In MASs, the information exchange among agents can naturally be modeled with the aid of algebraic graph theory. Depending on the communication direction, the interaction topology can be represented as either an undirected or a directed graph. Furthermore, as network attacks such as DoS or spoofing attacks may block communication links, network topologies often exhibit time-varying or switching characteristics^[63]. Therefore, it is necessary to extend classical graph theory concepts to dynamic scenarios.

Let $$ \mathcal{G} = (\mathcal{V}, \mathcal{E}, \mathcal{A}) $$ denote a weighted graph^[64], where $$ \mathcal{V} $$ = {v₁, v₂, …, v_N} is the set of nodes (agents), $$ \mathcal{E} \subseteq \mathcal{V} \times \mathcal{V} $$ is the set of edges (communication links), and $$ \mathcal{A} $$ = [a_ij] ∈ ℝ^N×N is the adjacency matrix. An edge (v_j, v_i) ∈ $$ \mathcal{E} $$ indicates that agent i can receive information from agent j, with weight a_ij > 0; otherwise, a_ij = 0. We assume no self-loops, i.e., a_ii = 0 for all i. The neighbor set of agent i is defined as $$ \mathcal{N} $$_i = {j ∈ $$ \mathcal{V} $$ | (v_j, v_i) ∈ $$ \mathcal{E} $$}.

For a directed graph (digraph), the in-degree of node i is d_in,i = Σ_j=1^Na_ij and the out-degree is d_out,i = Σ_j=1^Na_ji. The Laplacian matrix $$ \mathcal{L} $$ = [l_ij] ∈ ℝ^N×N is defined as

(1) $$ l_{ij} = \begin{cases} -a_{ij}, & i \neq j,\\ \sum_{k=1, k \neq i}^N a_{ik}, & i = j. \end{cases} $$

Equivalently, $$ \mathcal{L} = \mathcal{D}_{\text{in}} - \mathcal{A} $$, where $$ \mathcal{D} $$_in = diag{d_in,1, …, d_in,N}.

For an undirected graph, (v_j, v_i) ∈ $$ \mathcal{E} $$ implies (v_i v_j) ∈ $$ \mathcal{E} $$ and a_ij = a_ji. In this case, $$ \mathcal{A} $$ is symmetric, the degree of node i is d_i = Σ_j=1^Na_ij, and the Laplacian matrix is symmetric and positive semidefinite:

(2) $$ \mathcal{L} = \mathcal{D} - \mathcal{A}, $$

where $$ \mathcal{D} $$ = diag{d₁, …, d_N}. The Laplacian $$ \mathcal{L} $$ has a zero eigenvalue with associated eigenvector 1_N = [1, …, 1]$$ ^\top $$, and all other eigenvalues are positive if and only if the graph is connected^[64,65].

A directed graph contains a spanning tree if there exists a root node from which there is a directed path to every other node. For a digraph, $$ \mathcal{L} $$ has at least one zero eigenvalue, and all non-zero eigenvalues have positive real parts if and only if the graph contains a spanning tree^[50,51].

In addition to deterministic or switching topologies, recent work has considered random dynamic networks under mobile malicious attacks^[59]. In this setting, the network topology evolves according to a stochastic process, and the set of malicious nodes changes over time as the adversary moves across the network. The graph-theoretic robustness conditions are then expressed in terms of stochastic robustness rather than deterministic connectivity or spanning-tree conditions. This motivates the inclusion of stochastic robustness conditions alongside the union-graph and spanning-tree conditions discussed above, particularly for decision-layer resilient consensus against mobile Byzantine agents.

In many cooperative control tasks such as formation control and output regulation, a subset of agents, called leaders, generate reference trajectories that the remaining agents, called followers, must track. Consider an MAS with M followers and N - M leaders. The communication graph among the followers is denoted by $$ \mathcal{G} $$_F, with Laplacian matrix $$ \mathcal{L} $$_F. The interaction from leaders to followers is captured by a diagonal matrix $$ \mathcal{B} $$ = diag{b₁, …, b_M}, where b_i > 0 if follower i receives information from at least one leader, and b_i = 0 otherwise. The information exchange among all agents can then be described by the overall Laplacian-like matrix $$ \mathcal{H} = \mathcal{L}_F + \mathcal{B} $$, which plays a central role in the stability analysis of leader–follower consensus^[51,66].

Under DoS attacks or other communication impairments, the set of active links becomes time-dependent. We model the attacked communication network as a time-varying graph $$ \mathcal{G} $$(t) = ($$ \mathcal{V} $$, $$ \mathcal{E} $$(t), $$ \mathcal{A} $$(t)), where the edge set $$ \mathcal{E} $$(t) and adjacency weights a_ij(t) are piecewise constant and switch at isolated time instants^[24,67]. Specifically, let $$ \{\tau_k\}_{k \in \mathbb{N}} $$ be the switching instants and let $$ \mathcal{G} $$_σ(t) denote the active topology, where σ: [0, ∞) → $$ \mathcal{P} $$ is a piecewise constant switching signal taking values in a finite index set $$ \mathcal{P} $$. The Laplacian matrix at time t is then $$ \mathcal{L} $$_σ(t).

To ensure consensus or other cooperative objectives despite attacks, one often requires that the union graph satisfies connectivity conditions over certain time intervals. For a collection of graphs {$$ \mathcal{G} $$₁, …, $$ \mathcal{G} $$_m} on the same vertex set, the union graph is defined as $$ \bigcup_{k=1}^m \mathcal{G}_k = (\mathcal{V}, \bigcup_{k=1}^m \mathcal{E}_k) $$. A common sufficient condition for consensus under switching topologies is the existence of an infinite sequence of bounded intervals such that the union graph over each interval contains a spanning tree^[67].

Definition 1^[14]. In the context of Byzantine attacks, the adversary can compromise a subset of agents. Let $$ \mathcal{F} \subset \mathcal{V} $$ be the set of malicious nodes. The system is said to be under an F-local attack if for every normal agent i, at most F of its neighbors are malicious, i.e., $$ |\mathcal{N}_i \cap \mathcal{F}| $$ ≤ F. An F-total attack is one in which the total number of malicious agents in the network is at most F, i.e., |$$ \mathcal{F} $$| ≤ F.

We consider an MAS consisting of N autonomous agents. The dynamics of agent i (i = 1, 2, …, N) can be described by a general nonlinear ordinary differential equation coupled with an output equation:

(3) $$ \begin{aligned} \dot{x}_i(t) &= f_i\big(x_i(t), u_i(t), \omega_i(t), t\big), \\ y_i(t) &= h_i\big(x_i(t), \nu_i(t), t\big), \end{aligned} $$

where x_i ∈ $$ \mathbb{R}^{n_i} $$ is the state vector, u_i ∈ $$ \mathbb{R}^{m_i} $$ is the control input, y_i ∈ $$ \mathbb{R}^{p_i} $$ is the measured output, and ω_i, ν_i denote process and measurement disturbances, respectively. In the cooperative control setting, the control protocol u_i is typically a function of local relative information, i.e., u_i = κ_i($$ \sum_{j\in\mathcal{N}_i} $$a_ij(x_j - x_i)), where κ_i is a feedback law to be designed.

Depending on the physical characteristics of the agent, the functions f_i and h_i can be concretized into several widely studied categories. Agricultural embodied intelligent robot swarms are typically heterogeneous, consisting of nonholonomic ground vehicles for precise spraying and weeding, as well as underactuated aerial platforms for crop monitoring and mapping. Ground robots are often modeled as EL systems with nonholonomic constraints, while aerial robots exhibit strong nonlinearity and underactuated dynamics. This heterogeneity brings additional complexity to resilient consensus and formation control: different platforms have different driving capabilities, state dimensions, and vulnerability characteristics, thereby expanding the attack surface and increasing the difficulty of designing a unified resilient protocol.

To capture the heterogeneous collaboration between agricultural machinery and UAV formations, we model the ground–air swarm as a switched heterogeneous MAS. Ground vehicles are described by EL equations with nonholonomic constraints, while UAVs are modeled by underactuated nonlinear dynamics. The interconnection between ground and aerial agents is not merely informational but also physical: UAVs provide overhead perception and communication relaying, while ground robots execute physical tasks such as spraying, weeding, and harvesting. This physical–informational coupling creates new attack surfaces. For example, a compromised UAV can inject false crop-health maps into the ground robot network, causing incorrect spraying decisions; conversely, a compromised ground robot can broadcast false position or task-completion information, misleading UAV scheduling. Secure control must therefore consider not only consensus and formation stability but also task-level semantic consistency and physical safety constraints such as sprayer pressure limits, weeder torque bounds, and obstacle avoidance margins.

The simplest and most extensively studied case is that of homogeneous linear time-invariant (LTI) agents^[66]:

(4) $$ \dot{x}_i(t) = A x_i(t) + B u_i(t), \qquad i=1,\dots,N, $$

where A ∈ ℝ^n×n and B ∈ ℝ^n×m are constant matrices. When agents possess different physical characteristics, the MAS is said to be heterogeneous, and the dynamics take the form

(5) $$ \dot{x}_i(t) = A_i x_i(t) + B_i u_i(t), $$

with A_i ∈ $$ \mathbb{R}^{n_i \times n_i} $$, B_i ∈ $$ \mathbb{R}^{n_i \times m_i} $$. Heterogeneity introduces additional complexity because the agents’ state dimensions and dynamics may differ; output regulation and consensus require appropriate internal model or observer-based compensators^[66,68].

A broad class of nonlinear agents encountered in robotic and aerospace applications can be modeled as affine-in-control nonlinear systems:

(6) $$ \dot{x}_i = f_i(x_i) + g_i(x_i) u_i, $$

where f_i: $$ \mathbb{R}^{n_i} $$ → $$ \mathbb{R}^{n_i} $$ and g_i: $$ \mathbb{R}^{n_i} $$ → $$ \mathbb{R}^{n_i \times m_i} $$ are locally Lipschitz. This structure enables feedback linearization, SMC, and adaptive designs^[69,70].

A particularly important subclass for backstepping-based control is the strict-feedback form:

(7) $$ \begin{aligned} \dot{x}_{i,1} &= x_{i,2} + \varphi_{i,1}^\top(x_{i,1}) \theta_i, \\ \dot{x}_{i,2} &= x_{i,3} + \varphi_{i,2}^\top(x_{i,1}, x_{i,2}) \theta_i, \\ &\;\;\vdots \\ \dot{x}_{i,n_i} &= b_i u_i + \varphi_{i,n_i}^\top(x_i) \theta_i, \end{aligned} $$

where θ_i ∈ $$ \mathbb{R}^{q_i} $$ is a vector of unknown constant parameters, φ_i,k are known smooth function vectors, and b_i ≠ 0 is a known constant gain. This model is widely used for adaptive fuzzy and NN control of uncertain nonlinear MASs under cyberattacks^[36,37].

Robotic manipulators, autonomous vehicles, and spacecraft are typically governed by EL equations of the form

(8) $$ M_i(q_i) \ddot{q}_i + C_i(q_i, \dot{q}_i) \dot{q}_i + g_i(q_i) = \tau_i + \tau_{d,i}, $$

where q_i ∈ $$ \mathbb{R}^{n_i} $$ is the vector of generalized coordinates, M_i(q_i) is the positive definite inertia matrix, C_i(q_i, $$ \dot{q} $$_i)$$ \dot{q} $$_i represents Coriolis and centrifugal forces, g_i(q_i) is the gravitational torque, τ_i is the control input torque, and τ_d,i is an external disturbance. The EL model possesses several well-known structural properties, namely, the skew-symmetry of $$ \dot{M} $$_i - 2C_i and linearity in a set of physical parameters, that are essential for adaptive and passivity-based control design^[71,72].

In recent years, fractional-order calculus has been employed to model the memory and hereditary properties of certain physical processes, such as diffusion waves and viscoelasticity. The fractional-order MAS dynamics are described by the Caputo fractional derivative:

(9) $$ {}_0^C D_t^\alpha x_i(t) = f_i(x_i(t), u_i(t), t), \qquad 0 < \alpha < 2, $$

where ₀^CD_t^α denotes the Caputo fractional derivative of order α^[73]. When α = 1, the system reduces to the standard integer-order model. The non-local nature of fractional operators poses significant challenges for stability analysis under DoS attacks, requiring extended Lyapunov methods and memory-fusion controllers.

Communication noise and random cyberattacks naturally introduce stochastic perturbations. A general stochastic nonlinear MAS can be described by a set of It$$ \hat{o} $$ stochastic differential equations:

(10) $$ dx_i(t) = f_i(x_i(t), u_i(t)) dt + g_i(x_i(t)) dW_i(t), $$

where W_i(t) denotes a standard Wiener process independent across agents, and the functions f_i, g_i satisfy appropriate Lipschitz and growth conditions to ensure existence and uniqueness of solutions^[74,75]. Stochastic stability notions, such as noise-to-state stability and mean-square consensus, are then employed to evaluate system performance under random DoS attacks.

Practical agents often face actuator imperfections that alter the intended control input. A commonly adopted actuator fault model is given by

(11) $$ u_i^F(t) = \rho_i(t) u_i(t) + \phi_i(t), $$

where ρ_i(t) ∈ [$$ \underline{\rho} $$_i, 1] is the multiplicative efficiency factor (0 < $$ \underline{\rho} $$_i ≤ 1) and ϕ_i(t) is an additive stuck/bias fault^[76,77]. When ρ_i = 1 and ϕ_i ≠ 0, the actuator is under bias fault; when ρ_i = 0, the actuator loses effectiveness completely. In addition, the physical limits of actuators impose amplitude saturation:

(12) $$ \operatorname{sat}(u_i) = \operatorname{sign}(u_i) \min\{|u_i|, \bar{u}_i\}, $$

where $$ \bar{u} $$_i > 0 is the maximum admissible control magnitude^[78,79]. Both faults and saturation strongly interact with security mechanisms because DoS or deception attacks may prevent the timely diagnosis and accommodation of such hardware anomalies.

Traditional IT security primarily protects the confidentiality, integrity, and availability of information through cryptographic primitives, authentication, firewalls, and access control. In contrast, control-oriented security for MASs must additionally guarantee the stability, performance, and physical safety of the closed-loop dynamics under adversarial behavior^[80]. The essential difference is that control-oriented security treats attacks as signals injected into the feedback loop, and therefore models, detects, and compensates for them using control-theoretic tools such as observers, robust control, adaptive laws, and resilient protocols. This perspective exploits system dynamics, redundancy, and physical invariants that are largely absent in traditional IT security.

Figure 2 illustrates the complementary roles of the two paradigms within a feedback loop. Traditional IT security mainly operates at the transmission and computing infrastructure, protecting data availability, integrity, and confidentiality. Control-oriented security is distributed across the four information-flow nodes - perception, transmission, decision-making, and execution - and is tightly coupled with the physical plant. For example, SSE and physical-layer trust act at the perception node; event-triggered, self-triggered, and quantized communication act at the transmission node; resilient consensus, observer-based control, adaptive control, and RL act at the decision node; and fault-tolerant control, SMC, Nussbaum-function compensation, and impulsive control act at the execution node. Cross-layer mechanisms, such as watermarking, digital twins, and moving target defense, bridge multiple nodes. This diagram helps readers in the cybersecurity community see that control-oriented security is not a replacement for information technology (IT) security but a complementary layer that protects against the physical consequences of cyberattacks.

Having established the graph-theoretic foundations, agent dynamics, and a unified taxonomy of cyberattacks, we now formalize the cooperative control objectives pursued by MASs and introduce the four-node information flow architecture that will serve as the backbone for our defense strategy classification.

Let the agents be indexed by i = 1, 2, …, N. Depending on the mission, the MAS is required to achieve one or more of the following objectives through purely local information exchange.

Definition 2^[50,51]. The system is said to achieve state consensus if for any initial conditions,

(24) $$ \lim_{t \to \infty} \|x_i(t) - x_j(t)\| = 0, \quad \forall\, i,j \in \mathcal{V}. $$

In the leader–follower setting, leader-follower consensus requires lim_t→∞||x_i(t) - x₀(t)|| = 0 for all followers i, where x₀(t) is the leader’s state.

Definition 3^[86,87]. The MAS achieves a desired time-invariant formation specified by relative offset vectors d_ij ∈ ℝⁿ if

(25) $$ \lim_{t \to \infty} \big( x_i(t) - x_j(t) \big) = d_{ij}, \quad \forall\, i,j \in \mathcal{V}. $$

More general time-varying and affine formations have also been studied.

Definition 4^[88,89]. Suppose the MAS consists of M followers and N - M leaders. Let Ω_L(t) = Co{x_M+1(t), …, x_N(t)} be the convex hull spanned by the leaders’ states. Containment control is achieved if the followers’ trajectories converge to the convex hull, i.e.,

(26) $$ \lim_{t \to \infty} \operatorname{dist}\big( x_i(t), \Omega_L(t) \big) = 0, \quad i = 1,\dots,M. $$

Definition 5^[68,90,91]. Consider a linear exosystem generating the reference and disturbance signals: $$ \dot{w} $$ = Sw. Each agent’s regulated output is e_i = y_i - Qw. The cooperative output regulation problem is to design distributed controllers such that, for all initial conditions,

(27) $$ \lim_{t \to \infty} e_i(t) = 0, \quad \forall\, i \in \mathcal{V}, $$

while maintaining internal stability.

Definition 6^[92,93]. Let f_i: ℝⁿ → ℝ be a local convex cost function known only to agent i. The objective of distributed optimization is to design local update laws such that the agents’ states converge to a common minimizer of the global cost:

(28) $$ \lim_{t \to \infty} \|x_i(t) - x^*\| = 0, \quad x^* \in \arg\min_{x \in \mathbb{R}^n} \sum_{i=1}^N f_i(x). $$

Constraints and coupled costs can be incorporated.

In a cooperative control loop, information flows along a chain of four logical nodes: Perception (P), Transmission (T), Decision (D), and Execution (E). Figure 3 depicts this architecture for a single agent i interacting with its neighbors.

The signals at each node are defined as follows^[20,94]:

• Perception node (P): The agent measures its own state x_i and receives transmitted information from neighbors through the communication network, denoted by $$ \hat{x} $$_ji for j ∈ $$ \mathcal{N} $$_i. In an attack-free environment, $$ \hat{x} $$_ji = x_j^[44,95,96].

• Transmission node (T): The agent broadcasts its own state x_i over wireless links. The actual signal received by a neighbor j is $$ \tilde{x} $$_ij, which may be corrupted by DoS or deception attacks as modeled in Section 2.3^[63,97-100].

• Decision node (D): The agent collects all available information, local measurement $$ \tilde{x} $$_i (possibly attacked at the sensor) and received neighbor states {$$ \tilde{x} $$_ji}, and computes the control law u_i = κ_i($$ \tilde{x} $$_i, {$$ \tilde{x} $$_ji})^[101-105].

• Execution node (E): The control signal u_i is applied to the physical actuators. Actuator attacks, faults, or saturation may modify the effective input to $$ \tilde{u} $$_i^[106-110].

The four-node architecture provides a natural basis for classifying defense strategies by information-flow links. Table 3 presents the defense targets corresponding to each node, the representative methods reviewed in this survey, and the types of attacks they can resist. This classification system reveals complementary functional relationships among defense mechanisms and highlights the need to embed security from the very beginning of the design.

It is essential to distinguish single-layer defenses from cross-layer defenses. A single-layer defense acts primarily on one information-flow node, whereas a cross-layer defense couples two or more nodes and exploits their interactions. For example, event-triggered scheduling is a single-layer transmission defense; SSE is a single-layer perception defense; resilient consensus is a single-layer decision defense; and fault-tolerant control is a single-layer execution defense. In contrast, an event-triggered observer-based resilient controller is a cross-layer defense that couples transmission and decision-making; a digital twin-assisted defense couples perception, decision-making, and execution; physical-layer trust couples perception and transmission; and integrated fault diagnosis with task reallocation couples execution and decision-making. The subsequent sections explicitly indicate the coupling structure of each defense family.

Although the security–performance–resource trilemma is repeatedly emphasized throughout this survey, its manifestation in cross-layer joint defense mechanisms deserves a more systematic treatment. Most existing works optimize a single layer in isolation: perception-layer SSE improves estimation accuracy at the cost of additional computation and redundant sensing; transmission-layer event-triggered or quantized communication reduces bandwidth and exposure but may degrade the freshness and accuracy of information available to the decision layer; decision-layer learning-based or adaptive control enhances resilience to unknown attacks but requires substantial data, computation, and sometimes privacy-sensitive information exchange; execution-layer fault-tolerant or impulsive control preserves actuation safety but may increase control effort or reduce nominal performance. These single-layer optimizations are coupled through the closed-loop information flow and cannot be designed independently without incurring suboptimal or even unstable overall behavior.

We therefore summarize the intrinsic coupling effects among perception, transmission, decision-making, and execution as follows.

• Perception–Transmission coupling. The number and type of sensors determine the amount of information to be transmitted. Redundant or multimodal sensing improves attack detection but increases communication load and energy consumption. Conversely, aggressive event-triggered or quantized transmission reduces communication burden but may starve the perception layer of the data needed for SSE.

• Transmission–Decision coupling. DoS-induced packet loss and FDI-induced data corruption directly affect the information available to the decision layer. Event-triggered communication can reduce the attack surface, but the resulting intermittent information may degrade consensus accuracy and stability margins. Adaptive or learning-based decision layers may compensate for missing data, but they require additional computation and may suffer from parameter drift during long attack intervals.

• Decision–Execution coupling. Resilient decision policies often require greater control effort or more frequent switching, which may saturate actuators or accelerate hardware wear. Conversely, execution-layer faults or actuator attacks alter the effective control input, which the decision layer must estimate and compensate for. If the decision layer is not aware of execution-layer constraints, the resulting control may be infeasible or unsafe.

• Execution–Perception coupling. Actuator attacks or faults change the physical state of the plant, which in turn affects sensor measurements. Without cross-layer awareness, the perception layer may misinterpret attack-induced state deviations as sensor faults, leading to false alarms or missed detection.

A representative example of cross-layer joint defense is the hierarchical federated learning framework for anomaly detection in Industrial Internet of Things^[62]. In that work, anomaly detection is performed at the perception layer, federated learning is used at the transmission layer to build a universal detection model without sharing raw local data, and deep RL is employed at the decision layer to optimize the integration weights of local models. The framework explicitly balances privacy leakage, detection accuracy, system throughput, and latency. This illustrates that cross-layer coupling is not merely a theoretical concern but a practical design requirement: improving detection accuracy at the perception layer may increase communication and computation overhead at the transmission and decision layers, while reducing communication overhead may degrade detection accuracy and resilience.

Table 4 summarizes the coupling effects among the four nodes, the associated resource costs, the security benefits, and the potential performance degradation.

To further justify the novelty of the four-node information-flow architecture, we explicitly compare it with representative existing taxonomies in cyber-physical systems and secure control.

Surveys such as^[46-48] classify attacks into DoS, deception, replay, and disclosure categories, or distinguish between integrity, availability, and confidentiality attacks. These taxonomies are valuable for characterizing adversary capabilities and mathematical models. However, they do not indicate where in the control loop a defense should be deployed, nor how a defense at one layer affects another. For example, an event-triggered, observer-based controller acts simultaneously at the transmission node by reducing exposure and at the decision node by reconstructing states; this cross-layer coupling is invisible in an attack-type taxonomy.

Recent work has proposed architecture-driven taxonomies such as the ADHL framework^[60], which classifies threats and defenses across device, network, control, data, algorithm, and application layers, and the layered attack surface model (LASM)^[61], which decomposes agentic AI systems into seven layers. These frameworks provide valuable architectural decomposition, but they are primarily technology-stack-oriented: they describe the layers of a computing or robotic system rather than the functional stages of a closed-loop cooperative control task. In contrast, the four-node architecture is loop-centric: perception, transmission, decision-making, and execution correspond to the stages through which information flows to generate a control action, and the coupling among these stages is explicitly modeled. This distinction is particularly important for MASs, where the same physical node may participate in multiple loops, and the same attack may propagate across nodes.

Other surveys organize defenses by methodology, such as detection-based, estimation-based, robust-control-based, and learning-based approaches^[21]. While useful for methodological comparison, such taxonomies do not reveal the functional role of each defense within the information flow. A detection filter and a resilient consensus protocol may both be “detection-based” or “estimation-based”, yet they act at different nodes and have different coupling structures. The four-node architecture clarifies this by mapping each defense to the node where it operates and by distinguishing single-layer from cross-layer mechanisms.

The comparison above highlights three advantages that cannot be obtained from existing classifications. First, the four-node architecture is explicitly feedback-loop-centric, which enables the analysis of cross-layer coupling effects such as perception–transmission trade-offs in multimodal sensing and transmission–decision trade-offs in event-triggered resilient control^[31,62]. Second, it provides a common coordinate system for comparing heterogeneous defense mechanisms - observer-based, event-triggered, adaptive, learning-based, and fault-tolerant - on the same functional basis, namely the node at which they restore availability, integrity, or physical safety^{[14,21,46,114]}. Third, it exposes the security–performance–resource trilemma at each node and across nodes, which is essential for resource-aware co-design in resource-constrained platforms such as UAVs and agricultural robot swarms^[10,99]. These insights are not directly available from attack-type, architecture-layer, or defense-tool taxonomies^[47,60,61], and they motivate the cross-layer coupling analysis and the resource-aware defense taxonomy developed in Sections 3 and 4.

This subsection reviews perception-layer defenses, emphasizing SSE, attack detection, and physical-layer trust. We compare centralized and distributed estimators in terms of observability requirements, sparsity assumptions, computational complexity, and resilience guarantees.

The perception layer constitutes the sensory interface through which each agent measures its own state, the environment, and potentially the states of neighboring agents. In an ideal setting, the measurement y_i(t) ∈ $$ \mathbb{R}^{p_i} $$ of agent i is a deterministic function of its true state x_i(t), e.g., y_i(t) = C_ix_i(t). However, as shown in Figure 3, the perception node is a primary attack target for adversaries who seek to corrupt the information basis of cooperative control at its source. When sensor measurements are compromised, all downstream processing (including state estimation, control law computation, and coordination) becomes unreliable. The primary objective of perception-layer defense is therefore to obtain trustworthy state estimates despite compromised sensors, thereby insulating the decision and execution layers from corrupted data.

Sensor attacks on agent i can be modeled as alterations of the nominal measurement equation. Let y_i(t) = h_i(x_i(t)) be the true sensor output. Under attack, the actual measurement available to the agent becomes

(29) $$ \tilde{y}_i(t) = y_i(t) + \delta_i^s(t) \quad \text{or} \quad \tilde{y}_i(t) = a_i^s(t), $$

where δ_i^s(t) is an additive injection and a_i^s(t) is an arbitrary replacement signal. The attack is sparse if only a subset $$ \mathcal{K} \subset $$ {1, …, N} of agents are affected, with |$$ \mathcal{K} $$| ≤ κ^[111]. Such sparsity is a critical structural property exploited by many secure estimation algorithms. A more general model considers s-sparse attacks on the vector of all sensor measurements: the attacker can corrupt at most s out of p sensors of a single agent or across the network^[53,117]. Additionally, the attack may be stealthy, i.e., designed to evade residual-based detectors. A common stealthiness condition is that the attack sequence δ_i^s lies in the range space of a suitable system matrix, thus producing zero innovation under the nominal observer. Alternatively, the adversary may launch replay attacks by injecting previously recorded sensor traces^[83]. These sophisticated attacks demand detection mechanisms beyond conventional static thresholds.

The fundamental problem of SSE is to reconstruct the true state x_i(t) from a set of possibly corrupted measurements {$$ \tilde{y} $$_i}, with guarantees of correctness provided that the number of attacked sensors does not exceed a certain threshold. Early SSE work focused on centralized cyber-physical systems and can be broadly classified into two categories. (i) Compressive sensing and ℓ₀/ℓ₁ optimization: by modeling the attack vector as a sparse signal, the SSE problem is formulated as

(30) $$ \min_{\hat{x}, \hat{\delta}} \|\hat{\delta}\|_0 \quad \text{s.t.} \quad \tilde{y} = \mathcal{O} \hat{x} + \hat{\delta}, $$

where $$ \mathcal{O} $$ is the observability matrix. Under appropriate observability and redundancy conditions, the true state can be recovered exactly by solving a convex relaxation^[111,118]; (ii) Satisfiability modulo theory (SMT) and set-based methods: SMT solvers search for a state consistent with all but s measurements, yielding a guaranteed resilient estimate whenever fewer than s sensors are attacked^[117,119].

In MASs, the distributed nature of information adds an extra layer of complexity: each agent can only rely on its own sensor measurements and neighbor data that may have been tampered with during transmission. To address this challenge, two complementary research approaches have emerged: security estimation based on distributed observers and resilient consensus based on local estimation. A common design approach is to deploy a set of local observers, each of which estimates the state of a portion of the agent, and then integrate these estimation results through a resilient consensus mechanism. For instance, the sampled-data adaptive distributed observer proposed by Deng and Wen^[29] utilizes buffers to accommodate non-uniform time delays and prevents attackers from understanding the sampling patterns through time-varying sampling sequences, thereby reconstructing the state of the leader in heterogeneous linear MASs under the condition where DoS and spoofing attacks coexist. To ensure the smoothness of the observer derivative (which is a key prerequisite for implementing backstepping control under DoS attacks), Zhang et al. constructed a resilient observer for uncertain nonlinear MASs with strict feedback forms, specifically implemented as a first-order low-pass filter with an upper triangular chain structure^[102]. Another paradigm regards the local state estimation of each agent as a scalar or vector form of the quantity to be agreed upon, and uses resilient consensus algorithms to eliminate extreme or malicious estimates. The MSR algorithm and its weighted variant W-MSR guarantee that, as long as the network meets certain robustness conditions, estimates of normal agents converge to the convex hull of the initial values of themselves and other normal agents^[14,85]. When these resilient estimators are further combined with event-triggered communication, the attack surface can be significantly reduced by restricting non-essential transmissions^[120,121].

Shang^[59] extends resilient consensus to mobile malicious attacks on random dynamic networks. The adversary can compromise different agents over time, and the network topology itself is random. The proposed distributed discrete-time algorithms achieve resilient vector consensus under stochastic robustness conditions, using Lyapunov theory and martingale convergence. Compared with MSR/W-MSR algorithms on static or deterministically switching graphs, this line of work is more general in both the adversary model (mobile rather than static) and the network model (random rather than deterministic). However, the guarantee is asymptotic in expectation, and the work does not address communication-layer availability attacks, FDI on links, or execution-layer faults. Within the four-node framework, it is a single-layer decision defense. Integrating it with transmission-layer event-triggering and perception-layer secure estimation remains an open direction.

Perception-layer detection mechanisms aim to raise an alarm when sensor measurements deviate from expected behavior. Classical model-based methods rely on the generation of a residual signal $$ r_i(t) = \tilde{y}_i(t) - C_i \hat{x}_i(t) $$, where $$ \hat{x} $$_i is the state estimate from a nominal observer. If the system is attack-free, the residual should behave as white noise or exhibit bounded fluctuations; a sudden statistical change indicates a potential attack. Anomaly detectors in secure MASs span a spectrum of design philosophies. The chi-square (χ²) detector compares the weighted norm of the residual against a threshold derived from the χ² distribution, proving effective against non-stealthy attacks; however, adversaries with knowledge of the system matrices can completely bypass it. For more subtle, time-evolving threats, cumulative sum (CUSUM) and sequential probability ratio tests track persistent changes in the residual distribution over time, offering heightened sensitivity to slow-drift attacks that would otherwise remain unnoticed^[122]. In contrast, set-based and interval observers depart from the paradigm of a single point estimate, instead maintaining the set of all states that are consistent with the model and measurements, and triggering an alarm when this guaranteed set becomes empty or unacceptably large, thereby providing a rigorous framework for resilience under bounded uncertainties^[123].

In a multi-agent environment, cross-checking among neighbors can further improve the detection capability. For instance, an agent can compare a neighbor’s broadcast state with its own prediction of the neighbor’s trajectory. Persistent inconsistency indicates that either the agent’s own sensors have been attacked or the communication channel itself has been attacked. In addition, machine learning classifiers such as support vector machines and deep autoencoders have been used to learn normal behavior patterns in sensor data streams, marking anomalies without explicit system models.

In addition to pure network-level detection methods, the physical layer of wireless communication can provide additional fingerprint features that are extremely difficult for attackers to forge. The emerging paradigm of cyber-physical trust leverages these physical-layer features to establish trust relationships in agent communication. Radio frequency fingerprinting utilizes subtle process differences in the transmitter hardware to generate a unique and unforgeable signal signature, which is used to verify the identity of the signal source and distinguish legitimate agents from counterfeiters^[44]. Channel state information and received signal strength exploit the fact that transmitters located at different physical positions cannot produce exactly the same channel profile; by comparing the expected spatial signature with the actual measured value, injection attacks or relay attacks can be detected^[124]. When the agent is equipped with an antenna array, angle-of-arrival and distance measurements allow the estimated direction of the received message to be cross-checked with the known position of the claimed sender, thereby obtaining a location-based trust metric^[44]. These mechanisms operate independently of control logic and are inherently robust to algorithmic deception, complementing model-based SSE and anomaly detection methods. Although their integration with distributed consensus protocols is still in its infancy, this direction holds great promise for building a bridge of defense in depth between the information domain and the physical domain^[44,45].

For agricultural robot swarms, perception-layer defense must be co-designed with the physical characteristics of field sensing^[10]. GNSS/RTK spoofing can be detected by cross-validating with visual odometry, LiDAR scan matching, and crop-row detection. Multispectral deception can be detected by comparing current NDVI maps with historical field maps and with independent thermal or RGB imagery. Camera spoofing can be detected by consistency checks between stereo disparity, LiDAR depth, and IMU motion. LiDAR/IMU replay can be detected by temporal consistency and challenge–response mechanisms^[83]. Physical-layer trust based on RF fingerprints and channel state information can verify the identity of neighboring robots and ground stations^[44,124]. However, these mechanisms must be lightweight enough for embedded platforms and robust to dust, vibration, and temperature variations. Experimental validation should include field trials in orchards, greenhouses, and open fields, where GNSS availability, crop canopy, and weather conditions vary significantly.

From a cross-layer perspective, perception-layer defense cannot be designed in isolation^[62]. The number of redundant sensors and the frequency of SSE directly affect the transmission load and the computation burden of the decision layer. For example, multimodal sensing in agricultural robot swarms improves spoofing detection but increases the amount of data to be transmitted over intermittent rural networks^[99]. A cross-layer design should therefore jointly optimize sensor selection, transmission scheduling, and estimation accuracy under a unified resource budget. Conversely, SSE, attack detection filters, and physical-layer trust are primarily single-layer defenses acting on the perception node; when they are integrated with transmission scheduling or decision-layer observers, they become cross-layer defenses. For example, a secure estimator that adapts its sampling rate based on channel quality couples perception and transmission, whereas an observer-based detector that shares information with neighbors couples perception and decision-making^[120].

A systematic comparison of perception-layer defenses reveals clear trade-offs. Compressive-sensing and ℓ₀/ℓ₁ methods assume sparse sensor attacks and require a centralized or strongly connected measurement structure; they provide exact recovery guarantees under redundancy conditions but scale poorly with network size and assume bounded attack sparsity^[111,118]. SMT and set-based methods provide guaranteed resilient estimates under fewer than s attacked sensors, but their computational complexity grows combinatorially and they are difficult to distribute. Distributed observer-based schemes assume that the leader dynamics are detectable from local measurements and that the communication graph remains sufficiently connected; they scale better and provide asymptotic or exponential convergence, but their guarantees degrade under intermittent DoS and are sensitive to delay. MSR/W-MSR resilient consensus assumes an F-local or F-total Byzantine model and a graph-theoretic robustness condition [e.g., (F+1)-robustness]; it provides convergence to the convex hull of normal agents’ initial values, but requires redundant connectivity and does not directly address FDI on the communicated states^[14,85]. Physical-layer trust mechanisms based on RF fingerprints or channel state information assume that hardware imperfections or channel profiles are unforgeable; they provide identity verification with low computation, but their reliability degrades under high mobility, and their integration with control-layer stability proofs remains largely unexplored^[44,124]. For validation, most of these methods are demonstrated only through numerical simulation, and only a small subset reports hardware-in-the-loop or field experiments. This gap is particularly pronounced for agricultural robot swarms, where multimodal sensing, dust, vibration, and temperature variation are rarely captured in simulation.

Although significant progress has been made in perception-layer defense of MASs, for truly resilient autonomous clusters to be deployed effectively, several deeply intertwined challenges still need to be addressed. A fundamental bottleneck lies in the difficulty of scaling provably SSE: most existing algorithms assume that centralized measurements or dynamic structures are simple enough^[111]. Extending correctness guarantees to large-scale, heterogeneous, and nonlinear MAS without incurring unbearable communication and computational overhead remains an open issue. To make matters worse, under strong process noise and unknown inputs, it is also necessary to simultaneously detect and identify sensor anomalies. Distinguishing physical faults from deliberate attacks and locating compromised sensors are tasks that are naturally prone to false alarms, and the erosion of system performance by false alarms is no less than that by missed alarms^[46,53]. The threat landscape has become increasingly severe due to covert and coordinated adversaries, who inject time-varying and cross-agent correlated attack sequences that can simultaneously contaminate multiple sensors right under the noses of traditional residual monitors. To resist such threats, it is necessary to rely on a game-theoretic framework that can explicitly depict the collaborative adaptation of the opposing sides^[113,125]. Meanwhile, physical-layer trust mechanisms based on radio frequency fingerprints or channel state information have not yet been convincingly verified on highly mobile agents, because these mechanisms rely on static or slowly changing channel conditions, which often do not hold in fast-moving dynamic scenarios^[44]. Looking ahead, a key frontier is cross-layer collaborative design with a theoretical basis and integration across perception-layer detection, transmission-layer scheduling, and robust control at the decision-making layer, moving away from isolated single-layer optimization toward a resilient, integrated, and interconnected architecture.

This subsection reviews transmission-layer defenses against DoS, FDI, replay, and asynchronous multi-channel attacks. We distinguish single-layer communication scheduling from cross-layer co-design of event-triggering, quantization, topology switching, and control.

The transmission layer is the nervous system of an MAS. It enables agents to exchange state information, synchronize their decisions, and coordinate their actions. As modeled in Section 2.3, transmission links are the primary targets of DoS attacks and FDI attacks on communicated data. When a communication link from agent j to agent i is under DoS attack, the received signal is erased [δ_ij(t) = 0]; when under FDI attack, it is corrupted by an additive or multiplicative signal δ_ij^a(t). The defense at the transmission layer must simultaneously meet the interwoven requirements of availability and integrity: it is necessary to ensure that critical information can still reach its destination under intermittent channel congestion, while also preventing forged data from contaminating the coordination process. One often underestimated, but equally crucial requirement is efficiency - communication itself consumes energy and bandwidth, and excessive transmission directly expands the attack surface.

Event-triggered control is a rather mature technology in sampled-data systems. Its core idea is to transmit data only when the preset trigger conditions are violated^[126-128]. In the context of DoS attacks on MASs, event-triggered control plays a dual role: first, it reduces the number of transmission attempts, thereby lowering the probability that transmissions encounter interference windows; second, it can flexibly adjust the transmission interval to the system’s current needs. Even if packet loss occurs, it can still maintain considerable performance. For an agent i, the classical event-triggered condition is

(31) $$ t_{k+1}^i = \inf \big\{ t > t_k^i \;|\; \|e_i(t)\| \geq \sigma \|z_i(t)\| \big\}, $$

where e_i(t) = x_i(t_kⁱ) - x_i(t) is the measurement error, z_i(t) is a suitable local state-dependent signal (e.g., the consensus error), and σ > 0 is a design threshold. Under DoS attacks, the condition (31) must be augmented to account for the fact that a triggered transmission may be blocked. Two complementary strategies have been proposed.

If the communication channel is interfered with at the moment of trigger, the transmitted data will be temporarily cached. Once the attack stops, the system retries the transmission immediately. To ensure stability, it is usually mandatory to stipulate a retention time or a maximum allowable event interval^[54]. Xu et al. designed an adaptive fuzzy event-triggering scheme whose triggering threshold can be dynamically adjusted according to the estimated duration of the attack, thereby ensuring that the controller can receive updated information within a bounded period of time after the DoS attack ends^[31].

Dynamic event-triggered control (ETC) introduces an auxiliary internal variable η_i(t) that evolves according to

(32) $$ \dot{\eta}_i(t) = -\beta \eta_i(t) + \sigma \|z_i(t)\|^2 - \|e_i(t)\|^2, $$

with β > 0, and the triggering rule becomes t_k+1ⁱ = inf{t > t_kⁱ | η_i(t) + θ(σ ||z_i(t)||² - ||e_i(t)||²) ≤ 0}, where θ ∈ (0, 1). Dynamic event-triggered mechanism (DETM) can further reduce the number of events compared to static ETC and provides a unified Lyapunov analysis framework^[129,130]. Several recent works have merged DETM with DoS resilience: Yang et al. propose a self-triggered variant where the next triggering instant is predicted using only locally available information and the current attack status^[41], while Zhou et al. integrate DETM with pinning control for cluster consensus on signed graphs under DoS^[131].

A critical requirement for any ETC scheme is avoiding Zeno behavior, i.e., an infinite number of events in finite time. Under DoS, this is particularly challenging because communication blackouts may force events to accumulate at the attack boundaries. Most works prove a strictly positive minimum inter-event time (MIET) by bounding the evolution of ||e_i(t)}| / ||z_i(t)|| during both attack and attack-free intervals^[29,132].

The sequential scaling attack considered by He and Mo^[58] provides an instructive case study for transmission-layer defense. Unlike DoS, which erases signals, the scaling attack preserves the communication link but multiplicatively corrupts the transmitted data. The event-triggered protocols in^[58] reduce transmission opportunities and thereby limit the number of corrupted packets, while the consensus condition explicitly relates the triggering threshold to the attack duration and frequency. This is a cross-layer transmission–decision defense: the transmission node is protected by reducing exposure, and the decision node is protected by a consensus protocol that tolerates bounded scaling. However, the approach assumes linear agent dynamics and a known scaling structure, and it does not address replay, Byzantine, or actuator attacks. These limitations motivate the broader attack taxonomy and the balanced defense comparison developed in this survey.

Self-triggered control eliminates the need to continuously monitor trigger conditions. Its core idea is that whenever an event occurs, the next transmission moment^[133,134] is pre-calculated based on the current state and the model of the controlled object. Under DoS attacks, one of the major advantages of self-triggered control lies in the fact that it completely eliminates the need for continuous perception^{[126,127,133,134]}; continuous perception itself is a high-energy-consuming operation and will also expose more attack entry points for attackers^[97-100,135]. A typical self-triggered law for agent i takes the form

(33) $$ t_{k+1}^i = t_k^i + \Gamma_i\big(x_i(t_k^i), \hat{x}_{\mathcal{N}_i}(t_k^i), \theta_{\mathcal{N}_i}(t_k^i)\big), $$

where Γ_i(·) is a bounded positive function that depends on the agent’s state, the last received neighbor states, and the DoS status $$ \theta_{\mathcal{N}_i} $$ on its incoming links. For satellite formations under asynchronous DoS attacks, researchers have designed a self-triggered formation control scheme whose core lies in carefully designing event intervals to ensure that information from neighbors remains fresh enough to support consensus even in the event of limited communication losses^[136]. As an alternative technical approach to event-triggered and self-triggered schemes, periodic sampling with variable sampling rates has also attracted attention. Deng and Wen^[29] adopted a deliberately aperiodic, time-varying sampling sequence, making it difficult for attackers to synchronize interference with the sampling pattern.

When communication resources are severely limited, quantized control further compresses the transmitted information. Instead of full-state vectors, agents exchange quantized versions $$ \hat{x} $$_i = q(x_i), where q(·) is a uniform or logarithmic quantizer with finite precision^[137,138]. The interaction between quantization and DoS attacks creates a compounded information loss: packets may be lost due to jamming, and those that arrive carry quantization errors. The overall system can be analyzed using input-to-state stability (ISS) concepts, where both quantization error and packet dropout are treated as bounded disturbances^[24,139]. A uniform quantizer with an event-triggered consensus protocol is integrated, showing that consensus to a bounded ball can be achieved provided the product of quantization resolution and maximum DoS duration is below a computable threshold^[121]. More recently, zoom-in/zoom-out quantization^[137] and dynamic quantization^[140] have been explored to adapt the quantization level based on the attack intensity, thereby gradually refining the control precision during long attack-free intervals.

Since DoS attacks remove edges from the communication graph, the effective topology becomes time-varying: $$ \mathcal{G} $$(t) = ($$ \mathcal{V} $$, $$ \mathcal{E} $$(t)) where $$ \mathcal{E} $$(t) = {(j,i) | θ_ij(t) = 1}. Stability analysis under such switching topologies typically employs ADT or switching frequency conditions^[141,142]. A common sufficient condition for consensus is that the union graph over uniformly bounded time intervals contains a spanning tree^[67]. If the DoS attacks satisfy the frequency–duration constraints (15) and (16), one can derive explicit bounds on the allowable duty cycle η that guarantee this union graph condition^[24,81].

In addition to passively tolerating link removal, some methods actively reconstruct the communication topology to bypass attacked links. For instance, one study proposes a scheme that switches between backup topologies, driven by a continuous packet-loss monitoring function^[112]. As long as at least one backup topology remains connected within each attack window, consensus can be preserved without restricting the frequency or duration of DoS. Similarly, Dai et al. embedded topology handover into the impulsive control framework, synchronizing the pulse time with the handover event, thereby achieving leader-following synchronization under multi-channel independent DoS attacks^[34].

When the attacker is resource-constrained (e.g., limited jamming energy), the interaction between the defender (MAS) and the attacker can be modeled as a game. The defender chooses a transmission schedule or power allocation, while the attacker decides which links to jam and when. Let $$ \mathcal{P} $$_D and $$ \mathcal{P} $$_A be the action sets of the defender and attacker, and let J(u_D, u_A) be the cost function (e.g., tracking error plus transmission energy plus attack energy). A Nash equilibrium (u_D^*, u_A^*) satisfies

(34) $$ J(u_D^*, u_A^*) \le J(u_D, u_A^*), \quad \forall u_D \in \mathcal{P}_D, \qquad J(u_D^*, u_A^*) \le J(u_D^*, u_A), \quad \forall u_A \in \mathcal{P}_A.$$

Zero-sum game formulations, where J_D = -J_A, have been used to design optimal jamming and anti-jamming strategies in wireless MASs^[125,143]. Extensions to Stackelberg games, where the defender acts as the leader, yield proactive defense policies that anticipate the attacker’s best response^[113]. At the physical layer, dynamic power control based on the signal-to-interference-plus-noise ratio (SINR) provides an additional knob for mitigating jamming. By increasing transmission power during jamming periods or frequency-hopping, agents can maintain a minimum data rate at the cost of higher energy consumption^[124].

While DoS attacks have received extensive attention at the transmission layer, FDI, replay, and Byzantine attacks require equally systematic treatment. For FDI on communication links, defenses include authentication, message authentication codes, and encryption, but these alone cannot prevent compromised insiders from injecting validly signed false data^[23]. Control-aware detection is therefore needed, such as watermarking, dynamic challenge–response, and cross-checking with physical invariants^[53]. For replay attacks, time-stamping, nonce-based protocols^[83], and physical-layer fingerprints are effective^[44], but they must be lightweight enough for resource-constrained robots. For Byzantine attacks, the transmission layer must support robust aggregation and trust management, so that compromised nodes cannot dominate consensus^[14,85]. Network coding and redundant multi-path transmission can further improve resilience by allowing the receiver to reconstruct the true signal even when some paths are corrupted^[34,112]. These mechanisms complement DoS-oriented scheduling and together provide a more balanced transmission-layer defense.

Extreme farmland channel loss imposes unique constraints on transmission-layer defense^[10]. Rural wireless links are intermittent, long-range, and obstructed by terrain, crop canopy, and farm buildings. Dust, rain, and high temperature cause additional fading and hardware degradation. Under such conditions, event-triggered and self-triggered communication are necessities rather than mere efficiency tools, but their thresholds must adapt to time-varying channel quality and task criticality^[31,99]. During harvesting, position and task-completion updates are safety-critical and should be transmitted with higher priority and redundancy; during monitoring, lower-rate updates may suffice. Quantized communication can reduce bandwidth, but the quantization resolution must be co-designed with the control law to avoid instability^[121,137]. Topology switching and UAV relaying can restore connectivity when ground links fail, but they introduce new attack surfaces and require trust management^[34,112]. Game-theoretic power control and anti-jamming strategies must account for the energy constraints of battery-powered field robots and the limited spectrum available in rural areas^[113,125]. Field validation should measure packet loss, delay, and jamming resilience under realistic agricultural conditions.

Transmission-layer defense is intrinsically coupled with the decision layer. Event-triggered and self-triggered schemes reduce communication and exposure, but the resulting intermittent information may degrade the stability and performance of resilient consensus or learning-based control. Conversely, decision-layer adaptation can tolerate some packet loss, but only within bounds that depend on the transmission schedule. This coupling motivates cross-layer co-design of triggering thresholds, quantizer resolution, and controller gains, rather than separate tuning. The hierarchical federated learning framework in^[62] exemplifies such co-design by jointly considering communication efficiency, privacy preservation, and detection accuracy. In terms of classification, event-triggered, self-triggered, and quantized communication are single-layer defenses when they only schedule or compress transmissions; they become cross-layer defenses when their triggering thresholds, quantization resolution, or topology switching are co-designed with the control law or the estimator. For instance, an event-triggered observer-based controller couples transmission and decision-making, whereas a topology-switching scheme coordinated with impulsive control couples transmission and execution.

Transmission-layer defenses can be compared along the same six dimensions. Static event-triggered control assumes a known Lyapunov function or a known bound on the consensus error; it addresses DoS by reducing transmission opportunities and guarantees a positive MIET, but its threshold must be tuned conservatively, and its stability proof typically assumes that the union graph over bounded intervals contains a spanning tree^[126]. Dynamic event-triggered control introduces an auxiliary internal variable and provides a unified Lyapunov framework with fewer events, but requires additional state and computation on each agent^[129,130]. Self-triggered control eliminates continuous monitoring and is therefore attractive for energy-constrained platforms; however, it requires an accurate local model to predict the next triggering instant, and its guarantees degrade under model mismatch^[133,134]. Quantized communication assumes quantization error is a bounded disturbance and provides ISS-type guarantees, but the quantization resolution must be co-designed with the control gain; otherwise, the closed-loop system may exhibit limit cycles^[137,139]. Topology-switching and backup-topology schemes assume at least one connected backup graph within each attack window; they provide consensus without restricting DoS frequency or duration, but require additional coordination and may introduce switching transients^[34,112]. Game-theoretic power control assumes a rational, energy-constrained adversary and yields Nash or Stackelberg equilibria; it provides proactive defense but requires knowledge of the adversary’s cost function, which is often unavailable in practice^[113,125]. Regarding validation, most works use numerical simulation with up to five agents^[97,98]; large-scale wireless testbeds with realistic fading, interference, and hidden terminals are rare, and field validation in agricultural settings is almost absent.

Despite the extensive body of work surveyed above, transmission-layer defense in MASs continues to confront several deeply intertwined challenges that hinder the deployment of resilient autonomous networks. A primary limitation lies in the oversimplified modeling of DoS attacks: most existing guarantees rest on either global jamming that simultaneously blocks all links, or independent link failures governed by known stochastic statistics^[24,49]. The practically critical case of asynchronous, coordinated attacks that dynamically corrupt a time-varying subset of links remains largely unresolved^[27]. This gap is compounded by the persistent separation of communication and control design. Event triggers, quantizers, and power levels are typically tuned in isolation from the control law, introducing inherent conservatism; a truly integrated co-design framework that jointly optimizes control performance and communication resource expenditure under security constraints is still lacking^[62]. This separation crystallizes into a fundamental security–performance–resource trilemma, where attack resilience, control fidelity, and the consumption of energy, bandwidth, and computation are intrinsically coupled. Formal quantification of this trade-off and derivation of Pareto-optimal operating points remain open problems. The threat surface is further amplified by intelligent, protocol-aware adversaries that exploit detailed knowledge of event-triggered or self-triggered schemes to launch stealthy DoS attacks precisely at transmission instants, maximizing disruption with minimal energy^[32]. Countering such attackers requires unpredictable scheduling or randomized transmission policies, but robustness guarantees remain nascent. Finally, a critical gap remains between theoretical proposals and practical validation: most schemes are demonstrated only on small-scale numerical examples involving at most five agents. Their scalability to hundreds or thousands of agents, and their performance on real wireless testbeds afflicted by non-ideal channel effects such as fading, interference, and hidden terminals, have yet to be convincingly demonstrated.

This subsection reviews learning- and adaptive-control-based decision-layer defenses. We compare adaptive control, fuzzy/neural control, adaptive dynamic programming (ADP)/reinforcement learning (RL), and MARL in terms of required model knowledge, stability certification, sample efficiency, and adversarial vulnerability.

When the attack pattern, system dynamics, or environment is uncertain or time-varying, pre-designed fixed-gain controllers may fail to maintain the required performance and safety margins. Adaptive control and learning-based control provide two complementary paradigms that enable the MAS to evolve its defense strategy online by extracting knowledge from real-time data. In the four-node information flow architecture [Figure 3], these techniques primarily operate at the decision node (D) and the execution node (E), augmenting the nominal control law with mechanisms that compensate for unknown attack-induced perturbations or actuator faults, and even learning optimal countermeasures through interaction with the adversary.

The situation that adaptive control needs to deal with is: when the parameters or attack signals of the controlled object are unknown constants or change slowly, how to maintain the stability and tracking performance of the system^[69,144]. In MASs, a typical adaptive security control scheme adds an attack amplitude estimator and a corresponding offset term to the nominal consensus or formation protocol. Consider agent i with dynamics $$ \dot{x} $$_i = Ax_i + B(u_i + δ_i^a), where δ_i^a(t) is an unknown attack signal injected at the actuator (execution node). If δ_i^a can be parameterized as δ_i^a = $$ \Phi_i^\top $$(t)θ_i^* with known basis function Φ_i(t) and unknown constant parameter θ_i^*, an indirect adaptive controller takes the form

(35) $$ u_i = -K x_i - \Phi_i^\top(t) \hat{\theta}_i, $$

where $$ \hat{\theta}_i $$ is updated online via a Lyapunov-based adaptation law, e.g.,

(36) $$ \dot{\hat{\theta}}_i = \Gamma \Phi_i(t) B^\top P e_i, $$

with Γ = $$ \Gamma^\top $$ > 0 the adaptation gain, P the solution to a Lyapunov equation, and e_i the tracking error^[77]. Stability is guaranteed through a quadratic Lyapunov function V = $$ e_i^\top P e_i + \tilde{\theta}_i^\top \Gamma^{-1} \tilde{\theta}_i $$, where $$ \tilde{\theta}_i = \hat{\theta}_i $$ - θ_i^*. This framework has been extended to heterogeneous MASs under DoS and FDI attacks by Zhang et al. and Jiang et al., where the adaptive laws also incorporate projection operators to keep estimates within physically admissible bounds^[36,37].

For nonlinear MASs, the strict feedback form Equation (7) is naturally suitable for the application of adaptive backstepping methods. In each step of the backstepping design, the virtual control law is supplemented with an adaptive term to counteract the disturbances caused by unknown nonlinearity or attacks. Xu et al. combined adaptive fuzzy backstepping with an event-triggering mechanism to handle actuator failures and DoS attacks simultaneously^[31]. In the containment control problem, adaptive NNs are used to approximate unknown nonlinear functions and compensate for the loss of neighbor information caused by DoS attacks^[145]. One key challenge in adaptive security control is parameter drift: during a long DoS attack interval, the adaptive law may receive no new information, causing outdated errors to accumulate and potentially destabilizing the system. Common solutions include sigma correction, dead-zone correction, and parameter projection to prevent the estimated value from growing unbounded^[144].

When the attack δ_i^a or the system nonlinearities f_i(x_i) cannot be linearly parameterized, universal function approximators such as fuzzy logic systems (FLSs) and NNs provide a powerful alternative^[146,147]. An FLS or NN can be written as

(37) $$ f(x) = W^{*\top} \Phi(x) + \epsilon(x), $$

where W^* is an unknown ideal weight matrix, Φ(x) is a vector of basis functions (fuzzy membership or activation functions), and ϵ(x) is a bounded approximation error. The actual control employs an estimate $$ \hat{W} $$, updated online via gradient-based or Lyapunov-based rules.

In secure MASs, FLSs and NNs have become indispensable function-approximation tools, mainly supporting resilience against malicious attacks in three ways. First, they approximate the unknown attack signal δ_i^a or its envelope, thereby introducing compensation terms in the controller to actively counteract injected perturbations^[36]. Second, when there is a lack of an exact dynamic model of the agent, these approximators can directly learn the ideal control law in a model-free adaptive control framework, thereby bypassing the explicit system identification step^[148]. Third, they provide the infrastructure for learning value functions and optimal strategies for resilient control based on RL, acting as networks of critics and actors. A representative example of this third role is the event-triggered RL scheme designed for stochastic nonlinear systems^[55], where critic and actor NNs are employed to approximate value functions and synthesize control policies, respectively.

While adaptive control compensates for known-structured uncertainties, RL and ADP aim to learn optimal defense policies from data without requiring detailed attack models^[149,150]. The secure control problem is often framed as a two-player zero-sum game between the defender (controller) and the attacker (disturbance or adversary), leading to an H_∞-optimal control formulation:

(38) $$ \min_{u} \max_{d} \; \int_0^\infty \big( x^\top Q x + u^\top R u - \gamma^2 d^\top d \big) \, dt, $$

where d represents the attack signal and γ > 0 is the prescribed disturbance attenuation level. The solution to this game is the saddle point (u^*, d^*) satisfying the Hamilton–Jacobi–Isaacs (HJI) equation. ADP circumvents the curse of dimensionality by using a critic–actor architecture: (i) the critic NN approximates the optimal value function V^*(x); (ii) the actor NN approximates the optimal control policy u^*(x) [and sometimes the worst-case attack d^*(x)]. The weights of both networks are updated iteratively using temporal difference errors or integral reinforcement learning (IRL), which eliminates the need for knowledge of the system drift dynamics^[151].

For MASs under cyber attacks, several recent works have exploited ADP. Xu and Wu proposed a data-driven off-policy RL algorithm to learn the completely unknown system matrix of the leader, achieving optimal formation control in the presence of DoS^[38]. Nian et al. utilized ADP to solve constrained social cost minimization for heterogeneous MASs under DoS attacks with coupled cost functions^[42]. A particularly promising direction is MARL for cybersecurity^[45]. In this framework, each agent is an independent learner that adapts its policy based on local observations, potentially including explicit models of adversarial agents. Cooperative MARL algorithms, such as multi-agent deep deterministic policy gradient (MADDPG) and QMIX, have been applied to detect and mitigate jamming, spoofing, and FDI attacks in a fully distributed manner, albeit often without formal convergence guarantees.

Although the preceding discussion has outlined the main learning and adaptive paradigms, a deeper critical analysis is necessary because these methods are increasingly presented as general solutions to secure control. We therefore examine four fundamental challenges: stability certification, sample efficiency, exploration safety, and vulnerability of learning components to adversarial manipulation, and compare learning-based methods with model-based resilient control on a common basis. Table 5 summarizes the principal paradigms and their practical considerations.

Model-based resilient control typically provides Lyapunov-based asymptotic stability, ISS, or finite-time convergence guarantees under explicit attack bounds^[24,69,153]. Observer-based resilient consensus and SMC can certify stability under bounded DoS frequency and duration, and adaptive backstepping can guarantee ultimately uniformly bounded (UUB) signals under parameterized uncertainties^[37,77]. In contrast, RL and ADP provide stability guarantees only under restrictive conditions: either the value function is known to be Lyapunov, or the policy is constrained by a control barrier function (CBF) or neural barrier certificate^[110,149]. Most deep RL algorithms, including deep deterministic policy gradient (DDPG), proximal policy optimization (PPO), and soft actor-critic (SAC), offer no stability guarantee during training, and their convergence is asymptotic in probability at best^[45,152]. MARL is even weaker: non-stationarity induced by simultaneous policy updates invalidates the Markov assumption underlying single-agent convergence proofs, and global convergence is generally not guaranteed^[152,154]. Learning-based secure control therefore cannot currently replace model-based resilient control in safety-critical applications; at best, it can complement it.

Model-based resilient control requires a system model but needs little or no online data. Adaptive control requires only parameter identification data and converges in the order of the number of unknown parameters. In contrast, deep RL and ADP typically require thousands to millions of interactions to learn a useful policy, and the sample complexity grows with state dimension, action dimension, and network size^[159,151]. In multi-agent settings, the joint state-action space grows exponentially with the number of agents, making tabular or naive function-approximation approaches infeasible^[152]. Although transfer learning, meta-learning, and digital-twin-based pre-training can reduce online samples, they assume access to a high-fidelity simulator or a related task, which is often unavailable for adversarial scenarios^[155,156]. Sample efficiency therefore remains a fundamental bottleneck for deploying RL-based secure control on physical platforms.

Model-based resilient control separates design and operation: the controller is certified offline and then executed. RL, by contrast, learns through trial and error, and the exploration phase is inherently unsafe. An agent may take actions that violate physical constraints, damage actuators, or cause collisions. Safe RL with CBFs or shielding can mitigate this, but the shield itself must be certified, and its interaction with the learning policy is not fully understood^[110]. In MASs, exploration safety is further complicated because one agent’s unsafe action can propagate to neighbors. This is particularly problematic for agricultural robot swarms, where an exploratory action of a sprayer or weeder can directly damage crops or contaminate soil^[10]. Existing safe RL methods have not been convincingly validated on such safety-critical heterogeneous platforms.

Learning-based controllers introduce new attack surfaces that model-based designs lack. The critic network can be poisoned through manipulated rewards or falsified value targets; the actor network can be misled by adversarial perturbations in the observation space; and the replay buffer can be corrupted by injecting fabricated transitions^[154]. A small, carefully crafted perturbation that is imperceptible to residual-based detectors can cause the policy to output unsafe actions. Federated learning, often used to preserve privacy, is vulnerable to Byzantine participants that upload poisoned model updates^[157,158]. In contrast, model-based resilient control has a well-defined attack surface (the measurements and the communication links) and its stability proofs often explicitly account for bounded adversarial inputs. This asymmetry means that learning-based defenses may be circumvented by adversaries who target the learning process itself rather than the control loop.

On a common basis, model-based resilient control excels in stability certification, interpretability, and verifiability, and it requires little online data; its main limitations are conservatism, dependence on a reasonably accurate model, and difficulty in adapting to unmodeled or time-varying attacks. Learning-based control excels in adaptability, model-free operation, and handling of high-dimensional nonlinear dynamics; its main limitations are lack of formal guarantees, high sample complexity, unsafe exploration, and new adversarial vulnerabilities. These are complementary rather than substitutable strengths. A promising direction is hybrid architectures in which a model-based resilient controller provides a certified safety baseline, while a learning component improves performance and adapts to unknown attacks within the certified envelope. Examples include safe RL with CBFs, ADP with Lyapunov-based constraints, and learning-augmented observers^[62,110,151]. However, the theoretical foundations of such hybrids - especially formal stability and security guarantees under adversarial injection - remain largely open.

Another gap concerns deploying learning-based and adaptive methods on real physical platforms. Computational and memory constraints: most deep reinforcement learning (DRL) and MARL algorithms require high-dimensional NNs, large replay buffers, and frequent gradient updates, which exceed the onboard computation and memory of embedded platforms such as UAVs, agricultural ground robots, and low-power IoT devices^[10,99]; edge offloading and network pruning are promising remedies but introduce additional communication delays and new attack surfaces. Real-time and communication constraints: learning-based controllers often rely on frequent information exchange for policy evaluation, gradient aggregation, or federated model updates, and the resulting delays and packet losses in intermittent wireless networks can destabilize the learning process and invalidate stability proofs that assume perfect or bounded-delay communication. Robustness of security boundaries: NN policies are vulnerable to adversarial examples, data poisoning, and reward manipulation, and the exploration phase is inherently unsafe; although safe RL with CBFs and neural barrier certificates has been proposed, formal guarantees under active adversarial attacks are still largely missing^[110]. Simulation-to-reality gap: real platforms exhibit unmodeled dynamics, actuator nonlinearities, sensor noise, calibration errors, communication delays, and hardware aging, which can significantly degrade a policy that performs well in simulation; hardware-in-the-loop testing, digital twins, and domain randomization are necessary but rarely reported in the secure control literature^[155,156]. Agricultural robot swarm case: onboard computation is limited by cost, weight, and power; rural communication is intermittent and lacks redundancy; multimodal sensors are exposed to dust, rain, vibration, and extreme temperatures; and actuator attacks on sprayers, weeders, and wheel motors can directly affect crop yield and food safety^[10]. Cross-layer co-design, lightweight and verifiable learning architectures, and extensive field trials are therefore indispensable before deployment.

Decision-layer defenses such as resilient consensus, observer-based control, adaptive control, and RL are single-layer defenses when they only process the information available at the decision node. They become cross-layer defenses when they actively shape perception (e.g., by requesting additional measurements), transmission (e.g., by adapting communication schedules), or execution (e.g., by respecting actuator constraints). Safe RL with CBFs, for example, couples decision-making and execution^[110]; federated anomaly detection couples decision-making and transmission^[157,158]. These cross-layer architectures are essential for handling hybrid and stealthy attacks. For agricultural embodied intelligent robot swarms, decision-layer defense must additionally integrate task-level semantics with security: learning-based policies can adapt to unknown soil conditions, crop variability, and weather changes, but they must respect hard physical constraints such as sprayer flow limits, weeder torque bounds, and safe distances to humans and animals^[10]. Experimental studies should evaluate task-level performance, such as spraying accuracy, weeding completeness, and harvest efficiency, under adversarial conditions.

Learning-based and adaptive defenses should also be balanced across attack classes. For FDI attacks, adversarial training and robust regression can improve the detector’s resilience to stealthy injections, while watermarking can be integrated into the learning objective. For replay attacks, temporal consistency learning and sequence-based anomaly detection can distinguish replayed signals from genuine ones^[83]. For Byzantine attacks, robust federated learning and Byzantine-resilient aggregation rules can prevent malicious agents from poisoning the global model^[14,157]. For actuator attacks, safe RL with CBFs can constrain the policy to physically safe actions even under adversarial actuation^[110,115]. These directions are distinct from DoS-oriented event-triggered learning and require different assumptions, loss functions, and safety certificates. A balanced research agenda should therefore develop learning-based defenses for the full spectrum of attack classes, not only for DoS.

This subsection reviews execution-layer defenses against actuator attacks and faults. We compare passive fault-tolerant control (FTC), active FTC, SMC, Nussbaum-function compensation, anti-windup design, and impulsive control.

The execution layer is the final link in the four-node information flow architecture [Figure 3], and it is here that the control instruction u_i calculated by the decision-making layer is physically imposed on the actuator. Even if the security at the perception, transmission, and decision-making levels is all foolproof, a successful attack or a hardware failure at the execution level is sufficient to directly change the force, torque, or voltage that drives the robot, rendering all the resilience measures upstream futile. Actuator anomalies can be described by the fault model (11) and the saturation model (12).

A growing body of research combines privacy protection with security control in MASs. Differential privacy has been employed to mask the state of individual agents during consensus iterations to prevent adversaries from inferring private information from the exchanged messages^[167]. Homomorphic encryption enables controllers to perform calculations directly on encrypted data, thereby achieving resilient coordination without revealing the original state^[168]. Secure multi-party computation and federated learning are also applied to distributed anomaly detection, enabling agents to collaboratively identify attacks without sharing sensitive local data^[169]. These methods introduce a fundamental trade-off between privacy levels and control performance: the noise injected for privacy protection can reduce estimation accuracy and may be exploited by adversaries.

Privacy-preserving mechanisms span all four information-flow nodes, and their coupling with resilience deserves explicit treatment^[62]. Differential privacy is typically applied at the perception and transmission nodes to mask local measurements and transmitted states^[167,170]; homomorphic encryption protects the decision node by allowing computation on encrypted data^[168]; secure multi-party computation and federated learning couple transmission and decision-making for distributed anomaly detection^[157,169]; and privacy-aware actuator commands protect the execution node. These cross-layer couplings create a fundamental trade-off between privacy level and resilience: noise injected for privacy can degrade estimation accuracy, slow consensus, and reduce detection sensitivity, while encryption and secure computation introduce latency and computational overhead^[158,171]. Quantitatively, the privacy budget ϵ controls the amount of noise added: smaller ϵ yields stronger privacy but larger estimation error and slower convergence^[167]. In MASs, this trade-off is further complicated because each agent’s privacy mechanism affects the information available to its neighbors, and thus the overall resilience of the network^[94,170]. The key open challenges are threefold. First, privacy mechanisms must remain robust when some participants are malicious and actively attempt to infer private information from the collaborative defense process^[157,158]. Second, privacy budgets should adapt to real-time threat levels, relaxing when attacks are detected and tightening during normal operation. Third, formal stability and security guarantees must be established under privacy-induced disturbances, which are currently treated only as bounded noise in most analyses. This trade-off is particularly acute in agricultural robot swarms, where intermittent connectivity and limited onboard computation constrain the feasible privacy budget, and where regulatory requirements on data sharing may vary across jurisdictions^[10,99].

The resilient consensus and event-triggered schemes reviewed in Sections 3.2 and 3.3 assume fixed attack models and static trust, and the learning-based alternatives that could relax these assumptions still lack formal guarantees. This gap motivates a shift toward opponent-aware MARL, in which agents learn attack patterns and neighbor credibility through repeated interactions, and toward game-theoretic trust mechanisms that render cooperation incentive-compatible^[152,154]. Privacy-preserving distributed learning can support such policies without sharing raw trajectories^[170,172]. Three questions remain open: how to achieve provably stable trust evaluation under partial observability when malicious agents deliberately contaminate the learning process; how to guarantee safety during exploration (a challenge shared with data-driven adaptive defense); and how to scale collaborative defense to large-scale heterogeneous networks under communication and computation constraints. Neural barrier certificates offer a concrete pathway for the second question.

Most detection and control methods compared in Sections 3.1 and 3.3 treat network attacks and physical dynamics as separate problems, and physics-based detection remains largely limited to linear time-invariant systems. Yet in cyber-physical MASs, attacks ultimately manifest as violations of physical invariants, conservation laws, kinematic constraints, stability margins, and consensus properties, which adversaries cannot tamper with and which therefore constitute reliable detection signals. Physics-informed learning can embed these invariants into the detection and control models, enabling identification of covert attacks that pure data-driven detectors miss^{[44,95,96,155,173]}. Domain-specific constraints such as maximum acceleration, safe distance limits, and power flow equations extend this idea naturally to vehicle formations, UAV swarms, power systems, and agricultural robot swarms, where kinematic and safety constraints are tightly coupled with crop and terrain conditions^{[103,106,107,174]}. Open questions include how to extract physical invariants from high-dimensional nonlinear dynamics without a complete first-principles model, how to design controllers that degrade gracefully when detection fails, and how to distinguish legitimate physical disturbances from attack-induced anomalies in noisy and uncertain environments.

The defense taxonomy of Section 3 reveals that almost all reviewed mechanisms are add-on layers, and that even zero-trust approaches focus on access control rather than architecture refactoring. This patching paradigm carries three structural flaws: it imposes significant performance and communication overhead, it creates a single point of failure within the security layer itself, and it cannot resist zero-day vulnerabilities that exploit design flaws in the underlying control architecture. A shift toward native security design is therefore necessary, embedding authentication, redundancy, diversity, and moving target defense into the control architecture from the earliest design stage. Promising directions include dynamic heterogeneous redundancy, in which functionally equivalent but differently implemented controllers run in parallel and arbitrate their outputs; graph-theoretic topology design that maximizes inherent Byzantine resilience without additional security modules^[108,175]; and moving target defense that dynamically varies communication modes, control parameters, and topology to increase attacker uncertainty^[63,176]. These extend the resilient consensus and topology-switching methods reviewed in Sections 3.2 and 3.3 from runtime reconfiguration to design-time guarantees. The open questions are how to quantify the intrinsic security level of a control architecture, how to balance redundancy and diversity against the resource constraints of UAV swarms and agricultural robots, and how to design composable mechanisms that support the construction of large-scale systems from proven components.

The adaptive, fuzzy/neural, and ADP/RL methods compared in Section 3.3 share a common weakness: they are vulnerable to data poisoning, suffer catastrophic forgetting, and lack certifiable stability and security bounds, whereas model-based methods cannot adapt to unmodeled attacks^{[97,100,102,104,177,178]}. Hybrid architectures that use robust control as a certified safety baseline and data-driven learning for performance improvement offer a natural way forward. Safe RL with neural barrier certificates can provide exploration-time guarantees, lifelong learning can prevent forgetting, and digital twins can provide a safe pre-training sandbox that addresses the scarcity of rare attack scenarios^[155,156]. The open questions are how to certify a learning component that operates within a model-based safety envelope, how to detect poisoned or adversarial training data in real time, how to guarantee exploration safety in heterogeneous MASs where one agent’s action affects others, and how to provide composable stability and security guarantees when perception, transmission, decision-making, and execution are each partially learning-enabled.

Fully autonomous defenses, as reviewed in Section 3.3, respond rapidly but lack situational reasoning when confronted with novel attacks or situations outside the training distribution, and may make highly confident but disastrous decisions. Purely manual systems, by contrast, suffer from slow response, alarm fatigue, and cognitive bias. The complementary strengths of humans and automated systems, rapid consistent processing of known patterns vs. situational reasoning, novelty detection, and ethical judgment, are not yet exploited by existing human-in-the-loop methods, which focus on performance rather than security decisions^[109]. Adjustable autonomy offers a principled framework, dynamically allocating authority between autonomous defenses and human operators based on threat severity, system confidence, and decision criticality. Explainable AI is essential for calibrating trust, particularly for large language model integrated agents whose reasoning may be opaque. The open questions are how to design interfaces that present complex attack situations without causing information overload, how to formally model human trust and automation bias, and how to ensure security during transitions between autonomous and manual control under time pressure.

As noted in the synthesis above, the validation-method comparison in Section 3 shows that most reviewed algorithms are verified only through simulation and limited experiments, which cannot exhaust all possible attack scenarios or provide formal security guarantees. This constitutes a fundamental obstacle to deployment in safety-critical regulated domains such as automotive, aerospace, and industrial control. Although formal methods have been applied to specific control problems^[110,179], the state explosion problem limits their application to large-scale distributed MASs, and most existing methods are designed for static deterministic systems rather than the attack randomness, event-triggered communication, and adaptive learning components that characterize modern secure control. Compositional verification, which decomposes global security properties into locally verifiable conditions on individual agents, extends the stability proofs of observer-based and resilient consensus methods reviewed in Sections 3.1 and 3.3 to larger systems^[180]. Runtime verification supplements offline proofs by monitoring behavior after deployment, and probabilistic model checking handles random attack models and randomized defenses^[181,182]. The open questions are how to scale compositional methods to large-scale heterogeneous networks, how to verify learning-enabled defense components that existing frameworks treat as black boxes, and how to design specification languages that capture the dynamic nature of control requirements rather than borrowing general software security logic.

Security control and privacy protection are largely studied as independent problems, as the cross-layer discussion in Section 3.5 makes clear: security research promotes information sharing for attack detection, whereas privacy research restricts it to protect sensitive local data. This separation creates a fundamental tension, because effective collaborative defense requires sharing detailed status and anomaly information that may leak operational data, create new attack surfaces, or violate regulatory requirements. Federated anomaly detection, homomorphic encryption, and dynamic differential privacy can extend the privacy-preserving secure control methods reviewed in Section 3.5 to collaborative attack detection without disclosing raw data^{[94,157,158,170,171]}. Semantic communication, which transmits task-related semantics rather than raw data, offers a particularly promising route to harmonizing security and privacy. The open questions are how to characterize the fundamental trade-off between privacy budget and resilience, how to design privacy mechanisms robust to adversarial participants who exploit the collaborative defense process, and how to integrate privacy with event-triggered and resource-constrained control without incurring the overhead of existing cryptographic methods.

The comparative tables in Section 3 reveal that attack models and performance metrics vary widely across papers, preventing fair comparison and reproducibility, and that even widely studied problems such as DoS-resilient consensus lack common benchmarks. This fragmentation hinders industrial adoption, because practitioners cannot reuse well-tested security building blocks but must redesign solutions for each application. The field must therefore develop standardized security protocols, benchmark problems, and evaluation metrics analogous to transport layer security (TLS) in secure network communication. Key work includes general attack classification methods that support fair comparison, verifiable security protocols for consensus, formation control, and distributed optimization, and open-source reference implementations and testbeds^[155,156]. Standardized security indicators that quantify resilience, overhead, and detection performance from multiple dimensions will provide the foundation for principled comparison^[183-185]. The open questions are how to design protocols flexible enough for heterogeneous agents with different computation, communication, and energy constraints; how to develop benchmark problems that represent real attacks while remaining simple enough for controlled comparison; and how to enable third-party certification without disclosing proprietary control logic.

The domain comparison in Section 3 shows that generic security solutions impose unnecessary overhead in some domains and insufficient security in others, because they adopt worst-case assumptions that do not reflect domain-specific operational constraints, threat models, and performance requirements. Security protocols designed for stationary industrial control systems are too heavyweight for resource-constrained UAV swarms, whereas protocols designed for UAV swarms cannot provide the reliability required by smart grids where availability is paramount. Domain-customized design therefore extends the reviewed methods to UAV swarms, smart grids, vehicle platoons, satellite formations, and industrial control systems^{[29,99,103,106,107,135,174,186,187]}. For agricultural embodied intelligent robot swarms, five specific gaps follow directly from the analysis in Section 3: heterogeneous trust management between ground machinery and UAV formations, including cross-platform identity verification and semantic consistency of task-related messages; lightweight multimodal deception detection that fuses GNSS, vision, LiDAR, IMU, and multispectral data under embedded resource constraints; resilient communication protocols for extreme farmland channels, including adaptive event-triggering, UAV relaying, and delay-tolerant networking; safe RL with physical constraints for spraying, weeding, and harvesting; and field-validated benchmarks that include realistic attack scenarios, weather conditions, crop variability, and hardware-in-the-loop testing. A dedicated agricultural security testbed with real tractors, UAVs, sprayers, and field sensors is essential to bridge simulation and deployment. The broader open questions are how to systematically map domain-specific constraints and threat models to mechanism requirements, how to certify compliance with domain regulatory standards, and how to design mechanisms that degrade gracefully under resource limits rather than failing catastrophically when the design envelope is exceeded.

Almost all defense mechanisms reviewed in Section 3 respond only after an attack is detected and assume a fixed and known attack strategy. The rapid development of artificial intelligence is giving rise to a new generation of adaptive attacks that can automatically detect vulnerabilities, optimize strategies in real time, evade detection by learning the defense mechanism, and even exploit AI-based defense components through adversarial samples and prompt injection. These attacks break the fixed attack model assumptions underlying most existing resilient control theories. As both attackers and defenders adopt AI, the security of MASs will depend on a continuous co-evolutionary arms race that requires a fundamental shift from passive response to active defense. Active deception, honeypots, watermarking, adversarially robust learning, and opponent modeling extend the detection and learning-based defenses reviewed in Sections 3.1 and 3.3 to this co-evolutionary setting^[188]. The open questions are how to model the co-evolutionary dynamics between AI attackers and defenders, how to defend against prompt injection and semantic attacks on large language model integrated autonomous agents that operate at the semantic rather than network level, and how to design active defense mechanisms that avoid degrading normal system performance or introducing new vulnerabilities through the deception mechanism itself.

Table 6 summarizes the ten directions presented in Figure 4, each linked to the open challenges identified in Section 3 and to the reviewed methods they extend.

This roadmap highlights a gradual shift from near-term standardization and domain customization, through medium-term intelligent and data-driven defense, to long-term endogenous security and formally verified MASs. Each direction is anchored in a concrete gap identified by the comparative analysis of Section 3, and progress along these ten directions will deepen both the scientific understanding of secure cooperative control and the practical deployment of autonomous MASs in critical societal infrastructure.