⚡ electrical engineering

Distributed Containment of a Compromised Agent through Repulsive Cages

This paper proposes a distributed containment framework that leverages the uncompromised low-level collision-avoidance mechanisms of a hijacked agent to form "repulsive cages," enabling defender agents to steer the compromised target within safe regions by modeling the interaction as an online Stackelberg game and proving sublinear dynamic-regret bounds for a distributed approximation.

Original authors: Luigi Petruzziello, Camilla Fioravanti, Gabriele Oliva

Published 2026-07-02

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Luigi Petruzziello, Camilla Fioravanti, Gabriele Oliva

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Core Problem: A Hijacked Drone in a Flock

Imagine a flock of drones flying together in perfect formation. They are programmed to work as a team. However, one day, a hacker takes control of the "brain" (the high-level command) of just one drone in the flock.

This hijacked drone (let's call it the Target) now wants to fly off in a dangerous direction or crash into things. The hacker can tell it exactly where to go.

The Catch: The hacker cannot turn off the drone's "safety reflexes." Just like a human has a reflex to pull their hand away from a hot stove, every drone in this system has a built-in, low-level safety system that automatically pushes it away from anything too close. The hacker can't disable this; it's hardwired into the hardware.

The Solution: The "Repulsive Cage"

The other drones in the flock (the Defenders) can't force the hijacked drone to obey them. They can't say, "Stop!" or "Turn left!" because the hacker is in charge of those commands.

Instead, the defenders use a clever trick: They shape the air around the hijacked drone.

Think of the safety reflex as a strong wind that pushes the drone away from anything nearby.

If the defenders fly close to the hijacked drone, the "wind" pushes the drone away from them.
If the defenders arrange themselves in a specific circle around the drone, the combined "wind" from all of them creates a Repulsive Cage.

Even though the hacker is screaming, "Fly straight out of here!" the hijacked drone's own safety reflex pushes it back into the center of the cage because the defenders are blocking the exit. The defenders aren't controlling the drone; they are controlling the environment the drone reacts to.

The Game: The "Leader and Follower"

The paper describes this situation as a game of strategy, specifically a Stackelberg Game (think of it as a game of "I move first, you react").

The Defenders (Leaders): They decide where to move first. They pick a formation that creates the best possible "cage" or path toward a safe destination.
The Hacker (Follower): The hacker sees the defenders' new position and tries to find the worst possible command to break the cage or push the drone out of the safe zone.

The goal for the defenders is to pick a formation that works even if the hacker tries their absolute hardest to break it.

The Challenge: Doing It Without a Central Brain

In a perfect world, all the defenders would talk to a central computer, calculate the perfect cage, and move in unison. But in reality, they only talk to their immediate neighbors (like a group of friends whispering in a circle).

The paper proposes a Distributed Algorithm. This means:

Each defender only knows what its neighbors tell it.
They have to guess what the "total wind" (the aggregate repulsive field) feels like based on local information.
They constantly adjust their positions to keep the cage tight, even as the hacker tries to break it and the environment changes.

The Results: "Regret" and Success

The authors prove mathematically that their distributed method works almost as well as the perfect central computer.

They use a concept called "Regret." Imagine you are playing a game, and at the end, you look back and think, "If I had known the future, I could have played better."

High Regret: The defenders made a lot of mistakes compared to the perfect plan.
Low (Sublinear) Regret: As time goes on, the defenders make fewer and fewer mistakes per step. They learn to track the perfect solution so well that, on average, they are just as good as the central computer.

The simulations in the paper show that even with the hacker trying to escape and the defenders only talking to their neighbors, the "Repulsive Cage" holds. The hijacked drone stays inside the safe zone, and if the defenders want to move the drone to a specific safe spot, they can gently herd it there using this invisible cage of repulsion.

Summary

The Villain: A hacker controlling one drone's brain.
The Hero: The other drones using their own safety reflexes against the hacker.
The Weapon: A "Repulsive Cage" formed by the defenders' positions.
The Method: A smart, distributed strategy where drones whisper to neighbors to build a cage that the hacker cannot break, all while moving the drone to safety.

Technical Summary: Distributed Containment of a Compromised Agent through Repulsive Cages

Problem Statement
This paper addresses the security challenge of a compromised agent within a cooperative multi-agent system, such as a UAV swarm or mobile-robot fleet. The scenario assumes a "hybrid" compromise: an adversary has hijacked the high-level command channel of a single agent (the "target"), allowing them to select arbitrary motion setpoints, but the agent's low-level collision-avoidance safety layer remains intact and active. This safety layer, typically implemented in hardware or firmware, generates repulsive forces based on relative distances to other agents and cannot be disabled by the adversary.

The objective is to design a distributed control strategy for the remaining "defender" agents to keep the compromised target within a prescribed admissible region $\Omega_{k+1}$ at every time step, despite the adversary's worst-case command selection. The defenders cannot directly command the target; instead, they must exploit the target's uncompromised low-level repulsive response. By strategically positioning themselves, defenders shape the aggregate repulsive field acting on the target, effectively using the target's own safety mechanisms as an indirect actuation channel.

Methodology
The authors model the interaction as an online Stackelberg game with time-varying constraints and distributed information:

Game Structure: Defenders act as leaders, committing to a geometric configuration $y$ (induced by their high-level commands and the low-level repulsive layer). The adversary acts as a follower, observing this configuration and selecting a high-level command $u_a$ to maximize the target's escape from the admissible region.
Geometric Characterization: The paper derives an exact geometric condition for robust one-step containment. Using support functions and normal cones, the authors define a "repulsive cage"—a defender configuration that guarantees the target remains in the admissible region for all admissible adversarial commands. This is characterized by a directional containment margin $\ell_k(y; v)$ , where robust containment holds if the worst-case margin $c_k(y) \leq 0$ .
Centralized Oracle: A centralized Stackelberg oracle is defined as a benchmark that minimizes a loss function comprising the worst-case containment violation, a transport deficit (if steering toward a destination is required), and a regularization term for defender motion and separation.
Distributed Implementation: Since the centralized oracle requires global information, the authors propose a fully distributed online algorithm. This approach relies on:
- Dynamic Average Consensus: Defenders use local communication to estimate the aggregate repulsive field $g_k(y)$ generated by the team.
- Active-Direction Approximation: To handle the non-smooth maximization over directions required for the worst-case analysis, defenders perform a consensus routine over a finite direction dictionary (or use a geometric projection rule) to identify the most critical "active" direction.
- Projected Gradient Descent: Defenders update their induced configurations using local estimates of the subgradient of the loss function.

Key Contributions

Repulsive Cage Framework: The paper introduces the concept of a "repulsive cage," a geometric configuration of defenders that guarantees containment against all adversarial commands by leveraging the target's low-level repulsive primitive. This repurposes standard collision-avoidance mechanisms into a control channel for compromised agents.
Exact Geometric Characterization: The authors provide a rigorous derivation of robust one-step containment conditions using support functions, establishing an equivalence between the worst-case violation and a directional margin.
Distributed Online Stackelberg Control: The work formulates the containment task as an online Stackelberg game and develops a distributed algorithm that tracks the centralized oracle using only local sensing and communication.
Dynamic Regret Analysis: The paper proves sublinear dynamic-regret bounds for the distributed algorithm. This quantifies the performance gap between the distributed policy and the centralized oracle, explicitly accounting for network-induced estimation errors, direction-agreement approximations, and the temporal variability of the optimal solution.

Results

Theoretical Guarantees: Theoretical analysis demonstrates that the distributed algorithm achieves sublinear dynamic regret ( $Reg_T = o(T)$ ) and sublinear cumulative containment violation ( $V^\Psi_T = o(T)$ ) under specific conditions regarding the path variation of the oracle and the variation of the aggregate field.
Simulation Validation: Simulations with a 5-defender swarm and a hijacked target in a 2D environment validate the approach. The results show that the distributed controllers (using both active-direction consensus and a cheaper projection rule) successfully track the centralized oracle's performance, maintaining low instantaneous and cumulative regret while keeping the target within the admissible region.

Significance and Claims
The paper claims to offer a novel approach to resilient coordination that does not rely on detecting or isolating the compromised agent, which can be difficult in safety-critical, real-time scenarios. Instead, it exploits a structural property common in autonomous platforms: the persistence of low-level safety layers even under high-level compromise.

The authors position their work as distinct from existing "indirect herding" literature (e.g., StringNet) by focusing on a single internal hijacked agent with worst-case commands rather than external adversarial swarms, and by providing dynamic-regret guarantees against a time-varying oracle rather than static stability guarantees. The significance lies in providing a mathematically rigorous, distributed framework for containing compromised agents by turning their own safety mechanisms against them, ensuring safety without requiring full control over the compromised unit.