# Mission-Level Runtime Assurance for LLM-Assisted ISR Swarms over a Verification-Aware Fabric

arXiv: https://arxiv.org/abs/2607.23532 · HTML: https://mlsanity.com/paper/2607.23532/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 10 of its 37 references that are in the map.
- First posted on arXiv 26 Jul 2026.

## Builds on (most cited first, 10 of 10)

- [Do As I Can, Not As I Say: Grounding Language in Robotic Affordances](https://mlsanity.com/paper/2204.01691/) (2022)
- [Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection](https://mlsanity.com/paper/2302.12173/) (2023)
- [Ignore Previous Prompt: Attack Techniques For Language Models](https://mlsanity.com/paper/2211.09527/) (2022)
- [Formalizing and Benchmarking Prompt Injection Attacks and Defenses](https://mlsanity.com/paper/2310.12815/) (2023)
- [Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems](https://mlsanity.com/paper/2410.07283/) (2024)
- [SOTER: A Runtime Assurance Framework for Programming Safe Robotics Systems](https://mlsanity.com/paper/1808.07921/) (2018)
- [On Neural Network Equivalence Checking using SMT Solvers](https://mlsanity.com/paper/2203.11629/) (2022)
- [Monitoring Mobile and Spatially Distributed Cyber-Physical Systems](https://mlsanity.com/paper/1904.08847/) (2019)
- [TeSSLa: Temporal Stream-based Specification Language](https://mlsanity.com/paper/1808.10717/) (2018)
- [Counter-example guided Imitation Learning of Feedback Controllers from Temporal Logic Specifications](https://mlsanity.com/paper/2403.16593/) (2024)

## Abstract (arXiv)

Swarms of LLM-assisted autonomous robots are increasingly proposed for cooperative intelligence, surveillance, and reconnaissance (ISR) in contested environments. A growing class of their assurance failures arises not within any single platform but across the swarm: individually-compliant actions compose into a mission-level violation: a prohibited objective split across platforms to evade per-platform limits, or a collective budget quietly exceeded. Per-platform guardrails miss these by construction, and contested communications let the violation hide behind lost or delayed evidence. We present a three-tier (platform/squad/mission) compositional runtime-verification framework that decomposes a mission policy into per-agent and cross-agent aspects, aggregates per-platform verdicts over a verification-aware messaging fabric, and fuses them with an evidence-aware, two-axis (security x completeness) algebra whose provenance names the platforms that jointly triggered a violation. Because the fabric makes evidence loss and silence observable, unsupported negative verdicts are downgraded to an explicit unknown rather than reported as mission-wide all-clears. On a simulated ISR mission, an indirect prompt injection that causes real LLM planners to split a prohibited collection task across four platforms is invisible to every per-platform monitor yet detected compositionally with full provenance; under an injected fault campaign a best-effort central monitor emits silent false all-clears while the verification-aware fabric emits none.