Adversary-Aware Neuroevolutionary Navigation: Extending Uncertainty-Conditioned Skill Libraries to Contested ISR Under Jamming, Spoofing, and Denied Sensing

1. Introduction

Autonomous mobile robots are being adopted for intelligence, surveillance, and reconnaissance (ISR) tasks in environments too hazardous, remote, or time-critical for direct human operation. Ground and aerial platforms equipped with LiDAR, cameras, thermal imagers, and inertial sensors can map structures, monitor perimeters, and build situational awareness in areas denied to personnel. The same technical foundations that enable disaster-response robotics—reactive navigation under partial observability, onboard mapping, and autonomous exploration—underpin these ISR applications.

A defining feature separates contested ISR from disaster response, however. In a fire or a collapsed building, the environment degrades a robot’s perception passively: smoke attenuates LiDAR, rubble occludes cameras, and long corridors starve a SLAM back-end of loop closures. The degradation is severe but indifferent—it does not observe the robot and does not adapt. In a contested setting, degradation is produced strategically. An adversary may deny the Global Navigation Satellite System (GNSS) and radio communications through jamming [16,17], and may go further by injecting counterfeit signals designed to mislead—GPS spoofing that displaces the estimated position [21,22], or LiDAR spoofing that fabricates or suppresses returns [23]. Crucially, these attacks are adaptive: a reactive jammer can activate when it detects the robot’s radio-frequency (RF) emissions or its entry into a monitored area, and a spoofer can time its deception to the robot’s mission phase.

Recent learning-based navigation, including my own prior research, has made progress on robustness to environmental uncertainty. In particular, my uncertainty-conditioned MAP-Elites skill library (UC-MESL) [1] maintains a diverse archive of specialized navigation behaviors and selects among them online based on uncertainty estimates drawn from an onboard semantic SLAM back-end. This multi-regime design outperforms single-policy baselines when the operating regime shifts. But it rests on a hidden assumption: that the uncertainty estimates feeding the selector are faithful. Under a deceptive adversary, that assumption fails. A spoofer can make a region appear falsely low-uncertainty to lure the robot in, or hold the SLAM covariance artificially healthy while the true pose diverges. The signals the selector trusts become an attack surface. This is the central problem I address in this work.

I therefore extend the framework from passive to adversarial uncertainty. The multi-regime hypothesis of UC-MESL becomes, if anything, more compelling here: when an adversary actively pushes the robot between operating conditions, a library of specialists with contextual switching is a natural defense, provided the selector can reason about whether to believe its own instruments.

Contributions.

• A three-tier adversary model for ISR navigation (Section 4): a reproducible taxonomy—static jammer, reactive (behavior-triggered) jammer, and deceptive spoofer—spanning denial of service through active corruption of perception, instantiated concretely via ROS 2 and Gazebo plugins.
• A sensor-integrity (trust) layer robust to stealthy drift (Section 5.1): a cross-modal consistency estimator combining an instantaneous ${\chi }^2$ test on EKF innovation residuals with a windowed CUSUM statistic over the same residual stream. The cumulative component is essential: a bias injected slowly enough is absorbed by the filter state and leaves the instantaneous innovation within its nominal envelope, so a purely per-sample test cannot detect the very attack it is meant to catch. The layer complements resilient state-estimation techniques [27,29,31] at the behavior-selection level.
• An emissions-discipline behavior dimension (Section 5.3): a fourth axis in the quality-diversity descriptor capturing exposure/emission control, so the archive contains skills that actively manage what the adversary can observe.
• A rigorous contested-ISR evaluation protocol (Section 7): 1,500 evaluation episodes spanning 30 (method, environment, adversary) configurations, with paired non-parametric testing, Holm correction, bootstrap confidence intervals, and effect sizes, tracked via formally defined metrics—spoof susceptibility and denial-time-to-recovery—alongside a drift-rate sensitivity study that maps the detection boundary of the trust layer.

Scope. This work concerns non-lethal autonomy—reconnaissance, mapping, and situational awareness under adversarial conditions. It does not address, and is not to support, autonomous target engagement or weapons control. The defensive framing (staying operational under attack) and the robustness questions it raises are the core academic and practical contributions.

2. Related Work

2.1. Neuroevolution and Skill Libraries for Navigation

NeuroEvolution of Augmenting Topologies (NEAT) [5] evolves both the weights and the topology of neural networks, discovering compact controllers without a fixed architecture. It has proven effective for reactive navigation under uncertainty. My prior work applied NEAT to firefighting rover navigation in dynamic environments [3], extended it to multi-room scenarios with transfer learning [2], and broadened the application scope to urban search-and-rescue and industrial inspection with hybrid NEAT/RL training [4]. UC-MESL [1] combined NEAT-style mutation with quality-diversity optimization—MAP-Elites [6,7]—to produce a behavioral archive indexed by risk, uncertainty preference, and search style. The present work builds directly on my established pipeline and extends it to adversarial conditions. Related quality-diversity methods [8,9] and hierarchical / options frameworks [10,11] inform the skill-generation and skill-selection separation I inherit.

2.2. Autonomous ISR and GNSS-Denied Navigation

Robotic ISR and search-and-rescue have been studied since the early 2000s, formalized through DARPA and NIST programs [15], with classical pipelines combining SLAM [13], frontier-based exploration [14], and reactive control. GNSS-denied operation is a recurring challenge: platforms fall back on visual-inertial odometry and scan-matching when satellite signals are unavailable or unreliable. What is largely missing from this literature is an adaptive adversary in the loop—degradation that responds to the robot. My threat model makes that adversary explicit.

2.3. Jamming- and Denial-Aware Planning

A growing body of work addresses navigation under communication jamming. Wang and Gursoy formulate jamming-resilient path planning for cellular-connected UAVs against a dynamic jammer via reinforcement learning [16], and extend it to resilient data collection under adversarial attacks [17]. Hu et al. use deep RL with reconfigurable intelligent surfaces to reject jamming for UAV-borne IoT platforms [18]. Federated and multi-agent RL approaches address path planning in hostile environments with static and dynamic defenses [19] and secure autonomous swarms under jamming [20]. These works focus principally on maintaining a communication link; my contribution complements them by treating denial as one tier of a broader adversary and by adding deception of onboard perception.

2.4. Sensor Spoofing and Adversarial Perception

Systematic treatments of sensor spoofing against robotic vehicles catalog attacks on GNSS, LiDAR, cameras, and inertial sensors [21,22], and recent surveys extend this accounting to teleoperated legged platforms [32]. GPS spoofing lacks signal authentication and can be executed from tens of meters away [24]; mathematically stealthy variants have been characterized [21,25], and spoofing has been shown to degrade deep-RL-based UAV navigation specifically [26]. LiDAR spoofing can inject phantom obstacles or suppress genuine returns [23]. These results motivate my deceptive-spoofer tier and, importantly, the observation that spoofing corrupts derived quantities (uncertainty summaries, covariance) and not merely raw measurements.

2.5. Resilient State Estimation and Attack Detection

A substantial control-theoretic literature addresses secure state estimation under sensor attacks: attack-resilient fusion with bounded intervals [27], attack detection and identification in cyber-physical systems [28], secure fusion against false-data-injection attacks [29], and observability-decomposition-based resilient filtering [30]. Learning-based detectors such as QUADFormer [31] identify cyber attacks on quadrotors and reconfigure fusion to exclude compromised sensors. A recurring finding in this literature is that per-sample residual tests are blind to sufficiently slow bias injection, motivating cumulative statistics of the kind I adopt in Section 5.1. My sensor-integrity layer draws on this lineage—particularly cross-modal consistency and modality down-weighting—but operates at a different level: rather than only correcting the estimate, it exposes a trust signal to the behavior selector, so the robot can change strategy.

2.6. Adversarial Robustness of Learned Policies

Deep-learning-based autonomous systems are vulnerable to adversarial perturbations [22], and defenses remain an open area. Where much of that work hardens a single policy against perturbation, I take a complementary route: maintain a diverse archive of specialists and select among them under an explicit trust signal, so no single point of failure carries the whole mission.

3. Problem Formulation

I model contested ISR as a partially observable Markov decision process in which part of the observation channel is under adversarial control. Extending the rescue POMDP of UC-MESL [1], I define

$${\mathcal{P}}_{\mathrm{a}\mathrm{d}\mathrm{v}}=⟨\mathcal{S},\mathcal{A},\mathcal{O},T,Z_a,r,\gamma ⟩,$$

where $\mathcal{S}$ is the environment state (robot pose $x_t=\left(p_t,{\varphi }_t\right)\in SE\left(2\right)$, map geometry, targets/points-of-interest, and hazards), $\mathcal{A}\subset {\mathbb{R}}^2$ is the control command $\left(v_t,{\omega }_t\right)$, and $\mathcal{O}$ is the observation space (LiDAR, GNSS/odometry, RGB-D, thermal). The key departure is the adversary-parameterized observation likelihood

$$Z_a\left(o_t\mid s_t,a_t^{\mathrm{a}\mathrm{d}\mathrm{v}}\right), a_t^{\mathrm{a}\mathrm{d}\mathrm{v}}\sim {\pi }^{\mathrm{a}\mathrm{d}\mathrm{v}}\left(\cdot \mid {\xi }_t\right),$$

where the adversary policy ${\pi }^{\mathrm{a}\mathrm{d}\mathrm{v}}$ conditions on an adversary observation ${\xi }_t$ (e.g., a proxy of the robot’s RF emissions or coarse position) and outputs an attack action that drops, noises, or fabricates components of $o_t$. Because the uncertainty summaries and covariance that feed the robot’s selector are computed from $o_t$ through $Z_a$, they are themselves subject to adversarial influence.

3.1. Reward

I reuse the decomposed reward structure of UC-MESL and add an exposure term. At each step,

$$r_t=w_p\hspace{0.17em}{r}_t^{\mathrm{p}\mathrm{r}\mathrm{o}\mathrm{g}}+w_s\hspace{0.17em}{r}_t^{\mathrm{s}\mathrm{a}\mathrm{f}\mathrm{e}}+w_e\hspace{0.17em}{r}_t^{\mathrm{e}\mathrm{f}\mathrm{f}}+w_x\hspace{0.17em}{r}_t^{\mathrm{e}\mathrm{x}\mathrm{p}\mathrm{o}},$$

(1)

with $r_t^{\mathrm{p}\mathrm{r}\mathrm{o}\mathrm{g}}$ the information gain over unexplored cells plus a bonus for each newly confirmed point of interest, $r_t^{\mathrm{s}\mathrm{a}\mathrm{f}\mathrm{e}}=-1\left[\mathrm{collision}\right]-{\lambda }_{\mathrm{p}\mathrm{r}\mathrm{o}\mathrm{x}}\mathrm{m}\mathrm{a}\mathrm{x}\left(0,d_{\mathrm{s}\mathrm{a}\mathrm{f}\mathrm{e}}-d_t^{\mathrm{m}\mathrm{i}\mathrm{n}}\right)$ the collision and proximity penalty, $r_t^{\mathrm{e}\mathrm{f}\mathrm{f}}=-\left(c_{\mathrm{t}\mathrm{i}\mathrm{m}\mathrm{e}}+c_{\mathrm{e}\mathrm{n}\mathrm{e}\mathrm{r}\mathrm{g}\mathrm{y}}\left|v_t\right|\right)$ the time/energy cost, and $r_t^{\mathrm{e}\mathrm{x}\mathrm{p}\mathrm{o}}=-e_t$ the exposure penalty with $e_t$ the normalized emission level defined in Equation (7). Weights are $\left(w_p,w_s,w_e,w_x\right)=\left(1.00,2.00,0.05,0.30\right)$, with ${\lambda }_{\mathrm{p}\mathrm{r}\mathrm{o}\mathrm{x}}=0.40$, $d_{\mathrm{s}\mathrm{a}\mathrm{f}\mathrm{e}}=0.50\hspace{0.25em}\mathrm{m}$, $c_{\mathrm{t}\mathrm{i}\mathrm{m}\mathrm{e}}=0.01$, and $c_{\mathrm{e}\mathrm{n}\mathrm{e}\mathrm{r}\mathrm{g}\mathrm{y}}=0.02$; all are held fixed across methods and conditions. The quality score $Q\left(\pi \right)$ used by MAP-Elites is the undiscounted episode return under Equation (1). The ISR objective is subject to time and energy budgets and—newly—an exposure budget the adversary exploits.

4. Threat Model

My threat model comprises three tiers of increasing capability. Each is instantiated in simulation with documented parameters (Section 4.4) to support reproducibility. Throughout, I assume a defensive posture: the robot’s goal is to remain operational and complete its ISR task, not to counter-attack.

4.1. Tier 1: Static Jammer (Fixed-Zone Denial)

The static jammer denies GNSS and/or communications within fixed spatial zones. Upon entering a zone, the affected modalities become unavailable (GNSS position lost, map-sharing disabled); upon exit, they recover. This tier is a continuity case: it recovers the stationary communications-outage model of UC-MESL as a special case, and mirrors fixed-jammer formulations in the literature [17,20]. It attacks availability only.

4.2. Tier 2: Reactive Jammer (Behavior-Triggered Denial)

The reactive jammer activates as a function of the robot’s behavior: when the robot’s RF emissions exceed a threshold, or when it enters a monitored region, denial is triggered for an activation window with hysteresis. The essential difference from Tier 1 is that degradation now correlates with the robot’s own actions. A robot that emits freely or moves through monitored corridors invites denial; a robot that practices emission discipline can avoid it.

4.3. Tier 3: Deceptive Spoofer (Corrupted Perception)

The deceptive spoofer is the primary focus of this paper. Rather than denying signals, it injects false ones designed to mislead. I model three deception strategies grounded in demonstrated attacks:

Figure 1. Three-tier contested-ISR adversary model. Capability increases from fixed denial (Tier 1), to behavior-coupled denial (Tier 2), to active corruption of perception (Tier 3). Tiers 1 and 2 attack availability; Tier 3 attacks integrity, corrupting the estimates a behavior selector depends on.

Figure 1. Three-tier contested-ISR adversary model. Capability increases from fixed denial (Tier 1), to behavior-coupled denial (Tier 2), to active corruption of perception (Tier 3). Tiers 1 and 2 attack availability; Tier 3 attacks integrity, corrupting the estimates a behavior selector depends on.

• GNSS position offset. A gradual or step displacement of the estimated position, as in turn-by-turn manipulation, overshoot, and wrong-turn attacks [21,24]. Stealthy variants keep the injected error below naive detection thresholds [25]; the default configuration used here is a gradual drift specifically chosen to defeat per-sample residual tests (Section 7.11).
• Ghost / suppressed LiDAR returns. Fabricated returns that create phantom obstacles or open corridors, or suppression of genuine returns, following demonstrated LiDAR spoofing [23].
• False target/frontier signatures. Fabricated detections that lure the robot toward a decoy point of interest or a monitored zone, wasting mission time or drawing it into denial.

4.4. Adversary Realism and Reproducibility

While prior works often treat adversarial noise purely mathematically, I instantiate these threats concretely via ROS 2 manipulation to ensure physical plausibility. The configuration used to generate the results is given in Table 1.

5. Method: A-UC-MESL

A-UC-MESL introduces two main additions to my prior UC-MESL framework, leaving its offline quality-diversity discovery and online hierarchical switching structure intact (Figure 2). First, a sensor-integrity layer estimates a per-modality trust vector and feeds it into the mission state, so the selector can condition on instrument credibility. Second, an emissions-discipline axis is added to the behavior descriptor.

5.1. Sensor-Integrity (Trust) Layer

The trust layer computes a per-modality trust score ${\tau }_t^{\left(m\right)}\in \left[0,1\right]$ from cross-modal consistency. The underlying intuition is redundancy: independent modalities that disagree about the same physical quantity indicate that at least one is compromised.

Instantaneous component. Let ${\nu }_t^{\left(m\right)}$ be the EKF innovation for modality $m$ (the residual between the measurement and the predicted measurement) and $S_t^{\left(m\right)}$ its innovation covariance. The normalized discrepancy is the squared Mahalanobis distance

$$D_t^{\left(m\right)}={\left({\nu }_t^{\left(m\right)}\right)}^{\mathrm{\top }}{\left(S_t^{\left(m\right)}\right)}^{-1}{\nu }_t^{\left(m\right)},$$

(2)

which under nominal (attack-free) conditions is distributed as ${\chi }_{d_m}^2$ with $d_m=\mathrm{d}\mathrm{i}\mathrm{m}{\nu }^{\left(m\right)}$. Writing ${\chi }_{0.95,d_m}^2$ for the 95th-percentile threshold, the instantaneous trust score applies a sigmoid decay about that threshold,

$${\tau }_{\mathrm{i}\mathrm{n}\mathrm{s}\mathrm{t},t}^{\left(m\right)}=[1+\mathrm{e}\mathrm{x}\mathrm{p}\left(a_m\left(D_t^{\left(m\right)}-{\chi }_{0.95,d_m}^2\right)\right){]}^{-1},$$

(3)

with slope $a_m$ controlling how sharply trust collapses once the residual leaves its nominal envelope.

Cumulative component. Equation (3) alone is insufficient against the attack of primary interest. A bias injected slowly relative to the filter’s correction bandwidth is progressively absorbed into the estimated state; the innovation therefore remains inside its nominal envelope even as the true pose error grows without bound. This is precisely the regime a stealthy spoofer targets [25]. I therefore accumulate the same residual stream with a one-sided CUSUM statistic,

$$C_t^{\left(m\right)}=\mathrm{m}\mathrm{a}\mathrm{x}\left(0,\hspace{0.33em}{C}_{t-1}^{\left(m\right)}+D_t^{\left(m\right)}-d_m-b_m\right), C_0^{\left(m\right)}=0,$$

(4)

where $d_m$ is the nominal mean of $D_t^{\left(m\right)}$ and $b_m>0$ is a slack term setting the smallest persistent bias the detector is required to ignore. A sustained mean shift, however small per sample, drives $C_t^{\left(m\right)}$ upward at a rate proportional to the shift, giving a cumulative trust term

$${\tau }_{\mathrm{c}\mathrm{u}\mathrm{s}\mathrm{u}\mathrm{m},t}^{\left(m\right)}=[1+\mathrm{e}\mathrm{x}\mathrm{p}\left(a_m^c\left(C_t^{\left(m\right)}-h_m\right)\right){]}^{-1},$$

(5)

with decision threshold $h_m$ chosen to hold the nominal false-alarm rate at ${\alpha }_{\mathrm{F}\mathrm{A}}$ (calibrated on attack-free runs, Section 7.1). The reported trust is the conservative combination

$${\tau }_t^{\left(m\right)}=\mathrm{m}\mathrm{i}\mathrm{n}\left({\tau }_{\mathrm{i}\mathrm{n}\mathrm{s}\mathrm{t},t}^{\left(m\right)},\hspace{0.33em}{\tau }_{\mathrm{c}\mathrm{u}\mathrm{s}\mathrm{u}\mathrm{m},t}^{\left(m\right)}\right).$$

(6)

The statistic resets ($C_t^{\left(m\right)}\leftarrow 0$) whenever modality $m$ is re-verified against a trusted modality. Parameter values are listed in Table 2.

The trust vector ${\mathsf{\tau }}_t={\left[{\tau }_t^{\left(m\right)}\right]}_m\in {\left[0,1\right]}^M$ is used in two ways: (i) low-trust modalities are down-weighted in the state estimate (as in reconfigurable fusion [31]), and (ii) ${\mathsf{\tau }}_t$ is exposed to the selector so behavior can change when trust collapses.

5.2. Adversary-Aware Mission State

The UC-MESL mission state $g_t$ (local/global occupancy entropy, SLAM pose-uncertainty trace, hazard intensity, target-likelihood, battery, comms status) is augmented with trust and exposure features:

$$g_t^{\mathrm{a}\mathrm{d}\mathrm{v}}=\left[\hspace{0.17em}{g}_t\hspace{0.17em}\parallel \hspace{0.17em}{\mathsf{\tau }}_t\hspace{0.17em}\parallel \hspace{0.17em}{e}_t\hspace{0.17em}\parallel \hspace{0.17em}{\widehat{d}}_t\hspace{0.17em}\right],$$

where $e_t\in \left[0,1\right]$ is the robot’s current emission/exposure level and ${\widehat{d}}_t\in \left[0,1\right]$ is an estimated local denial-likelihood. The conceptual shift is that the selector now conditions on “do I believe my instruments” (${\mathsf{\tau }}_t$) and “am I likely being observed / denied” ($e_t$, ${\widehat{d}}_t$) alongside “how uncertain am I” ($g_t$).

5.3. Emissions, Exposure, and the Behavior Archive

UC-MESL indexes its MAP-Elites archive by a three-dimensional descriptor—risk exposure $\rho$, uncertainty preference $\eta$, and search style (tortuosity) $\kappa$. I add a fourth axis, emissions discipline $\epsilon \left(\pi \right)$.

I model RF exposure based on active telemetry and map-sharing transmissions. Exposure $e_t\in \left[0,1\right]$ is the normalized moving-average integral of transmission power over a sliding window $W=10\hspace{0.25em}\mathrm{s}$:

$$e_t={\displaystyle \frac{1}{P_{\mathrm{m}\mathrm{a}\mathrm{x}}W}}{\int }_{t-W}^t{P}_{\mathrm{t}\mathrm{x}}\left(s\right)\hspace{0.17em}ds.$$

(7)

The reactive jammer triggers when $e_t$ crosses $e_{\mathrm{t}\mathrm{r}\mathrm{i}\mathrm{g}}$ (Table 1). The emissions-discipline descriptor $\epsilon \left(\pi \right)$ is the episode mean of $e_t$, driving the QD algorithm to discover “quiet” navigation strategies. Under the reactive jammer (Tier 2), the selector can dispatch low-$\epsilon$ skills to deny the adversary triggering information—an option that simply does not exist without this axis. Archive discretization is given in Table 3.

For comparison, the three-axis UC-MESL archive under the same budget fills 147 of 180 cells (81.7%); the lower coverage of the four-axis grid reflects the added $\epsilon$ dimension rather than a regression in search, and 38% of the newly reachable cells lie in the two lowest $\epsilon$ bins that the three-axis descriptor cannot express.

5.4. Selector Under a Compromised State

Both selector variants of UC-MESL are extended to consume $g_t^{\mathrm{a}\mathrm{d}\mathrm{v}}$.

Rule-guided selector. New priority rules sit above my existing ISR rules: (R0-integrity) if trust in localization drops below ${\tau }_{\mathrm{l}\mathrm{o}}$, prefer skills that rely on trusted modalities and reduce exposure; (R-denial) if ${\widehat{d}}_t$ is high, dispatch low-$\epsilon$ conservative skills.

Learned selector. The learned selector (a small PPO-trained policy [12] over discrete skill indices) takes $g_t^{\mathrm{a}\mathrm{d}\mathrm{v}}$ as input. Action masking removes skills the safety/integrity layer would immediately override. Dwell hysteresis (${\tau }_{\mathrm{d}\mathrm{w}\mathrm{e}\mathrm{l}\mathrm{l}}=4.0\hspace{0.25em}\mathrm{s}$) prevents rapid oscillation.

5.5. Safety and Integrity Override

UC-MESL’s hardware-independent safety layer is extended with an integrity override: if trust in localization falls below ${\tau }_{\mathrm{l}\mathrm{o}}$, cap speed at $0.35\hspace{0.25em}\mathrm{m}\hspace{0.17em}{\mathrm{s}}^{-1}$ and suppress target-approach commitment until the estimate is re-verified against trusted modalities. This is my deception analogue of the physical-safety override.

6. Algorithms

Algorithm 1 A-UC-MESL Offline Skill Discovery (QD + NEAT, adversary-augmented)

Require: 4-D descriptor grid $\mathcal{G}$; adversary curriculum $\left\{{\pi }^{\mathrm{a}\mathrm{d}\mathrm{v}}\right\}$; iterations $N$; quality weights $\mathbf{w}$; population $N_p$; episodes $E$

Ensure: Archive $\mathcal{A}$ mapping cells → elite skills

1: $\mathcal{A}\leftarrow \mathcal{\varnothing }$; population ← $N_p$ minimal NEAT genomes

2: for $n=1$ to $N$ do

3:   Select parents (uniform until archive seeded, then from filled cells)

4:   Generate $N_p$ offspring via NEAT variation (weight / add-node / add-conn / crossover)

5:   for each offspring ${\pi }^{\left(j\right)}$ (parallel) do

6:     Sample adversary tier/config from the curriculum

7:     Evaluate ${\pi }^{\left(j\right)}$ over $E$ randomized episodes under that adversary

8:     $\mathbf{b}\left({\pi }^{\left(j\right)}\right)\leftarrow \left[\rho ,\eta ,\kappa ,\epsilon \right]$; $Q\left({\pi }^{\left(j\right)}\right)\leftarrow$ return of Eq. (1)

9:     $c\leftarrow \mathrm{c}\mathrm{e}\mathrm{l}\mathrm{l}\left(\mathbf{b}\left({\pi }^{\left(j\right)}\right),\mathcal{G}\right)$

10:    if $\mathcal{A}\left[c\right]=\mathrm{\varnothing }$ or $Q\left({\pi }^{\left(j\right)}\right)>Q\left(\mathcal{A}\left[c\right]\right)$ then $\mathcal{A}\left[c\right]\leftarrow {\pi }^{\left(j\right)}$

11:    end if

12:  end for

13: end for

14: return $\mathcal{A}$

Algorithm 2 A-UC-MESL Runtime Control (Online Switching Under Adversary)

Require: Archive $\mathcal{A}$; semantic SLAM; integrity layer $f_{\mathrm{t}\mathrm{r}\mathrm{u}\mathrm{s}\mathrm{t}}$; selector $\mu$; safety+integrity layer $\mathcal{L}$; dwell ${\tau }_{\mathrm{d}\mathrm{w}\mathrm{e}\mathrm{l}\mathrm{l}}$

1: Initialize SLAM, map, clock $t\leftarrow 0$; default skill $k_0$; $t_{\mathrm{s}\mathrm{w}\mathrm{i}\mathrm{t}\mathrm{c}\mathrm{h}}\leftarrow 0$; $C_0^{\left(m\right)}\leftarrow 0\hspace{0.25em}\forall m$

2: for $t=1$ to $T_{\mathrm{m}\mathrm{a}\mathrm{x}}$ do

3:   Receive (possibly adversarial) observation $o_t$ from $Z_a$

4:  Update SLAM/EKF; compute innovations ${\nu }_t^{\left(m\right)}$ and uncertainty summaries

5:   $D_t^{\left(m\right)}\leftarrow$ Eq. (2); $C_t^{\left(m\right)}\leftarrow$ Eq. (4)

6:   ${\mathsf{\tau }}_t\leftarrow f_{\mathrm{t}\mathrm{r}\mathrm{u}\mathrm{s}\mathrm{t}}\left({\mathbf{D}}_t,{\mathbf{C}}_t\right)$ via Eq. (6); down-weight low-trust modalities

7:   Update exposure $e_t$ (Eq. (7)), denial estimate ${\widehat{d}}_t$

8:   $g_t^{\mathrm{a}\mathrm{d}\mathrm{v}}\leftarrow \left[\hspace{0.17em}{g}_t\hspace{0.17em}\parallel \hspace{0.17em}{\mathsf{\tau }}_t\hspace{0.17em}\parallel \hspace{0.17em}{e}_t\hspace{0.17em}\parallel \hspace{0.17em}{\widehat{d}}_t\hspace{0.17em}\right]$

9:   if $\left(t-t_{\mathrm{s}\mathrm{w}\mathrm{i}\mathrm{t}\mathrm{c}\mathrm{h}}\right)\Delta t\ge {\tau }_{\mathrm{d}\mathrm{w}\mathrm{e}\mathrm{l}\mathrm{l}}$ or integrity/safety rule triggered then

10:    $k_t\sim \mu \left(k\mid g_t^{\mathrm{a}\mathrm{d}\mathrm{v}}\right)$; if $k_t\ne k_{t-1}$ then $t_{\mathrm{s}\mathrm{w}\mathrm{i}\mathrm{t}\mathrm{c}\mathrm{h}}\leftarrow t$

11:  else $k_t\leftarrow k_{t-1}$

12:  end if

13:  ${\tilde{a}}_t\sim {\pi }_{k_t}\left(a\mid o_t\right)$; $a_t\leftarrow \mathcal{L}\left({\tilde{a}}_t,o_t,{\mathsf{\tau }}_t\right)$ ▷ safety + integrity

14:  Execute $a_t$; update resources

15: end for

Figure 3. Archive illumination. Because the descriptor is four-dimensional, each panel marginalizes over the two remaining axes; the $\epsilon$ marginal shows that the adversary-augmented curriculum populates the low-emission region that UC-MESL’s three-axis archive cannot represent.

Figure 3. Archive illumination. Because the descriptor is four-dimensional, each panel marginalizes over the two remaining axes; the $\epsilon$ marginal shows that the adversary-augmented curriculum populates the low-emission region that UC-MESL’s three-axis archive cannot represent.

7. Experimental Design and Results

7.1. Simulation Architecture and Hardware

Experiments were conducted using the simulated Project AFAR (Autonomous Firefighting AI Rover) platform, extending its firefighting autonomy capabilities to contested ISR scenarios. The software stack uses ROS 2 Humble and Gazebo Fortress, running on a workstation with an AMD Ryzen 9 7950X, 64 GB DDR5 RAM, and an NVIDIA RTX 4090. The physics update rate was fixed at 1,000 Hz and the control loop runs at 20 Hz; determinism is obtained by fixing the random seed of every stochastic node and running the simulator in lockstep with the control loop rather than by the update rate itself.

Detector thresholds ($h_m$, ${\alpha }_{\mathrm{F}\mathrm{A}}$) were calibrated on 40 held-out attack-free runs generated with seeds disjoint from the evaluation seeds, so that no evaluation episode informs the detector configuration. The calibrated configuration yields 0.9 false trust collapses per attack-free episode-hour.

7.2. Evaluation Design and Episode Accounting

Every reported cell is a (method, environment family, adversary condition) configuration evaluated for 50 episodes: 5 fixed random seeds (42, 101, 2024, 888, 1337) × 10 randomized episodes per seed. Each seed generates a distinct family of environment instantiations (obstacle layout, target placement, adversary siting); all methods are evaluated on the identical instantiation for a given (seed, episode index), which makes cross-method comparison paired. Each episode has a budget of 600 s and contains 4 genuine points of interest. The full study comprises 30 such configurations and therefore 1,500 evaluation episodes, decomposed in Table 4.

Block B reuses the Tier 3 rubble configurations from Block A rather than re-running them; Block C reuses the full A-UC-MESL configuration from Block A as its reference row; Block D reuses the default drift rate from Block A.

7.3. Metrics

• Targets confirmed (↑): number of genuine points of interest positively identified within the confirmation tolerance (1.5 m) before the mission budget expires; the maximum attainable score is 4.
• Spoof susceptibility (↓): the fraction of injected deception events that induce a mission-relevant erroneous commitment, i.e. $S=N_{\mathrm{e}\mathrm{r}\mathrm{r}}/N_{\mathrm{i}\mathrm{n}\mathrm{j}}$, where an erroneous commitment is an approach to a decoy target, entry into a denial zone attributable to a fabricated frontier, or a localization error exceeding 3.0 m sustained for more than 5.0 s.
• Denial-time-to-recovery (DTTR) (↓): median wall-clock time from denial onset to restoration of nominal navigation performance, defined as progress rate returning to within 90% of the pre-denial running mean.
• Collisions (↓): mean count per episode.
• Normalized performance drop $\Delta =\left({\mathrm{s}\mathrm{c}\mathrm{o}\mathrm{r}\mathrm{e}}_{\mathrm{c}\mathrm{l}\mathrm{e}\mathrm{a}\mathrm{n}}-{\mathrm{s}\mathrm{c}\mathrm{o}\mathrm{r}\mathrm{e}}_{\mathrm{a}\mathrm{d}\mathrm{v}}\right)/\left({\mathrm{s}\mathrm{c}\mathrm{o}\mathrm{r}\mathrm{e}}_{\mathrm{c}\mathrm{l}\mathrm{e}\mathrm{a}\mathrm{n}}+ϵ\right)$ on targets confirmed, with $ϵ={10}^{-6}$; lower is more robust.

7.4. Statistical Protocol

Comparisons between methods are paired at the (seed, episode index) level, giving $n=50$ matched pairs per cell, and evaluated with the two-sided Wilcoxon signed-rank test. Because a single test is run per (metric, environment, adversary) family, $p$-values are corrected across the comparisons within each table using the Holm–Bonferroni procedure; corrected values are reported. Effect sizes are reported as the matched-pairs rank-biserial correlation $r_{\mathrm{r}\mathrm{b}}$. Confidence intervals are bias-corrected and accelerated (BCa) bootstrap intervals over episodes with 10,000 resamples. Because episodes within a seed share a layout generator, I additionally fit a linear mixed model with method as a fixed effect and seed as a random intercept as a robustness check; between-seed variance accounts for 7.4% of total variance in targets confirmed, and the sign and significance of every headline comparison are unchanged. Full test statistics are given in Table 5.

The learned selector’s advantage over the rule-guided selector is real but modest; the large effects are against single-policy and adversary-unaware alternatives.

7.5. Adversary Implementation in ROS 2

The adversary models were not mathematically abstracted in the state space, but implemented directly via ROS 2 node interception to validate true systems engineering resilience:

• GPS Spoofing: A custom wrapper around the gazebo_ros_gps plugin injects a time-varying bias function directly into the nav_msgs/Odometry topic, initiating a slow-drift attack (default 0.5 m/s) chosen to evade per-sample step-change detection.
• LiDAR Spoofing: A custom node subscribes to the genuine sensor_msgs/LaserScan from the Gazebo ray sensor. To simulate ghost points, random arrays of indices within the ranges array are artificially shortened to 1.5 m. To simulate suppression, specific angular bounds are overwritten to range_max.

7.6. Baselines and Hyperparameters

Offline training of the PPO baseline used 2 million timesteps (≈ 14 hours wall-clock), learning rate $3\times {10}^{-4}$, batch size 2048. NEAT skill generation ran with population 150 for 500 generations (≈ 36 hours). Baselines are:

• Single-policy NEAT [3,5]: one policy, no diversity.
• PPO (End-to-End) [12]: deep-RL baseline.
• UC-MESL (adversary-unaware) [1]: ablates the trust layer and $\epsilon$ axis.

• UC-MESL (rule) and A-UC-MESL (learned): proposed methods.

All five methods are evaluated in every environment family and adversary condition.

7.7. Main Results

Table 6 reports results under the deceptive spoofer (Tier 3), the condition under which spoof susceptibility is defined. A-UC-MESL (learned) outperforms every alternative on target confirmation and spoof susceptibility (Table 5). By detecting compromised estimates via the trust layer, the selector prevents the rover from committing to false targets injected by the spoofer.

7.8. Robustness Across Adversary Tiers

Table 7 reports the clean-condition reference scores and the normalized performance drop $\Delta$ on target confirmation (Section 7.3). In the absence of an adversary all five methods are within 0.18 targets of one another, and the adversary-unaware baselines are in fact marginally ahead—the archive’s adversarial curriculum costs a little nominal throughput. That ordering inverts as soon as the adversary acquires capability: all methods handle the static jammer comparably, but under the reactive and then the deceptive adversary the single-policy and adversary-unaware baselines degrade three to four times as fast as A-UC-MESL.

The deceptive-spoof row is consistent by construction with the rubble block of Table 6: e.g. UC-MESL, $\left(2.72-1.65\right)/2.72=0.39$.

7.9. Denial-Time-to-Recovery Under the Reactive Jammer

Table 8 reports DTTR under Tier 2, the condition the metric is defined for. The emissions-discipline axis matters here in a way it does not under Tier 1: because denial is triggered by the robot’s own emissions, a low-$\epsilon$ skill both shortens each denial window and reduces the number of windows entered. The floor on DTTR is set by the jammer’s activation window ($T_{\mathrm{o}\mathrm{n}}=45\hspace{0.25em}\mathrm{s}$), so the achievable range is narrow; the larger effect is on how often the robot is denied at all.

Methods without the $\epsilon$ axis have no mechanism to hold mean emission below the trigger threshold $e_{\mathrm{t}\mathrm{r}\mathrm{i}\mathrm{g}}=0.55$, and are consequently denied roughly twice as often.

7.10. Ablations

Table 9 isolates each component on the rubble family under the deceptive spoofer. Two results stand out. Removing the trust layer entirely causes a catastrophic regression in spoof susceptibility, as the selector blindly trusts manipulated covariances. More informative is the intermediate variant: retaining the instantaneous ${\chi }^2$ test but removing the CUSUM accumulator recovers only about a third of the gap, because the default $0.5\hspace{0.25em}\mathrm{m}\hspace{0.17em}{\mathrm{s}}^{-1}$ drift sits well below the per-sample test’s detection floor (Section 7.11). The cumulative statistic, not cross-modal consistency alone, is doing most of the work against this adversary.

7.11. Drift-Rate Sensitivity of the Trust Layer

The stealthiness of a GNSS spoof is governed by its drift rate: slower injection is harder to detect but takes longer to displace the robot. Figure 4 sweeps the drift rate and reports detection rate and time-to-detection for the full trust layer and for the instantaneous-${\chi }^2$ ablation; Table 10 summarizes the three swept rates.

Time-to-detect is reported only where the detection rate exceeds 0.5.

The instantaneous test loses detection power below approximately $1.2\hspace{0.25em}\mathrm{m}\hspace{0.17em}{\mathrm{s}}^{-1}$, where the injected bias is absorbed into the filter state; the CUSUM component extends usable detection down to $0.03\hspace{0.25em}\mathrm{m}\hspace{0.17em}{\mathrm{s}}^{-1}$ at a cost of 14 s of additional latency at the default rate. This sensitivity study delimits the operating envelope of the defense and identifies the drift regime an adversary would have to accept to remain undetected—at which point accumulating the 3.0 m position error that constitutes a mission-relevant failure requires 100 s, or 17% of the episode budget, and reaching the 8 m maximum offset is no longer possible within a single episode. The defense therefore converts detection into rate-limiting rather than eliminating the attack.

7.12. Skill-Usage and Trust Analysis

Figure 5 shows a representative episode timeline. When a spoofing episode begins and GNSS trust collapses, the selector shifts to low-$\epsilon$, trusted-modality skills and suppresses target-approach until trust recovers. Across the Tier 3 rubble episodes, the selector spends 34% of post-detection time in the two lowest-$\epsilon$ archive bins, against 6% before detection, and the mean number of skill switches per episode rises from 4.1 to 7.6.

7.13. Runtime Cost

The trust layer adds 1.8 ms per control cycle (3.6% of the 50 ms budget at 20 Hz) and $O\left(M\right)$ memory in the number of modalities. Archive lookup and skill dispatch add a further 0.4 ms. The additions are therefore compatible with onboard deployment on the target compute platform.

8. Discussion

Why a skill library plus trust reasoning. Under an adaptive adversary, the operating regime is not merely non-stationary—it is driven by an agent that observes the robot. A single policy must fold denial-robustness, deception-robustness, and nominal efficiency into one set of weights, sacrificing peak behavior in each mode. A diverse archive holds dedicated specialists, and my trust-augmented selector composes them over time. Crucially, the trust layer breaks the circularity that a naive uncertainty-conditioned selector would suffer: without it, a spoofer that holds covariance artificially low could keep the selector in an aggressive, exposed skill precisely when caution is warranted.

The cost of robustness. Table 7 shows the trade honestly: A-UC-MESL is marginally worse than the adversary-unaware baseline when no adversary is present (2.58 vs. 2.72 targets). The archive spends capacity on skills that are only useful under attack, and the integrity override occasionally suppresses a legitimate approach. Whether that trade is worthwhile is an operational question about the expected threat environment, not a purely technical one.

Interpretability. As in UC-MESL, the descriptor axes correspond to quantities measurable at runtime, so the mapping from mission state to appropriate skill is legible. The emissions axis adds an operationally meaningful control: an operator can reason about “quiet” versus “fast” skills directly.

Limitations. (i) The 4-D archive increases compute and lowers coverage (45.8% against 81.7% for the three-axis grid under the same budget); a continuous QD variant [9] may mitigate boundary effects. (ii) The trust layer assumes at least one uncompromised modality per shared quantity; a coordinated multi-modality attack could defeat cross-modal consistency, a known limit of resilient fusion [27,29]. (iii) The CUSUM statistic buys detection of slow drift at the cost of latency, and an adversary who accepts a drift rate below $0.03\hspace{0.25em}\mathrm{m}\hspace{0.17em}{\mathrm{s}}^{-1}$ remains under the detection boundary of Section 7.11; the defense converts a detection problem into a rate-limiting one rather than eliminating it. (iv) Five seeds bound the resolution of between-seed variance estimates; the paired within-seed design mitigates but does not remove this. (v) All results are simulated, and the adversary is scripted rather than itself learned—a co-adapting adversary is the natural next step.

Ethical and scope considerations. My contribution focuses on defensive robustness: keeping a reconnaissance robot operational and honest about its own state under attack. The framework does not perform, and should not be adapted to perform, autonomous target engagement. Dual-use is inherent to autonomy research; I state the non-lethal scope explicitly and encourage downstream users to preserve it.

9. Conclusion

I presented A-UC-MESL, extending the uncertainty-conditioned MAP-Elites skill library from passive to adversarial uncertainty for contested ISR. By integrating a cross-modal sensor-integrity layer that pairs an instantaneous ${\chi }^2$ innovation test with a cumulative statistic, the framework identifies manipulated sensor streams including the slow-drift attacks that per-sample tests cannot see. The emissions-discipline descriptor further enabled behaviors that actively denied triggers to reactive jammers, roughly halving the number of denial windows entered. Future work will translate the Project AFAR codebase from Gazebo to a real-world EW test range to validate sim-to-real transfer of the trust layer, and will examine both coordinated multi-modality attacks and a co-adapting learned adversary, neither of which the current threat model covers.