Autonomy in Check: Governor-Mediated Adaptive Security at the Edge
Split-control architecture adds a deterministic governor to validate LLM and rule-based planner intents before eBPF enforcement at the edge.
Researchers propose a split-control edge security architecture in which an untrusted planner emits typed security intents that a deterministic governor checks against safety, resource, temporal-stability, and proportionality invariants. Admitted actions are bound to signed receipts and compiled into pre-installed eBPF map updates. A Raspberry Pi 5 prototype on a university 5G test network admitted, rejected, and bounded intents at microsecond cost.
- Governor mediates between untrusted planners and kernel enforcement
- Signed receipts bind admitted actions to eBPF map updates
- Prototype validated on Raspberry Pi 5 in a 5G test network
- Formalizes three threat classes at the planner-enforcement boundary
From the original article
1 min read at arxiv.orgAdaptive security at the network edge increasingly relies on automated planners, including rule-based controllers, learned policies, and LLM-assisted agents, that translate observations into enforcement actions. Once such a planner can influence live policy state, syntactic validity is not enough.
By Ijaz Ahmad · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.