- The paper introduces a modular digital twin that models autonomy interfaces, trust boundaries, provenance, and degraded-mode behavior instead of pursuing complete physical-environment realism.
- The architecture combines multi-modal confidence checks, application-layer validation beyond encrypted transport, runtime state monitoring, and structured logs to test replay, spoofing, malformed inputs, and sensor loss.
- The evaluation found no unsafe continuation across five-run subsystem-loss trials, with mean containment latencies of 511–957 ms, while exposing unresolved risks in authenticated telemetry provenance and stale operator displays.
Motivation and problem statement
Security evaluation of learning-enabled autonomous platforms is constrained by limited access to fielded systems, contested communications infrastructure, and representative adversarial test conditions. Neubert, Niure Kandel, and Peköz address this constraint by constructing a threat-oriented digital twin: an open-source, modular replica of a robotic-combat-vehicle-like autonomy stack whose purpose is not environmental realism but faithful representation of the interfaces, states, and trust assumptions that govern behavior under attack (2604.25757). The authors position the work against three adjacent but disconnected research threads — security-oriented digital twins for industrial cyber-physical systems, runtime assurance via monitored switching, and UAV communication-security research — arguing that none provides an end-to-end, unclassified evaluation environment for a full autonomy stack.
The paper advances three methodological claims. First, a useful security twin does not require perfect fidelity to the physical environment; it requires accurate reproduction of trust boundaries and degraded-mode logic. Second, threat-driven requirements yield a more defensible design than simulation-first construction because each component must justify its observability, validation logic, and fail-safe behavior. Third, an open-source implementation can support meaningful security experimentation when perception, decision, and control are explicitly separated and provenance metadata is recorded.
Threat-derived requirements
The architecture is derived from three requirement classes rather than from platform emulation. Perception integrity requires that raw detections never be treated as authoritative facts; outputs must carry confidence, survive cross-modal agreement checks, and be prevented from driving state transitions when sensing is ambiguous. This responds directly to adversarial ML results showing that small or physically realizable perturbations can induce confident misclassification. Communication trust boundaries are modeled around selective failure modes — stale commands arriving late, replayed telemetry remaining well formed, encrypted channels carrying semantically malicious content — using ATT&CK for adversary vocabulary and ATLAS for ML-specific threats. The requirement is post-decryption validation and auditable evidence of record acceptance or rejection. Runtime assurance and graceful degradation requires bounded responses when trust decays, subsystem liveness monitoring, and operator-visible supervisory control over high-impact actions, consistent with NIST cyber-resilience guidance on anticipate, withstand, recover, and adapt functions.
Architecture
The implementation decomposes the platform into three isolated execution domains — sensor/simulation host, autonomy-core host, and control/gateway host — communicating over ROS 2 with DDS transport, leaving SROS2/DDS-Security extensions available. Perception is deliberately multi-modal: RGB imagery feeds an ONNX detector while depth, LiDAR, and thermal streams provide corroboration; detections become confidence-weighted tracks only after spatial consistency and cross-sensor checks succeed. The authors concede that the twin uses controlled visual abstractions rather than operational datasets, so its research value lies in the validation pipeline rather than detection accuracy benchmarks.
Communications are split by traffic class: telemetry traverses a DTLS channel from autonomy core to gateway, while commands use a separate MQTT/TLS supervisory path. After DTLS termination, the gateway still enforces length, schema, freshness window, source identity, and sequence monotonicity checks before internal publication — converting encrypted transport into an application-aware trust boundary aligned with zero-trust guidance. The autonomy core is a discrete state machine (idle, ready, prepare-to-act, restricted/hold-safe) whose transitions depend on perception confidence, liveness, geofence status, and communication freshness, augmented with provenance metadata that lets downstream logic distinguish live observations from synthetic or stale ones. Structured logging at every stage makes the simulator a testbed: it can reveal whether a spoofed input was filtered at the gateway, whether confidence collapsed before action, and whether hold-safe entry occurred for the correct reason.
Communication-path evaluation
The initial evaluation used two measures: application-level rejection of stale, malformed, or provenance-inconsistent telemetry, and safety-preserving containment (drop, downgrade, degrade, or HOLD_SAFE) before unsafe state propagation. An adversarial relay inserted on the DTLS path introduced replay, delay, duplication, and packet loss without modifying autonomy or gateway logic.
The central finding concerns a teammate scenario. When a secondary teammate identity was admitted under the intended trust model, transport authentication succeeded, yet authenticated session membership did not guarantee semantic provenance of forwarded telemetry: telemetry derived from another unit crossed the cryptographic boundary whenever timing remained within the freshness window. Critically, freshness, sequencing, and higher-layer consistency checks then drove the receiving unit into HOLD_SAFE rather than allowing continued reliance on inconsistent teammate state. This is a notable result because it demonstrates both a genuine cross-layer gap between transport identity and telemetry origin and the sufficiency of containment logic above the cryptographic boundary to bound its operational effect. A negative control confirmed that a naive relay re-originating traffic as a different apparent peer could not enter the established DTLS association and produced no application-visible telemetry — establishing that the interesting failure mode is authenticated provenance ambiguity, not unauthenticated relay insertion.
Perception stress and quantified degradation
Repeated subsystem-loss trials quantified bounded degradation:
| Trial type |
Runs |
Outcome |
Mean transition latency |
p95 latency |
| Thermal processing loss |
5 |
Degraded mode; PREPARE_TO_FIRE revoked |
511 ms |
<1.7 s |
| RGB detector loss |
5 |
Degraded mode; PREPARE_TO_FIRE revoked |
957 ms |
<1.7 s |
| Localization/track starvation |
5 |
Safe degraded completion |
— |
— |
No unsafe continuation was observed in any trial. However, track-starvation trials exposed a layered assurance gap: stale tracks occasionally persisted on the operator display even as supervisory state remained safe, indicating that display freshness and supervisory state are governed by different mechanisms. Exploratory thermovisual perturbation showed that baseline misclassification could be reduced through adversarially informed retraining, after which manipulated cues were discarded without unsafe engagement; the authors conclude that the residual hardening need is plausibility-bounded thermal validation rather than additional mode logic. These evaluations are preliminary in scale — five runs per condition — and the paper does not claim universal robustness, only that confidence gating, cross-modal validation, and explainability metadata prevent a single manipulated observation from driving an unsafe transition.
Cross-domain transferability
The claimed transferability is architectural rather than literal. What generalizes across ground, UAV, and space platforms is the assurance pattern itself: trust-bounded communications, freshness validation, confidence-weighted perception, supervisory safety control, observability of stale or degraded state, and graceful degradation. For UAV instantiation, the plant-facing layer would shift toward flight control, loiter, and return-to-base logic; for space systems, toward attitude control, payload management, and ground–space command mediation. The transferability claim rests on the observation that these dependencies recur across autonomy stacks despite differences in plant dynamics, sensor modalities, control laws, and timing regimes; it is asserted as a design argument, not validated empirically on air or space platforms.
Limitations and open questions
Several limitations are stated plainly in the paper. The ground-based proxy cannot reproduce operational data complexity, and visual abstractions were chosen for reproducibility at the cost of benchmark-level perception realism. The evaluation covers a small number of trials per fault class, and the teammate-provenance gap is demonstrated in one scenario under one trust model; whether higher-layer containment bounds the effect across richer multi-agent topologies remains open. The persistence of stale tracks on the operator display identifies an unresolved layered-assurance question between display freshness and supervisory state that the current mode logic does not close. Finally, the cross-domain applicability to UAV and space stacks is architectural inference; no flight or orbital experiments substantiate it.
Conclusion
This work contributes a reproducible design pattern that translates threat analysis into observable, controllable tests for spoofing, replay, malformed-input injection, degraded sensing, and adversarial ML stress on autonomous platforms. Its key empirical result is that transport admission did not guarantee telemetry provenance in a teammate scenario, while higher-layer assurance bounded the operational effect through HOLD_SAFE containment; repeated subsystem-loss trials consistently revoked engagement authority within sub-second to sub-two-second latencies with no unsafe continuation. The results indicate that a security-oriented digital twin can serve as a practical pre-deployment assurance instrument by converting cross-layer trust assumptions into measurable resilience outcomes, though the scale of evaluation and the single-platform instantiation leave the breadth of those outcomes to be established.