Theory / Formalism

Mission-Centered Resiliency for Teams of Autonomous Agents — a formal foundation for studying how teams of autonomous agents stay (or fail to stay) on-mission under decentralized control, partial observability, and adversarial pressure. The framework is built around the mission as the unit of analysis, not the individual agent.

Foundational premise & interactional regimes

Some missions exceed the operational capacity of any single actor: high-stakes, time-constrained, executed in dynamic environments under partial information, evolving constraints, and little tolerance for delay, error, or failure. The challenge is sustained mission execution under conditions that progressively erode performance and stability. The mission is the primary unit of analysis — agents, structure, autonomy, and interaction matter only through their effect on mission feasibility, progress, degradation, and recovery.

Once the mission is primary, the next question is the structure of interaction through which execution unfolds. The presence of multiple agents is not, by itself, decisive; what matters is the structure of inter-agent relations in a decentralized setting where no persistent central authority governs execution. Mission-level behavior emerges from those relations — the interactional space. Different regimes produce different mechanics of execution:

The labels collaboration / cooperation are treated as loose cues; the regimes are defined through their interactional properties (objective alignment, action coupling, separability of effort, shared progress/risk/consequence). This four-regime vocabulary is the original backbone from the early Formalization; it survives into the mature document as the framing of the interaction structure.

Missions are grouped not by hardware or domain but by the dominant coupling mechanism tying agents together. The taxonomy exposes the structure through which local behavior becomes mission-level effect — and through which local disruption becomes mission-level loss:

The three-layer architecture

The formalism develops in three layers, with a Dec-POMDP backbone at the center and graph-theoretic, control-theoretic, game-theoretic, and learning-based views entering as complementary extensions. The modeling problem is fundamentally micro–macro: missions succeed or fail at the macro level, while execution unfolds at the micro level through local decisions and constrained interaction. A useful model must keep both and make the relation between them explicit.

Interaction affects the mission twice: first by shaping what enters each local history through communication, second by shaping how local decisions compose into the next global state. A local message, dropped link, delayed summary, or corrupted signal can therefore matter far beyond the agent at which it first appears.

Micro-level formalism

Execution is local: at each step, agent i acts not from the full mission state but from what is locally available. Let the agent set be I = {1, …, n} over horizon t ∈ {0, …, H−1}. Agent i has observation space Ωᵢ and action space Aᵢ; at time t it receives a direct observation oₜⁱ ∈ Ωᵢ and an auxiliary input qₜⁱ ∈ Qᵢ. The auxiliary input is deliberately broad — it may carry neighbor communication, role, trust, belief summaries, uncertainty, or health.

Because execution is decentralized, the agent chooses from its locally available history, not the current input alone:

Any quantity that later matters for execution must enter through qₜⁱ, become part of xₜⁱ, and influence action through hₜⁱ and πᵢ. The policy may be hand-designed, model-based, learned, recurrent, stochastic, or role-conditioned. History-based local decision-making does not conflict with a first-order Markov assumption at the system level — the global dynamics can be Markovian while no single agent sees the full global state.

Macro-level formalism — the Dec-POMDP backbone

The latent mission process that local actions jointly induce is modeled as a finite-horizon cooperative Decentralized Partially Observable Markov Decision Process — the right starting point because the mission is sequential, partially observed, decentralized, and team-level by construction. The mission model is the tuple:

The joint policy π = (π₁,…,πₙ) induces the mission trajectory — the main macro-level object, since mission-level claims are made over how execution unfolds through time:

The return J(π) is a standard mission-level abstraction, but it is insufficient on its own: a mission may accumulate reward while its structural capacity to continue erodes. Degradation, viability, and failure are built on top of this backbone once the interaction and micro–macro mapping are explicit.

The interaction bridge

The bridge between micro and macro is the interaction layer: communication, message passing, neighborhood structure, role-dependent influence, and propagation. Decentralized coordination is not produced by local policy alone — it is produced by local policy acting through a structured pattern of inter-agent communication and dependence. The structure is a time-varying directed interaction graph:

If agent j sends a signal to i, write it mₜ^j→i. The communication input to i is the aggregation of received neighbor signals:

The operator Aggᵢ is left abstract on purpose — averaging, consensus, message fusion, belief update, map merging, or trust-weighted filtering. This is the communication component inside the auxiliary input: simplest case qₜⁱ = cₜⁱ; richer settings qₜⁱ = (cₜⁱ, rₜⁱ, uₜⁱ, …) with role/mode rₜⁱ and a local uncertainty/trust/health variable uₜⁱ. The trust-by-default assumption enters exactly here: under nominal operation agents treat neighbor signals as valid decision inputs, discounting them only after clear inconsistency.

Working assumptions

The framework is developed under explicit assumptions — realistic starting conditions, not universal claims. The mature document carries eight; the Swarm-Resiliency draft states the load-bearing first five (A1–A5):

Nominal vs. off-nominal execution

Nominal execution is execution within the expected operating regime: the joint trajectory stays inside an admissible region where sensing, communication, and local decision-making behave within design assumptions. It may include noise and variation, but not in a form that changes the basic logic of execution — geometrically, motion within an expected operating region, near a constrained manifold of admissible mission dynamics.

Off-nominal execution begins when the trajectory departs that regime. The cause is intentionally cause-agnostic — disturbance, fault, isolation, anomaly, misbehavior, or adversarial influence. It marks a regime shift, not yet a verdict on success or failure: information quality shifts, interaction patterns weaken or distort, redundancy erodes, or local decisions no longer compose as expected.

Within that shift, four trajectory-level concepts orient everything downstream — health tracks the broader condition of execution; viability asks whether successful completion is still achievable; degradation marks weakening of health; failure begins when viability is lost. Distinct from these are four response concepts:

A mission can recover without full healing, and a system can heal locally without full mission recovery. This nominal / off-nominal + health / viability / resilience / recovery vocabulary originates in the early Formalization and is made precise by the definitions and metrics below.

Mission objectives — the core definitions

Because the cooperative return alone cannot detect eroding structural capacity, the framework adds formal objects capturing the conditions for continued execution: the constraint set, mission health, the viability kernel, and trajectory-level predicates for success, degradation, and failure.

Deviation, stealth & the threat model

The deviation model is cause-agnostic — it captures any bounded departure from nominal behavior. The Swarm-Resiliency draft frames this as an effect-based threat model: rather than model the exploit path, model its mission-relevant outcome, namely that a subset of agents no longer follows the nominal decentralized decision rule. A disturbance instance is the tuple D = (C, α, ε, Δ).

The framework also bounds intervention frequency — the total activated steps across all compromised agents is capped by an intervention budget T_int: Σ_i∈C Σ_t βₜⁱ ≤ T_int. Together these define the feasible strategy set Φ_k(α, ε_s, T_int) of deviation profiles with |C|≤k satisfying amplitude, stealth, and intervention bounds.

Threat-model taxonomy: natural faults vs. adversarial attacks

f-local / f-total models (from Byzantine consensus): f-total caps the whole network at |C|≤f; f-local caps any agent's neighbors at |C∩Nᵢ(t)|≤f. Resilient consensus under f-local faults requires (2f+1)-robustness of the graph — connecting interaction-layer structure directly to the threats the mission can withstand. Three attack surfaces exist: message corruption (KL on the message distribution), observation tampering (within the sensor-noise envelope), and action perturbation (TV on the action distribution).

Propagation — how local deviation becomes mission-level effect

A purely local deviation need not stay local. Once it enters the interaction graph it alters neighbors' inputs, shifts downstream decisions, changes the future joint action, and modifies later mission states and observations.

For agents not directly connected, influence propagates over multi-hop paths in the time-expanded interaction graph. The ℓ-step influence is bounded by the sum over directed length-ℓ paths of the product of edge-level influences:

This upper bound follows from the data-processing inequality and the triangle inequality for total variation. It is a strict generalization of consensus error propagation: in linear consensus x_t+1=Wₜxₜ+ηₜ, a perturbation at node i reaches node j at t+ℓ as [W_t+ℓ−1…W_t+1]_ji times the perturbation — the linear, deterministic special case of the general influence chain.

The adversarial game & the break budget

Under an adversarial threat model the contest is a two-player zero-sum partially observable stochastic game (POSG): blue (the swarm) plays a defensive joint policy to maximize mission return; red (a centralized adversary on k of n agents) selects a deviation profile from the feasible set to minimize it.

The return gap quantifies degradation under worst-case attack at resource level k: ΔJ(k) = J(π; clean) − min_D∈Φk J(π, D).

The stealth–degradation trade-off (the stealth–damage frontier)

The stealth constraint forces a Pareto frontier between mission degradation and detectability. A maximally damaging attack (ε_s→∞) is trivially detected; a perfectly stealthy attack (ε_s=0) may produce little degradation. Between them lies the achievable frontier — and its shape is mission-family-dependent (information-coupled missions may expose a steep frontier where small stealth budgets yield large damage; connectivity-coupled missions may flatten it).

Hypotheses on adversarial amplification (H1–H3)

The zero-sum framing plus the propagation formalism motivate three structural hypotheses that distinguish adversarial pressure from random faults.

Resiliency metrics

The formal objects above enable a precise, trajectory-based, threat-parameterized vocabulary for resiliency, aligned with the resilience-engineering distinctions of robustness, brittleness, elasticity, and recovery.

Summary

Worked example — shared exploration & phantom-coverage injection

The full formalism is instantiated on a shared exploration mission: team-level coverage of an unknown environment within a finite horizon. It is information-coupled with a secondary topology coupling, and it shows concretely how a local lie propagates through frontier sharing into mission-level coverage loss.

• State. A W×W grid; each agent occupies a cell pₜⁱ; a coverage indicator ξₜ marks sensed cells; the comm graph is proximity-based: (j,i)∈Eₜ ⇔ ∥pₜ^j−pₜⁱ∥_∞ ≤ r_comm. So sₜ = ({pₜⁱ}, ξₜ, Gₜ).
• Observation. Cells within a sensing radius r_sense — the local coverage fragment. No agent sees the full map.
• Action / reward. {N,S,E,W,stay}; coverage is monotone; team reward = incremental coverage gained per step.
• Coupling — frontier sharing. Agent j sends mₜ^j→i = (Fₜ^j, ξ̂ₜ^j) (its frontier + local coverage belief); aggregation is set union cₜⁱ = ∪_j∈Nᵢ(t) ξ̂ₜ^j. This is where propagation originates: a slightly wrong but plausible frontier shifts neighbors' moves, they sense the wrong cells, and forward messages that reinforce the mistake.

Second instantiation — communication relay (topology-coupled): agents maintain end-to-end connectivity between source–destination pairs; the dominant health indicator is algebraic connectivity λ₂; the attack surface is the relay structure itself (position drift / message corruption reducing path redundancy); the break-budget driver is vertex connectivity κ. The two instantiations demonstrate the formalism generalizes across mission families.

Focused research questions (RQ1–RQ6)

The broad questions narrow into a focused agenda, each connected to a formal handle developed above.

Source documents

This page transcribes the formal content so the site carries it independently. The original source files (with their full TikZ figures, Pareto plots, and bibliography) are available for download:

Related pages: Architecture — the engineering of the same swarm (the substrate these objects are measured on) · Findings — the empirical evidence, including the compromise sweep that instantiates the break budget and the stealth–damage frontier · Literature — where this framework sits in the field.