Discovering Antagonists in Networks of Systems: Robot Deployment

2 min read

Wenger, Eberhard and Ebel detect robots that misuse a Voronoi coverage task to take over a region of interest. A robot that drifts towards that region pushes its neighbours away through the tessellation, so an antagonist can quietly blind the swarm to part of the area. A normalising flow, trained only on simulations of normal behaviour, predicts how likely each motion is given the robot’s context (neighbours’ positions, the area’s corners and edges). A detection criterion then labels the robot normal or antagonistic. They test five antagonists: brute force (straight to the target), sneaky (normal at first, then small steps), two Weibull-weighted variants, and a spoofer that lies about its position until it gets there.

Findings

  • The best criterion (the mean of action likelihoods) caught at least 80 % of every antagonist type while keeping false positives for normal robots below 5 %.
  • Simulations used 3 to 20 robots. Hardware used 3 to 5 omnidirectional Mecanum-wheel robots tracked by an OptiTrack system at 100 Hz, and gave results similar to simulation.
  • In the small hardware arena the spoofer’s position jump was smaller, so the mean criterion sometimes missed it. A naive criterion that fires on a single unlikely action caught spoofers well.
  • An ablation shows the new context representation and network beat the authors’ earlier LSTM-based method in both prediction and detection robustness.

Limits

  • One antagonist per run. Multiple antagonists are future work (authors).
  • Training needs a simulator of normal behaviour, and the detector judges physical motions only.
  • There is no fault class: a robot with a slipping wheel would also look antagonistic (my reading). Detection is the end point, with no response.

Relevance

A learned detector for physical misbehaviour in robot teams that does not need examples of attacks, useful next to the message-level defences in resilient consensus. It raises the usual robot security question: with motion data alone, how would a team tell an attacker from a broken robot?