.
- The quarantine (D4) restores exploration to the unattacked level in every setting and false data in most. It falls short with two colluding attackers, fakes next to real drones, three of ten caves and a 16-drone team.
- Body binding (D5) cuts false cells from fakes next to real drones from 782 to 57 per map, the level of an honest team, and fixes the caves and the 16-drone team. Colluding attackers remain the exception.
- An honest drone was revoked by a teammate only twice in 2,350 missions.
Limits
- Simulation only, with known poses, an idealised depth camera, mostly point-mass motion, and the assumption that a drone can detect and tell apart other drones (authors).
- The compromised drone never lies under its own identity, the shadow attacker keeps a fixed offset rather than adapting to message delays, and the team never changes during a mission (authors).
- None of the defences authenticates an identity. They complement signed messages rather than replace them (authors).
Relevance
The defences are the physical-evidence idea of spoof-resilient networks and the blocklist protocol applied to shared maps: a teammate’s data is believed when it agrees with what you can see. The gap between restoring coverage and removing false data is the useful result for collaborative-slam, where a few fabricated cells can still mislead a planner. Compare the Safe Wrapper, which also targets Sybil attacks but with statistical guarantees per link. See aerial-swarms, byzantine-fault-tolerance and comparison-byzantine-defences.