SafePLUG: Modular Safety Augmentation

• SafePLUG is a design pattern offering modular, plug-and-play safety enhancements that integrate seamlessly into existing systems without requiring redesign.
• It underpins diverse applications including secondary control in attacked LTI systems, secure smart metering, privacy-preserving pairing, EV charging defenses, and multimodal traffic accident analysis.
• By leveraging techniques such as cryptographic verification, Lyapunov stability, and dynamic network slicing, SafePLUG provides scalable and resilient safety augmentations across varied domains.

SafePLUG is not a single standardized architecture. The label appears explicitly in multimodal traffic accident understanding and, in several technical syntheses, denotes plug-and-play safety or security augmentations that are added to an existing system without redesign of the primary control, communication, or application stack. Across these usages, SafePLUG refers to secondary controllers for attacked LTI cyber-physical systems, communication-assisted protection in distribution systems, privacy-preserving metering proxies, secure pairing and onboarding mechanisms, inline defenses for smart plugs and EV charging ports, server-side tool regulators for MCP-enabled agents, and pixel-level plus temporally grounded multimodal reasoning for traffic accidents (Sheng et al., 9 Aug 2025, Lin et al., 2022, Jawurek et al., 2010, Wang et al., 1 Jun 2026).

1. Scope and nomenclature

The term has a strongly contextual meaning. In "SafePLUG: Empowering Multimodal LLMs with Pixel-Level Insight and Temporal Grounding for Traffic Accident Understanding" it is the formal name of a multimodal framework (Sheng et al., 9 Aug 2025). In "Plug-and-Play Secondary Control for Safety of LTI Systems under Attacks," the source states that the term “SafePLUG” is not explicitly defined in the paper, but that the proposed secondary controller embodies a plug-and-play safety augmentation added in parallel to an already stabilizing primary controller (Lin et al., 2022). Other sources use SafePLUG as a technical mapping for a privacy component inserted between a smart meter and a supplier backend, a secure plug-and-play onboarding mechanism in power-distribution communication networks, a secure smart-plug blueprint derived from Tapo vulnerabilities, or a server-side safety plugin for MCP-enabled agents (Jawurek et al., 2010, Zhong et al., 2024, Bonaventura et al., 2024, Wang et al., 1 Jun 2026).

A common misconception is that SafePLUG denotes one research lineage. The literature instead shows several unrelated but structurally similar constructions. A plausible characterization is that SafePLUG names a design pattern: a modular, locally inserted mechanism that constrains an existing system by secure I/O selection, cryptographic binding, dynamic filtering, or formally verified invariance. This pattern is explicit in safe-set LMIs, commitment verification, dynamic network slicing, server-side tool mediation, and inline physical-signal validation (Lin et al., 2022, Jawurek et al., 2010, Zhong et al., 2024, Wang et al., 1 Jun 2026).

2. Secondary safety control for attacked LTI cyber-physical systems

In the control-theoretic usage, SafePLUG denotes a concurrent secondary controller for an LTI plant already stabilized by a primary controller but exposed to actuator and sensor attacks. The plant is

$$\dot{x}_p(t)=A_p x_p(t)+B_p u(t), \qquad y(t)=C_p x_p(t),$$

while the primary controller is unaware of attacks and operates on corrupted measurements and actuation channels. Attacks are modeled as additive signals bounded by

$a(t)^\top R_a a(t)\le 1,\qquad R_a\succ 0.$

The secondary controller uses a secure local sensor subset and secure actuation path,

$$\dot{x}_2(t)=A_2 x_2(t)+B_2 y_S(t),\qquad u_S(t)=C_2 x_2(t)+D_2 y_S(t),\qquad u=u_P+E_u u_S,$$

so that no attack signals enter the secondary loop. Safety is specified by an ellipsoidal safe set

$\mathcal S=\mathcal E(R_\zeta,\bar\zeta),$

and the objective is to construct an invariant ellipsoid $\mathcal E_P=\{\zeta\mid \zeta^\top P\zeta\le 1\}$ such that $\mathcal E_P\subseteq \mathcal S$ for all attacks satisfying the ellipsoidal budget (Lin et al., 2022).

The method combines reachability analysis, Lyapunov functions, the S-procedure, and convex synthesis. For primary-only assessment, Proposition 1 and Theorem 1 give sufficient conditions under which an ellipsoid $\mathcal E_Q$ is forward invariant and contained in the projected safe set; resilience can then be assessed by minimizing $\mathrm{Tr}[R_a]$, which is used as a convex proxy for the attack ellipsoid volume. For secondary synthesis, Theorem 2 assumes Assumption 1 and $n_1=n_2$, introduces a Scherer-type change of variables, and produces LMIs in decision variables $\eta=(X,Y,\mathbf A,\mathbf B,\mathbf C,\mathbf D)$. Feasibility of

$a(t)^\top R_a a(t)\le 1,\qquad R_a\succ 0.$0

guarantees forward invariance and safe-set inclusion; optimization can minimize either $a(t)^\top R_a a(t)\le 1,\qquad R_a\succ 0.$1 or $a(t)^\top R_a a(t)\le 1,\qquad R_a\succ 0.$2 (Lin et al., 2022).

The numerical study fixes $a(t)^\top R_a a(t)\le 1,\qquad R_a\succ 0.$3, $a(t)^\top R_a a(t)\le 1,\qquad R_a\succ 0.$4, $a(t)^\top R_a a(t)\le 1,\qquad R_a\succ 0.$5, and $a(t)^\top R_a a(t)\le 1,\qquad R_a\succ 0.$6. Under those parameters, the primary alone yields an invariant set only if the inclusion constraint is dropped, so safety cannot be guaranteed. With the secondary controller synthesized from the LMIs, the invariant ellipsoid is strictly inside the safe set, and safety is guaranteed under attacks satisfying $a(t)^\top R_a a(t)\le 1,\qquad R_a\succ 0.$7. An alternative objective minimizing $a(t)^\top R_a a(t)\le 1,\qquad R_a\succ 0.$8 produces a much smaller invariant set but also extreme controller gains, which indicates a robustness–implementability trade-off not resolved by the LMI feasibility conditions themselves (Lin et al., 2022).

3. Protection and communication infrastructure in power distribution

In meshed distribution protection, SafePLUG-style logic appears as plug-and-play, communication-assisted multifunctional relays whose settings are intended to remain independent of network topology, DG state, and grid-connected versus islanded operation. Directional determination is performed via a distance element used only as a directional comparator, with forward defined by $a(t)^\top R_a a(t)\le 1,\qquad R_a\succ 0.$9 and reverse by $$\dot{x}_2(t)=A_2 x_2(t)+B_2 y_S(t),\qquad u_S(t)=C_2 x_2(t)+D_2 y_S(t),\qquad u=u_P+E_u u_S,$$0. Starting elements use superimposed residual current $$\dot{x}_2(t)=A_2 x_2(t)+B_2 y_S(t),\qquad u_S(t)=C_2 x_2(t)+D_2 y_S(t),\qquad u=u_P+E_u u_S,$$1 with default threshold $$\dot{x}_2(t)=A_2 x_2(t)+B_2 y_S(t),\qquad u_S(t)=C_2 x_2(t)+D_2 y_S(t),\qquad u=u_P+E_u u_S,$$2 for ground faults, current unbalance $$\dot{x}_2(t)=A_2 x_2(t)+B_2 y_S(t),\qquad u_S(t)=C_2 x_2(t)+D_2 y_S(t),\qquad u=u_P+E_u u_S,$$3 with default threshold $$\dot{x}_2(t)=A_2 x_2(t)+B_2 y_S(t),\qquad u_S(t)=C_2 x_2(t)+D_2 y_S(t),\qquad u=u_P+E_u u_S,$$4 for two-phase faults, and $$\dot{x}_2(t)=A_2 x_2(t)+B_2 y_S(t),\qquad u_S(t)=C_2 x_2(t)+D_2 y_S(t),\qquad u=u_P+E_u u_S,$$5 thresholds on all three superimposed phase currents for three-phase faults. The architecture also includes reverse-fault block logic, peer-to-peer blocking and inter-trip messaging, CTI $$\dot{x}_2(t)=A_2 x_2(t)+B_2 y_S(t),\qquad u_S(t)=C_2 x_2(t)+D_2 y_S(t),\qquad u=u_P+E_u u_S,$$6, and breaker-failure timer $$\dot{x}_2(t)=A_2 x_2(t)+B_2 y_S(t),\qquad u_S(t)=C_2 x_2(t)+D_2 y_S(t),\qquad u=u_P+E_u u_S,$$7 (Tsimtsios et al., 2018).

The distinctive claim of that protection scheme is not merely sensitivity but coordination without a coordination study. Main line relays and lateral protection are coordinated by dynamically mapping measured $$\dot{x}_2(t)=A_2 x_2(t)+B_2 y_S(t),\qquad u_S(t)=C_2 x_2(t)+D_2 y_S(t),\qquad u=u_P+E_u u_S,$$8 through uploaded lateral TOC curves $$\dot{x}_2(t)=A_2 x_2(t)+B_2 y_S(t),\qquad u_S(t)=C_2 x_2(t)+D_2 y_S(t),\qquad u=u_P+E_u u_S,$$9, so the backup trip delay becomes $\mathcal S=\mathcal E(R_\zeta,\bar\zeta),$0. The relays send blocking immediately upon probable fault detection and cancel it only after one cycle, so fiber latency is negligible relative to the $\mathcal S=\mathcal E(R_\zeta,\bar\zeta),$1 processing cycle. In the reported 20 kV meshed test system, correct phase selection and direction were obtained in all tested cases across $\mathcal S=\mathcal E(R_\zeta,\bar\zeta),$2PH, $\mathcal S=\mathcal E(R_\zeta,\bar\zeta),$3PH, $\mathcal S=\mathcal E(R_\zeta,\bar\zeta),$4PHG, and SLG faults, under both GC and ISL operation; the scheme also handled loop loss, DG relocation, mass DG loss, and fully IIDG islanding without settings changes (Tsimtsios et al., 2018).

A different power-distribution usage concerns communication networks rather than protection relays. There, SafePLUG corresponds to secure plug-and-play support for terminal devices through an authentication-slice-based network slicing scheme. Unauthenticated devices are confined to an authentication slice spanning “as many ports as possible”; only devices with successful cryptographic authentication via encryption chips can be admitted to service slices. In the MILP formulation, service-slice admission is gated by

$\mathcal S=\mathcal E(R_\zeta,\bar\zeta),$5

while security-aware routing is enforced by

$\mathcal S=\mathcal E(R_\zeta,\bar\zeta),$6

The optimization first maximizes connectivity through the authentication slice and then maximizes weighted service value under authentication results (Zhong et al., 2024).

That network formulation treats plug-and-play as zero-touch onboarding under strict containment. Dynamic slice ranges are adjusted when authentication succeeds or fails, and periodic polling can retract a device from all service slices if re-authentication fails. In a 60-node simulation, the MILP slicing problem was solved in $\mathcal S=\mathcal E(R_\zeta,\bar\zeta),$7 seconds with YALMIP and Gurobi, and authentication polling required only $\mathcal S=\mathcal E(R_\zeta,\bar\zeta),$8 kbps per node. The reported effects include favorable resource utilization, recovery from communication interruption, terminal device plug-and-play support, load balancing, improved robustness, and confinement of illegitimate devices to the authentication slice (Zhong et al., 2024).

4. Privacy-preserving metering and peripheral-free pairing

In smart metering, SafePLUG denotes an in-line privacy component placed between a household smart meter and the supplier backend. The smart meter commits to each interval consumption value $\mathcal S=\mathcal E(R_\zeta,\bar\zeta),$9 using Pedersen commitments

$\mathcal E_P=\{\zeta\mid \zeta^\top P\zeta\le 1\}$0

signs the interval indices and commitment vector, and transmits plaintext usage only toward the plug-in. The plug-in then computes the billed total

$\mathcal E_P=\{\zeta\mid \zeta^\top P\zeta\le 1\}$1

and the backend verifies

$\mathcal E_P=\{\zeta\mid \zeta^\top P\zeta\le 1\}$2

The supplier thus learns only the total billed amount rather than the fine-grained load profile, while authenticity is provided by the smart meter’s signature over the commitments and indices (Jawurek et al., 2010).

This metering construction is explicitly designed to preserve existing infrastructure. It requires no hardware changes to the smart meter and only small software changes to the smart meter and backend. The paper reports a Java prototype on an Intel Core i5 M540 at $\mathcal E_P=\{\zeta\mid \zeta^\top P\zeta\le 1\}$3 GHz, with most computation performed at the backend and the plug-in, and states that one backend system can handle about $\mathcal E_P=\{\zeta\mid \zeta^\top P\zeta\le 1\}$4 protocol instances per day on that hardware if verification is buffered over the day (Jawurek et al., 2010).

A distinct pairing-oriented SafePLUG-style design is SwitchPairing, which derives authentication material from user-controlled power switching rather than from peripheral I/O. Pairing devices share a power source, the user presses and releases the switch several times, and the devices reconstruct a timing sequence $\mathcal E_P=\{\zeta\mid \zeta^\top P\zeta\le 1\}$5 through periodic persistence to non-volatile memory. The prototype uses TI CC2640R2F boards, heartbeat period $\mathcal E_P=\{\zeta\mid \zeta^\top P\zeta\le 1\}$6, and delay tolerance $\mathcal E_P=\{\zeta\mid \zeta^\top P\zeta\le 1\}$7. The sequence is bound into commitments and ECDH-derived keys, and the paper reports $\mathcal E_P=\{\zeta\mid \zeta^\top P\zeta\le 1\}$8 success over $\mathcal E_P=\{\zeta\mid \zeta^\top P\zeta\le 1\}$9 trials for $\mathcal E_P\subseteq \mathcal S$0 presses at $\mathcal E_P\subseteq \mathcal S$1. For the same parameter regime, it estimates adversarial success probability $\mathcal E_P\subseteq \mathcal S$2, compared with $\mathcal E_P\subseteq \mathcal S$3 for BLE Passkey Entry (Shao et al., 2020).

These two lines of work make a useful distinction. The metering plug-in is an untrusted intermediary whose correctness is externally verifiable through commitments, whereas the pairing mechanism treats the physical plug and on-board clocks as the out-of-band trust anchor. This suggests two different SafePLUG interpretations: one centered on cryptographic verifiability of transformed data, the other on extraction of shared entropy from a constrained physical interaction (Jawurek et al., 2010, Shao et al., 2020).

5. Smart-plug hardening and EV charging defenses

The Tapo vulnerability study motivates a security-engineering usage of SafePLUG as a secure smart plug architecture. The paper identifies four root vulnerabilities in the affected ecosystem: no device authentication in TSKEP, a hardcoded short shared secret for discovery authentication, lack of randomness in AES-128-CBC, and no message freshness. It then presents Attack Scenario 6, in which an attacker operating a rogue Wi-Fi AP forges UDP discovery responses, completes TSKEP as a fake device, and exfiltrates the victim’s Tapo account email/password together with the local Wi-Fi SSID/password during onboarding. The study finds full exploitability on the L530E, L510E V2, and L630; partial exposure on the P100; and limited exposure on the C200 because it uses HTTPS/TLS and rejects non-HTTPS downgrades (Bonaventura et al., 2024).

The resulting SafePLUG design requirements are concrete rather than rhetorical: authenticated ECDH with device certificates, QR-bound fingerprints, HKDF-derived session keys, mTLS for LAN and cloud, AEAD such as AES-GCM or ChaCha20-Poly1305, per-device discovery/authentication keys instead of global secrets, replay protection through nonces or timestamps, secure credential transport to the device public key, signed OTA, and HTTPS/TLS-only local APIs (Bonaventura et al., 2024). A plausible implication is that “plug-and-play” in commodity IoT is only defensible when discovery, onboarding, and local control are cryptographically bound to device identity and freshness.

EV charging work extends the SafePLUG idea to inline electrical defense. One paper shows that charging protocols such as SAE J1772, CCS, IEC 61851, GB/T 20234, and NACS rely on simple analog trust anchors: fixed impedances on CC/PP-type lines and $\mathcal E_P\subseteq \mathcal S$4 PWM on the control pilot. Its proof-of-concept PORTulator uses an RP2040, AD5160 digital potentiometer, and $\mathcal E_P\subseteq \mathcal S$5 controller to spoof resistor states and CP duty cycles, and it reports vulnerability across $\mathcal E_P\subseteq \mathcal S$6 charging standards used by $\mathcal E_P\subseteq \mathcal S$7 real-world charger piles. The corresponding SafePLUG defense is an inline module with high-speed ADC sensing, buffered gating, secure element support, and non-resistive memory components in the authentication path; it superimposes challenge tones in the $\mathcal E_P\subseteq \mathcal S$8 range, verifies spectral consistency and duty-cycle stability over a validation window $\mathcal E_P\subseteq \mathcal S$9, and uses identity-coded RC or RL transfer functions to reject static spoofing (Shi et al., 19 Jun 2025).

A separate EV-charging paper analyzes ISO 15118 Plug and Charge payment and demonstrates a relay in which the attacker’s vehicle receives energy while a victim vehicle is billed. The root cause is that the Authorization signature covers only a random challenge, without binding EVSE identity, session parameters, time, or TLS channel to the signed message. The paper therefore recommends including EVSE identifier in the signed Authorization payload, using timing-based anomaly detection, encoding EVSE geo-coordinates in certificates, aborting on multiple SDP responses, and, as an alternative, replacing in-band Plug-and-Charge authorization with out-of-band OEM-backend authorization (Löw et al., 17 Dec 2025). Together with the physical-layer study, this shows that EV-side SafePLUG concepts range from analog-signal validation to protocol-layer context binding.

6. Server-side capability regulation for MCP-enabled agents

In the agent-systems literature, SafePLUG is the server-side plugin that operationalizes SafeMCP. It runs on the MCP server, intercepts both tool discovery and tool execution, and constrains state-dependent power before an agent acts. Power is formalized through a state-specific tool mapping $\mathcal E_Q$0, and the state space is partitioned into $\mathcal E_Q$1, $\mathcal E_Q$2, $\mathcal E_Q$3, and $\mathcal E_Q$4, with

$\mathcal E_Q$5

The plugin implements a two-tier defense: proactive tool filtering during tools.list, and immediate intervention during tools.call when the predicted next state is unsafe (Wang et al., 1 Jun 2026).

Its decision rule is explicitly safety-constrained: $\mathcal E_Q$6 after which the agent selects $\mathcal E_Q$7. Training proceeds in three stages: environmental dynamic grounding on ToolEmu and AgentHarm data, safe policy initialization on $\mathcal E_Q$8 oracle-augmented samples with balanced safe/critical/unsafe labels, and PPO-based RL with dual verifiable rewards. The reward design includes $\mathcal E_Q$9 and a continuous tool-filtering reward based on Smooth Tchebycheff scalarization over false negatives and false positives (Wang et al., 1 Jun 2026).

The reported evaluation is unusually explicit about the safety–utility frontier. On PowerSeeking Bench, safety rates are $\mathrm{Tr}[R_a]$0, $\mathrm{Tr}[R_a]$1, and $\mathrm{Tr}[R_a]$2 across GPT-4o-mini, Gemini-2.0-Flash, and Llama-3.1-8B. On ToolEmu, safety reaches up to $\mathrm{Tr}[R_a]$3 and Libra up to $\mathrm{Tr}[R_a]$4 with GPT-4o-mini; on GPT-4o, safety is approximately $\mathrm{Tr}[R_a]$5 and Libra approximately $\mathrm{Tr}[R_a]$6. On AgentHarm, the top Libra score is $\mathrm{Tr}[R_a]$7 with negligible benign over-blocking of approximately $\mathrm{Tr}[R_a]$8. The system also reduced total token cost on ToolEmu to $\mathrm{Tr}[R_a]$9 overhead (Wang et al., 1 Jun 2026).

This usage differs from physical or control-theoretic SafePLUG instances in substrate, but not in structure. The plugin is still a non-primary supervisory layer, uses predictive models to delimit an admissible action set, and provides a fail-safe intercept path when the primary agent policy would enter a hazardous state. That structural similarity is suggestive rather than terminologically canonical (Wang et al., 1 Jun 2026).

7. Multimodal traffic accident understanding

The explicit namesake framework SafePLUG in multimodal learning addresses the mismatch between coarse image/video-level MLLM reasoning and the fine-grained requirements of traffic accident analysis. It equips a general-purpose vision–language backbone with arbitrary-shaped visual prompts for region-aware question answering, language-guided pixel-level segmentation through a special <SEG> token and a SAM-based decoder, and lightweight temporal grounding through number prompts overlaid on video frames (Sheng et al., 9 Aug 2025).

The architecture combines a LanguageBind video encoder with number prompts, a LanguageBind image encoder for semantic scene embeddings, a SAM-based pixel encoder for dense spatial features, a visual prompt encoder inspired by SEEM, and a Vicuna-7B v1.5 LLM. Placeholder tokens such as <video>, <image>, and <region> are inserted into the textual stream; projected visual features replace those placeholders in the LLM input space. For segmentation, the hidden state of <SEG> is projected to a segmentation prompt and fused with SAM encoder features before decoding a binary mask. Training is two-stage: Stage I covers accident description, region QA, and temporal localization with frozen video and image encoders and LoRA-based LLM tuning; Stage II fine-tunes the SAM decoder and <SEG> projection layers using BCE and DICE losses weighted $n_1=n_2$0 and $n_1=n_2$1, together with text cross-entropy weighted $n_1=n_2$2 (Sheng et al., 9 Aug 2025).

The dataset is itself a central contribution: $n_1=n_2$3M frames, over $n_1=n_2$4K multimodal QA pairs, support for boxes, masks, and temporal grounding, and a test set sampled with $n_1=n_2$5 QA pairs for each of four tasks. It is built upon DoTA and MM-AU using a semi-automated pipeline involving InternVL3-78B, Qwen2.5-VL-72B, Qwen2.5-72B, SAM, and six-expert filtering of masks (Sheng et al., 9 Aug 2025).

Reported results establish SafePLUG as a fine-grained accident-understanding model rather than merely a visual grounding add-on. On region QA it reaches BLEU $n_1=n_2$6, ROUGE $n_1=n_2$7, BERTScore $n_1=n_2$8, and GPT $n_1=n_2$9. On pixel grounding it achieves AP@30 $\eta=(X,Y,\mathbf A,\mathbf B,\mathbf C,\mathbf D)$0, AP@50 $\eta=(X,Y,\mathbf A,\mathbf B,\mathbf C,\mathbf D)$1, AP@70 $\eta=(X,Y,\mathbf A,\mathbf B,\mathbf C,\mathbf D)$2, and mIoU $\eta=(X,Y,\mathbf A,\mathbf B,\mathbf C,\mathbf D)$3. On accident description it reports BLEU $\eta=(X,Y,\mathbf A,\mathbf B,\mathbf C,\mathbf D)$4, ROUGE $\eta=(X,Y,\mathbf A,\mathbf B,\mathbf C,\mathbf D)$5, BERT $\eta=(X,Y,\mathbf A,\mathbf B,\mathbf C,\mathbf D)$6, and GPT $\eta=(X,Y,\mathbf A,\mathbf B,\mathbf C,\mathbf D)$7. On temporal localization it attains AP@30 $\eta=(X,Y,\mathbf A,\mathbf B,\mathbf C,\mathbf D)$8, AP@50 $\eta=(X,Y,\mathbf A,\mathbf B,\mathbf C,\mathbf D)$9, AP@70 $a(t)^\top R_a a(t)\le 1,\qquad R_a\succ 0.$00, and mIoU $a(t)^\top R_a a(t)\le 1,\qquad R_a\succ 0.$01. Ablations show that removing number prompts degrades temporal localization from $a(t)^\top R_a a(t)\le 1,\qquad R_a\succ 0.$02 to $a(t)^\top R_a a(t)\le 1,\qquad R_a\succ 0.$03, removing visual prompts lowers region QA from $a(t)^\top R_a a(t)\le 1,\qquad R_a\succ 0.$04 to $a(t)^\top R_a a(t)\le 1,\qquad R_a\succ 0.$05, and removing the pixel decoder reduces pixel grounding mIoU from $a(t)^\top R_a a(t)\le 1,\qquad R_a\succ 0.$06 to $a(t)^\top R_a a(t)\le 1,\qquad R_a\succ 0.$07 (Sheng et al., 9 Aug 2025).

Within the broader SafePLUG vocabulary, this framework is the clearest case where the name designates a unified model rather than a mapped design pattern. Even so, it preserves the recurring semantics of the term: insertion of an auxiliary mechanism that makes an existing backbone more locally grounded, more selective, and more reliable under operationally important constraints (Sheng et al., 9 Aug 2025).