{"id":"189026bd-7bd0-4f2d-b64e-67bc44b21475","arxiv_id":"2507.17875","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A Beta-distribution, hidden Markov trust estimator plus trust-weighted covariance intersection improves simulated multi-UAV surveillance under false-positive and false-negative attacks.","lead":"This paper builds a system that rates how much each drone in a team can be trusted, then uses those ratings to weight the data drones share during surveillance. If it works, a drone team can keep an accurate picture of the ground even when some drones are hacked and sending false detections.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"PSM loop can self-confirm: the reference 'fused tracks' used in §5.3.2/Fig. 6 may already contain the proximal agent's own earlier false tracks, so a false track can generate a positive PSM and raise its own trust.","rationale":"The central claim depends on trust PSMs being informative about whether a proximal agent's data are consistent with an independent picture of the world. As described in §5.3.2 and Figure 6, the comparison reference is the ego's fused track set. That set is built, via Algorithm 3, from the same proximal data whose trustworthiness is being assessed. Without explicit track provenance, a false track injected by a compromised agent can become part of the reference and then be matched to itself on the next cycle, producing a positive PSM and raising the very trust that should be lowered. This is a more direct threat to the paper's internal argument than the reader's stated weakest assumption about spoofed pose/orientation/FOV, because it applies within the paper's own attack model of injected false positives. The reader did note in the rationale that PSM generation is self-referential, but the formal weakest_assumption field points elsewhere, hence partial agreement. The paper has released code and a dataset, which makes the concern empirically checkable rather than merely speculative. The verdict should remain CONDITIONAL: if the provenance test confirms self-confirmation, the central claim is unsupported; if it does not, the concern is resolved. The existing CONDITIONAL verdict already covers addressable correctness risks, and this specific check should be added as an explicit condition.","tokens_in":16575,"tokens_out":8533,"duration_ms":104676,"concrete_test":"Using the released repository, add a source/track-provenance tag to every fused track; during PSM generation, record whether an assignment matches a fused track whose provenance is the same proximal agent. Re-run the §7.1 case study and Figure 9a; if precision recovery disappears or weakens materially when such self-matches are excluded or flagged, the trust loop is self-confirming and the central claim is not supported as described. If the result is essentially unchanged, the concern is refuted.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Figure 6 and §5.3.2 state that trust PSMs are generated by comparing each proximal agent's tracks against the ego's fused tracks; §5.4.1/Algorithm 3 then fuses those same tracks with weights from the current trust distributions. The fused track set is therefore not an independent reference. In the first fusion cycle after an FP injection, a false track that does not match any existing ego track generates a negative PSM; but if it is added to the fused set (initial trust is neutral, so it is not fully rejected), then in the next cycle the same proximal track matches the fused track it created. Eq. (5)-(6) then count that association as a positive PSM (v near 1, high confidence), increasing the agent's α and the false track's trust. The paper does not specify track provenance or removal of flagged tracks before PSM generation, so the reported recovery in §7.1 may be an artifact of contamination being masked by honest-agent redundancy rather than of trust estimation. This is a correctness risk inside the paper's own FP-attack model, not just under the broader pose-spoofing threat the reader identified.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a trust-based framework for distributed data fusion among camera-equipped UAVs conducting ISR. Each ego agent maintains Beta distributions for the trustworthiness of proximal agents and of individual tracks. Trust pseudomeasurements are generated from pairwise consistency checks between a proximal agent's tracks and the ego's fused tracks; they are incorporated via closed-form Beta-Bernoulli conjugate updates, with a negativity bias to make trust fall faster than it rises. The resulting trust means are used as weights in an N-fold covariance-intersection fusion algorithm, and low-trust tracks are flagged. The authors introduce a CARLA-based multi-agent aerial dataset, provide a repeatability package, and evaluate the method in Monte Carlo simulations under false-positive/false-negative attacks. They report that trust-informed fusion recovers precision to near baseline after an attack transient and that agent/track trust metrics improve with agent density.","tokens_in":16909,"tokens_out":9206,"duration_ms":94748,"significance":"If the central claim holds, this framework is a practical reactive-security component for decentralized aerial autonomy: it operates on compact track messages (around 35 kbps per agent), requires no oracle trust labels, and is accompanied by an open dataset and repeatability package. Modeling trust as full Beta distributions rather than scalar point values is a useful step beyond earlier scalar trust models, and the explicit release of simulation code is a real strength. However, the empirical significance is currently tempered because the trust measurement reference is not independent of the trust-weighted fusion output, and because the PSM construction is under-specified. The presented results do not yet distinguish a genuinely self-correcting trust estimator from one that partly confirms its own earlier outputs.","major_comments":[{"comment":"The trust pseudomeasurement loop is self-referential. Figure 6 and the text in §5.3.2 state that PSMs are generated by comparing each proximal agent's tracks to the ego's fused tracks, but Algorithm 3 fuses those same tracks with weights derived from the trust distributions. In the first cycle after a false-positive injection, a false track that is not matched to an existing ego track yields a negative PSM; however, because initial trust is neutral, it is not rejected outright and becomes part of the fused set. On the next cycle, the same proximal track matches the fused track it created, and Eqs. (5)–(6) count the association as a positive, high-confidence PSM, increasing both the track's and the agent's trust. The paper never specifies that tracks are tagged by provenance or that flagged low-trust tracks are excluded from the PSM reference before the next update, so the recovery reported in §7.1 may be an artifact of contamination being masked by honest-agent redundancy rather than of trust estimation. Please either specify explicit provenance tracking and removal of flagged tracks from the reference, or generate PSMs only against ego-local tracks or a reference that excludes the proximal agent's own earlier contributions, and add an ablation showing the FP-attack case-study result without self-generated reference tracks.","section":"§5.3.2, §5.4.1, Fig. 6, Eqs. (5)–(6)"},{"comment":"The update described as 'inspired by Gibbs sampling' is not a sampling procedure. No samples are drawn, no Markov chain is defined, and Eqs. (5)–(6) are standalone closed-form conjugate updates. The conditionals in Eq. (4) are not the full conditionals of a joint distribution over all agent and track trust variables, and §5.3.5 immediately replaces the joint distribution with independent Beta approximations. Consequently, the phrase 'Gibbs sampling' overstates the methodological contribution and may mislead readers about convergence or consistency properties. Please either remove the Gibbs-sampling language and describe the procedure as a sequential conjugate Bayesian filter with a coordinate-wise approximation, or, if the Gibbs analogy is retained, specify the actual conditional distributions, the sampling scheme, and a convergence argument.","section":"§5.3.4 and §5.3.5"},{"comment":"The PSM generation function is not sufficiently specified. Eqs. (5)–(6) require a value v_{j,k} and confidence c_{j,k} for every agent-track pair, and Figure 6 gives a qualitative flow chart, but the text does not define how v_{j,k} and c_{j,k} are computed from the assignment distances, association thresholds, FOV filtering, or track covariances. It also does not define how the FOV filtering in Eq. (3) interacts with the assignment cost, or how the negative PSM magnitude is set. Since the entire trust update depends on these quantities, the quantitative results in Figures 9–12 cannot be reproduced from the paper text alone, even with the repeatability package. Please provide explicit formulas or pseudocode for v_{j,k} and c_{j,k}, including all thresholds and normalization steps, and state which values were used in the reported experiments.","section":"§5.3.2, Fig. 6"},{"comment":"The consistency check that defines trust has no independent anchor if a compromised agent can report false ownship pose or camera calibration. Sections 3.2.2 and 5.3.1 assume accurate ownship localization and known, fixed camera intrinsics in order to predict what an agent should have observed. A data-level attacker who also tampers with the pose vector listed in §3.3.1 can make its false tracks appear geometrically consistent with the ego's FOV prediction, and the PSM loop will then validate them. Section 4 lists spoofing channels, but the evaluations in Section 7 only cover false-positive, false-negative, and translation attacks on track data. Please either restrict the paper's security claims to attacks that do not corrupt ownship state or calibration, or add experiments and algorithmic mechanisms that address pose and FOV spoofing, for example cross-checks against GPS/IMU consensus or temporal consistency of the reported pose.","section":"§3.2.2, §5.3.1, §4.1"}],"minor_comments":[{"comment":"The OSPA expression appears to have the wrong sign on the cardinality penalty and to omit the outer 1/p root from the standard definition in [31]; as written, for n<m the term c^p(n-m) is negative, which would subtract rather than add the cardinality mismatch cost.","section":"§A.2, Eq. (8)"},{"comment":"Eq. (3) defines Δθ and Δφ as arctan(n_x/(2 f_x)) and arctan(n_y/(2 f_y)), which are half-angles, while the text calls them the horizontal and vertical angles of the camera's FOV; please clarify whether the subsequent FOV filtering uses these half-angles or doubles them.","section":"§5.3.1, Eq. (3)"},{"comment":"The claim that 'to the best of our knowledge, none existed before this work' is stronger than the related-work section supports, given references [7], [8], [16], and [17]; please soften the claim or provide a precise comparison that distinguishes the present contribution.","section":"§5.1"},{"comment":"The assumption that latency and communication drops can be neglected because 'TCP data buffers' handle them is optimistic for ad hoc aerial networks; please justify this modeling choice or qualify the scope of the communication model.","section":"§3.3.1"},{"comment":"OSPA is defined in §6.4 and Appendix A.2 but never reported in the experimental results; reporting OSPA for the case study and attacker-capability experiments would substantiate the claim that trust-informed fusion recovers accurate situational awareness.","section":"§6.4 and §7"}],"recommendation":"major_revision","confidential_remarks":"The self-referential PSM loop and the under-specified PSM definition are the two issues that most need addressing before publication; both are fixable with ablations and explicit formulas. I would also check whether the 'Gibbs sampling' framing is an artifact of an earlier version of the paper; it should be corrected. The repeatability package is a genuine strength, though I did not run it and therefore cannot vouch for the numerical results beyond the text."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this is a real engineering contribution—released CARLA multi-agent aerial dataset, reproducible pipeline, and a trust-weighted fusion scheme that plausibly improves precision under false-positive attacks. The core Beta-HMM trust representation is not new here (it is the authors' own CDC work and the MATE paper), but the aerial FOV pseudomeasurements and the dataset are. If I were refereeing, I would not desk-reject; I would send it out and ask for one specific fix and one ablation.\n\nWhat it does well: the dataset and code are the kind of thing the field needs; the paper is honest about sparsity limiting trust observability (Section 7.3, limitations); the metrics section defines trust accuracy carefully; and the negatively-weighted update (trust drops faster than it rises) is a sensible design choice.\n\nThe soft spots, in rough order. First, the PSM loop is not fully anchored. Section 5.3.2/Figure 6 generates trust PSMs by comparing each proximal agent's tracks to the ego's fused tracks, and Algorithm 3 weights those fused tracks by the same trust estimates. A false track that survives one fusion cycle can then match itself in the next cycle and generate a positive PSM, raising its own trust. The paper never specifies that tracks originating from a given agent are excluded before PSM generation, or that flagged tracks are removed before forming the reference. The stress-test note is right: this can entrench an initially wrong prior. It is not fatal in the reported Monte Carlo results, because dense honest coverage provides independent negative evidence, but the paper needs an ablation that separates \"trust estimation is doing the work\" from \"honest-agent redundancy is masking contamination.\"\n\nSecond, the 'Gibbs sampling' label in Section 5.3.4 is wrong. No sampling occurs; it is a coordinate-wise closed-form Beta-Bernoulli update. That is a terminology fix, not a correctness problem. Third, several parameters—initial Beta priors, B_cn, T_cn, T_c_tau, and the PSM confidence construction—are left unspecified in the text. The released code may pin them down, but the paper should state them. Also, the consistency check assumes accurate ownship localization and known calibration; a compromised agent reporting corrupt pose breaks the anchor. That is a real scope limitation, not hidden: the attacker model is explicitly data-level FP/FN/translation.\n\nOverall: the central idea is defensible, the evidence is mostly simulation but the dataset is a legitimate artifact. For a reader working on multi-agent security or reactive fusion, this is worth a serious referee. My recommendation: conditional accept; require the track-provenance clarification and the redundancy ablation.","headline":"Solid, reproducible engineering contribution with a genuine dataset; the trust loop needs an explicit track-provenance guard and a redundancy ablation before the recovery claim is fully convincing.","tokens_in":17402,"tokens_out":2703,"would_cite":true,"duration_ms":30016,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that distributed camera-equipped UAV networks can detect compromised agents and restore near-baseline tracking accuracy after a false-positive attack, by weighting data fusion with Beta-distributed trust estimates.","keywords":["trust-based sensor fusion","distributed data fusion","multi-agent autonomy","hidden Markov model","Beta distribution","covariance intersection","adversarial detection","unmanned aerial vehicles"],"falsifier":"Run an attack in which a compromised agent sends false tracks together with a slightly altered camera calibration or field-of-view description, so that the ego's predicted observations match the false tracks; if the agent's estimated trust stays high, the consistency-check anchor has been broken. A complementary test introduces an occlusion between a benign agent and the ground: if its trust collapses even though it is reporting truthfully, the method cannot separate natural errors from malicious misbehavior.","tokens_in":16382,"feed_emoji":"🚁","tokens_out":6791,"duration_ms":64894,"temperature":0.7,"pith_summary":"The paper is trying to establish that multi-UAV surveillance networks can keep producing accurate situational awareness even when some agents are compromised, by scoring each agent's reports against what physics says it should have seen. The authors build a trust layer in which each agent maintains Beta-distributed estimates of how trustworthy every nearby agent and every tracked object is, updated by pseudomeasurements from pairwise consistency checks. These trust distributions then weight a covariance-intersection fusion step, so unreliable reports are down-weighted rather than blended in equally. In simulated contested ISR missions with up to 50 camera-equipped UAVs, the framework restores precision to near-baseline levels after a false-positive attack begins and outputs usable agent- and track-level trust distributions. A sympathetic reader would care because it offers a perception-aware alternative to Byzantine fault tolerance for aerial autonomy.","feed_headline":"Trust weighting restores drone tracking accuracy after attacks","feed_subtitle":"Beta-distributed trust scores catch malicious UAVs and restore situational awareness after a false-data attack.","key_machinery":"The load-bearing object is the trust pseudomeasurement combined with the Beta-distributed hidden Markov trust state. A pseudomeasurement is a pair $(v_{j,k}, c_{j,k})$ in $[0,1]$, where $v$ is the degree to which a proximal agent's track agrees with the ego's fused track set and $c$ is the confidence in that comparison; the agreement is only computed for tracks lying inside the proximal agent's predicted field of view. These pseudomeasurements feed a conjugate Bayesian update, turning a Beta prior $\\mathrm{Beta}(\\alpha,\\beta)$ into a Beta posterior via the closed-form update $\\Delta\\alpha_{j,t} = \\sum_k c_{j,k} v_{j,k}$ and $\\Delta\\beta_{j,t} = \\sum_k c_{j,k}(1-v_{j,k})$, with an optional negativity bias that drops trust faster than it builds. The downstream mechanism is trust-weighted covariance intersection, where each agent's information-form contribution is scaled by $\\mathbb{E}[\\tau_i]$ and the fused confidence is $\\hat{\\zeta}_{CI} = \\sum_i \\omega_i \\mathrm{Var}[\\tau_i]$. Together these pieces turn raw disagreement into a probabilistic suspicion that is then used to filter and reweight incoming data.","core_discovery":"The central claim is that trust-informed data fusion, built on Beta-distributed hidden Markov model estimates, detects misbehaving agents and recovers accurate situational awareness in contested multi-UAV ISR. Each ego agent generates trust pseudomeasurements by comparing a proximal agent's reported tracks against a prediction of what that agent should have observed given its position, camera calibration, and field of view; these pseudomeasurements update Beta distributions for agent trust and track trust in closed form. Fusion then weights each agent's contribution by the expected value of its trust distribution inside a covariance-intersection update, with the variance of the trust distributions producing a fusion-confidence measure. In Monte Carlo evaluations on a new CARLA-based multi-agent aerial dataset, the framework restores precision to near-baseline after false-positive attacks begin, and trust-estimation accuracy improves monotonically with agent density in both benign and adversarial settings.","pith_inferences":["If the consistency-check anchor is the weak point, the framework's own logic suggests that protecting pose and calibration reports (e.g., with signed messages or redundant cross-checks) would harden the trust loop; the paper does not develop this.","Because trust observability requires field-of-view overlap, mission planning that actively routes UAVs to maintain overlapping coverage would strengthen detection; the paper only notes this as future work.","The independence approximation between agent and track trust distributions could be probed by correlated attacks that spread false tracks across several mutually consistent agents; testing such coordinated adversaries would reveal whether the closed-form Beta updates remain reliable.","Replacing track-level comparisons with pixel-wise semantic segmentation could catch manipulations that pass track-level checks, at the cost of higher bandwidth; the paper raises this as a future direction rather than a demonstrated result."],"forward_implications":["Under a false-positive attack, trust-informed fusion first dips with the untrusted baseline but then climbs back to pre-attack precision and recall, while the untrusted pipeline stays degraded.","Trust-estimation accuracy improves as agent density increases, so networks with more overlapping fields of view can detect adversaries that sparse networks miss.","The framework outputs usable probability distributions over both agent trust and track trust, not just binary verdicts, giving operators a graded picture of who to rely on.","Even when a large fraction of agents are attacked, trust-weighted fusion shows significant precision and recall gains over untrusted fusion.","The released CARLA-based multi-agent aerial dataset provides a reusable testbed for evaluating assured fusion under varied attacker models."],"supporting_citations":[{"why":"Supplies the Beta-distributed trust representation and the hidden Markov trust-estimation starting point that the framework builds on.","marker":"[16]"},{"why":"Provides the distributed data fusion formulation and covariance intersection baseline that the trust-weighted fusion extends.","marker":"[12]"},{"why":"Supplies the CARLA urban simulator with its realistic camera and physics models used to generate the evaluation dataset.","marker":"[9]"},{"why":"Supplies the dataset-generation pipeline adapted to build the first multi-agent aerial CARLA dataset.","marker":"[15]"},{"why":"Provides the expanded simulator API used to configure multiple UAVs with sensing and navigation in CARLA.","marker":"[19]"},{"why":"Supplies the OSPA metric used to evaluate multi-target tracking performance in the fusion experiments.","marker":"[31]"},{"why":"Provides the covariance intersection algorithm that the trust-weighted fusion reweights with trust distributions.","marker":"[22]"},{"why":"Motivates why classical Byzantine fault tolerance is insufficient for UAVs subject to natural false positives, occlusions, and sensor degradation.","marker":"[11]"}],"fun_headline_variants":["Beta trust scores catch malicious UAVs, restore tracking","Trust-based fusion recovers drone accuracy after attacks","Hidden Markov trust detects rogue agents in UAV networks","Trust-weighted sensor fusion defeats false-date attacks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The entire trust loop rests on the ego agent being able to predict what each proximal agent should have observed, which requires accurate ownship localization, known camera calibration, and an unobstructed ground-parallel field of view; if a compromised agent reports a false pose, orientation, or field of view, the consistency check has no independent anchor and trust can be manipulated.","fun_headline_variants_meta":{"raw":{"variants":["Beta trust scores catch malicious UAVs, restore tracking","Trust-based fusion recovers drone accuracy after attacks","Hidden Markov trust detects rogue agents in UAV networks","Trust-weighted sensor fusion defeats false-date attacks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000172,"raw_usage":{"total_tokens":1232,"prompt_tokens":859,"completion_tokens":373,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":475,"completion_tokens_details":{"reasoning_tokens":314}},"tokens_in":475,"tokens_out":373,"duration_ms":5103,"temperature":1.0,"reasoning_tokens":314,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T14:40:00.014587+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run an attack in which a compromised agent sends false tracks together with a slightly altered camera calibration or field-of-view description, so that the ego's predicted observations match the false tracks; if the agent's estimated trust stays high, the consistency-check anchor has been broken. A complementary test introduces an occlusion between a benign agent and the ground: if its trust collapses even though it is reporting truthfully, the method cannot separate natural errors from malicious misbehavior.","supporting_citations":[{"cited_title":"Spencer Hallyburton and Miroslav Pajic","cited_arxiv_id":null,"evidence_quote":"Supplies the Beta-distributed trust representation and the hidden Markov trust-estimation starting point that the framework builds on."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the distributed data fusion formulation and covariance intersection baseline that the trust-weighted fusion extends."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the expanded simulator API used to configure multiple UAVs with sensing and navigation in CARLA."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the OSPA metric used to evaluate multi-target tracking performance in the fusion experiments."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the covariance intersection algorithm that the trust-weighted fusion reweights with trust distributions."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Motivates why classical Byzantine fault tolerance is insufficient for UAVs subject to natural false positives, occlusions, and sensor degradation."}],"review_version":1}