Decentralised Shields and Distributed Safety

• Decentralised shields are distributed safety mechanisms that shift validation, auditing, and runtime interventions from a centralized authority to multiple local nodes.
• They employ patterns like replicated data validation, semantics-aware detection, local runtime action filtering, and compositional shielding to enhance system resilience.
• Applications span space situational awareness, blockchain security, federated learning, and multi-agent control, showing measurable improvements in detection and fault tolerance.

Searching arXiv for the listed shield-related papers and topic coverage. Decentralised shields are distributed safety and security mechanisms that remove single points of failure by relocating validation, auditing, runtime intervention, or policy restriction from a central authority to multiple peers, local controllers, or local estimators. In the literature, the term denotes several related but non-identical constructions: permissioned ledgers for orbital ephemeris dissemination, semantics-aware detectors for cross-chain bridges, distributed auditing frameworks for LLM-based multi-agent systems, local runtime enforcers in multi-agent control, compositional shield synthesis for POMDPs and Dec-POMDPs, and per-agent shielding for stochastic multiplayer games (Graczyk et al., 2021, Lin et al., 28 Aug 2025, Wang et al., 28 Nov 2025, Yang et al., 8 Apr 2026, Carr et al., 15 Sep 2025, Pranger et al., 2 Jun 2026). The unifying idea is not a single formalism, but a recurring systems principle: safety-critical decisions should depend on replicated or locally enforceable checks rather than on a brittle centralized monitor.

1. Conceptual scope

In the broadest sense used by the cited work, a decentralised shield is a mechanism that constrains unsafe system evolution while preserving distributed operation. The concrete object being shielded varies by domain. In space situational awareness, the protected object is the TLE or ephemeris dissemination path used for conjunction assessment; in blockchain security it is the end-to-end cross-chain execution path; in federated learning it is the gradient/update surface that leaks private information; in MARL and control it is the action stream emitted by learning agents; in network defense it is the game arena induced by topology and formal specifications (Graczyk et al., 2021, Lin et al., 28 Aug 2025, Li et al., 6 Aug 2025, ElSayed-Aly et al., 2021, Hsain et al., 11 Jun 2026).

Two recurring design goals appear across these settings. First, decentralisation is used to eliminate single points of failure or single trusted auditors. EphemeriShield replaces direct TLE “push” from a few hubs with a permissioned, private ledger replicated at every peer; AgentShield replaces a single auditor with multiple sentries and arbiters; online runtime enforcement for multi-agent systems places a shield onboard every agent rather than in a centralized synthesizer (Graczyk et al., 2021, Wang et al., 28 Nov 2025, Raju et al., 2019). Second, decentralisation is paired with explicit safety semantics rather than mere data distribution. BridgeShield learns cross-chain semantics through heterogeneous meta-path attention, Dec-POMDP shielding compiles shield process algebra to local Mealy machines, and compositional POMDP shielding intersects local permissive policies over belief supports (Lin et al., 28 Aug 2025, Yang et al., 8 Apr 2026, Carr et al., 15 Sep 2025).

A common misconception is that decentralisation alone provides correctness. The cited work does not support that interpretation. The mechanisms rely on chaincode validation, consensus, attractor computation, belief-support updates, control barrier functions, or local pathfinding; decentralisation changes where enforcement happens, but not the need for explicit correctness conditions (Graczyk et al., 2021, Hegde et al., 30 Apr 2025, Pranger et al., 2 Jun 2026).

2. Architectural patterns

The literature exhibits several recurrent implementation patterns.

Paradigm	Representative systems	Core mechanism
Replicated data-validation shield	EphemeriShield, Free2Shard	Permissioned replication, consensus, dynamic self-allocation
Semantics-aware detection shield	BridgeShield, AgentShield	Heterogeneous attention, cascade auditing, consensus
Local runtime action shield	Factored MARL shields, online synthesis, HSS	Per-agent or per-factor action filtering and correction
Compositional formal shield	Dec-POMDP local shields, compositional POMDP shields, Tempest SMG shields	Projection, intersection, permissive policies, local state estimators

The first pattern is replication with accountable membership. EphemeriShield stores object identifiers, epochs, and orbital elements in immutable transactions replicated to all peers, with strong, verifiable identities and governance that can sanction or exclude low-quality or malicious providers (Graczyk et al., 2021). Free2Shard addresses a different problem—liveness under a fully adaptive adversary in sharded systems—but the same anti-centralization logic appears in its dynamic self-allocation algorithm, which lets users allocate themselves to shards without requiring a central or cryptographic proof (Rana et al., 2020).

The second pattern is hierarchical detection rather than direct action blocking. BridgeShield constructs a unified heterogeneous graph over source chain, off-chain coordination, and destination chain, then applies intra-meta-path and inter-meta-path attention to identify anomalous cross-chain behaviors (Lin et al., 28 Aug 2025). AgentShield uses a three-layer defense in which Critical Node Auditing prioritizes high-influence agents, Light Token Auditing applies a Strict Unanimity Rule over lightweight sentries, and Two-Round Consensus Auditing escalates uncertain cases to a heavyweight committee (Wang et al., 28 Nov 2025).

The third pattern is local runtime enforcement. In safe MARL, factored shielding decomposes the global state space into factors, synthesizes local Mealy machines, and composes their admissible actions through intersection and coordination at boundaries (ElSayed-Aly et al., 2021). The online synthesis approach of 2019 goes further toward decentralisation: every agent carries a pathfinder and an ordering mechanism, modifies only its own trajectory, and relies only on its communication group rather than on global state (Raju et al., 2019). In connected autonomous vehicles, the decentralised Hybrid Safety Shield is per-vehicle and combines an optimisation-based longitudinal CBF filter with a rule-based lateral CBF invariance check (Hegde et al., 30 Apr 2025).

The fourth pattern is compositional or projected shielding under partial observability. The Dec-POMDP work compiles a global shield process into a process automaton, then a global Mealy machine, and finally local Mealy machines whose states are belief-style subsets of global Mealy states consistent with each agent’s observations (Yang et al., 8 Apr 2026). The compositional POMDP work decomposes the state space into submodels, synthesizes local shields, and defines the global shield by pointwise intersection,

$Sh(h)=\bigcap_{i=1}^n Sh_i(E_i(h)),$

with local estimators $E_i$ over belief supports (Carr et al., 15 Sep 2025). Tempest’s turn-based SMG shields realize an analogous decentralised deployment form: player-specific local filtering is sufficient because exactly one player acts at any state (Pranger et al., 2 Jun 2026).

3. Formal mechanisms

A central formal distinction in this literature is between shields that validate data and shields that constrain actions. EphemeriShield belongs to the former class. When a new ephemeris entry $(object_i, epoch_{new}, OE_{new})$ arrives, the chaincode retrieves the last accepted state, propagates it to the new epoch using a numerical propagator such as SGP4, and accepts the update only if

$|OE_{new}-OE_{prop}|<\epsilon,$

otherwise raising a warning (Graczyk et al., 2021). The safety object is therefore an accepted replicated catalog rather than a controller.

Action shields instead define admissible choices. In Tempest’s RL workflow, the pre-shield is

$$O_{pre}(s)=\{a\in A(s)\mid risky(s,a)\le \delta_\phi\},$$

with dangerous-state fallback to least-unsafe actions, while per-agent decentralisation in turn-based SMGs is given by

$$Sh_i(s)=O_{pre}(s)\ \text{if}\ s\in S_i,\quad Sh_i(s)=A(s)\ \text{otherwise}.$$

Because the state space is partitioned by controller, local restrictions coincide with centralized enforcement at runtime (Pranger et al., 2 Jun 2026).

Several papers derive shields from game-theoretic winning regions. In safe MARL via shielding, the safety specification is translated to a DFA, combined with an environment abstraction, and solved as a two-player safety game; the winning set induces the safe joint-action set $\sigma(g,l)=\{a\in A\mid \delta^g(g,l,a)\in W\}$ (ElSayed-Aly et al., 2021). In defensibility analysis for adversarial networks, the attacker’s constrained attractor is computed as a least fixpoint

$$Attr_A^*=\mu X.(U\cup \text{attacker-predecessors}\cup \text{defender-predecessors}),$$

the winning region is $W=S_\times\setminus Attr_A^*(U)$, and the shield $Safe(\cdot)$ is extracted as a witness of defensibility rather than as the primary product (Hsain et al., 11 Jun 2026).

Partial observability introduces a different synthesis route. The Dec-POMDP approach first specifies safe global behavior in a shield process algebra with guarded choice and recursion, then projects the resulting global Mealy shield to local Mealy machines that output per-agent safe action sets based on belief-style state subsets consistent with local observation histories (Yang et al., 8 Apr 2026). The compositional POMDP paper similarly reasons over belief supports rather than exact beliefs and proves a soundness theorem for avoid specifications when local shields are intersected over an admissible decomposition (Carr et al., 15 Sep 2025).

Some decentralised shields are not automata-theoretic. BridgeShield models cross-chain behaviors as a heterogeneous graph

$E_i$0

and uses hierarchical attention,

$E_i$1

followed by inter-meta-path weighting

$E_i$2

to produce anomaly-sensitive embeddings (Lin et al., 28 Aug 2025). AgentShield combines topological scoring

$E_i$3

with a two-stage audit protocol whose first-round failure probability decays approximately as $E_i$4 (Wang et al., 28 Nov 2025). In CAV shielding, forward invariance is enforced by the discrete-time CBF condition

$E_i$5

together with a QP that minimally modifies the proposed longitudinal command (Hegde et al., 30 Apr 2025).

4. Representative domains

Space situational awareness provides one of the clearest examples of a decentralised shield as infrastructure hardening. EphemeriShield addresses cyber-ASAT attacks that manipulate external TLEs relied upon for conjunction assessment. It targets source-side alteration, in-transit tampering, and accidental errors, and replaces a centralized ephemeris repository with a permissioned, private ledger in which SST data providers, SST data users, and conjunction-analysis nodes share a full replicated catalog. The design focuses on integrity, authenticity, auditability, availability, Byzantine fault tolerance, and Sybil resistance; confidentiality is explicitly not the emphasis (Graczyk et al., 2021).

Blockchain systems use the term in a more semantics-aware sense. BridgeShield is a decentralised shield for cross-chain bridge applications that jointly models source-chain traces, off-chain relayer behavior, and destination-chain execution to detect source-chain, off-chain, and destination-chain attacks. Its meta-paths explicitly encode lock, relay, verify, mint, approval, and event-only unlock structures that single-chain detectors do not capture (Lin et al., 28 Aug 2025). Free2Shard addresses decentralized shielding at the protocol level: it is a sharding architecture secure against a fully adaptive adversary through Dynamic Self Allocation, asynchronous shard rotation, and operation in a purely identity-free proof-of-work setting (Rana et al., 2020). The defensibility-analysis work shifts the term again, treating shield synthesis as a design-time analytical instrument for network defense rather than a runtime governor (Hsain et al., 11 Jun 2026).

Federated learning uses decentralised shields primarily for privacy and robustness. SelectiveShield is a lightweight hybrid defense against gradient leakage in heterogeneous FL. Clients quantify parameter sensitivity via empirical Fisher information, negotiate a shared sensitive set, encrypt consensus-sensitive coordinates with CKKS, protect non-critical coordinates with adaptive differential privacy, and keep personal-sensitive parameters local for personalization (Li et al., 6 Aug 2025). Pelta is a hardware-backed client-local gradient shield that uses a Trusted Execution Environment to hide the leftmost factors of the backpropagation chain rule, thereby impeding white-box adversarial probing in federated models (Queyrut et al., 2023).

Multi-agent decision systems use decentralised shields as action filters and auditors. AgentShield secures LLM-based MAS through topology-aware prioritization and distributed auditing rather than a single trusted auditor (Wang et al., 28 Nov 2025). Safe MARL via shielding distinguishes centralized shielding from factored shielding, with the latter synthesizing multiple concurrent local shields over factors of the joint state space (ElSayed-Aly et al., 2021). The 2019 online synthesis work attaches a shield onboard every agent and synthesizes corrections at runtime, while the Dec-POMDP work synthesizes local Mealy shields that account for observation history rather than using memoryless local filters (Raju et al., 2019, Yang et al., 8 Apr 2026). In autonomous driving, decentralised Hybrid Safety Shields operate per vehicle using only ego state and nearby-vehicle state in a fixed local topology, with no central coordinator (Hegde et al., 30 Apr 2025).

The literature also contains explicit claims of domain transfer. EphemeriShield argues that permissioned replication, strong identities and accountability, embedded validation logic, and immutable auditing apply to power grid PMU data, maritime AIS, and aviation ADS-B (Graczyk et al., 2021). This suggests that “decentralised shield” is increasingly functioning as a cross-domain design pattern for cyber-physical systems in which measurement streams drive safety-critical decisions.

5. Guarantees and empirical evidence

The evidence base is heterogeneous. Some papers are empirical detection or control studies; others are formal analyses or design proposals. BridgeShield reports experiments on 51 real-world cross-chain attack events and states that it achieves an average F1-score of 92.58%, representing a 24.39% improvement over state-of-the-art baselines; it also reports that max pooling yields the best attack-class F1 and that $E_i$6 balances precision and recall (Lin et al., 28 Aug 2025). AgentShield reports a 92.5% recovery rate, restores performance by 19.8% on average under mixed attacks, and reduces auditing overhead by over 70% compared to existing methods, with concrete no-attack and attack overhead comparisons against Majority Voting (Wang et al., 28 Nov 2025).

In federated learning, SelectiveShield reports utility and privacy trade-offs across MNIST, FMNIST, CIFAR-10/100, SVHN, and STL10 under non-IID partitions. The reported results include CIFAR-10 accuracy up to 0.655, CIFAR-100 accuracy between 0.397 and 0.416, zero plaintext exposure on encrypted coordinates, and iDLG-based ablations showing that increasing $E_i$7 increases leakage as $E_i$8 shrinks (Li et al., 6 Aug 2025). Pelta reports that shielding both branches of a Transformer+CNN ensemble raises robust accuracy from 27.2% to 98.8% against SAGA while keeping clean accuracy at approximately 99%, with a shielded-prefix memory footprint of 28.96 MB in the ensemble worst case (Queyrut et al., 2023).

In multi-agent control and RL, factored and decentralized shields are evaluated both formally and empirically. Safe MARL via shielding reports zero collisions with both centralized and factored shielding, while factored shielding is more scalable in the number of agents than centralized shielding (ElSayed-Aly et al., 2021). The online synthesis approach proves that runtime synthesis time is quadratic in the number of agents and reports that, for 50 agents in a 50x50 grid, synthesis at runtime requires a few seconds per agent whenever a potential collision is detected (Raju et al., 2019). The Dec-POMDP case study shows that different shield processes can reduce collisions to 0.000 while varying substantially in reachability and shield failure, and PRISM is used to compute best- and worst-case safety probabilities independently of the agents’ policies (Yang et al., 8 Apr 2026). Compositional shielding for POMDPs reports zero safety violations during and after learning, and states that compositional synthesis permits safe RL in environments two orders of magnitude larger than other state-of-the-art model-based approaches (Carr et al., 15 Sep 2025).

Cyber-physical control results are similarly concrete. In on-ramp merging, MARL-HSS reports zero crashes with average speeds of 28.36 m/s in light traffic and 26.54 m/s in moderate traffic, compared with 27.70 m/s and 27.32 m/s for the baseline, which incurs 6.3 and 5 crashes on average, respectively (Hegde et al., 30 Apr 2025). Free2Shard provides mainly theoretical guarantees: under the F2S policy,

$E_i$9

and total throughput scales as $(object_i, epoch_{new}, OE_{new})$0 under the stated conditions (Rana et al., 2020). By contrast, EphemeriShield explicitly does not present empirical benchmarks or case studies; its claims are design-level arguments about resilience via replication, multi-source ingestion, and immutable traceability (Graczyk et al., 2021).

This disparity in evidence matters. Some decentralised shields are validated through benchmarked classification or control performance, while others remain primarily architectural or theorem-driven proposals. The term therefore denotes a family of mechanisms with different evidentiary standards rather than a single mature benchmarked technology.

6. Limitations, controversies, and open directions

The literature converges on decentralisation as a way to remove single points of failure, but it does not converge on a single deployment doctrine. A major point of divergence is whether shield synthesis should primarily be a runtime enforcement mechanism or a design-time analytical tool. “Beyond Runtime Enforcement” argues that shield synthesis is “the wrong product” when interpreted mainly as a deployed runtime governor and instead treats the defensibility verdict, winning region, and defensibility fingerprint as the main outputs (Hsain et al., 11 Jun 2026). Other papers, especially in RL, MARL, and autonomous driving, treat runtime filtering as the central mechanism (ElSayed-Aly et al., 2021, Hegde et al., 30 Apr 2025, Pranger et al., 2 Jun 2026).

Another recurrent limitation is compositionality. The compositional POMDP paper proves soundness for avoid specifications under admissible decomposition, but also notes conservatism from absorbing interfaces and over-approximate partial models (Carr et al., 15 Sep 2025). The network-defensibility work states explicitly that local shields are not generally compositional without interface invariants and assume–guarantee closure; cross-subnetwork couplings can violate global invariants even when each local action is shield-safe (Hsain et al., 11 Jun 2026). The Dec-POMDP work likewise shows that limited observability can force conservatism or shield failure, particularly when local observation radius is small (Yang et al., 8 Apr 2026).

Strong environmental assumptions are also common. MARL-HSS assumes pure CAV traffic with perfect, delay-free, lossless communication and fully cooperative sharing of true states (Hegde et al., 30 Apr 2025). Tempest’s decentralised deployment relies on turn-based SMGs in which exactly one player acts per state; the paper explicitly notes that simultaneous-move games would require a central coordinator or a compositional assume–guarantee scheme outside the present tooling (Pranger et al., 2 Jun 2026). Pelta assumes trusted hardware and excludes side channels (Queyrut et al., 2023). SelectiveShield assumes a trusted key distribution/decryption server and notes that compromise of $(object_i, epoch_{new}, OE_{new})$1 would expose encrypted updates (Li et al., 6 Aug 2025). BridgeShield identifies coverage gaps for non-EVM chains and partial off-chain visibility (Lin et al., 28 Aug 2025).

Governance and accountability remain nontrivial even when the underlying mechanism is technically well defined. EphemeriShield requires consortium agreement on membership policies, validation thresholds $(object_i, epoch_{new}, OE_{new})$2, and incident response, and does not specify automatic quorum-based resolution rules or rollback procedures (Graczyk et al., 2021). AgentShield depends on bounded adversary fractions and on sentry competence; sophisticated multi-hop traps may satisfy unanimity spuriously if all sentries err (Wang et al., 28 Nov 2025). Free2Shard leaves formal optimization of parameters such as $(object_i, epoch_{new}, OE_{new})$3, $(object_i, epoch_{new}, OE_{new})$4, epoch lengths, and block sizes as future work (Rana et al., 2020).

Open directions are correspondingly broad. The cited work points toward dynamic topology adaptation and formal guarantees under asynchronous communication in MAS (Wang et al., 28 Nov 2025); richer sensor fusion and stronger validation mechanisms in orbital-data ledgers (Graczyk et al., 2021); robust mask negotiation and Byzantine-resilient aggregation in federated learning (Li et al., 6 Aug 2025); symbolic model checking for scalable shield synthesis in RL (Pranger et al., 2 Jun 2026); automated decomposition and graph partitioning for compositional shielding in partial observability (Carr et al., 15 Sep 2025); and contract synthesis for decentralised defensibility analysis in adversarial networks (Hsain et al., 11 Jun 2026). Taken together, these directions indicate that decentralised shields are evolving from a narrow runtime-enforcement idiom into a broader research program about how distributed systems can preserve safety under incomplete trust, partial observability, and adversarial adaptation.