Technical Summary: Neuro-Agentic Control Framework for Industrial IoT Security

1. Problem Statement

Cyberattacks on Operational Technology (OT) and Industrial Internet of Things (IIoT) systems are increasingly causing significant financial losses and physical safety risks. Traditional rule-based monitoring is insufficient for the complex, dense environments of modern industrial deployments. While Large Language Models (LLMs) offer powerful semantic reasoning capabilities for decision support, their tendency to "hallucinate" (generate factually incorrect or physically impossible outputs) poses unacceptable safety liabilities for closed-loop control systems. Conversely, existing time-series forecasting models often lack the semantic reasoning required to formulate complex counter-strategies. There is a critical need for a framework that leverages the reasoning power of LLMs while strictly grounding their actions in physical reality to prevent catastrophic failures in Cyber-Physical Systems (CPS).

2. Methodology

The paper proposes a Neuro-Agentic Control Framework, a two-stage architecture that decouples semantic reasoning from physical control. The system operates as a closed loop consisting of two primary agents:

• The Architect (LLM Planner): Utilizing Gemini 2.5 Flash-Lite, this agent acts as a semantic reasoner. It receives contextual data (sensor trends, predicted time-to-failure, and operational manuals retrieved via Retrieval-Augmented Generation) and generates candidate control strategies. These strategies are output as structured JSON objects defining an action type, magnitude (e.g., drain rate), and duration.
• The Sentinel (Physics Engine): Utilizing TimesFM (a pre-trained Time-Series Foundation Model), this agent serves as a deterministic physics ground-truth. It does not update its internal weights but uses its pre-trained knowledge of temporal dynamics to forecast future system states.

Core Mechanism: Counterfactual Physics Injection

The central innovation is the Counterfactual Physics Injection mechanism. Since the LLM cannot directly modify the foundation model's weights, the framework translates the LLM's semantic commands into numerical perturbations within the forecasted time series.

• The system simulates the effect of an LLM-proposed action (e.g., opening a drain valve) by applying a cumulative linear injection to the forecasted horizon.
• For a drain rate $\mu$ and duration $\delta$, the modified forecast $\hat{y}'_t$ is calculated as:
  • $\hat{y}'_t = \hat{y}_t + \mu \cdot (t + 1)$ for $t < \delta$ (cumulative drain effect).
  • $\hat{y}'_t = \hat{y}_t + \mu \cdot \delta$ for $t \geq \delta$ (maintaining the final drained level).
• This allows the Sentinel to predict the physical outcome of a proposed action before it is executed.

Hallucination Rejection Strategy

The framework employs a deterministic Hallucination Rejection algorithm. Before any action is executed, the Sentinel simulates the outcome of every candidate strategy proposed by the Architect.

• Safety Verification: If a simulated action results in a system state worse than the baseline (e.g., a positive magnitude "filling" action during an overflow scenario, or an action that fails to lower the level below the critical threshold), it is rejected.
• Optimization: The system selects the optimal action $a^*$ that minimizes the projected risk (maximum peak level) across all valid candidates. If all candidates are unsafe or ineffective, the system defaults to a "Monitor" state.

3. Key Contributions

1. Novel Architecture: A Neuro-Agentic Control framework that explicitly separates semantic reasoning (LLM) from physical control (Foundation Model) for IoT systems.
2. Counterfactual Physics Injection: A mechanism to translate semantic control actions into numerical perturbations of future forecasts, enabling deterministic validation without fine-tuning the foundation model.
3. Deterministic Rejection Strategy: A safety layer based on worst-case risk minimization that automatically rejects unsafe, physically invalid, or hallucinatory LLM proposals.
4. Empirical Validation: Demonstration of the framework's efficacy on the Secure Water Treatment (SWaT) dataset, showing superior breach prevention compared to traditional deep learning baselines.

4. Experimental Results

The framework was evaluated on the SWaT dataset (Secure Water Treatment) under 15 stochastic attack scenarios involving three types of attacks: Sudden Spike, Gradual Drift, and High Noise. The performance was compared against LSTM and Temporal Convolutional Network (TCN) baselines.

• Breach Prevention:
  • Neuro-Agentic: Prevented breaches in 5 out of 15 trials (33.3%).
  • LSTM: Prevented breaches in 4 out of 15 trials (26.7%).
  • TCN: Prevented breaches in 2 out of 15 trials (13.3%).
• Risk Reduction:
  • The Neuro-Agentic framework achieved a mean risk reduction of 48.51 units, significantly outperforming LSTM (16.77 units) and TCN (20.29 units).
  • In the most successful trial (Trial 10), the framework reduced the risk peak by 215.38 units, more than three times the maximum reduction achieved by the LSTM baseline.
• Safety and Hallucination:
  • Crucially, the Neuro-Agentic system executed zero hallucinated or physically invalid actions. The Sentinel successfully filtered out all unsafe proposals (e.g., positive magnitude actions during overflow) before execution.
  • In contrast, the baselines either failed to prevent breaches or, in the case of the Neuro-Agentic system, the rejection mechanism ensured that no "hallucinated" strategies were ever applied to the system.

5. Significance and Claims

The paper claims that the Neuro-Agentic Loop successfully bridges the gap between the high-level reasoning of Generative AI and the strict safety requirements of industrial control. By utilizing a Time-Series Foundation Model as a "Sentinel," the system provides a physics-grounded world model that validates LLM decisions deterministically.

• Safety Assurance: The framework transforms LLMs from opaque, probabilistic predictors into explainable, safety-constrained planners. It ensures that no hallucinatory control actions are executed, addressing a primary barrier to using LLMs in safety-critical CPS.
• Performance: The system demonstrates that coupling an LLM with a foundation model yields better breach prevention and risk reduction than traditional deep learning models, particularly in scenarios requiring rapid, decisive intervention (e.g., sudden spikes).
• Trade-offs: The authors acknowledge that this approach introduces an inference latency of 1.5 to 2.5 seconds per control cycle (due to LLM generation and counterfactual simulation), which is higher than traditional PID controllers but remains within the operational time constants of most chemical and fluid processes.

The paper concludes that this architecture offers a viable path toward autonomous, safe industrial defense, provided that latency is managed and the system is validated across diverse environments. Future work is proposed to optimize inference latency via model quantization and to test robustness against adversarial attacks targeting the foundation model's forecast horizon.