🤖 AI

Agents for Agents: An Interrogator-Based Secure Framework for Autonomous Internet of Underwater Things

This paper proposes a secure, scalable framework for the Internet of Underwater Things that utilizes a passive, transformer-based interrogator to dynamically monitor agent behavior and assign trust scores, leveraging a permissioned blockchain for tamper-proof identity management to achieve significantly higher detection accuracy against compromised agents with minimal energy overhead compared to static trust baselines.

Original authors: Ali Akarma, Toqeer Ali Syed, Abdul Khadar Jilani, Salman Jan, Hammad Muneer, Muazzam A. Khan, Changli Yu

Published 2026-04-07

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Ali Akarma, Toqeer Ali Syed, Abdul Khadar Jilani, Salman Jan, Hammad Muneer, Muazzam A. Khan, Changli Yu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a team of underwater robots (like robotic fish and submarines) working together to explore the ocean, check oil pipelines, or watch for tsunamis. They talk to each other using sound waves (acoustics) because radio waves don't work underwater. This is called the Internet of Underwater Things (IoUT).

The problem? These robots are autonomous. They make their own decisions. But what if one of them gets hacked, goes crazy, or starts lying? In the past, security systems were like a bouncer at a club door: once you showed your ID (authentication), you were trusted forever. If a robot was "good" at the start, the system assumed it would stay good. But if a robot got compromised after it entered, the system wouldn't know until it was too late.

This paper proposes a new, smarter security system called "Agents for Agents." Here is how it works, using simple analogies:

1. The "Passive Observer" (The Interrogator)

Instead of constantly stopping robots to check their ID cards (which wastes time and battery), the system uses a special module called an Interrogator.

The Analogy: Think of the Interrogator as a security guard who watches from a balcony. The guard doesn't stop the robots to search their pockets (which would slow them down). Instead, the guard just watches how they move and talk.
What they watch: They look at the metadata (the "envelope" of the message), not the message itself. They check: Is this robot talking too fast? Is it sending messages at weird times? Is it suddenly talking to neighbors it never spoke to before?

2. The "Behavioral Detective" (The AI Brain)

The Interrogator uses a lightweight AI (a "Transformer" model) to analyze these patterns.

The Analogy: Imagine a detective who knows your daily routine. If you usually walk to work at 8:00 AM, but suddenly you start walking at 3:00 AM, running in circles, or shouting at strangers, the detective gets suspicious.
The Result: The AI gives every robot a "Trust Score" (from 0 to 1). If a robot starts acting weird, its score drops. It doesn't matter if the robot still has a valid ID card; if its behavior is suspicious, the score drops.

3. The "Digital Ledger" (The Blockchain)

All these trust scores are recorded in a special, unchangeable notebook called a Permissioned Blockchain.

The Analogy: Think of this as a shared Google Doc that only the surface ships and trusted validators can edit. Once a robot's bad behavior is written down, it can't be erased or faked. It creates a permanent history of who is trustworthy.
Why it matters: It prevents a hacked robot from deleting its own bad record.

4. The "Traffic Cop" (Enforcement)

When a robot's trust score gets too low, the system takes action, but it's smart about it.

The Analogy: Imagine a traffic cop who doesn't immediately arrest the driver.
- Level 1 (Low Suspicion): The cop just watches the driver closer.
- Level 2 (High Suspicion): The cop puts the driver in a "slow lane" (throttling their data).
- Level 3 (Confirmed Bad): The cop pulls the driver over and tells everyone else to ignore them (isolating the robot).
The Goal: This stops the bad robot from spreading lies or stealing data, but it keeps the rest of the team working smoothly.

Why is this a big deal?

It's Energy Efficient: Underwater robots have tiny batteries. Checking every single message would drain them. This system only checks the "patterns," saving energy.
It's Fast: It catches bad actors quickly before they can ruin the whole mission.
It's Fair: It doesn't just trust robots because they have a password; it trusts them because they act right.

The Results

The researchers tested this in a computer simulation with 50 robots.

Better Detection: It caught bad robots 21.7% better than old systems.
Low Cost: It only used a tiny bit extra battery (about 6%), which is like adding a small flashlight to a diver's gear.
Reliability: The team delivered more data successfully because the "bad apples" were removed before they could spoil the bunch.

In short: This paper suggests that for underwater robots to be safe, we shouldn't just check their ID cards at the door. We should have a smart, passive system that watches their behavior 24/7, records the evidence on an unchangeable ledger, and gently (or firmly) stops anyone who starts acting suspiciously.

1. Problem Statement

The Internet of Underwater Things (IoUT) relies on Autonomous Underwater Vehicles (AUVs) and sensor nodes for decentralized sensing and coordination. However, current security models suffer from critical vulnerabilities:

Static Trust Assumption: Most deployments rely on static authentication. Once an agent is authenticated, it is implicitly trusted for the entire mission duration, leaving the network vulnerable to compromised, spoofed, or malfunctioning agents (insider threats).
Environmental Constraints: Underwater acoustic channels are characterized by low bandwidth, high latency, intermittent connectivity, and strict energy limits. Traditional continuous cryptographic surveillance is too resource-intensive for these conditions.
Lack of Behavioral Monitoring: Existing solutions focus on key management and authentication but fail to detect gradual behavioral deviations or insider attacks that occur after initial authentication.

2. Methodology

The authors propose an Interrogator-Based Secure Framework that integrates continuous behavioral trust monitoring into the IoUT operational lifecycle without disrupting autonomy. The architecture follows an Observe-Decide-Act paradigm:

A. System Architecture

Operational Agents: Heterogeneous nodes (sensors and AUVs) performing sensing and routing.
Interrogator Module: A privileged, passive software module deployed on high-capacity nodes (e.g., AUVs with Jetson-class GPUs or surface gateways). It monitors communication metadata (inter-packet timing, routing stability, retransmission rates, neighbor churn) without inspecting payload content to preserve bandwidth and privacy.
Governance Layer: A permissioned blockchain consortium (using Hyperledger Fabric and PBFT consensus) running on surface gateways. It stores tamper-proof trust evidence and identity records, avoiding the overhead of public blockchains.

B. Behavioral Trust Inference

Model: A lightweight Transformer model (4 attention layers, 1.2M parameters, quantized) is used to analyze temporal sequences of agent behavior.
Dynamic Scoring: The model calculates a dynamic trust score ( $\tau \in [0, 1]$ $τ \in [0, 1]$ ) for each agent.
- Scores are updated via exponential smoothing to handle noise and environmental variations.
- The model is optimized for sparse acoustic traffic and runs on embedded GPUs with low power consumption (5–10 W).
Thresholding: Agents must maintain a trust score above a minimum threshold ( $\tau_{min} = 0.65$ ) to forward mission-critical data.

C. Adaptive Enforcement & Incident Response

Proportional Monitoring: The system operates in a "baseline" mode with low-duty-cycle monitoring. If an agent's trust score drops, the system switches to an "interrogation state" with increased surveillance.
Tiered Enforcement:
1. Local Action: Immediate local constraints (e.g., routing exclusion, transmission throttling) are applied by interrogators upon high-confidence anomaly detection.
2. Consortium Validation: Policy updates and logical isolation are confirmed via the permissioned blockchain to ensure decentralized consensus.
Recovery: Isolated agents can be reintegrated after recovery procedures or operator intervention.

3. Key Contributions

Interrogator-Based Architecture: A novel framework enabling continuous behavioral verification in decentralized IoUTs, decoupling security monitoring from operational data flow.
Lightweight Transformer Inference: A specialized, quantized Transformer model designed specifically for sparse, high-latency acoustic communication patterns, outperforming traditional LSTM baselines in stability.
Hybrid Governance Model: A tiered enforcement mechanism combining rapid local response with decentralized blockchain validation, balancing speed and security without compromising scalability.
Non-Intrusive Security: The system monitors metadata only, ensuring that payload analysis does not consume excessive bandwidth or energy.

4. Performance Results

The framework was evaluated using the NS-3 Aqua-Sim simulator with 50 heterogeneous agents in a 1 $km^2$ area, simulating 15% adversarial nodes.

Anomaly Detection Accuracy:
- Proposed Framework: 94.2% mean accuracy.
- Static Trust Baseline: 72.5%.
- Bayesian Reputation Model: 86.1%.
- Result: A 21.7% relative improvement over static baselines.
Energy Overhead:
- The behavioral monitoring introduced an average overhead of only 5.8% compared to static trust.
- Inference energy per agent was 0.35–0.6 J, representing less than 7% of the daily energy budget for high-capability AUVs.
Communication Reliability:
- Packet Delivery Ratio (PDR): Increased to 91.6% (vs. 79.4% for static trust and 86.7% for Bayesian).
- Early detection and isolation of malicious nodes stabilized routing paths and reduced retransmissions.
Scalability: Detection accuracy remained above 92% with 50 agents, showing no significant increase in enforcement latency as deployment density grew.

5. Significance

This paper addresses a critical gap in underwater security by shifting from static authentication to continuous behavioral validation. Its significance lies in:

Resilience: It effectively mitigates insider threats and compromised nodes that bypass traditional cryptographic checks.
Feasibility: By utilizing lightweight metadata analysis and permissioned blockchains, it proves that robust security is achievable within the strict energy and bandwidth constraints of underwater acoustic networks.
Operational Continuity: The proportional enforcement mechanism ensures that security measures do not disrupt the autonomy or mission continuity of the underwater fleet.

The study concludes that behavior-driven validation is a viable path for securing long-duration, autonomous IoUT deployments in adversarial maritime environments.