Engineering Trustworthy Agentic AI for Critical Systems

# Engineering Trustworthy Agentic AI for Critical Systems
Source: [https://arxiv.org/html/2607.18548](https://arxiv.org/html/2607.18548)
Omar Al\-Refai[https://orcid.org/0009-0002-8357-0668](https://orcid.org/0009-0002-8357-0668), Ibrahim Shahbaz[https://orcid.org/0009-0007-2520-3970](https://orcid.org/0009-0007-2520-3970), Adam Ali Husseinat[https://orcid.org/0009-0002-0426-0486](https://orcid.org/0009-0002-0426-0486), Michael Mandulak[https://orcid.org/0009-0002-6656-6237](https://orcid.org/0009-0002-6656-6237), Jaewon Kim[https://orcid.org/0000-0002-3021-729X](https://orcid.org/0000-0002-3021-729X), Eman Hammad[https://orcid.org/0000-0001-6069-1550](https://orcid.org/0000-0001-6069-1550)Corresponding authors: Omar Al\-Refai \(e\-mail: omaralrefai@tamu\.edu\) and Eman Hammad \(e\-mail: eman\.hammad@tamu\.edu\)\.O\. Al\-Refai, I\. Shahbaz, A\. Ali Husseinat, and E\. Hammad are with the Innovations in Systems Trust and Resilience \(iSTAR\) Laboratory, Texas A&M University, TX, USA\. E\.Hammad and M\. Mandulak are with the Texas A&M Institute of Data Science \- Security, Privacy and Resilience for Trusted AI \(SPARTA\) Thematic Lab\., Texas A&M University, TX, USA\. J\. Kim is with the Texas A&M Global Cyber Research Institute \(GCRI\), Texas A&M University, TX, USA\.

###### Abstract

Agentic artificial intelligence systems, capable of autonomous perception, planning, tool use, and multi\-step action, are increasingly proposed for critical engineering domains where decisions carry physical, operational, or economic consequences\. This survey addresses a gap in current literature by treating trustworthiness, whether agentic behavior can be verified, audited, and trusted under the constraints that engineering practice actually requires, as a first\-class engineering property, rather than evaluating agentic AI by task capability alone\. The study adopts a trustworthiness model organized around five cross\-cutting dimensions: safety and constraint satisfaction; robustness and reliability; transparency and interpretability; accountability and auditability; and privacy and security\. This is mapped onto an agentic assurance workflow spanning perception through audit\. Building on this foundation, agentic systems architectures, threats, concrete trust mechanisms, and quantitative metrics are surveyed for direct application in agentic systems development and evaluation\. These principles are then examined across four constraint\-bound engineering domains: power systems, autonomous vehicles/robotics/UAVs, high\-performance computing, and communication networks, identifying recurring design patterns, shared failure modes, and domain\-specific gaps\. Synthesizing across those domains, agentic AI trustworthiness is shown to be a single problem, with a path outlined toward a reusable, cross\-domain assurance framework analogous to the graded certification regimes used by mature safety\-critical engineering fields\.

## IIntroduction

Agentic artificial intelligence \(Agentic AI\) refers to AI systems designed to autonomously perceive their environment, reason over goals and intermediate states, and execute sequences of actions; often iteratively and over extended horizons to achieve objectives within dynamic environments\[[14](https://arxiv.org/html/2607.18548#bib.bib4)\]\. The key difference between agentic AI systems and static predictive single\-turn large language models \(LLMs\) lies in their incorporation of explicit decision\-making loops, memory, tool use, and sometimes coordination among heterogeneous agents, including humans\.

Recent advances have operationalized these ideas through architectures such as reasoning–acting interleaving \(e\.g\., ReAct\)\[[130](https://arxiv.org/html/2607.18548#bib.bib5)\], self\-reflective agents \(e\.g\., Reflexion\)\[[107](https://arxiv.org/html/2607.18548#bib.bib6)\], deliberative search over intermediate reasoning steps \(e\.g\., Tree\-of\-Thoughts\)\[[129](https://arxiv.org/html/2607.18548#bib.bib7)\], and multi\-agent LLM\-based systems capable of communication and task decomposition\. Collectively, these approaches mark a shift from passive AI components toward autonomous, goal\-directed systems that can adapt, plan, and act in complex environments\. Although these capabilities have shown promise in various domains, their implementation in critical infrastructure systems such as power grids, autonomous vehicles and robotic platforms, high\-performance computing facilities, and communication networks presents fundamental trustworthiness challenges\[[89](https://arxiv.org/html/2607.18548#bib.bib8)\]\. Failures in these environments can cause cascading outages, physical harm, financial loss, or safety hazards to the public and human operators, in addition to performance degradations\[[80](https://arxiv.org/html/2607.18548#bib.bib9),[24](https://arxiv.org/html/2607.18548#bib.bib10)\]\.

Trust in agentic AI is an existential requirement rather than an auxiliary concern, requiring autonomous agents to consistently respect operational constraints, maintain resilience against adversity and uncertainty, provide transparency into decision\-making processes, facilitate accountability and auditability, and prevent abuse or unintentional escalation\. Agentic AI systems, in contrast to traditional automation, can create and execute new action sequences, communicate with external tools or simulators, and adjust their tactics online, thereby enhancing both their potential impact and their failure modes\.

This survey addresses the growing gap between the rapid development of agentic AI architectures and the limited understanding of their reliability when used in critical infrastructures\. This work offers a structured, trust\-centered analysis that specifically targets domains where autonomous decision\-making carries significant societal, economic, and safety consequences, rather than providing a broad or capability\-driven overview of agentic AI\. In addition to cataloging agentic trustworthiness techniques, we synthesize existing knowledge on whether and under what circumstances such systems can be responsibly relied upon in operational environments with strict requirements and low fault tolerance\.

We contribute to this effort in four ways\. First, we create a unified taxonomy of agentic AI architectures that encompasses prevalent design patterns from the literature, including reasoning\-acting interleaving agents, self\-reflective and memory\-augmented agents, tool\-augmented agents based on external environments, deliberative planning agents based on structured search, and multi\-agent systems with coordination and role specialization capabilities\. The survey’s conceptual foundation, grounded in this taxonomy, enables systematic comparisons between otherwise disparate methods\.

Second, we organize these architectural classes around five cross\-cutting trustworthiness dimensions: safety and constraint satisfaction, robustness and reliability, transparency and interpretability, accountability and auditability, and privacy and security, mapped onto a ten\-point agentic workflow spanning perception through audit\[[3](https://arxiv.org/html/2607.18548#bib.bib26)\]\. Instead of treating trust as a post\-hoc or abstract issue, we examine where in this workflow trust mechanisms are present, and where they are absent, exposing recurring patterns of incomplete coverage, implicit assumptions, and unresolved risk that are frequently overlooked in capability\-focused discussions of agentic AI\.

Third, we translate this workflow\-level view into material developers can act on directly: a survey of trust mechanisms already embedded in agentic loops, including guardrails, safe reinforcement learning formulations, and robustness measures against distribution shift and adversarial manipulation; a review of how AI safety evaluation has evolved from representation\- and reasoning\-level probes to behavior, risk, and trajectory\-level assessment of agentic workflows; and a consolidated set of quantitative metrics, spanning tool use, memory coherence, planning quality, policy adherence, and goal drift, that can be reported directly rather than inferred from task success alone\.

Fourth, we ground this architectural and trust analysis in four constraint\-bound engineering domains: power systems, autonomous vehicles/robotics/UAVs, high\-performance computing, and communication networks\. We examine how agentic AI has been proposed or implemented across these domains, including the types of simulators, benchmarks, and testbeds used for assessment, and the degree to which trustworthiness is operationalized through quantifiable constraints, failure analyses, or deployment\-relevant metrics\. By comparing and contrasting agentic AI in these domains, we identify and analyze discrepancies between real\-world operational requirements and benchmark\-driven validation, as well as domain\-specific failure modes that generic agent evaluations do not capture\. This led to a major insight that agentic AI trustworthiness is not four separate engineering problems but one problem observed from four vantage points, obscured by domain\-specific vocabulary and disconnected evaluation practices\. The recurring gaps of 1\) the absence of domain\-aware safety guarantees under distribution shift and adversarial conditions, 2\) the lack of standardized trust\-oriented evaluation, 3\) limited integration of formal verification and runtime monitoring, and 4\) inadequate human\-agent oversight appear in each domain under different vocabulary but share a common structure\. Building on this insight, the survey outlines a path toward a reusable, cross\-domain trustworthiness framework analogous to the graded certification regimes that aviation and automotive safety engineering already use, shifting the field’s next phase of progress from architectural novelty toward assurance infrastructure\.

In contrast to current surveys on agentic AI that mostly focus on reasoning skills, coordination methods, and performance metrics, this work highlights trustworthiness and the challenges posed by critical infrastructure\. Unlike surveys on trustworthy AI that mainly discuss static models or single\-decision scenarios, we specifically address the unique risks posed by autonomous, sequential, and tool\-integrated agentic systems\. This survey fills an important gap where agentic AI, trustworthiness, and high\-stakes real\-world applications meet\. It provides a solid foundation for researchers and practitioners seeking to transition agentic AI from experimental settings to practical applications\.

The remainder of this paper is organized as follows\. Section[II](https://arxiv.org/html/2607.18548#S2)introduces agentic AI architectures and the four target domains\. Section[III](https://arxiv.org/html/2607.18548#S3)presents our five trustworthiness dimensions and the ten\-point assurance workflow\. Section[IV](https://arxiv.org/html/2607.18548#S4)analyzes representative agentic architectures through this trust lens\. Section[V](https://arxiv.org/html/2607.18548#S5)surveys concrete trust mechanisms, Section[VI](https://arxiv.org/html/2607.18548#S6)traces the evolution of AI safety evaluation from representation\-level probes to agentic, trajectory\-level assessment, and Section[VII](https://arxiv.org/html/2607.18548#S7)consolidates quantitative metrics for agentic workflows\. Sections[VIII](https://arxiv.org/html/2607.18548#S8),[IX](https://arxiv.org/html/2607.18548#S9),[X](https://arxiv.org/html/2607.18548#S10), and[XI](https://arxiv.org/html/2607.18548#S11)examine domain\-specific applications, Section[XII](https://arxiv.org/html/2607.18548#S12)synthesizes cross\-domain insights and gaps, and Section[XIII](https://arxiv.org/html/2607.18548#S13)concludes with open challenges and future directions\.

## IIBackground: Agentic Architectures and Trustworthy AI

### II\-AAgentic Architectures with LLMs

Recent advances in large language models \(LLMs\) have led to a shift from static, single\-turn inference to agentic AI structures\. In these systems, models are part of closed\-loop setups that can make decisions over time, interact with their surroundings, and adapt their behavior\. Unlike traditional LLM usage, where models produce responses based on a set prompt, agentic structures treat LLMs as decision\-making cores\. These models constantly observe state information, consider goals and outcomes, take actions, and update their internal information based on the feedback they receive\. This change has led to a growing number of LLM\-based agents\.

At a high level, agentic architectures can be categorized based on the number of decision\-making entities involved and their interaction patterns\. Single\-agent architectures consist of a single LLM\-driven agent operating within an environment, often enhanced with memory and access to tools\. These agents typically handle planning, reasoning, and acting independently to achieve a specific goal\. In contrast, multi\-agent architectures involve several agents, each potentially powered by an LLM, that coordinate, communicate, or compete to solve tasks together\. Multi\-agent systems add complexity through communication protocols, role specialization, negotiation, and conflict resolution\. They also increase the challenges posed by coordination failures and unexpected behaviors\.

A key feature of modern agentic AI systems is their use of tools and interaction with their environment\. Instead of working solely in text space, agents increasingly connect with external APIs, simulators, databases, code interpreters, cyber ranges, or physical system models\[[9](https://arxiv.org/html/2607.18548#bib.bib45)\]\. Using these tools allows agents to go beyond language generation\. They can query real\-time information, execute control actions, or manipulate simulated or real\-world environments\. In critical infrastructure contexts, these environments may include power system simulators, reinforcement learning settings, network emulators, or operational dashboards\. This tightens the link between agent decisions and system\-level consequences\.

Most agentic architectures can be described using a generic agent loop, as shown in Figure[1](https://arxiv.org/html/2607.18548#S2.F1), which captures the repeating structure behind different implementations\. In this loop, the agent first observes the current state of the environment, including system outputs, sensor data, or feedback from previous actions\. It then reasons over this information to determine the best course of action, often using intermediate representations such as chain\-of\-thought reasoning, plans, or evaluations of candidate actions\. The agent then acts by issuing commands, using tools, or interacting with other agents or environments\. Finally, the agent updates its memory, adding new observations, action outcomes, or self\-reflective feedback to guide future decisions\. This observe, reason, act, and update cycle continues until a termination condition is met\.

![Refer to caption](https://arxiv.org/html/2607.18548v1/x1.png)Figure 1:Generic agentic AI observe–reason–act loop\.While this agent loop offers flexibility, it also raises new trust issues that do not exist with static model inference\. Errors can accumulate over iterations, actions may have irreversible effects, and unexpected behaviors can emerge from long\-term interactions with complex environments or other agents\. Therefore, it is vital to understand how different agentic architectures implement this loop, and where safeguards, constraints, or oversight mechanisms are included\. This understanding is crucial for assessing their suitability in high\-stakes, safety\-critical situations\. This foundational insight drives the taxonomy and trust\-centered analysis presented in the rest of this survey\.

Building on the single\-agent loop, multi\-agent systems \(MAS\) spread these processes across a network of specialized entities\. In a multi\-agent setup, the ”environment” often becomes a shared space\. Here, the actions of one agent become the observations of another\. This creates a coordination loop that controls how individual agents interact\. These systems typically depend on a communication layer, often called a ”blackboard” or a messaging protocol, to share plans, intermediate reasoning, or tool outputs\.

The multi\-agent setup introduces three critical components beyond the standard loop:

- •Role Specialization:Agents are often assigned specific ”personas” or subsets of tools \(e\.g\., a ”Coder” agent and a ”Reviewer” agent\), allowing for a divide\-and\-conquer approach to complex tasks\.
- •Communication Protocols:Agents must decide not justwhatto do, butwhat to tellothers\. This includes sharing state updates, requesting assistance, or negotiating during conflicts\.
- •Global vs\. Local Memory:While individual agents maintain local logs of their reasoning, a multi\-agent system often incorporates a shared memory or ”Global State” to ensure all participants remain aligned on the ultimate goal\.

![Refer to caption](https://arxiv.org/html/2607.18548v1/x2.png)Figure 2:Generic multi\-agent architecture showing interconnected loops, shared memory, and collective interaction in a common environment\.As in the MAS illustrated in Figure[2](https://arxiv.org/html/2607.18548#S2.F2), the complexity shifts from individual thinking to group coordination\. While this can improve performance on separate tasks, it also brings in ”emergent risks\.” Minor errors in one agent’s output propagate as they pass through the network of agent interactions\.

This transition from individual reasoning to collective behavior necessitates a dual\-layered approach to trustworthiness\. We must evaluate intra\-agent reliability, ensuring the internal decision\-making core of each entity remains robust, alongside inter\-agent trust, which governs the integrity of communication, coordination, and delegated authority across the network\. Assessing these two dimensions is essential to preventing local errors from escalating into systemic failures within the broader ecosystem\.

### II\-BCase Studies

This survey presents a general case\-study perspective on trustworthy agentic AI, while synthesizing the discussion through four representative engineering domains:power systems,autonomous vehicles, robotics, and UAVs,high\-performance computing, andcommunication networks\. These domains provide a concrete basis for examining how agentic AI may be introduced into existing monitoring, control, optimization, and decision\-making loops to support human operators, augment established automation pipelines, or increasingly assume parts of the operational process\. They are selected because they are mature engineering fields with well\-defined operational constraints, hard system requirements, and safety\-critical deployments\. Consequently, trustworthiness cannot be viewed solely as a property of the AI model, but must instead be evaluated against domain\-specific requirements, including safety, reliability, timing, resilience, resource constraints, security, accountability, and the consequences of incorrect autonomous actions\. While these four domains do not encompass every application of agentic AI, they provide a technically grounded foundation for studying trust in systems with significant real\-world consequences\.

Together, these domains span a broad range of system scales and architectural characteristics\. Power systems represent large\-scale cyber\-physical infrastructure with tightly coupled physical dynamics; autonomous vehicles, robotics, and UAVs embody mission\-level autonomy in dynamic environments; high\-performance computing exposes low\-level computational and resource\-management constraints; and communication networks capture the distributed data flows that interconnect these systems\. This bounded yet diverse scope enables meaningful comparisons of trustworthiness challenges across complementary engineering settings while maintaining a focus on domains where agentic AI requires rigorous architectural design and system\-level assurance\.

## IIIDimensions of Trustworthiness

In critical engineering domains, trustworthiness cannot be treated as a static property of an AI model or an isolated software component\. Agentic AI systems operate over extended time horizons, interact with tools and environments, and may trigger actions whose effects propagate across physical, cyber, and organizational layers\[[90](https://arxiv.org/html/2607.18548#bib.bib20)\]\. Accordingly, this survey adopts a resilience\-oriented view of trustworthiness: an agentic system is trustworthy to the extent that it can*anticipate*,*withstand*,*recover from*, and*adapt to*disturbances, including faults, distribution shifts, specification gaps, and adversarial manipulation, while remaining within acceptable operational bounds\.

We organize this view around five cross\-cutting dimensions: safety and constraint satisfaction, robustness and reliability, transparency and interpretability, accountability and auditability, and privacy and security\. These dimensions are informed by established safety, assurance, and governance frameworks, including functional safety standards, Safety of the Intended Functionality \(SOTIF\), cybersecurity guidance, and emerging AI governance regimes such as the EU AI Act\. They are not treated as independent checkboxes; rather, they serve as analytical lenses for comparing how agentic AI systems are designed, evaluated, and justified in critical application settings\.

### III\-ASafety and Constraint Satisfaction

Safety and constraint satisfaction refer to the extent to which agent actions remain within operational, physical, legal, and procedural limits\. In safety\-critical engineering, safety is commonly defined as freedom from unacceptable risk\[[49](https://arxiv.org/html/2607.18548#bib.bib72)\]\. For agentic AI, this requires more than high task performance: the system must respect safety envelopes, operational rules, and hard constraints even when goals conflict, information is incomplete, or the environment changes unexpectedly\. This dimension is closely related to SOTIF, which emphasizes hazards that arise not only from component failures but also from functional insufficiencies and specification gaps in complex autonomous systems\[[106](https://arxiv.org/html/2607.18548#bib.bib73)\]\. In practice, safety evidence may include formal constraints, runtime monitors, fallback policies, hazard analysis, safety integrity targets, or empirical demonstrations that the agent does not violate critical operating limits\[[4](https://arxiv.org/html/2607.18548#bib.bib21),[50](https://arxiv.org/html/2607.18548#bib.bib80)\]\.

### III\-BRobustness and Reliability

Robustness and reliability capture the agent’s ability to maintain acceptable behavior under uncertainty, stress, and imperfect operating conditions\. Robustness concerns performance under distribution shifts, adversarial inputs, missing information, tool failures, delayed observations, and compounding errors over long\-horizon tasks\[[67](https://arxiv.org/html/2607.18548#bib.bib22)\]\. Reliability concerns whether the system behaves consistently within its intended operating conditions and maintains failure rates compatible with deployment requirements\. Standards such as ISO 21448 emphasize the importance of defining an Operational Design Domain \(ODD\), detecting when the system has exited that domain, and triggering safe fallback behavior when assumptions no longer hold\[[106](https://arxiv.org/html/2607.18548#bib.bib73)\]\. For agentic AI, this dimension therefore requires stress testing, boundary\-case evaluation, failure\-mode analysis, and evidence that local errors do not escalate into system\-level failures\[[77](https://arxiv.org/html/2607.18548#bib.bib81),[118](https://arxiv.org/html/2607.18548#bib.bib82)\]\.

### III\-CTransparency and Interpretability

Transparency and interpretability refer to the degree to which agent behavior can be inspected, explained, and meaningfully reviewed by human stakeholders\. In agentic systems, transparency is not limited to explaining a final output; it also includes tracing goals, intermediate states, tool calls, memory updates, assumptions, uncertainty, and the reasoning pathways that connect observations to actions\. Interpretability should distinguish between post\-hoc narratives that merely rationalize an outcome and explanations that provide testable, decision\-relevant evidence about why the agent behaved as it did\[[29](https://arxiv.org/html/2607.18548#bib.bib23),[6](https://arxiv.org/html/2607.18548#bib.bib116)\]\. This dimension is especially important for high\-risk systems, where the EU AI Act emphasizes transparency and human oversight as conditions for responsible deployment\[[33](https://arxiv.org/html/2607.18548#bib.bib83)\]\. In practice, transparency mechanisms may include interpretable state representations, causal or counterfactual explanations, explicit uncertainty reporting, and operator\-facing status indicators that distinguish normal, degraded, abnormal, and unsafe behavior\[[118](https://arxiv.org/html/2607.18548#bib.bib82)\]\.

### III\-DAccountability and Auditability

Accountability and auditability refer to the mechanisms that allow actions, decisions, failures, and design choices to be reconstructed and assigned to responsible actors or system components\. This dimension is essential because agentic outcomes often emerge from interactions among models, tools, policies, memory systems, human operators, and other agents rather than from a single isolated decision\[[92](https://arxiv.org/html/2607.18548#bib.bib24)\]\. Accountability, therefore, requires traceable tool use, tamper\-evident logs, versioned policies, documented memory or knowledge updates, human override pathways, and clear responsibility boundaries across the system lifecycle\. Governance frameworks and conformity\-assessment regimes emphasize that high\-risk systems should maintain evidence of risk management, oversight, monitoring, and post\-deployment accountability\[[33](https://arxiv.org/html/2607.18548#bib.bib83),[35](https://arxiv.org/html/2607.18548#bib.bib85)\]\. In this survey, auditability is treated as the evidentiary backbone of trustworthiness: without reconstructible evidence, claims about safety, robustness, or security remain difficult to verify\.

### III\-EPrivacy and Security

Privacy and security concern the protection of data, models, tools, and operational behavior against unauthorized access, leakage, manipulation, or misuse\. Agentic AI expands the traditional attack surface because agents may retrieve information, call tools, write to memory, coordinate with other agents, and act autonomously across cyber\-physical workflows\[[1](https://arxiv.org/html/2607.18548#bib.bib25)\]\. Relevant risks include prompt injection, tool hijacking, adversarial inputs, data exfiltration, model theft, unsafe privilege escalation, and manipulation of agent behavior by malicious actors\[[45](https://arxiv.org/html/2607.18548#bib.bib32)\]\. Cybersecurity standards and engineering practice emphasize secure communication, secure boot, access control, monitoring, and defense\-in\-depth architectures\[[106](https://arxiv.org/html/2607.18548#bib.bib73),[115](https://arxiv.org/html/2607.18548#bib.bib86)\]\. For agentic AI, this dimension requires not only conventional information security controls but also agent\-specific safeguards such as sandboxed tool execution, least\-privilege permissions, red teaming, anomaly detection, and mechanisms to contain compromised or misaligned agent behavior\.

To operationalize these dimensions, we treat trustworthiness as a workflow\-level property rather than a model\-level attribute\. Rather than relying on the compressed observe–reason–act–update abstraction, we expand the agentic loop into ten stages:*perception/observation*,*reasoning*,*planning*,*tool use*,*communication/coordination*,*memory update*,*validation*,*action/execution*,*monitoring/re\-evaluation*, and*audit/logging*\. This decomposition is not meant to prescribe a fixed implementation for every agentic system; instead, it provides an analytical structure for identifying where trust mechanisms, constraints, and evidence should be placed\. For each trustworthiness dimension, we ask: \(i\) what threat, hazard, or failure model is relevant; \(ii\) what mechanisms are embedded into the workflow to prevent, detect, constrain, or correct failures; and \(iii\) what evidence or quantitative metrics are reported to support the trustworthiness claim\. This framing highlights a central gap in current systems: many improve capability, orchestration, or partial transparency, yet still lack compositional safeguards and evidence across safety, robustness, accountability, and security\. Figure[3](https://arxiv.org/html/2607.18548#S3.F3)summarizes this workflow\-centered view of trustworthy agentic AI across the target engineering domains\.

![Refer to caption](https://arxiv.org/html/2607.18548v1/Figures/survey-framework.png)Figure 3:Holistic framework for trustworthy agentic AI in critical engineering systems\. The figure organizes the agentic workflow around perception, reasoning, planning, tool use, communication, memory update, validation, action, monitoring, and audit\. Five trustworthiness dimensions act as cross\-cutting requirements across the workflow: safety and constraint satisfaction, robustness and reliability, transparency and interpretability, accountability and auditability, and privacy and security\. Representative trust mechanisms and quantitative metrics are mapped to the workflow, while the target application domains illustrate how trust requirements vary across power systems, autonomous vehicles/robotics/UAVs, high\-performance computing, and communication networks\.TABLE I:Trustworthiness dimensions: threats, mechanisms, and resilience phases\. Each dimension is evaluated across the anticipate–withstand–recover–adapt cycle\. See Sections[III](https://arxiv.org/html/2607.18548#S3)and[V](https://arxiv.org/html/2607.18548#S5)for mechanism detail\.

## IVTrustworthiness in Current Agentic Architectures

Current agentic AI architectures differ in how they organize reasoning, action, memory, tool use, and coordination\. From a trustworthiness perspective, however, most of them follow a common pattern: they improve capability, interaction, and observability, but they rarely provide explicit assurance across safety and constraint satisfaction, robustness and reliability, transparency and interpretability, accountability and auditability, and privacy and security\. This section reviews the main architecture classes and evaluates the extent to which trustworthiness is built into the architecture rather than assumed from the surrounding environment\.

LLMReasoningAction /Tool CallObservationReflectionTrace\(a\) Reasoning–Acting / Self\-ReflectiveProblemPath 1Path 2Path 3Evaluator /ScorerSelectedAnswer\(b\) Deliberative / Test\-Time ReasoningAgent 1Agent 2Agent 3Supervisor /ConsensusJointDecision\(c\) Multi\-Agent CoordinationAgentTools / APIsExternalEnvironmentPolicy /Sandbox\(d\) Tool\-Using / Environment\-GroundedAgent 1Agent 2Protocol /Message SchemaAudit /VerificationNL / Latent\(e\) Communication and Coordination

Figure 4:Representative agentic AI architecture classes and their trustworthiness implications\. Dashed arrows denote reflection, communication, or information exchange, while solid arrows denote execution, control, evaluation, or verification flow\.### IV\-AReasoning\-Acting and Self\-Reflective Agents

Reasoning\-acting architectures, represented by ReAct, interleave model reasoning with external actions such as tool calls, search, or environment interaction\[[130](https://arxiv.org/html/2607.18548#bib.bib5)\]\. Their main strength is transparency: intermediate reasoning and action traces make failures easier to inspect and debug\. They also improve grounding compared with purely generative models because the agent can observe feedback from the environment before continuing execution\.

However, ReAct\-style systems are trust\-light by design\. Safety and constraint satisfaction are usually inherited from the tool environment rather than enforced by the agent itself\. Robustness is also limited, especially in long\-horizon tasks where small reasoning or tool\-use errors can accumulate\. Extensions such as ReST meets ReAct improve reliability by using self\-generated trajectories and automated evaluation to refine behavior\[[5](https://arxiv.org/html/2607.18548#bib.bib19)\]\. This can reduce variance across runs, but it also introduces a new risk: if the evaluator is itself an LLM, incorrect judgments may be reinforced rather than corrected\.

Self\-reflective agents, such as Reflexion, add an explicit feedback step in which the agent converts failures into natural language reflections and reuses them in future attempts\[[107](https://arxiv.org/html/2607.18548#bib.bib6)\]\. This improves behavioral traceability and can increase task success over repeated trials\. Nevertheless, the trust boundary remains largely unchanged\. Reflections are only as reliable as the agent’s own diagnosis, and there is no built\-in mechanism for independent verification, formal accountability, or security against adversarial inputs\.

Fig\.[4](https://arxiv.org/html/2607.18548#S4.F4)\(a\) illustrates this architecture as a reasoning–action–observation loop augmented by a reflective trace for debugging and behavioral feedback\.

### IV\-BDeliberative and Test\-Time Reasoning Architectures

Deliberative architectures address the limitations of single\-path generation by exploring multiple reasoning paths before selecting an answer\. Tree\-of\-Thoughts, for example, organizes candidate reasoning steps into a search process with generation, evaluation, pruning, and backtracking\[[129](https://arxiv.org/html/2607.18548#bib.bib7)\]\. These systems are stronger than simple reasoning\-acting loops when tasks require planning, lookahead, or comparison between alternatives\. They are also relatively interpretable because the explored paths and selection process can be inspected\.

Their weakness is that reliability depends heavily on the quality of the internal or external evaluator\. Poor evaluation can lead to premature pruning, overconfident selection, or repeated exploration of weak solutions\. Value\-guided variants such as Q\* improve performance by using learned scoring models to guide reasoning\[[120](https://arxiv.org/html/2607.18548#bib.bib18)\], but this shifts part of the decision process into a less interpretable component\. As a result, deliberative planners improve reasoning quality and robustness, but they do not, by themselves, provide safety guarantees, accountability, or protection against misuse\.

More recent reasoning models, including DeepSeek\-R1 and OpenAI o\-series models, move deliberation into the model’s native test\-time reasoning process\[[94](https://arxiv.org/html/2607.18548#bib.bib178),[76](https://arxiv.org/html/2607.18548#bib.bib179)\]\. These systems can perform deeper reasoning, self\-checking, and backtracking before producing a final answer\. This improves capability and often reliability, but it also creates a new trust problem: the most important reasoning steps may be hidden, only partially observablas different agents can be assigned different roles or areas of e, or difficult to verify\. For critical systems, this means that stronger reasoning capability must be paired with reasoning safety, monitoring, and external validation; otherwise, the same capability that improves performance can also make failures more complex and harder to detect\.

Fig\.[4](https://arxiv.org/html/2607.18548#S4.F4)\(b\) shows deliberative reasoning as the exploration of multiple candidate paths followed by evaluator\-based selection\.

### IV\-CMulti\-Agent Architectures and Coordination

Multi\-agent architectures distribute reasoning and decision\-making across multiple agents that communicate, specialize, debate, or hand off tasks\. Examples include role\-based systems such as CAMEL and broader LLM\-based multi\-agent frameworks\[[59](https://arxiv.org/html/2607.18548#bib.bib17),[61](https://arxiv.org/html/2607.18548#bib.bib11)\]\. Their main advantage is robustness through diversity: agents can critique one another, divide complex tasks, or recover from local errors\. They also support modularity, as different agents can be assigned different roles or areas of expertise\.

At the same time, multi\-agent systems expose some of the most serious trustworthiness gaps\. Safety becomes a system\-level property rather than an individual\-agent property\. A single agent may appear reasonable in isolation, while, through interaction, the group produces unsafe, inconsistent, or unaccountable behavior\. Responsibility attribution is especially difficult because final decisions emerge from communication, negotiation, and accumulated context rather than a single model output\.

Communication protocols, as discussed later on, partially address this problem by structuring agent interactions\. Natural language coordination is flexible but ambiguous, while structured protocols reduce ambiguity and improve logging\. Agent\-to\-agent protocols and tool\-interface standards can improve interoperability and auditability, but they do not guarantee that the content of communication is correct, safe, or aligned with system goals\. Supervisory agents and consensus\-based coordination can improve robustness, but they also shift trust to the supervisor or to the aggregation rule\. Thus, multi\-agent architectures are promising for scalability and specialization, but remain weak in accountability, security, and system\-level assurance\.

Fig\.[4](https://arxiv.org/html/2607.18548#S4.F4)\(c\) summarizes multi\-agent coordination as distributed agent interaction followed by supervision or consensus\-based aggregation\.

### IV\-DTool\-Using and Environment\-Grounded Agents

Tool\-using architectures extend agents from text generation to action in external environments\. Toolformer shows that models can learn when to call external tools\[[102](https://arxiv.org/html/2607.18548#bib.bib15)\], while systems such as VOYAGER demonstrate long\-horizon skill acquisition in interactive environments\[[121](https://arxiv.org/html/2607.18548#bib.bib16)\]\. These architectures improve grounding because the agent can use external information, execute actions, and observe results\. They also make some behavior more inspectable through tool traces, logs, and reusable skills\.

However, tool grounding does not automatically imply trustworthiness\. In fact, tool access increases the consequences of failure\. Incorrect reasoning can become incorrect action, and unsafe tool use can affect external systems\. ToolGym makes this issue explicit by evaluating agents in open\-world tool settings with long\-horizon workflows and injected failures\[[125](https://arxiv.org/html/2607.18548#bib.bib12)\]\. Such environments improve robustness evaluation, but they remain primarily diagnostic rather than preventive\.

Production frameworks such as LangChain, LangGraph, AutoGen, CrewAI, OpenHands, and SuperAGI move agent design closer to deployable software systems\[[23](https://arxiv.org/html/2607.18548#bib.bib28),[72](https://arxiv.org/html/2607.18548#bib.bib29)\]\. Their trust contribution is mainly operational: tracing, monitoring, role assignment, workflow control, sandboxing, testing, and human\-in\-the\-loop intervention\. These mechanisms improve transparency, auditability, and failure containment, but they are engineering controls rather than formal guarantees\. More security\-oriented designs, such as cognitive\-executive separation, go further by treating the reasoning model as untrusted and enforcing constraints outside the model\[[39](https://arxiv.org/html/2607.18548#bib.bib182),[38](https://arxiv.org/html/2607.18548#bib.bib183),[40](https://arxiv.org/html/2607.18548#bib.bib184),[26](https://arxiv.org/html/2607.18548#bib.bib185)\]\. This is a stronger trust direction because it separates decision generation from permission to act\.

Fig\.[4](https://arxiv.org/html/2607.18548#S4.F4)\(d\) depicts tool\-using agents as systems whose decisions are routed through tools, external environments, and policy or sandbox controls\.

### IV\-ECommunication and Coordination between Agents

The shift from single\-agent systems to multi\-agent architectures changes the locus of trust\. In multi\-agent systems, reliability depends not only on individual model behavior but also on inter\-agent interaction\[[119](https://arxiv.org/html/2607.18548#bib.bib127)\]\. As agents exchange information, coordinate actions, and reuse one another’s outputs, local errors and behavioral mismatches can propagate across agent boundaries and become system\-level risks\.

Communication is central to this trust problem\. Natural language remains the dominant interface because it supports flexible dialogue, critique, and negotiation\. However, its flexibility introduces ambiguity\. Agents may report incorrect state transitions, produce false coordination signals, or create what is often calledhallucinated coordination\. Structured communication protocols address this risk by requiring interactions to follow schemas or formal message formats\[[119](https://arxiv.org/html/2607.18548#bib.bib127),[42](https://arxiv.org/html/2607.18548#bib.bib128)\]\. These protocols improve consistency and reduce ambiguity, but they primarily constrain syntax rather than the semantic validity of exchanged information\. The Model Context Protocol \(MCP\) reflects this direction by formalizing tool use, context serialization, and persona definitions\.

Beyond symbolic communication, recent work explores communication inlatent representation spaces, where agents share internal hidden states instead of text outputs\. This can enable richer and more efficient information transfer, support parallel reasoning, and improve alignment among agents\[[28](https://arxiv.org/html/2607.18548#bib.bib129)\]\. The trade\-off is transparency\. Latent communication reduces human interpretability and makes interactions harder to audit, creating an oversight challenge for trust\-critical systems\[[137](https://arxiv.org/html/2607.18548#bib.bib130)\]\.

Coordination strategies determine how communication is organized, checked, and acted upon\. Decentralized, leaderless methods reduce single points of failure and often draw on Byzantine fault tolerance and consensus\-based design\[[54](https://arxiv.org/html/2607.18548#bib.bib131)\]\. By aggregating outputs across agents or requiring agreement before action, these methods improve robustness against faulty or adversarial participants\. Supervisory structures add monitoring agents that enforce constraints and reduce misuse or unsafe behavior\. However, they can also introduce bottlenecks or shift trust to a single supervisory entity rather than resolving the underlying coordination risks\[[19](https://arxiv.org/html/2607.18548#bib.bib132)\]\.

Multi\-agent systems also introduce failure modes that differ from those in single\-agent models\. Communication channels can spread misinformation, allowing incorrect or manipulated knowledge to circulate and persist in shared memory\. Strategic behavior may emerge, including deception, collusion, or covert signaling embedded in otherwise benign outputs\. Long interaction chains can also cause role drift, in which agents gradually deviate from their assigned responsibilities, leading to coordination failures\. These risks show that trust cannot be evaluated only at the level of individual agents; it must account for interaction dynamics over time\.

Addressing these risks requires explicit verification and interpretability of multi\-agent interactions rather than relying solely on black\-box evaluation\. Recent work on multi\-agent interpretability analyzes internal representations across agents to detect coordinated or deceptive behavior\. Formal methods provide another path by constraining interactions in which agents gradually deviate from their assigned responsibilities, ensuring actions are carried out through verifiable protocols and that behavior remains consistent with predefined specifications\. These approaches offer stronger guarantees, but they remain difficult to scale and often require access to internal model states or rigid interaction structures\.

Overall, communication and coordination are not merely enabling mechanisms in agentic systems; they are primary determinants of trustworthiness\. Current approaches remain fragmented, addressing protocol design, robustness, or interpretability in isolation\. A central open challenge is to develop compositional frameworks that jointly reason about communication, coordination, and system\-level behavior over long\-horizon interactions\. Without this integration, trust in multi\-agent systems will remain partial because risks can still emerge from interactions among otherwise well\-behaved components\.

Fig\.[4](https://arxiv.org/html/2607.18548#S4.F4)\(e\) highlights communication\-centered architectures in which agent exchanges are structured through protocols and checked through audit or verification mechanisms\.

TABLE II:Qualitative trustworthiness coverage across agentic AI architecture classes, with representative strengths and weaknesses\.Note:Low indicates limited or mostly implicit support; Medium indicates partial support; High indicates explicit and recurring architectural support\.

As shown in Table[II](https://arxiv.org/html/2607.18548#S4.T2), current agentic architectures show meaningful progress in capability, interaction, and observability, but trustworthiness remains uneven\. Transparency is the most consistently supported dimension because many architectures expose reasoning traces, tool calls, search paths, or workflow logs\. Robustness is improving through reflection, deliberation, multi\-agent critique, and failure\-aware evaluation\. In contrast, safety, accountability, and privacy/security remain comparatively weak because they require enforceable constraints, independent verification, secure execution boundaries, and durable audit records\. This gap motivates a shift from capability\-centered agent design toward assurance\-centered architectures, where trust mechanisms are built into the agent loop rather than added after deployment\.

## VTrust Mechanisms in Agentic Architectures

This section reviews the technical frameworks and practical measures used to keep agentic AI systems safe, predictable, and aligned with ethical limits\. As agent\-based systems shift from basic chatbots to tools that plan and reason across several steps, methods for building trust need to move past simple filtering of final outputs and toward safeguards built into the system’s structure and the way it stores and uses information\.

Taken together, the guardrail\-based, learning\-based, and robustness\-oriented mechanisms reviewed in this section rarely address a single trustworthiness dimension or intervene at a single point in the agentic loop\. Table[III](https://arxiv.org/html/2607.18548#S5.T3)consolidates this coverage, mapping each mechanism onto the five trustworthiness dimensions introduced in Section[III](https://arxiv.org/html/2607.18548#S3)and onto the ten\-point agentic workflow\. The resulting picture shows that guardrail mechanisms concentrate on the reasoning and action stages, learning\-based mechanisms extend coverage into planning and memory, and robustness\-oriented mechanisms such as Zero Trust and supply\-chain hardening span nearly the full observe–reason–act–update cycle, underscoring that no single mechanism class delivers assurance across the entire workflow on its own\.

### V\-AGuardrails, Policies, and Safety Filters

Clear, preventive limits serve as the primary safeguard against malicious misuse and unintended harm\. Standard post\-hoc alignment methods, such as training a model to refuse certain requests, are widely used, but the cited sources argue that they can be fragile and bypassed with relatively simple changes to the prompt\[[140](https://arxiv.org/html/2607.18548#bib.bib49),[139](https://arxiv.org/html/2607.18548#bib.bib42)\]\.

#### V\-A1Safety Pretraining

Instead of relying solely on fixes added after training, safety pretraining aims to incorporate safety from the beginning by shaping the training data and procedures around clear safety goals\[[68](https://arxiv.org/html/2607.18548#bib.bib34)\]\. This is done in three main procedures: filtering web data for safety, rewriting text to place unsafe content in a safer context, and training models to refuse harmful requests in a native way\. Lastly, adopting ”Native Refusal” using datasets, such as RefuseWeb, so the model learnswhyrefusing is the right choice, not justwhento refuse\[[68](https://arxiv.org/html/2607.18548#bib.bib34)\]\.

#### V\-A2Representation\-Level ”Circuit Breakers”

Standard refusal filters can be bypassed by adding adversarial suffixes to a prompt\[[140](https://arxiv.org/html/2607.18548#bib.bib49)\]\. Circuit\-breaking is a method that targets the internal patterns that a model uses when it is about to produce unsafe content\. In practice, it can stop or redirect the system mid\-response when the prompt is trying to steer it toward harmful output\[[139](https://arxiv.org/html/2607.18548#bib.bib42)\]\. In prior studies, this approach has worked well in multimodal models and can block image\-based attacks that typical filters miss\[[139](https://arxiv.org/html/2607.18548#bib.bib42)\]\.

#### V\-A3Programmatic Rule Enforcement

Frameworks such as RuLES \(Rule\-following Language Evaluation Scenarios\) provide programmatic checks to assess whether an agent violates a defined set of behavioral constraints \(e\.g\., ”do not generate abusive content”\) during user interaction\[[79](https://arxiv.org/html/2607.18548#bib.bib46)\]\. This makes it easier to confirm, through automated checks, whether rules are being followed than to rely on manual review\[[79](https://arxiv.org/html/2607.18548#bib.bib46)\]\.

#### V\-A4Tamper\-Resistant \(TAR\) Safeguards

In open\-weight LLMs, common safety measures can be weakened if someone fine\-tunes the model to change its weights\. TAR aims to create safeguards that hold up even after hundreds of rounds of adversarial fine\-tuning, so the model maintains the same safety behavior over time\[[116](https://arxiv.org/html/2607.18548#bib.bib41)\]\.

### V\-BLearning for Trust: Safe RL, Reward Design, and Feedback

In agentic systems, trustworthiness can be compromised when the reward signal pushes the agent toward actions that raise its score but do not match the user’s goals or the intended task\. This points to an ethical trade\-off: when the reward setup favors it, agents may learn Machiavellian tactics, such as deception and power\-seeking, to increase their rewards\[[82](https://arxiv.org/html/2607.18548#bib.bib51)\]\. This occurs because reward functions act as proxies for desired behavior, and when these proxies are incomplete or misspecified, agents optimize for the proxy rather than the underlying implicit objective\.

#### V\-B1Utility and Value Engineering

Recent work in Utility Engineering reports that as large language models get bigger, they tend to develop value\-like patterns on their own\[[74](https://arxiv.org/html/2607.18548#bib.bib37)\]\. By examining how consistent these newly observed preferences are, researchers can spot situations in which an AI may prioritize its own interests over those of humans\. Utility control methods could be used to align these emerging values with broader human norms, including standards set by citizen assemblies\[[74](https://arxiv.org/html/2607.18548#bib.bib37)\]\.

#### V\-B2Ethical Steering

A common question in agentic AI research is whether adding ethical limits inevitably reduces an agent’s ability to perform well\[[2](https://arxiv.org/html/2607.18548#bib.bib27)\]\. TheMACHIAVELLIbenchmark tests this assumption by showing that agents can be guided toward safer behavior while maintaining task performance\[[82](https://arxiv.org/html/2607.18548#bib.bib51)\]\. By treating harmful behaviors as measurable signals in interactive settings, the benchmark enables safety to be improved through the system’s design and evaluation, rather than treating it as a separate rule imposed from outside\.

In terms of trustworthiness, this result matters for neural agentic systems because their behavior can arise stochastically from prompt\-based coordination rather than from explicit symbolic rules\. Recent analyses note that when these systems run on their own, they can slowly shift away from their intended goals and apply what they learned in the wrong way\. The MACHIAVELLI findings indicate that steering language models can improve both safety and capability simultaneously, suggesting that alignment should be treated as part of how an agent makes decisions rather than as an after\-the\-fact oversight layer\[[82](https://arxiv.org/html/2607.18548#bib.bib51)\]\.

#### V\-B3Post\-Training Unlearning Methods

A key challenge in deploying agentic AI systems is reducing the risk that they are used for harmful purposes while preserving their general capabilities\[[3](https://arxiv.org/html/2607.18548#bib.bib26)\]\. Safety measures that rely on refusal rules or prompt filtering mostly work only during the user’s interaction with the system\. They can still be bypassed through jailbreaks, adversarial prompts, or later fine\-tuning, so the risky information remains stored in the model\.

Representation Misdirection for Unlearning \(RMU\) addresses this issue by altering the model’s internal representations tied to unsafe subject areas\. Instead of blocking responses, RMU changes the model’s internal activations on risky inputs, while keeping activations on harmless inputs close to those of the original model\[[60](https://arxiv.org/html/2607.18548#bib.bib43)\]\. This leads to a practical loss of access to hazardous knowledge at the level of internal representations\.

Results on the Weapons of Mass Destruction Proxy \(WMDP\) benchmark suggest that RMU lowers performance on biosecurity and cybersecurity hazard tasks to roughly the level of random guessing, while maintaining most general reasoning and conversational fluency\. In probing and adversarial optimization tests, the removed knowledge did not reappear, suggesting genuine unlearning rather than simple masking\[[60](https://arxiv.org/html/2607.18548#bib.bib43)\]\.

Representation\-level unlearning can remove specific unsafe behaviors after training\. This gives a practical way to restrict an agent in adversarial or misuse settings while keeping most of the system’s useful performance\.

### V\-CRobustness to Distribution Shift and Adversaries

A trustworthy agent should remain reliable under expected and unexpected real\-world conditions and in the face of active adversarial attacks\. This typically poses challenges similar to those associated with protecting any digital system\. However, because some AI models/agents are black\-box, their behavior becomes more unpredictable in unforeseen real\-world scenarios, thereby making them more vulnerable to adversarial attacks, including but not limited to fuzzing attacks\.

#### V\-C1Generalizing to Unforeseen Adversaries

Traditional robustness research has focused narrowly onLpL\_\{p\}\-bounded perturbations, but real\-world ”worst\-case” scenarios are far more diverse\[[55](https://arxiv.org/html/2607.18548#bib.bib50)\]\. This is because

To better align research results with real\-world conditions, the authors of\[[55](https://arxiv.org/html/2607.18548#bib.bib50)\]propose ImageNet\-UA, a benchmark that tests models on eighteen new non\-LpL\_\{p\}attacks, including Glitch, Kaleidoscope, and Wood, designed to mimic complex, differentiable image corruptions\.

Instead of relying on threat models that assume a fixed set of attacks, ImageNet\-UA tests models under structural, semantic, and data distribution changes that were not present in training\. This setup asks whether a model can keep making correct predictions when the world shifts in ways it was not trained to expect, which is closer to the kinds of changing and adaptive disturbances that agentic AI systems may face in real settings\[[55](https://arxiv.org/html/2607.18548#bib.bib50)\]\.

While larger models often perform better on capabilities benchmarks like BIG\-bench\[[113](https://arxiv.org/html/2607.18548#bib.bib66)\]or Humanity’s Last Exam \(HLE\)\[[84](https://arxiv.org/html/2607.18548#bib.bib38)\], scale alone does not guarantee robustness against lateral or unstructured reasoning challenges\.

#### V\-C2Universal and Transferable Attacks on Agents

Recent studies suggest that agentic AI systems are particularly vulnerable to automated adversarial attacks that slip past common alignment and safety controls\. Rather than relying on hand\-crafted prompts like traditional jailbreaks, these attacks exploit consistent weaknesses in how agents read goals, follow instructions, and interpret how a task is framed\.

One clear case is the Greedy Coordinate Gradient \(GCG\) method, which systematically searches for adversarial suffixes that can be added to an otherwise harmless prompt to increase the chance that the model outputs content that is not allowed or could cause harm\[[140](https://arxiv.org/html/2607.18548#bib.bib49)\]\. A key point is that GCG does not need access to a model’s internal details when it is used in practice\. After these suffixes are found, they can be applied again in later interactions\. More worrying is that these attacks can be easily transferred across different models and settings\.

Prior work suggests that adversarial suffixes developed with smaller open\-source models can transfer to larger, closed\-domain systems, including OpenAI and Anthropic models\[[140](https://arxiv.org/html/2607.18548#bib.bib49)\]\. Because these prompt attacks carry over from one model to another, scale or proprietary training alone does not provide much protection against prompt\-based adversaries\.

In agentic settings, this vulnerability becomes even more pronounced\. Findings from the AgentHarm benchmark suggest that when a harmful request is presented as part of an agent’s assigned work, such as helping with fraud, cybercrime, or circumventing policies, many frontier agents comply even without complex jailbreak prompts\[[11](https://arxiv.org/html/2607.18548#bib.bib39)\]\. This idea of agentic compliance means that as systems become more capable through goal\-focused design and the use of tools, they may also create more opportunities for attackers to interfere, because the system tends to prioritize completing the task over adhering to safety limits\.

Taken together, the results suggest that universal and transferable adversarial attacks remain a basic problem for agentic AI systems\. System reliability should not be judged solely by fixed prompt guards or by the alignment of a single model\. It also needs evaluation of how well it transfers across different models, whether automated tools can detect new attacks, and how agent\-style prompts can alter the system’s interpretation of a user’s intent\.

#### V\-C3Systemic and Supply\-Chain Vulnerabilities

In many agentic AI systems, trust can be weakened not only by model errors but also by weak software engineering practices and unreliable deployment pipelines\. As agent frameworks push for rapid prototyping and “vibe\-coding,” teams often put security off or assume tools and libraries will handle it, leaving the full system fragile from start to finish\. One clear example is the MoltBot case study, which was later renamed OpenClaw\. A security review found that the assistant saved sensitive API keys and credentials in plain text\. The review also found that its backup process kept copies of these secrets even after users tried to delete them\[[111](https://arxiv.org/html/2607.18548#bib.bib67)\]\.

These design choices break basic security principles and show that agent\-based systems can unintentionally store and reveal sensitive data, regardless of the language model’s alignment or intent\. These risks become worse when indirect prompt injection attacks are involved\. Agents who read outside materials such as web pages, PDFs, or emails can be quietly steered off course if those materials contain hidden, harmful instructions\. These instructions may be placed in ways a reader would not notice, such as white text on a white background or commands stored in metadata\.

If these injected prompts run, they can instruct the agent to pull out private data, use tools in unintended ways, or take over connected accounts, even when the user does nothing\. This attack vector points to a basic trade\-off in agentic systems: they need to accept input from their environment, but they also need clear, strict limits on what actions they can carry out\. In summary, agentic AI can be exposed to risks that come through the software supply chain\.

Many agent frameworks and tool ecosystems rely on large numbers of third\-party libraries and community contributions, and these components are often added with limited screening and little ability to audit their code or provenance\. A malicious commit, a compromised dependency, or a compromised package manager account can spread a backdoor across many downstream systems and reach hundreds of thousands of deployed agents\.

In this setting, how much we can trust an agent depends directly on the integrity of the wider software ecosystem it relies on\. Overall, these weaknesses in the wider system and in the supply chain show that protecting agentic AI is not just about the model itself\. Strong defenses depend on combining secure software engineering, careful isolation and validation of external inputs, and strict oversight of the entire supply chain\. Taken together, these steps help prevent minor implementation mistakes from spreading into large\-scale security incidents\.

#### V\-C4Zero Trust and Persistence

As concerns about agentic vulnerabilities expand, recent studies have focused on strengthening system design using Zero Trust principles and continuous, tamper\-resistant protections\. Instead of relying on perimeter defenses or fixed assumptions about alignment, these approaches assume compromise can occur and focus on ongoing checks throughout the agent’s lifecycle\. In a Zero Trust approach to AI, agents, datasets, tools, and execution pipelines are treated as separate entities that each need their own verification and access controls, rather than being trusted by default because they sit in the same system\[[15](https://arxiv.org/html/2607.18548#bib.bib68)\]\. In this model, nothing is assumed to be trusted\. Access rights are checked each time, based on the user’s identity and the current context\.

In agentic systems, this supports identity\-bound inference and tight limits on tool use, data access, and task execution, which helps keep the blast radius small for both prompt\-driven and system\-level attacks\[[15](https://arxiv.org/html/2607.18548#bib.bib68)\]\. Agent Delegation Tokens \(ADTs\) have been proposed as cryptographic add\-ons to existing identity systems, such as X, to enable controlled action delegation\. X\.509 certificates are digital files that bind a public key to an identified subject, and they are commonly used in systems like TLS to support authentication and encrypted communication\[[15](https://arxiv.org/html/2607.18548#bib.bib68)\]\.

Architectural hardening also depends on keeping the system stable, even when an attacker tries to change it in harmful ways\. This means designing the system so it resists tampering and continues to work as intended under adversarial pressure\. Tamper\-resistant \(TAR\) safeguards are meant to keep safety controls in place even if a model is fine\-tuned or intentionally trained to weaken them\[[116](https://arxiv.org/html/2607.18548#bib.bib41)\]\. Complementary circuit\-breaker checks discussed earlier can act on the model’s internal representations, stopping risky action plans before they turn into actual tool calls\[[139](https://arxiv.org/html/2607.18548#bib.bib42)\]\. These measures move safety enforcement away from basic prompt screening and toward tighter oversight of the agent’s underlying behavior\.

Recent work is exploring certifiable robustness methods that provide formal guarantees against specific types of perturbations\[[47](https://arxiv.org/html/2607.18548#bib.bib69)\]\. Lipschitz\-constrained training can provide provable upper bounds on a model’s sensitivity to small input changes, and it often leads to better deterministic VRA results under formal verification\. Even though these guarantees cover only a narrow range of cases, they are an important step toward agent\-based systems whose safety can be verified with formal methods rather than inferred from experiments\.

In an academic setting, Zero Trust architectures, cryptographic delegation\[[41](https://arxiv.org/html/2607.18548#bib.bib71)\], persistent safeguards, and certifiable robustness can be considered complementary components of a defense stack, each addressing distinct risks and limitations in system security\. This shift shows that dependable agentic AI depends on more than alignment and evaluation\. It also depends on careful system design that expects adversarial pressure at every layer\.

TABLE III:Coverage matrix linking trust mechanisms to trustworthiness dimensions and agentic workflow targets\.Note:Checkmarks indicate the primary dimensions addressed by each mechanism and the main workflow stages where it intervenes\. Obs\. = perception/observation, Reas\. = reasoning, Plan = planning, Tool = tool use, Comm\. = communication/coordination, Mem\. = memory update, Val\. = validation, Act = action/execution, Mon\. = monitoring/re\-evaluation, and Audit = audit/logging\.

## VIThe Evolution of AI Safety Evaluation

Evaluation methodologies for AI systems have undergone a significant transformation, evolving from internal transparency mechanisms to system\-level risk assessment frameworks\. This progression reflects a shift in focus from understanding model internals to validating reasoning processes, to stress\-testing behavior, and ultimately to quantifying hazardous capabilities\.

Evaluating agentic behavior should not rely only on whether the final answer looks right\. It also requiresprocedural transparency, where, at an operational level, one can see the steps the agent takes, including the information it uses, the assumptions it makes, and how it handles uncertainty, to understand how it arrives at a conclusion\. This distinction is particularly important in agentic systems, where decisions unfold over multiple steps and intermediate errors or misaligned reasoning can propagate even when the final output appears correct\.

### VI\-ARepresentation\-Level Evaluation

Based on research in cognitive neuroscience, Representation Engineering \(RepE\) takes a top\-down approach to transparency\[[138](https://arxiv.org/html/2607.18548#bib.bib48)\]\. Looking at patterns across groups of neurons instead of single cells allows researchers to track broader cognitive states, such as honesty, seeking power, and intent to avoid harm\. This makes it possible to spot signs of deception that might not be visible in the final written text\[[95](https://arxiv.org/html/2607.18548#bib.bib35)\]\.

This view matters from a trustworthiness perspective because agents work over time, pursue goals, and change their actions as situations and settings change\. RepE\-style monitoring lets researchers track an agent’s internal representations over time to detect whether harmful intent, reward hacking, or goal misalignment is emerging, even when the agent’s outward behavior still appears compliant\. This is sometimes referred to as ”goal hijacking”\.

Instead of judging a system only by behavior checks or by filtering its outputs, RepE bases trust on whether its internal states stay consistent\. This can flag early problems before they become clear mistakes in what the system says or does\. The paper shows that representation\-level probes can track safety\-relevant concepts, such as honesty and harmlessness, across a range of prompts and tasks\. This suggests RepE is a practical proof of concept for ongoing oversight, interpretability, and control in long\-horizon autonomous agent systems\[[138](https://arxiv.org/html/2607.18548#bib.bib48)\]\.

However, while representation\-level monitoring provides valuable signals, it should be viewed as complementary to external verification mechanisms rather than a replacement, due to the difficulty of reliably interpreting internal states in some cases\.

### VI\-BReasoning\-Level Evaluation

Following the same design principles as the previous subsections, the MoReBench framework shifts attention away from models’ final answers and toward their intermediate reasoning steps, enabling researchers to study how conclusions are reached rather than only what is produced at the end\[[22](https://arxiv.org/html/2607.18548#bib.bib33)\]\. The method relies on rubrics developed by subject experts to assess how agents notice morally relevant factors and balance competing aims, aiming to keep their reasoning consistent with established normative ethical frameworks\[[22](https://arxiv.org/html/2607.18548#bib.bib33)\]\.

In agentic settings, this form of evaluation is particularly important because agents must make sequential decisions under uncertainty, where intermediate reasoning steps directly influence downstream actions\.

### VI\-CBehavior\-Level Evaluation

HarmBench provides a standard automated red teaming setup that supports large\-scale verification\. This lets developers run the same set of tests across 18 red\-teaming methods to check how well the model holds up and to work together on stronger refusal safeguards\[[73](https://arxiv.org/html/2607.18548#bib.bib44)\]\. HarmBench and similar benchmarks can serve as a final encapsulation layer for verifying trustworthiness in an Agentic AI architecture/application\.

### VI\-DRisk\-Level Evaluation

Benchmarks such as WMDP evaluate models across domains involving dual\-use knowledge—information with both legitimate and potentially harmful applications, such as biosecurity, cybersecurity, and chemical synthesis\[[60](https://arxiv.org/html/2607.18548#bib.bib43)\]\. Monitoring performance on these tasks allows institutions to assess whether an agent retains capabilities that could be misused by malicious actors\.

This form of evaluation is critical for trustworthiness, as it enables targeted auditing of high\-risk knowledge domains and supports decisions about capability restriction, controlled access, or post\-training unlearning interventions\.

### VI\-EToward Agentic Evaluation

While previous evaluation methods have focused on internal representations, reasoning processes, observable behaviors, and hidden risk abilities, they often assume static or one\-step interactions\. However, modern agentic systems operate in changing environments where actions unfold over longer periods, involve the use of tools, and rely on ongoing feedback\. This change requires new evaluation frameworks that account for temporal structure, interactions with the environment, and the cumulative effects of decisions\.

Claw\-Eval takes a step in this direction by introducing evaluation protocols designed for agentic workflows\. Instead of evaluating isolated outputs or skills, it assesses agents within the context of multi\-step tasks\. Success depends on not just being correct at each step but also on how well the overall path holds together\[[131](https://arxiv.org/html/2607.18548#bib.bib126)\]\. This involves maintaining consistent goals, recovering from mid\-task failures, and effectively using external tools and environmental signals\.

A key feature of this approach is its focus on trajectory\-level evaluation\. Failures are no longer limited to incorrect outputs; they can also manifest as planning errors, cascading mistakes across steps, or unintended interactions with tools and environments\. Therefore, evaluations must capture not just if an agent succeeds but also how it behaves throughout the task\. This includes its ability to adapt, withstand disruptions, and stay aligned with its goals over time\.

This approach reveals a significant limitation of earlier evaluation methods: they overlook the complex nature of agentic execution\. Even when individual components, like reasoning modules or safety filters, work reliably alone, their interactions over time can create new failure types that static benchmarks won’t catch\.

Claw\-Eval thus represents a shift from focusing on specific abilities to assessingsystem\-levelbehavior\. Trust must be built through sequences of actions rather than isolated outputs\. This change highlights the need for evaluation frameworks that are compositional, capable of reasoning about component interactions, and sensitive to failures that only emerge in long\-term, multi\-agent, or tool\-integrated scenarios\.

Figure[5](https://arxiv.org/html/2607.18548#S6.F5)summarizes this progression toward a composable agentic evaluation\[[7](https://arxiv.org/html/2607.18548#bib.bib188)\]\. The upper layer captures four complementary evaluation lenses: representation\-level evaluation asks what the model internally encodes; reasoning\-level evaluation examines how it reaches conclusions; behavior\-level evaluation tests what it outputs or does; and risk\-level evaluation assesses what harmful capabilities it may enable\. However, these layers remain incomplete for agentic AI unless their evidence can be composed across execution over time\. The lower layer, therefore, highlights the additio nal requirements of agentic evaluation: assessing full trajectories, multi\-step interactions, compounded errors, tool use, and environmental feedback\. This motivates a shift from isolated benchmark scores toward composable, system\-level evaluation of how agents behave across long\-horizon, tool\-integrated, and environment\-coupled workflows\.

![Refer to caption](https://arxiv.org/html/2607.18548v1/Figures/benchmarks.png)Figure 5:Evolution of Benchmarks from static AI safety evaluation to agentic system\-level evaluation\.

## VIIQuantitative Metrics for Agentic Workflows

The research community has developed specific metrics to assess the internal effectiveness and logical integrity of agentic components, thereby going beyond ”black\-box” evaluations\. The Agentic Application Evaluation Framework \(AAEF\) identifies four main quantitative metrics: Tool Utilization Efficacy \(TUE\), Memory Coherence and Retrieval \(MCR\), Strategic Planning Index \(SPI\), and Component Synergy Score \(CSS\)\[[88](https://arxiv.org/html/2607.18548#bib.bib90),[87](https://arxiv.org/html/2607.18548#bib.bib91)\]\. A consolidated summary of all metrics introduced throughout this section, spanning component\-level effectiveness, safety and policy adherence, goal alignment, domain\-specific evaluation, and adversarial robustness, is provided in Table[IV](https://arxiv.org/html/2607.18548#S7.T4)\.

### VII\-ABase Operational Metrics

#### VII\-A1Tool Utilization Efficacy \(TUE\)

The ability of agentic systems to communicate with external tools and APIs is a major source of their usefulness or ’utility’\. The choice to use a tool, however, creates a failure mode called ”tool hallucination,” in which an agent tries to use a nonexistent tool or sends incorrect parameters\[[114](https://arxiv.org/html/2607.18548#bib.bib92),[78](https://arxiv.org/html/2607.18548#bib.bib93)\]\.

The mathematical formulation for Tool Utilization Efficacy is:

T​U​E=α⋅\(Tool Selection Accuracy\)\+β⋅\(Tool Usage Efficiency\)\+γ⋅\(API Call Precision\)TUE=\\alpha\\cdot\(\\text\{Tool Selection Accuracy\}\)\\\\ \+\\beta\\cdot\(\\text\{Tool Usage Efficiency\}\)\\\\ \+\\gamma\\cdot\(\\text\{API Call Precision\}\)whereα,β,γ\\alpha,\\beta,\\gammaare adjusted tunable weights based on the specific criticality of the application\. In this context,Tool Selection Accuracyrefers to the rate at which the AI chooses the most appropriate tool for a given task, whileTool Usage Efficiencyprovides a measure of how optimally the AI utilizes those selected tools by considering factors such as unnecessary calls and resource usage\. Finally,API Call Precisionaccounts for the precision and appropriateness of the specific parameters used during the execution of those API calls\[[87](https://arxiv.org/html/2607.18548#bib.bib91)\]\.

This metric is particularly important for applications such as flight planning or medical diagnosis, where selecting the wrong data source \(e\.g\., using a weather API instead of a NOTAM database\) could paralyze the entire workflow\[[78](https://arxiv.org/html/2607.18548#bib.bib93)\]\.

#### VII\-A2Memory Coherence and Retrieval \(MCR\)

Agents must maintain persistent context over long time horizons, unlike traditional chatbots\. An agent may ”forget” user\-imposed constraints due to memory issues, such as context window saturation or ineffective retrieval, leading to undesired results\. The agent’s capacity to retain and use information is measured by MCR:

M​C​R=Cp​s×Ri​n​f​o1\+Lr​e​t,MCR=\\frac\{\\text\{$C\_\{ps\}$\}\\times\\text\{$R\_\{info\}$\}\}\{1\+\\text\{$L\_\{ret\}$\}\},\(1\)where the constituent variables are defined as:

- •Context Preservation Score \(Cp​sC\_\{ps\}\):The ratio of maintained contextual anchorsAmA\_\{m\}to the total active anchorsAtA\_\{t\}established in the prompt sequence, calculated asCp​s=AmAtC\_\{ps\}=\\frac\{A\_\{m\}\}\{A\_\{t\}\}\. This measures the agent’s logical consistency across a session\.
- •Information Retention Rate \(Ri​n​f​oR\_\{info\}\):The proportion of specific data pointsIIsuccessfully retrieved from a long\-term memory store or past context after a decay period or token offset, defined asRi​n​f​o=Ir​e​c​a​l​l​e​dIt​o​t​a​lR\_\{info\}=\\frac\{I\_\{recalled\}\}\{I\_\{total\}\}\.
- •Retrieval Latency \(Lr​e​tL\_\{ret\}\):The temporal delay \(usually measured in seconds for human applications\) between a query and the successful injection of retrieved context into the model’s active window\. The constant11is added to the denominator to normalize for near\-zero latency and prevent mathematical instability\[[87](https://arxiv.org/html/2607.18548#bib.bib91),[88](https://arxiv.org/html/2607.18548#bib.bib90),[78](https://arxiv.org/html/2607.18548#bib.bib93)\]\.

The Information Retention Rate is measured by tagging specific data items and checking for their correct retrieval across intervals\. High retrieval latency is penalized because slow agent responses can make a system impractical for real\-time operations, especially during pre\-flight checks or intrusion response\[[124](https://arxiv.org/html/2607.18548#bib.bib95)\]\.

#### VII\-A3Strategic Planning Index \(SPI\)

Strategy formulation can be seen as the cognitive core of agentic AI\. The SPI assesses the agent’s proficiency in goal decomposition and its ability to adapt to environmental change\.

The index is defined by the following equation:

S​P​I=\(G​D​E⋅P​A\)⋅\(1−P​E​E​R\)SPI=\(GDE\\cdot PA\)\\cdot\(1\-PEER\)\(2\)
Where the constituent metrics are defined as:

- •Goal Decomposition Efficiency \(GDE\):The AI’s ability to break down complex, multi\-stage goals into logical, manageable sub\-tasks\. This is the ratio of successfully identified sub\-tasks to the optimal number of steps required for a goal \(G​D​E=S​u​b​t​a​s​k​si​d​e​n​t​i​f​i​e​dS​u​b​t​a​s​k​so​p​t​i​m​a​lGDE=\\frac\{Subtasks\_\{identified\}\}\{Subtasks\_\{optimal\}\}\)\.
- •Plan Adaptability \(PA\):The degree to which the agent adjusts its roadmap in response to dynamic circumstances or unforeseen constraints\. This is measured by the percentage of successful reroutes completed within a predefined latency threshold after an environmental trigger\.
- •Plan Execution Error Rate \(PEER\):The frequency of failures or deviations encountered during the physical or digital execution of planned actions\[[87](https://arxiv.org/html/2607.18548#bib.bib91)\]\. This is simply the total number of failed actions divided by the total number of attempted steps in a mission \(P​E​E​R=F​a​i​l​u​r​e​sT​o​t​a​l​\_​S​t​e​p​sPEER=\\frac\{Failures\}\{Total\\\_Steps\}\)\.

Planning failures frequently manifest when an agent’s internal model is too rigid\. For instance, in aviation, a failure to adapt to a suddenTemporary Flight Restriction \(TFR\)can compromise a mission\. Similarly, in critical infrastructure, an agent must be able to instantly reroute planning during achange in network topologyin a power grid to maintain stability\. A high SPI indicates an agent that is not only a precise planner but also a resilient executor in stochastic environments\[[78](https://arxiv.org/html/2607.18548#bib.bib93)\]\.

#### VII\-A4Component Synergy Score \(CSS\)

The CSS evaluates the caliber of interactions in multi\-agent systems, where independent agents work together to resolve challenging issues:

C​S​S=C​C​U​R⋅W​C​I1\+C​C​RCSS=\\frac\{CCUR\\cdot WCI\}\{1\+CCR\}\(3\)
where the constituent variables are defined as:

- •Cross\-Component Utilization Rate\(C​C​U​RCCUR\): How often information or outputs from one component are effectively used by another\. This is calculated as the ratio of successfully ingested shared outputs to the total number of outputs generated\.
- •Workflow Cohesion Index\(W​C​IWCI\): A measure of the seamless integration among components\. This would be the inverse of the average latency, or ”handoff friction,” between agents, where 1 represents a seamless, immediate transition\.
- •Component Conflict Rate\(C​C​RCCR\): The frequency of conflicts or inconsistencies between different components\[[87](https://arxiv.org/html/2607.18548#bib.bib91)\]\. This is the number of redundant tasks or deadlocked states divided by the total number of task cycles\.

Cross\-component utilization tracks how effectively information flows between specialized agents \(e\.g\., a ”researcher agent” and a ”summarizer agent”\)\[[87](https://arxiv.org/html/2607.18548#bib.bib91)\]\. A high Component Conflict Rate indicates that agents duplicate work, oscillate handoffs, or create deadlocks, all of which erode system\-level trust\[[88](https://arxiv.org/html/2607.18548#bib.bib90),[114](https://arxiv.org/html/2607.18548#bib.bib92)\]\.

### VII\-BSafety and Policy Adherence

The ”Safety Gap”, the notable discrepancy between nominal task completion and policy\-compliant execution, is a crucial finding in recent agentic research\. Agents often use shortcuts or disregard safety procedures to achieve high success rates, according to benchmarks such as ST\-WebAgentBench\[[58](https://arxiv.org/html/2607.18548#bib.bib96)\]and AgentHarm\[[11](https://arxiv.org/html/2607.18548#bib.bib39)\]\. This type of metric is particularly important for enterprise applications\.

ST\-WebAgentBench introduces the Completion Under Policy \(CuP\) metric to evaluate agents against enterprise\-grade constraints across six dimensions: User Consent, Boundary Compliance, Strict Execution, Hierarchy Adherence, Robustness, and Error Handling\[[58](https://arxiv.org/html/2607.18548#bib.bib96),[101](https://arxiv.org/html/2607.18548#bib.bib97)\]\. The associated metrics, including Completion Rate \(CR\), Completion Under Policy \(CuP\), Partial CuP \(pCuP\), and Risk Ratio, are summarized alongside all other section metrics in Table[IV](https://arxiv.org/html/2607.18548#S7.T4)\.

For example, an agent adhering to Boundary Compliance would be restricted from finalizing any financial transaction exceeding $5,000 without first surfacing a request for dual authorization from a verified human supervisor\.

According to evaluations of state\-of\-the\-art agents, over 38% of successful tasks violated at least one safety policy, with the CuP dropping to 15\.0% even though the nominal success \(CR\) may reach 24\.3%\[[58](https://arxiv.org/html/2607.18548#bib.bib96)\]\. For instance, the company may be held legally liable if a sales representative retrieves pricing successfully but does so by scraping unapproved competitor websites\. Agents are unintentionally encouraged to avoid approval workflows or to disregard consent checks to maximize efficiency if only CR is measured\[[101](https://arxiv.org/html/2607.18548#bib.bib97)\]\.

### VII\-CMeasuring Goal Drift

Goal Drift, or an agent’s tendency to progressively stray from its initially specified objective, poses a serious risk to autonomous agents operating independently for extended periods\[[108](https://arxiv.org/html/2607.18548#bib.bib101)\]\. Even though an agent may begin a task perfectly aligned, its objectives may shift subtly as it gives in to external pressures or pursues instrumental ends, such as generating money to accomplish a larger mission\. In other words, an agent is more likely to ”forget” the mission’s original purpose and begin imitating the distractions it encounters in its own conversation history, the more involved it becomes in its work\[[12](https://arxiv.org/html/2607.18548#bib.bib100)\]\.

#### VII\-C1Detecting Drift

It is challenging to identify goal drift because it is not always abrupt; rather, it is a gradual deterioration of intent that is missed by single\-turn benchmarks\. Researchers use a Goal\-Drift Score to quantify this\[[12](https://arxiv.org/html/2607.18548#bib.bib100)\], which penalizes deviations by directly comparing the agent’s intermediate plan states and actions to the original specification\. This is frequently divided into two distinct behaviors:

- •Goal Drift through Actions \(Commissions\):This gauges instances in which an agent willfully acts improperly, such as purchasing stocks that defy a ”green” mandate in the name of profit\.
- •Goal Drift through Inaction \(Omissions\):This is more frequent and occurs when an agent neglects to correct a misaligned state, like when it was instructed to switch back to a carbon\-neutral goal but neglects to sell off ”dirty” stocks\.

Even the best models, such as Claude 3\.5 Sonnet, have demonstrated detectable drift in simulated stock trading environments after about 100,000 interactions\[[12](https://arxiv.org/html/2607.18548#bib.bib100)\]\. This drift is closely linked to ”pattern\-matching”; instead of following the system prompt hidden at the very top, the model starts treating the various distractions and conflicting goals in its context window as the new ”norm” to follow\.

#### VII\-C2Mitigation

Practitioners employ Strong Goal Elicitation to halt the ”drift\.” Rather than simply telling an agent to ”minimize emissions,” you need to give it explicit instructions to ignore all other pressures and concentrate only on the main objective\. This ”strong” instruction greatly improves an agent’s resilience against adversarial noise, according to research\. Moreover, the agent’s ”eyes on the prize” can be maintained during long\-horizon tasks by implementing explicit goal reminders or constrained planning mechanisms\[[108](https://arxiv.org/html/2607.18548#bib.bib101)\]\.

Beyond following technical standards, it is important to assess the agent’s ethical profile using a Harm\-Reduction Index\. This index offers a complete view of the system by combining three qualitative measures:

- •Hallucination Rate:How often the agent makes false claims\.
- •Toxicity Score:Identifying harmful outputs or biased language\.
- •Fairness Metrics:Evaluating if the agent’s actions lead to fair outcomes for different groups\.

By merging behavioral Goal\-Drift Scores with broader safety indices discussed in previous sections, evaluators can ensure that an agent is not only efficient in its task but also remains aligned with human values throughout its operational life\[[108](https://arxiv.org/html/2607.18548#bib.bib101)\]\.

### VII\-DDomain\-Specific Metrics

The idea of trustworthiness is not fixed; it varies depending on a system’s specific context and goals\. For example, in critical infrastructure, a power grid agent sees trustworthiness as physical reliability\. Its main job is to continually meet hardware requirements, such as voltage stability and frequency control, to avoid major blackouts\. In contrast, a cybersecurity agent works within a logic\-based system\. Here, trust is judged by how well it can implement quick containment measures and handle escalation processes to reduce digital threats\. The first focuses on physical laws, while the second focuses on protecting information integrity\. Therefore, an agent considered ”trustworthy” in one area may not work well in the other because of these differing priorities\.

#### VII\-D16G and Autonomous UAV Systems \(α3\\alpha^\{3\}\-Bench\)

For autonomous Unmanned Aerial Vehicles \(UAVs\) operating under the dynamic and often unpredictable constraints of next\-generation networking, theα3\\alpha^\{3\}\-Bench framework introduces a unified evaluation paradigm\[[34](https://arxiv.org/html/2607.18548#bib.bib98)\]\. Unlike traditional benchmarks that focus on isolated reasoning tasks,α3\\alpha^\{3\}\-Bench models mission execution as a language\-mediated, multi\-turn control loop between an LLM\-based agent and a human operator, grounded in realistic 6G conditions\[[34](https://arxiv.org/html/2607.18548#bib.bib98)\]\.

The framework evaluates agent performance through a compositeα3\\alpha^\{3\}metric, which aggregates six critical pillars into a weighted score:

- •Task Outcome \(TO\):Measures mission completion success and adherence to strict JSON schema requirements\.
- •Safety Policy \(SP\):Assesses compliance with flight constraints\. The score is initialized at 1\.0, with fixed penalties for altitude violations and No\-Fly Zone \(NFZ\) intrusions\[[34](https://arxiv.org/html/2607.18548#bib.bib98)\]\.
- •Tool Consistency \(TC\):Evaluates the semantic and structural alignment between the agent’s Model Context Protocol \(MCP\) tool calls and the resulting environmental observations\.
- •Interaction Quality \(IQ\):Measures the grounding of the dialogue and ensures strict speaker alternation between the operator and the agent\.
- •Network Robustness \(NR\):Quantifies the agent’s resilience and adaptive reasoning under degraded 6G conditions, including jitter, packet loss, and fluctuating latency\.
- •Communication Cost \(CC\):Penalizes excessive token consumption and redundant protocol overhead to encourage efficient reasoning\.

To facilitate cross\-model comparison across varying computational footprints,α3\\alpha^\{3\}\-Bench introduces reliability\-adjusted and efficiency\-normalized scores:αper\-sec3\\alpha^\{3\}\_\{\\text\{per\-sec\}\}\(performance per second of latency\) andαper\-1k3\\alpha^\{3\}\_\{\\text\{per\-1k\}\}\(performance per 1,000 tokens\)\[[34](https://arxiv.org/html/2607.18548#bib.bib98)\]\. Empirical evaluations using this benchmark reveal that while state\-of\-the\-art frontier models maintain high baseline mission success \(TO and SP≥0\.95\\geq 0\.95\), their performance robustness can degrade by 30–40% under adverse network conditions\[[34](https://arxiv.org/html/2607.18548#bib.bib98)\]\. These findings highlight a critical gap in current agent design, underscoring the need for network\-aware architectures to enable reliable 6G\-enabled aerial autonomy\.

#### VII\-D2Cybersecurity Operations

In today’s security operations, the main aim of using autonomous agents is to reduce alert fatigue and improve threat containment lifecycles\. People now assess Traditional Security Operations Centers \(SOCs\) and Managed Detection and Response \(MDR\) services more on how well they can shift from human\-based triage to agent\-assisted responses\[[124](https://arxiv.org/html/2607.18548#bib.bib95)\]\.

The efficacy of these agents is quantified through a set of core operational metrics, including Mean Time to Detect \(MTTD\), Mean Time to Respond \(MTTR\), Containment Rate, and Escalation Rate, which are summarized alongside all other section metrics in Table[IV](https://arxiv.org/html/2607.18548#S7.T4)\. These metrics serve as benchmarks for evaluating the autonomy and reliability of security agents in dynamic enterprise environments\.

While both SOC and MDR frameworks use these metrics, MDR models usually prioritize Detection Accuracy, which is the ratio of True Positives to False Positives\. This focus is important because autonomous agents that create too many false alarms can disrupt real business workflows\. This undermines the operational efficiency they are meant to improve\. As a result, the development of cybersecurity agents is moving toward ”risk\-based outcomes\.” Here, success is measured by reducing material impact rather than just counting the number of alerts handled\.

#### VII\-D3Adversarial Robustness and Security Metrics

Trustworthiness is seriously damaged if a system can be directed toward harmful purposes\. Adversarial testing for agents should go beyond single\-turn ”jailbreaks” and focus on multi\-turn ”exploit generation\.\[[17](https://arxiv.org/html/2607.18548#bib.bib108)\]”

The HarmBench framework offers a standardized way to evaluate ”robust refusal behaviors\.\[[73](https://arxiv.org/html/2607.18548#bib.bib44)\]” It measures Attack Success Rate using an open\-source classifier calibrated to GPT\-4 validation accuracy\.

A​S​R=1N​∑i=1NSuccess​\(fT​\(xi\),y\)ASR=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\text\{Success\}\(f\_\{T\}\(x\_\{i\}\),y\)\(4\)
Experimental results indicate that larger models do not ensure better safety\. In fact, vision\-based LLM agents show ASRs of up to 80% in certain contextual attacks\[[73](https://arxiv.org/html/2607.18548#bib.bib44)\]\. Additionally, while automated attacks like GCG result in low ASRs on some defenses, multi\-turn human red teaming can uncover failures with ASRs reaching 75%\. This shows that relying only on numbers can give a false sense of security\[[96](https://arxiv.org/html/2607.18548#bib.bib107)\]\.

Beyond operational performance, the trustworthiness of autonomous agents depends on their ability to resist attacks and prevent data theft\. Additional security\-focused metrics include:

- •PII Leakage Rate:Measures how often an agent accidentally reveals Personally Identifiable Information \(PII\) from its underlying weights or Retrieval\-Augmented Generation \(RAG\) data stores\. This is an important privacy metric for agents managing sensitive enterprise or user data\[[128](https://arxiv.org/html/2607.18548#bib.bib104),[71](https://arxiv.org/html/2607.18548#bib.bib106)\]\.
- •Jailbreak Success Rate \(JSR\):Quantifies the proportion of adversarial prompts, like ”Do Anything Now” \(DAN\) variants or complex role\-play attacks, that successfully get past the model’s safety measures and refusal layers\[[71](https://arxiv.org/html/2607.18548#bib.bib106)\]\.
- •Prompt Infection Probability:In multi\-agent systems, this metric tracks how quickly a single harmful input can spread through a group\. It can ruin the execution state or decision\-making logic of other agents through communication between them\[[86](https://arxiv.org/html/2607.18548#bib.bib105)\]\.
- •Chain\-of\-Trigger \(CoTri\) Robustness:Evaluates the agent’s ability to resist sequential, multi\-step triggers that aim to divert it from its main mission through gradual manipulation\. Recent research on agentic backdoors suggests that this metric checks if the agent maintains task integrity when faced with ”Chain\-of\-Trigger” sequences that unexpectedly try to influence robustness using hidden triggers\[[86](https://arxiv.org/html/2607.18548#bib.bib105)\]\.

TABLE IV:Quantitative Metrics for Agentic Workflows and Their Trustworthiness Implications- •Note:S&CS = safety and constraint satisfaction; R&R = robustness and reliability; T&I = transparency and interpretability; A&A = accountability and auditability; P&S = privacy and security\.

## VIIIApplications in Power Systems

Power systems provide a representative critical infrastructure domain for studying trustworthy agentic AI because grid operations combine cyber\-physical dynamics, strict engineering constraints, safety\-critical decisions, and human operator oversight\. Recent work shows a transition from conventional AI models for forecasting, optimization, and control toward LLM\-enabled agents that can interpret natural\-language requests, retrieve grid\-specific knowledge, invoke external solvers, and coordinate multi\-step workflows\. Roadmap and review studies frame this transition as a shift from passive model\-in\-the\-loop analytics\[[104](https://arxiv.org/html/2607.18548#bib.bib75),[105](https://arxiv.org/html/2607.18548#bib.bib76),[8](https://arxiv.org/html/2607.18548#bib.bib78),[103](https://arxiv.org/html/2607.18548#bib.bib77)\], to agent\-in\-the\-loop grid intelligence, where foundation models, standardized tool interfaces, and workflow orchestration support planning, operations, restoration, and energy management tasks \(Fig\.[6](https://arxiv.org/html/2607.18548#S8.F6)\)\[[133](https://arxiv.org/html/2607.18548#bib.bib173),[127](https://arxiv.org/html/2607.18548#bib.bib174),[56](https://arxiv.org/html/2607.18548#bib.bib175),[37](https://arxiv.org/html/2607.18548#bib.bib176)\]\. The reviewed works, therefore, reveal two sides of the same story: emerging design patterns that make power\-system workflows more agentic, and systemic failure modes that appear when semantic reasoning, tool invocation, and operational decision support are connected to critical grid functions\.

![Refer to caption](https://arxiv.org/html/2607.18548v1/Figures/ps_mas_2.png)Figure 6:Power\-systems adaptation of the multi\-agent agentic AI architecture\.### VIII\-AEmerging Design Patterns

#### VIII\-A1Agent\-in\-the\-Loop Grid Intelligence

A first design pattern is the progression from task\-specific AI models toward agent\-in\-the\-loop grid intelligence\. This evolution can be summarized in three stages\. The first stage corresponds to traditional AI/ML methods used as task\-specific predictors, classifiers, or optimizers\. The second stage introduces LLM\-assisted power systems, where models support dispatchers and engineers through natural\-language interaction, data interpretation, code generation, and simulation\. GAIA and local fine\-tuned/RAG\-based LLM environments are examples of this assistant\-oriented phase\[[21](https://arxiv.org/html/2607.18548#bib.bib171),[112](https://arxiv.org/html/2607.18548#bib.bib172)\]\. The third stage is agentic AI, in which the model is embedded within an architecture capable of planning, tool invocation, memory/context management, feedback correction, and multi\-agent coordination\. Representative examples include X\-GridAgent for power\-grid analysis\[[122](https://arxiv.org/html/2607.18548#bib.bib164)\], GridMind for OPF and contingency analysis\[[53](https://arxiv.org/html/2607.18548#bib.bib165)\], PowerChain for distribution\-grid workflow automation\[[13](https://arxiv.org/html/2607.18548#bib.bib166)\], Grid\-Agent for violation remediation\[[135](https://arxiv.org/html/2607.18548#bib.bib167)\], DrAgent for disturbance\-record analysis\[[98](https://arxiv.org/html/2607.18548#bib.bib168)\], and agentic planning frameworks for simulation orchestration\[[136](https://arxiv.org/html/2607.18548#bib.bib169)\]\.

This pattern is important because it changes the role of AI in power systems\. The model is no longer only producing a prediction or recommendation; it is increasingly embedded in a workflow that interprets operator intent, selects tools, reasons over intermediate results, and supports multi\-step engineering tasks\. Its trustworthiness value comes from making grid intelligence more interactive, modular, and operator\-facing, while still allowing domain tools and human oversight to remain part of the loop\.

#### VIII\-A2Solver\-in\-the\-Loop Engineering Grounding

A second design pattern is the separation of semantic reasoning from numerical execution\. Across the selected literature, LLMs interpret user intent, decompose tasks, retrieve context, and select actions, while trusted engineering tools perform power\-flow, OPF, contingency, simulation, or scheduling computations\. This solver\-in\-the\-loop design is central to GridMind, X\-GridAgent, PowerChain\[[53](https://arxiv.org/html/2607.18548#bib.bib165),[122](https://arxiv.org/html/2607.18548#bib.bib164),[13](https://arxiv.org/html/2607.18548#bib.bib166)\]and a feedback\-driven simulation framework\[[52](https://arxiv.org/html/2607.18548#bib.bib170)\]\.

This pattern directly supports safety and constraint satisfaction\. In power systems, agent outputs must respect voltage limits, thermal ratings, generation constraints, power\-flow feasibility, restoration requirements, and user/device constraints\. Grounding LLM reasoning in deterministic solvers, simulators, domain\-specific tools, or verified workflows reduces unsupported language\-model reasoning\[[53](https://arxiv.org/html/2607.18548#bib.bib165),[122](https://arxiv.org/html/2607.18548#bib.bib164),[52](https://arxiv.org/html/2607.18548#bib.bib170),[13](https://arxiv.org/html/2607.18548#bib.bib166)\]\. Grid\-Agent goes further by adding a validation agent, sandboxed execution, and rollback before accepting remediation actions\[[135](https://arxiv.org/html/2607.18548#bib.bib167)\]\. GAIA also evaluates safety but remains explicitly advisory, leaving final decisions to human dispatchers\[[21](https://arxiv.org/html/2607.18548#bib.bib171)\]\. Together, these works show that solver\-in\-the\-loop grounding is becoming a central design principle for trustworthy power\-system agents\.

#### VIII\-A3Hierarchical Specialization and Feedback\-Corrected Workflows

A third design pattern is hierarchical agent specialization, where different agents perform planning, execution, validation, enhancement, or appliance\-level control\. Grid\-Agent, the agentic planning framework, and the HEMS agent demonstrate this modular structure\[[135](https://arxiv.org/html/2607.18548#bib.bib167),[136](https://arxiv.org/html/2607.18548#bib.bib169),[30](https://arxiv.org/html/2607.18548#bib.bib177)\]\. This structure supports workflow decomposition: one component can plan, another can execute, another can validate, and another can explain or refine the result\.

A closely related pattern is feedback\-based reliability improvement\. Several works introduce mechanisms that improve agent behavior after errors or incomplete executions\. The introduced in\[[52](https://arxiv.org/html/2607.18548#bib.bib170)\]use feedback\-driven correction for simulations; DrAgent repairs malformed tool\-call arguments and caches repeated computations\[[98](https://arxiv.org/html/2607.18548#bib.bib168)\]; PowerChain uses expert\-verified reasoning trajectories to improve generalization to unseen distribution\-grid analyses\[[13](https://arxiv.org/html/2607.18548#bib.bib166)\]; and Grid\-Agent uses adaptive network representations and validation\-based remediation\[[135](https://arxiv.org/html/2607.18548#bib.bib167)\]\. These methods demonstrate that agentic workflows can outperform direct prompting and improve task completion in grid\-analysis settings\. Their trustworthiness stems from making power\-system agents less dependent on a single, fragile model response and more capable of iterative correction\.

#### VIII\-A4Human\-Facing Assistance Across the Power\-System Stack

A fourth design pattern is the use of agentic AI as a human\-facing interface across different levels of the power\-system stack\. At the bulk\-system level, GAIA supports dispatch, operation monitoring, operation adjustment, and black\-start reasoning, while PowerAgent and foundation\-model studies outline broader visions for operator copilots and grid\-aware AI workflows\[[21](https://arxiv.org/html/2607.18548#bib.bib171),[133](https://arxiv.org/html/2607.18548#bib.bib173),[127](https://arxiv.org/html/2607.18548#bib.bib174)\]\. For grid analysis, X\-GridAgent and GridMind automate power\-flow, OPF, contingency, and topology\-related workflows through natural\-language interfaces and solver calls\[[122](https://arxiv.org/html/2607.18548#bib.bib164),[53](https://arxiv.org/html/2607.18548#bib.bib165)\]\. For distribution systems, PowerChain targets automated analysis workflows on real utility data\[[13](https://arxiv.org/html/2607.18548#bib.bib166)\]\. For control\-oriented applications, Grid\-Agent studies violation detection and remediation under voltage, thermal, and connectivity constraints\[[135](https://arxiv.org/html/2607.18548#bib.bib167)\]\. For event analysis, DrAgent applies tool\-using agents to disturbance records\[[98](https://arxiv.org/html/2607.18548#bib.bib168)\]\. Finally, the HEMS framework extends agentic AI to behind\-the\-meter residential scheduling from natural\-language user preferences\[[30](https://arxiv.org/html/2607.18548#bib.bib177)\]\.

This pattern improves usability and interpretability by exposing intermediate plans, tool calls, retrieved context, solver outputs, and natural\-language explanations\. GridMind and X\-GridAgent make grid studies more accessible by translating complex solver\-driven analyses into conversational workflows\[[53](https://arxiv.org/html/2607.18548#bib.bib165),[122](https://arxiv.org/html/2607.18548#bib.bib164)\]\. DrAgent provides step\-by\-step reasoning for fault analysis, allowing operators to inspect the diagnostic process\[[98](https://arxiv.org/html/2607.18548#bib.bib168)\]\. The HEMS agent similarly improves user interaction by translating natural\-language preferences into appliance schedules\[[30](https://arxiv.org/html/2607.18548#bib.bib177)\]\. These features matter because power\-system operators and users need to understand not only the final recommendation but also the assumptions and computational path behind it\.

### VIII\-BSystemic Failure Modes

#### VIII\-B1Empirical Safety Without Formal Assurance

The first failure mode is that safety is still treated mostly as empirical validation rather than formal assurance\. Current systems often check whether generated workflows, simulations, schedules, or recommendations are feasible, but they do not prove that the agentic loop cannot produce unsafe intermediate actions, invalid tool calls, or harmful recommendations under distribution shift\. This is especially important in power systems because even advisory outputs can shape operator decisions under time pressure\.

The failure mode is therefore not a lack of safety awareness, but a gap between checked feasibility and assured constraint satisfaction\. Solver\-in\-the\-loop architectures reduce unsupported LLM reasoning, and validation agents or rollback mechanisms improve safety in specific workflows\[[53](https://arxiv.org/html/2607.18548#bib.bib165),[122](https://arxiv.org/html/2607.18548#bib.bib164),[52](https://arxiv.org/html/2607.18548#bib.bib170),[13](https://arxiv.org/html/2607.18548#bib.bib166),[135](https://arxiv.org/html/2607.18548#bib.bib167)\]\. However, future systems need explicit safety envelopes, precondition checks for tool calls, fail\-safe fallback policies, and clear separation between advisory, supervisory, and actuation privileges\.

#### VIII\-B2Narrow Robustness Evidence

The second failure mode is that robustness evaluation remains narrow\. Most evaluations are conducted on benchmark test systems, curated simulation tasks, real disturbance records, utility analysis queries, or price\-based scheduling scenarios\[[53](https://arxiv.org/html/2607.18548#bib.bib165),[52](https://arxiv.org/html/2607.18548#bib.bib170),[13](https://arxiv.org/html/2607.18548#bib.bib166),[98](https://arxiv.org/html/2607.18548#bib.bib168),[30](https://arxiv.org/html/2607.18548#bib.bib177)\]\. These settings are valuable, but they do not fully capture long\-horizon operation, cascading failures, corrupted telemetry, adversarial prompts, stale topology, or tool\-chain outages\.

GAIA makes this limitation visible by revealing weaknesses under rare events, where correct recommendations may still be delayed, or insufficiently urgent\[[21](https://arxiv.org/html/2607.18548#bib.bib171)\]\. Thus, current reliability evidence supports feasibility but not yet deployment\-grade robustness\. For trustworthy power\-system agents, robustness must be evaluated not only by task\-completion rate, but also by behavior under rare contingencies, degraded observability, unavailable tools, adversarial inputs, and changing grid states\.

#### VIII\-B3Visible Reasoning Without Validated Interpretability

The third failure mode is the gap between explanation visibility and validated interpretability\. Agentic systems often expose reasoning steps, tool calls, retrieved information, or natural\-language explanations\. These traces are useful for debugging and operator interaction, but they do not guarantee that the explanation is faithful, complete, or calibrated to operator needs\.

The review papers emphasize explainability and operator trust as central requirements\[[56](https://arxiv.org/html/2607.18548#bib.bib175),[37](https://arxiv.org/html/2607.18548#bib.bib176)\], yet most application papers do not evaluate explanation quality through human\-subject studies, trust calibration, or improvements in operator decision\-making\. This matters because a plausible explanation can still hide an incorrect assumption, an invalid retrieved context, or a misleading chain of reasoning\. For power\-system agents, interpretability must therefore move beyond exposing workflow traces toward validating whether those traces actually improve operator understanding and decision quality\.

#### VIII\-B4Incomplete Accountability Across Agentic Workflows

The fourth failure mode is the lack of end\-to\-end accountability across agentic grid workflows\. Accountability requires that agent outputs be traceable to user inputs, retrieved data, tool calls, intermediate states, validation results, and human approvals\. Some systems provide partial auditability by construction\. PowerChain represents analyses as workflow trajectories\[[13](https://arxiv.org/html/2607.18548#bib.bib166)\]; GridMind preserves analytical state and solver\-related information\[[53](https://arxiv.org/html/2607.18548#bib.bib165)\]; X\-GridAgent uses modular servers and memory mechanisms\[[122](https://arxiv.org/html/2607.18548#bib.bib164)\]; and DrAgent produces explicit tool\-call plans for fault\-analysis tasks\[[98](https://arxiv.org/html/2607.18548#bib.bib168)\]\. These artifacts can support post\-hoc review and debugging\.

However, most papers do not define accountability as a first\-class design objective\. They rarely specify responsibility assignment, operator override logging, tamper\-evident records, approval chains, or compliance integration with utility procedures\. For critical infrastructure, auditability must move beyond recording tool calls toward structured governance: who requested the action, what data were used, which constraints were checked, who approved the recommendation, and how the system can be reconstructed after an incident\.

#### VIII\-B5Expanded Misuse Attack Surface

The fifth failure mode is the expanded security and misuse attack surface introduced by tool\-using power\-system agents\. Security is one of the least mature trustworthiness dimensions in the reviewed literature on power\-system agents\. Tool\-using agents increase grounding and numerical reliability, but they also expand the attack surface through APIs, simulators, databases, RAG pipelines, memory modules, and actuation interfaces\. MCP\-style and tool\-based architectures in PowerAgent, X\-GridAgent, GridMind, Jia et al\., and HEMS therefore create potential risks such as prompt injection, malicious retrieval, tool misuse, unauthorized execution, and data leakage\[[133](https://arxiv.org/html/2607.18548#bib.bib173),[122](https://arxiv.org/html/2607.18548#bib.bib164),[53](https://arxiv.org/html/2607.18548#bib.bib165),[52](https://arxiv.org/html/2607.18548#bib.bib170),[30](https://arxiv.org/html/2607.18548#bib.bib177)\]\.

Some works partially address security\-relevant concerns\. The local fine\-tuned LLM environment emphasizes offline operation for sensitive power\-system data\[[112](https://arxiv.org/html/2607.18548#bib.bib172)\], while Grid\-Agent considers cyberattack\-induced grid violations as part of its remediation context\[[135](https://arxiv.org/html/2607.18548#bib.bib167)\]\. Reviews also identify cyber\-physical security, failure modes, and safe deployment as major concerns\[[56](https://arxiv.org/html/2607.18548#bib.bib175),[37](https://arxiv.org/html/2607.18548#bib.bib176)\]\. Nevertheless, systematic security evaluation is largely missing\. Future power\-system agents should include least\-privilege tool access, typed function schemas, sandboxing, provenance checks for retrieved data, adversarial testing, and explicit authorization barriers for high\-impact actions\.

### VIII\-CSynthesis

The reviewed works show that agentic AI in power systems is advancing through four useful design patterns: agent\-in\-the\-loop grid intelligence, solver\-in\-the\-loop engineering grounding, hierarchical and feedback\-corrected workflows, and human\-facing assistance across the grid stack\. These patterns make grid analysis, simulation, dispatch support, disturbance analysis, distribution\-grid workflows, and residential scheduling more interactive, modular, and capable of supporting multi\-step engineering tasks\[[122](https://arxiv.org/html/2607.18548#bib.bib164),[53](https://arxiv.org/html/2607.18548#bib.bib165),[13](https://arxiv.org/html/2607.18548#bib.bib166),[135](https://arxiv.org/html/2607.18548#bib.bib167),[98](https://arxiv.org/html/2607.18548#bib.bib168),[136](https://arxiv.org/html/2607.18548#bib.bib169),[52](https://arxiv.org/html/2607.18548#bib.bib170),[21](https://arxiv.org/html/2607.18548#bib.bib171),[30](https://arxiv.org/html/2607.18548#bib.bib177)\]\. At the same time, they expose five systemic failure modes: safety remains mostly empirical, robustness evidence is narrow, explanations are not yet validated, accountability is incomplete, and security evaluation remains underdeveloped\.

The central lesson is that trustworthy power\-system agents must be evaluated not only by task success, but also by unsafe\-action rate, constraint\-violation severity, robustness to rare events, explanation usefulness, audit completeness, security against misuse, and human override behavior\. For power systems, the main challenge is not whether LLM agents can assist engineers, but whether their autonomy can be bounded, verified, monitored, and governed well enough for critical\-infrastructure environments\.

Table[V](https://arxiv.org/html/2607.18548#S12.T5)summarizes representative agentic AI systems in power\-system applications and evaluates them through our trustworthiness dimensions\.

## IXApplications in Autonomous Vehicles, Robotics, and UAVs

Autonomous vehicles, robotics, and UAVs provide a high\-stakes, embodied setting for trustworthy agentic AI, as decisions made by agents can directly affect physical motion, human safety, and cyber\-physical infrastructure\. In these systems, the agentic loop does not end with text generation or recommendation; it can extend from perception and reasoning to planning, control, and actuation \(Fig\.[7](https://arxiv.org/html/2607.18548#S9.F7)\)\. This creates a sharper trust problem than in purely digital domains\. The reviewed works, therefore, reveal two sides of the same story: emerging design patterns that bind high\-level autonomy to safety, monitoring, and accountability mechanisms, and systemic failure modes that appear when perception, reasoning, communication, and actuation are connected in real\-world environments\.

![Refer to caption](https://arxiv.org/html/2607.18548v1/Figures/uav_mas.png)Figure 7:Robotics adaptation of the multi\-agent agentic AI architecture\.### IX\-AEmerging Design Patterns

#### IX\-A1Actuation\-Level Safety Filters and Runtime Assurance

A major design pattern is to place formally motivated or runtime\-enforced safety mechanisms at the actuation boundary\. Control Barrier Functions \(CBFs\) enforce forward\-invariance constraints so that the system remains within a safe set during operation\[[10](https://arxiv.org/html/2607.18548#bib.bib146)\]\. Black\-Box Simplex architectures provide a runtime assurance structure that can switch from an advanced controller to a verified safety controller without requiring full access to the internal model\[[75](https://arxiv.org/html/2607.18548#bib.bib147)\]\. Runtime assurance for learning\-enabled autonomous driving applies a similar principle by wrapping a learned planner with a low\-level safety monitor\[[20](https://arxiv.org/html/2607.18548#bib.bib148)\]\.

This pattern is important because it separates high\-level planning from low\-level safety enforcement\. The high\-level agent may reason, plan, or propose actions, but the final actuation layer is constrained by a safety mechanism that can reject or override unsafe behavior\. Its trustworthiness value comes from reducing the risk that an unverified agent directly controls physical motion without a validated safety backstop\.

#### IX\-A2Layered Trust Architectures for Verified Autonomy

A second design pattern is the use of layered trust architectures that combine regulatory, architectural, and hardware\-based controls\. Regulatory frameworks such as UNECE WP\.29 R155 and ISO/SAE 21434 emphasize cybersecurity management, traceability, and lifecycle\-based security engineering for vehicles\[[81](https://arxiv.org/html/2607.18548#bib.bib162),[109](https://arxiv.org/html/2607.18548#bib.bib163)\]\. These standards do not, by themselves, solve the agentic trust problem, but they establish the need for auditable cybersecurity processes and accountability structures for autonomous systems\.

Recent work also points toward Zero\-Trust Architectures \(ZTA\) and hardware\-based trust, such as TPM\-based remote attestation, to verify and attribute autonomous decisions to authenticated agents\. This pattern is important because embodied agents operate across multiple trust boundaries: sensors, onboard compute, external networks, cloud services, tools, and actuation modules\. Layered trust architectures enable asking not only whether a decision was safe, but also whether it originated from an authenticated component operating within a verified system state\.

#### IX\-A3Multi\-Layer Threat\-Aware Evaluation

A third design pattern is the use of threat\-aware evaluation to expose how embodied agents fail under adversarial conditions\. Several works study attacks on the perception layer, including physical\-world hijacking of visual perception through ControlLoc\[[66](https://arxiv.org/html/2607.18548#bib.bib149)\], LiDAR\-induced trajectory\-prediction deception\[[64](https://arxiv.org/html/2607.18548#bib.bib150)\], and latency\-oriented physical\-world attacks such as SlowPerception\[[65](https://arxiv.org/html/2607.18548#bib.bib151)\]\. Other work studies physical\-layer threats such as UAV GPS spoofing and GPS spoofing detection\[[31](https://arxiv.org/html/2607.18548#bib.bib156),[25](https://arxiv.org/html/2607.18548#bib.bib157)\], as well as network\-layer manipulation in vehicle\-to\-everything platforms\[[44](https://arxiv.org/html/2607.18548#bib.bib158)\]\.

More recent threats target the model layer directly\. Physical prompt injection and visual adversarial attacks show that signs, typographic artifacts, or visual inputs can hijack vision\-language driving agents without any digital manipulation\[[62](https://arxiv.org/html/2607.18548#bib.bib159),[134](https://arxiv.org/html/2607.18548#bib.bib160)\]\. Theα3\\alpha^\{3\}\-Bench framework is an early step toward benchmark\-based evaluation of UAV agents under 6G conditions, measuring safety, robustness, and efficiency in a more unified setting\[[34](https://arxiv.org/html/2607.18548#bib.bib98)\]\. Together, these works show that trustworthiness in embodied agents must be evaluated across the full perception\-to\-actuation pipeline rather than only at a single component\.

#### IX\-A4Post\-Hoc Explanation and Regulatory Logging

A fourth design pattern is the use of explanation and logging mechanisms for audit, debugging, and accident reconstruction\. SAFE introduces saliency\-aware counterfactual explanations for deep neural network driving systems\[[100](https://arxiv.org/html/2607.18548#bib.bib154)\], while SAFE\-RL extends this direction to deep reinforcement\-learning policies\[[99](https://arxiv.org/html/2607.18548#bib.bib155)\]\. These methods support interpretability by identifying how changes in salient inputs could alter system behavior\.

Regulatory logging and cybersecurity management frameworks also support accountability by requiring traceability and lifecycle governance\[[81](https://arxiv.org/html/2607.18548#bib.bib162),[109](https://arxiv.org/html/2607.18548#bib.bib163)\]\. Their trustworthiness value is strongest after an incident: they can help reconstruct what happened, which component was involved, and whether the system followed the required cybersecurity or operational process\. In embodied agentic systems, this is essential because failures may involve multiple layers, including perception, reasoning, tool use, control, actuation, and human approval\.

### IX\-BSystemic Failure Modes

#### IX\-B1Layered Verification Gap

The first failure mode is the verification gap between layers\. Low\-level safety filters such as CBFs and Simplex\-style architectures offer formal or runtime guarantees at the actuation boundary\[[10](https://arxiv.org/html/2607.18548#bib.bib146),[75](https://arxiv.org/html/2607.18548#bib.bib147),[20](https://arxiv.org/html/2607.18548#bib.bib148)\], but the high\-level reasoning layer, increasingly an LLM or VLM, remains unverified\. Current designs treat the safety filter as a backstop, yet they rarely characterize how often the high\-level planner produces unsafe candidates, how the filter degrades under distribution shift, or whether a safe fallback exists when both layers are uncertain\.

The failure mode is therefore not only unsafe actuation, but overreliance on a low\-level backstop without quantifying the residual risk that survives it\. Future systems should define explicit fallback policies tied to the Operational Design Domain and determine, before deployment, when a high\-level agent may advise, recommend, or directly actuate\. This requires a notion of graded autonomy, in which actuation authority is granted incrementally and revoked the moment the high\-level planner leaves its validated operating envelope\.

#### IX\-B2Cross\-Layer and Physically Realizable Attacks

The second failure mode is robustness against physically realizable and cross\-layer attacks\. Existing studies often evaluate threats one layer at a time: perception attacks\[[66](https://arxiv.org/html/2607.18548#bib.bib149),[64](https://arxiv.org/html/2607.18548#bib.bib150),[65](https://arxiv.org/html/2607.18548#bib.bib151)\], physical\-layer spoofing\[[31](https://arxiv.org/html/2607.18548#bib.bib156),[25](https://arxiv.org/html/2607.18548#bib.bib157)\], network\-layer manipulation\[[44](https://arxiv.org/html/2607.18548#bib.bib158)\], and model\-layer prompt injection\[[62](https://arxiv.org/html/2607.18548#bib.bib159),[134](https://arxiv.org/html/2607.18548#bib.bib160)\]are usually treated separately\. In deployment, however, an adversary can combine these vectors, and a defense validated against one layer may fail against another\.

This matters because embodied agents depend on a continuous chain from sensing to interpretation, planning, communication, and actuation\. A small perturbation at one layer can propagate into unsafe behavior at another\. The field therefore needs combined threat models and evaluation protocols that stress the full perception\-to\-actuation pipeline under simultaneous, adaptive attacks rather than single\-vector benchmarks\.

#### IX\-B3Faithful and Timely Interpretability

The third failure mode is the lack of faithful and timely interpretability\. Saliency\-based and counterfactual explanations support accident reconstruction and pre\-deployment auditing\[[100](https://arxiv.org/html/2607.18548#bib.bib154),[99](https://arxiv.org/html/2607.18548#bib.bib155)\], but they are often produced after the fact and their faithfulness is seldom validated\. A plausible explanation may identify visually salient regions or counterfactual changes, but it may not faithfully represent the causal basis of the agent’s decision\.

This limitation is especially important in embodied systems because decisions unfold on millisecond timescales\. Explanations that are useful only for forensic review may not support real\-time operator oversight\. Future explanations should be evaluated for whether they actually improve operator decisions and trust calibration, not only for plausibility or visual appeal\.

#### IX\-B4Missing End\-to\-End Provenance and Attribution

The fourth failure mode is the absence of end\-to\-end, tamper\-evident provenance\. Regulatory frameworks mandate cybersecurity management and traceability\[[81](https://arxiv.org/html/2607.18548#bib.bib162),[109](https://arxiv.org/html/2607.18548#bib.bib163)\], yet they do not specify how to reconstruct the agentic chain that links perception, reasoning, tool use, actuation, and human approval into a single auditable record\. This leaves a gap between compliance\-oriented traceability and agent\-level accountability\.

For embodied agents, accountability must answer a concrete chain of questions: what the agent perceived, how it interpreted the scene, which model or tool generated the decision, what constraints were checked, what action was selected, whether a human approved it, and whether the acting component was authenticated\. Pairing such provenance with Zero\-Trust Architectures and hardware\-based attestation, so that each decision is both verifiable and attributable, remains an open design problem\.

#### IX\-B5Fragmented and Capability\-Driven Benchmarks

The fifth failure mode is the lack of standardized, trustworthiness\-oriented benchmarks for embodied agents\. Theα3\\alpha^\{3\}\-Bench framework is an early step for UAV agents under 6G conditions\[[34](https://arxiv.org/html/2607.18548#bib.bib98)\], but most evaluations remain capability\-driven or attack\-specific\. They typically measure whether the system completes the task or withstands a specific attack, rather than jointly evaluating safety, robustness, interpretability, accountability, and security\.

A reusable benchmark should jointly measure these trustworthiness dimensions across driving, manipulation, and aerial tasks\. It should report unsafe\-action rate, constraint\-violation severity, human\-override behavior, attack success rate, explanation usefulness, and audit completeness alongside task success\. Without this shift, the field risks producing embodied agents that appear capable in isolated tests but remain untrusted under real deployment conditions\.

### IX\-CSynthesis

The reviewed works show that embodied agentic AI can be made safer through four useful design patterns: actuation\-level safety filters, layered trust architectures, threat\-aware evaluation, and post\-hoc explanation with regulatory logging\. These patterns provide important building blocks for bounding autonomy, detecting adversarial failures, reconstructing incidents, and connecting physical actions to cybersecurity and accountability processes\.

At the same time, the evidence remains fragmented across isolated mechanisms and threat models\. The main systemic failure modes are the verification gap between high\-level reasoning and low\-level safety, vulnerability to cross\-layer and physically realizable attacks, insufficiently faithful and timely explanations, missing end\-to\-end provenance, and the absence of standardized trustworthiness\-oriented benchmarks\. The central lesson is that trustworthy embodied agents must be evaluated at the interfaces where perception becomes interpretation, interpretation becomes planning, and planning becomes physical action\. Reliable deployment requires graded autonomy, verified low\-level safety layers, combined threat models, real\-time interpretability, tamper\-evident provenance, and benchmarks that measure trustworthiness rather than capability alone\.

## XApplications in High\-Performance Computing

As agentic systems increasingly process large\-scale data within high\-fidelity simulations, complex digital twins, and heterogeneous systems, the integration of these agents with High\-Performance Computing \(HPC\) resources has become essential for feasibility\. Beyond established conventions of trust and resilience in agentic systems, the incorporation of HPC resources introduces a new critical dimension:resilience at scale\[[27](https://arxiv.org/html/2607.18548#bib.bib118)\]\. To achieve resilience at scale, efficient methods addressingfaultsin system operations are vital for stable, large\-scale agentic systems; a critical topic in modern agentic system design using HPC resources\[[16](https://arxiv.org/html/2607.18548#bib.bib152)\]\. Works involving HPC resources, whether to support agentic deployment or to enable the agent to act upon, focus on innovating fault tolerance for systemic failure modes arising from hardware degradation and unsafe agent interactions in large\-scale systems \(Fig\.[8](https://arxiv.org/html/2607.18548#S10.F8)\)\.

![Refer to caption](https://arxiv.org/html/2607.18548v1/Figures/hpc_mas.png)Figure 8:High\-performance computing adaptation of the multi\-agent agentic AI architecture\.### X\-AEmerging Design Patterns

#### X\-A1Fault Tolerance

As applications push exascale performance, the likelihood of faults increases proportionally with the complexity of data distributions, frequent inter\-process communication \(IPC\), and the maximization of parallel hardware\[[63](https://arxiv.org/html/2607.18548#bib.bib153)\]\. These often manifest as instances of data corruption, message loss, hardware defects and software interrupts, among others\. To mitigate these risks,Fault Tolerancein HPC systems focuses on evaluating, diagnosing and preventing faults or failures in both software and hardware components, regardless of application\[[27](https://arxiv.org/html/2607.18548#bib.bib118)\]\. Methods for fault tolerance range from general purposeCheckpointingrollback protocols and software\-orientedAlgorithm\-Based Fault Tolerance\(ABFT\)\[[48](https://arxiv.org/html/2607.18548#bib.bib119)\]to distributed repair mechanisms, among similar modalities\. The integration of these fault\-tolerance methods improves resilience with minimal impact on performance, enabling stable agentic deployments\.

#### X\-A2Multi\-Agent Systems

To leverage interactions between agents to further system resilience, multi\-agent deployments effectively mimic HPC parallelism, enabling system recovery through coordination\. This adopts fault tolerance through ’self\-healing’ mechanisms, which tasks agents with features for resource monitoring, crash detection and recovery actions to incorporate system state data in decisions towards system stability\[[93](https://arxiv.org/html/2607.18548#bib.bib113),[83](https://arxiv.org/html/2607.18548#bib.bib117)\]\. These self\-healing mechanisms are intuitively integrated into existing agent actions on HPC topologies, such as workload distribution and anomaly detection\[[110](https://arxiv.org/html/2607.18548#bib.bib115),[117](https://arxiv.org/html/2607.18548#bib.bib114)\]\.

In other instances, traditional rollback mechanisms can be applied through multi\-agent interactions as a transactional relation\[[18](https://arxiv.org/html/2607.18548#bib.bib112)\]\. These systems match actions with their reversals while maintaining system interaction logs, enabling dynamic return to safe states without complex coordination between agents\.

### X\-BSystemic Failure Modes

#### X\-B1Hardware Failures

The first and fundamental source of failure stems from hardware degradation, which introduces system instability and compromises the predictability of agentic actions\. In exascale environments, these failures range from total system crashes to data corruption\[[16](https://arxiv.org/html/2607.18548#bib.bib152)\]\. While standard checkpointing and self\-healing mechanisms can isolate localized node failures in multi\-agent systems, they are ineffective at detecting and responding to data corruption\[[91](https://arxiv.org/html/2607.18548#bib.bib110)\]\. This directly degrades agentic system trust from a hardware perspective, as increased workload scales increase the potential for data corruption and hardware failure\.

#### X\-B2Memory Latency

The second primary failure mode covers latency for expensive computations and memory access\. Computational overheads are consistently optimized per application, though memory access latency has been shown to be a primary limitation to scaling AI workloads\[[36](https://arxiv.org/html/2607.18548#bib.bib111)\]\. This latency is present within context\-window updates, cache accesses and weight retrievals for LLM\-based applications, limiting scalability across large heterogeneous systems\. This results in trust degradation in agentic systems, as lengthy decision times lead to unpredictable behavior when conflicting notions of the current system state arise\.

### X\-CSynthesis

The reviewed works demonstrate the importance in overlap between hardware robustness and agentic trust, as AI applications consistently face resilience concerns on the operational level\. Patterns for design in resilience mechanisms highlight the efficacy of checkpointing, self\-healing and mult\-agent coordination methods, though this is reliant on domain\-specific implementations\. Given the limitations of hardware degradation and memory latency, there is a severe lack of frameworks detailing resilience in extreme\-scale agentic systems to broadly address these challenges\. Such solutions would consider a combination of adaptive mechanisms for memory efficiency and decentralized operational conditions across a wide variety of domain applications\.

## XIApplications in Communication Networks

Agentic AI enters communication networks by turning high\-level intent, semantic content, or operational context into actions that affect the network\. This makes communication systems more adaptive and easier to operate, but it also changes the trust problem\[[32](https://arxiv.org/html/2607.18548#bib.bib1)\]\. The system is no longer only transmitting information or optimizing links; it is interpreting intent, reconstructing meaning, selecting tools, and in some cases triggering network behavior \(Fig\.[9](https://arxiv.org/html/2607.18548#S11.F9)\)\. The reviewed works, therefore, reveal two sides of the same story: emerging design patterns that make communication systems more agentic, and systemic failure modes that appear when interpretation is connected to actuation\.

![Refer to caption](https://arxiv.org/html/2607.18548v1/Figures/comm_mas.png)Figure 9:Communication networks adaptation of the multi\-agent agentic AI architecture\.### XI\-AEmerging Design Patterns

#### XI\-A1Intent Abstraction and Human\-in\-the\-Loop Control

A major design pattern is the abstraction of human intent into machine\-interpretable network objectives\. LUMI is an early example of this pattern: it allows operators to express network intents in natural language, maps them into the Nile intermediate representation, and compiles them into executable configurations\[[51](https://arxiv.org/html/2607.18548#bib.bib133)\]\. This creates a human\-agent network loop in which the agent is not merely assisting the operator but actively mediating between human goals and network behavior\.

LLM\-based intent extraction for 5G core networks extends this idea by using language models as the intent\-understanding layer for network management\[[70](https://arxiv.org/html/2607.18548#bib.bib139)\]\. Semantic routing further strengthens this direction by routing requests across different model pathways to improve orchestration performance and efficiency\[[69](https://arxiv.org/html/2607.18548#bib.bib140)\]\. Together, these works show that intent abstraction can improve usability, scalability, and adaptability in network management\. Their trustworthiness value comes from making intent processing more structured and partially inspectable, especially when intermediate representations or routing decisions expose how a request is handled\.

#### XI\-A2Semantic Communication: From Bits to Meaning

A second design pattern is the move from syntactic communication to semantic communication\. Instead of optimizing only for bit\-level or symbol\-level recovery, semantic communication systems aim to preserve task\-relevant meaning\. DeepSC demonstrates this shift through transformer\-based semantic encoding and decoding for text transmission under noisy channel conditions\[[126](https://arxiv.org/html/2607.18548#bib.bib135)\]\. DeepSC\-S applies the same principle to speech, showing that speech communication can be optimized around recovered semantic content and perceptual quality rather than exact signal reconstruction\[[123](https://arxiv.org/html/2607.18548#bib.bib136)\]\.

This pattern is important because it makes the communication process itself more intelligent\. The channel is no longer treated only as a medium for symbols; it becomes part of a meaning\-preserving pipeline\. These works show strong robustness under difficult channel conditions and establish semantic\-level optimization as a useful design principle\. In the context of agentic systems, this matters because agents often act on interpreted meaning rather than raw signals\.

#### XI\-A3Security\-First Enhancements and Agent Evaluation

A third design pattern is the introduction of security and evaluation mechanisms around agentic communication pipelines\. In semantic communication, physical\-layer semantic encryption and obfuscation protect the meaning of transmitted content rather than only the raw signal\[[85](https://arxiv.org/html/2607.18548#bib.bib141)\]\. This is important because semantic systems create new forms of exposure: an attacker may target the meaning itself, even when the transmitted symbols are not fully recovered\.

Beyond communication\-specific systems, ToolEmu and Agent Security Bench provide evaluation frameworks for tool\-using LLM agents\[[97](https://arxiv.org/html/2607.18548#bib.bib143),[132](https://arxiv.org/html/2607.18548#bib.bib144)\]\. These works are not network\-management papers, but they are directly relevant to communication agents because future network agents will rely on tools, memory, prompts, and multi\-step decision pipelines\. They show that agentic systems should be tested not only for task success, but also for unsafe tool use, prompt injection, memory manipulation, and adversarial behavior\. This gives communication\-network research a useful model for pre\-deployment stress testing and security benchmarking\.

### XI\-BSystemic Failure Modes

#### XI\-B1Intent Ambiguity Leading to Unsafe Actuation

The first failure mode appears at the boundary between human intent and system action\. Intent\-based systems assume that a user goal can be translated into a correct network behavior, but natural language intents are often ambiguous, underspecified, or context\-dependent\. LUMI makes this translation more structured through Network Intent LanguagE \(Nile\), but it does not fully solve the problem of whether the interpreted intent is safe, authorized, or complete\[[51](https://arxiv.org/html/2607.18548#bib.bib133)\]\. LLM\-based intent extraction increases flexibility, but it also increases exposure to prompt manipulation and unsafe intent acceptance\[[70](https://arxiv.org/html/2607.18548#bib.bib139)\]\.

INTENDER makes this risk concrete by showing that intent parsing and state transitions in intent\-based networking can become attack surfaces\[[57](https://arxiv.org/html/2607.18548#bib.bib134)\]\. This means the issue is not only whether the agent understands the user, but whether the system can prevent a misunderstood or malicious intent from becoming an executable network action\. The failure mode is therefore a missing trust layer between interpretation and actuation requiring architectural changes and trust\-driven mechanisms\[[43](https://arxiv.org/html/2607.18548#bib.bib2)\]\.

#### XI\-B2Semantic Misalignment

The second failure mode appears when a system preserves meaning in a shallow sense but fails to preserve the correct meaning for the task\. DeepSC and DeepSC\-S show that semantic communication can improve robustness under noisy conditions\[[126](https://arxiv.org/html/2607.18548#bib.bib135),[123](https://arxiv.org/html/2607.18548#bib.bib136)\]\. However, semantic similarity or perceptual quality does not necessarily guarantee that the reconstructed message is operationally correct\.

This is referred to as semantic misalignment\. A reconstructed message may appear plausible, fluent, or semantically close, while still altering the instruction, omitting important context, or leading to an unsafe interpretation\. This is especially dangerous when semantic communication feeds into decision\-making or network\-control agents\. In that setting, the key question is not only whether the receiver recovered similar meaning, but whether the recovered meaning is valid for the downstream action\.

#### XI\-B3Lack of End\-to\-End Accountability

The third failure mode is the lack of accountability across the full agentic communication pipeline\. Current systems often provide only partial visibility into a single component\. LUMI exposes an intermediate intent representation\[[51](https://arxiv.org/html/2607.18548#bib.bib133)\]\. Semantic communication papers report semantic or perceptual performance metrics\[[126](https://arxiv.org/html/2607.18548#bib.bib135),[123](https://arxiv.org/html/2607.18548#bib.bib136)\]\. Agent benchmarks expose failures in tool\-using agents\[[97](https://arxiv.org/html/2607.18548#bib.bib143),[132](https://arxiv.org/html/2607.18548#bib.bib144)\]\. However, these pieces do not yet form a comprehensive recoverable accountability chain\.

This matters because failures can originate from many places: the user intent, the intent parser, the semantic encoder, the reconstructed message, the routing decision, the tool call, or the final network action\. Without provenance logs, policy\-check records, decision traces, and responsibility attribution, it is difficult to determine why a failure occurred or who should be held responsible\. For trustworthy communication agents, accountability must be built into the entire workflow rather than added after deployment\.

### XI\-CSynthesis

The reviewed works show that agentic AI in communication networks is advancing through three useful design patterns: intent abstraction, semantic communication, and security\-oriented evaluation\. These patterns make networks easier to operate, more robust under uncertainty, and better able to support autonomous workflows\. At the same time, they expose three systemic failure modes: ambiguous intent can lead to unsafe actuation, semantic preservation can still produce incorrect meaning, and partial visibility does not provide end\-to\-end accountability\.

The central lesson is that trustworthy agentic communication systems must be evaluated at the interfaces where interpretation becomes consequence\. The critical boundaries are human intent to machine action, transmitted meaning to task correctness, and agent decision to responsibility\. Current work provides important building blocks, but reliable deployment requires stronger formal constraints, runtime safeguards, adversarial testing, and provenance mechanisms that connect the full pipeline\.

## XIICross\-Domain Insights

TABLE V:Representative agentic AI works across application domains through a trustworthiness lens\.WorkFocus / TypeKey Mechanism or InsightSafetyRob\.Interp\.AuditSec\.Power Systems\(Sec\.[VIII](https://arxiv.org/html/2607.18548#S8)\)PowerAgent\[[133](https://arxiv.org/html/2607.18548#bib.bib173)\]Grid operation/planning roadmapFoundation model \+ MCP \+ workflows△\\triangle△\\triangle△\\triangle△\\triangle△\\triangleFoundation models\[[127](https://arxiv.org/html/2607.18548#bib.bib174)\]AI–grid interactionFoundation\-model integration△\\triangle△\\triangle△\\triangle×\\times△\\triangleSmart\-grid review\[[56](https://arxiv.org/html/2607.18548#bib.bib175)\]Safe/explainable smart\-grid agentsReview and taxonomy of trustworthy agents△\\triangle△\\triangle△\\triangle△\\triangle△\\triangleElectrical\-engineering review\[[37](https://arxiv.org/html/2607.18548#bib.bib176)\]Agentic AI in EETaxonomy and failure\-mode analysis△\\triangle△\\triangle△\\triangle△\\triangle△\\triangleX\-GridAgent\[[122](https://arxiv.org/html/2607.18548#bib.bib164)\]Grid analysisPlanning–coordination–action hierarchy△\\triangle△\\triangle✓\\checkmark△\\triangle×\\timesGridMind\[[53](https://arxiv.org/html/2607.18548#bib.bib165)\]OPF and contingency analysisLLM agents with deterministic solvers△\\triangle△\\triangle✓\\checkmark△\\triangle×\\timesPowerChain\[[13](https://arxiv.org/html/2607.18548#bib.bib166)\]Distribution\-grid workflowsVerified tool\-call trajectories△\\triangle✓\\checkmark△\\triangle✓\\checkmark×\\timesGrid\-Agent\[[135](https://arxiv.org/html/2607.18548#bib.bib167)\]Violation remediationPlanning, validation, and rollback✓\\checkmark△\\triangle△\\triangle△\\triangle△\\triangleDrAgent\[[98](https://arxiv.org/html/2607.18548#bib.bib168)\]Fault/disturbance analysisReWOO \+ tools \+ argument repair△\\triangle△\\triangle✓\\checkmark△\\triangle×\\timesAgentic planning\[[136](https://arxiv.org/html/2607.18548#bib.bib169)\]Simulation orchestrationPlanning, validation, and enhancement agents△\\triangle△\\triangle△\\triangle△\\triangle×\\timesJia et al\.\[[52](https://arxiv.org/html/2607.18548#bib.bib170)\]Power\-system simulationsRAG \+ reasoning \+ feedback acting△\\triangle✓\\checkmark△\\triangle△\\triangle×\\timesGAIA\[[21](https://arxiv.org/html/2607.18548#bib.bib171)\]Dispatch supportFine\-tuned dispatch LLM△\\triangle△\\triangle△\\triangle×\\times△\\triangleLocal fine\-tuned LLM\[[112](https://arxiv.org/html/2607.18548#bib.bib172)\]Secure local analysisOffline RAG \+ planner \+ sandbox tools△\\triangle△\\triangle△\\triangle△\\triangle✓\\checkmarkHEMS\[[30](https://arxiv.org/html/2607.18548#bib.bib177)\]Residential schedulingOrchestrator \+ appliance agents△\\triangle△\\triangle✓\\checkmark△\\triangle△\\triangleAutonomous Vehicles, Robotics, and UAVs\(Sec\.[IX](https://arxiv.org/html/2607.18548#S9)\)Control Barrier Functions\[[10](https://arxiv.org/html/2607.18548#bib.bib146)\]Safety filterForward\-invariance constraints enforced at the actuation boundary✓\\checkmark△\\triangle×\\times×\\times×\\timesBlack\-Box Simplex\[[75](https://arxiv.org/html/2607.18548#bib.bib147)\]Runtime assuranceSwitching to a verified safety controller without model access✓\\checkmark✓\\checkmark×\\times×\\times×\\timesRTA for learning\-enabled AD\[[20](https://arxiv.org/html/2607.18548#bib.bib148)\]Runtime assuranceWraps a learned planner with a low\-level safety monitor✓\\checkmark△\\triangle×\\times×\\times×\\timesα3\\alpha^\{3\}\-Bench\[[34](https://arxiv.org/html/2607.18548#bib.bib98)\]EvaluationSafety, robustness, and efficiency benchmark for UAV agents over 6G✓\\checkmark✓\\checkmark△\\triangle×\\times△\\trianglePhysical prompt injection\[[62](https://arxiv.org/html/2607.18548#bib.bib159)\]Threat: model layerTypographic injection hijacks VLM driving agents△\\triangle△\\triangle×\\times×\\times✓\\checkmarkVisual adversarial attack\[[134](https://arxiv.org/html/2607.18548#bib.bib160)\]Threat: perceptionAdversarial inputs mislead VLM autonomous\-driving perception△\\triangle✓\\checkmark×\\times×\\times✓\\checkmarkControlLoc\[[66](https://arxiv.org/html/2607.18548#bib.bib149)\]Threat: perceptionPhysical\-world hijacking of visual perception△\\triangle✓\\checkmark×\\times×\\times✓\\checkmarkLiDAR trajectory attack\[[64](https://arxiv.org/html/2607.18548#bib.bib150)\]Threat: perceptionLiDAR\-induced trajectory\-prediction deception△\\triangle✓\\checkmark×\\times×\\times✓\\checkmarkSlowPerception\[[65](https://arxiv.org/html/2607.18548#bib.bib151)\]Threat: perceptionPhysical\-world latency attack on visual perception△\\triangle✓\\checkmark×\\times×\\times✓\\checkmarkSAFE\[[100](https://arxiv.org/html/2607.18548#bib.bib154)\]ExplanationSaliency\-aware counterfactual explanations for DNN driving systems×\\times×\\times✓\\checkmark△\\triangle×\\timesSAFE\-RL\[[99](https://arxiv.org/html/2607.18548#bib.bib155)\]ExplanationSaliency\-aware counterfactual explainer for deep RL policies×\\times×\\times✓\\checkmark△\\triangle×\\timesUNECE WP\.29 R155\[[81](https://arxiv.org/html/2607.18548#bib.bib162)\]StandardCybersecurity management system requirements for vehicles△\\triangle×\\times×\\times✓\\checkmark✓\\checkmarkISO/SAE 21434\[[109](https://arxiv.org/html/2607.18548#bib.bib163)\]StandardAutomotive cybersecurity engineering lifecycle△\\triangle×\\times×\\times✓\\checkmark✓\\checkmarkGPS spoofing countermeasure\[[31](https://arxiv.org/html/2607.18548#bib.bib156)\]Defense: physical layerGame\-theoretic protection of UAVs against GPS spoofing△\\triangle△\\triangle×\\times×\\times✓\\checkmarkGPS spoofing detection\[[25](https://arxiv.org/html/2607.18548#bib.bib157)\]Defense: physical layerCamera\-stream detection of drone GPS spoofing×\\times△\\triangle×\\times×\\times✓\\checkmarkV2X security\[[44](https://arxiv.org/html/2607.18548#bib.bib158)\]Defense: network layerSecuring vehicle\-to\-everything communication platforms×\\times△\\triangle×\\times×\\times✓\\checkmarkHigh\-Performance Computing\(Sec\.[X](https://arxiv.org/html/2607.18548#S10)\)Checkpointing\[[27](https://arxiv.org/html/2607.18548#bib.bib118)\]Resilience amidst hardware faultsSafe state marking and rollback procedures to enable restoration in the event of failure△\\triangle✓\\checkmark×\\times×\\times×\\timesTransactional Rollback\[[18](https://arxiv.org/html/2607.18548#bib.bib112)\]Logging\-based checkpointingPair actions with reversing actions for recovery△\\triangle✓\\checkmark✓\\checkmark△\\triangle△\\triangleAlgorithm\-Based Fault Tolerance\[[48](https://arxiv.org/html/2607.18548#bib.bib119)\]Operational resilienceChecksum\-verified operations to separate verification from hardware△\\triangle✓\\checkmark×\\times△\\triangle△\\triangleSelf\-Healing\[[83](https://arxiv.org/html/2607.18548#bib.bib117)\]Self\-monitoring and recoveryAgentic profiling of system status and responding actions to combat faults during system processing△\\triangle✓\\checkmark△\\triangle△\\triangle×\\timesMulti\-Agent Coordination\[[93](https://arxiv.org/html/2607.18548#bib.bib113)\]Agentic coordinationAgentic synchronization to enable self\-verification of faulty processes△\\triangle✓\\checkmark△\\triangle✓\\checkmark△\\triangleCommunication Networks\(Sec\.[XI](https://arxiv.org/html/2607.18548#S11)\)LUMI\[[51](https://arxiv.org/html/2607.18548#bib.bib133)\]Intent abstraction and HITL controlNatural\-language intents compiled into executable network configurations△\\triangle△\\triangle△\\triangle△\\triangle×\\timesIntent Extraction for 5G\[[70](https://arxiv.org/html/2607.18548#bib.bib139)\]LLM\-based intent extractionLLMs used for intent understanding in 5G core management△\\triangle△\\triangle△\\triangle△\\triangle×\\timesSemantic Routing\[[69](https://arxiv.org/html/2607.18548#bib.bib140)\]LLM\-assisted semantic routingSemantic routing improves orchestration efficiency and modularity△\\triangle✓\\checkmark△\\triangle△\\triangle△\\triangleINTENDER\[[57](https://arxiv.org/html/2607.18548#bib.bib134)\]Security testing for IBNIntent parsing and state transitions exposed as attack surfaces△\\triangle△\\triangle△\\triangle△\\triangle✓\\checkmarkDeepSC\[[126](https://arxiv.org/html/2607.18548#bib.bib135)\]Semantic communicationMeaning\-oriented communication under noisy channels×\\times✓\\checkmark×\\times×\\times×\\timesDeepSC\-S\[[123](https://arxiv.org/html/2607.18548#bib.bib136)\]Semantic speech communicationSemantic speech transmission robust to channel degradation×\\times✓\\checkmark×\\times×\\times×\\timesSecure Semantic Communication\[[85](https://arxiv.org/html/2607.18548#bib.bib141)\]Security\-first semantic communicationProtects semantic content through physical\-layer encryption△\\triangle△\\triangle×\\times×\\times✓\\checkmarkToolEmu\[[97](https://arxiv.org/html/2607.18548#bib.bib143)\]Agent safety evaluationSandbox\-based evaluation for unsafe tool\-using behavior✓\\checkmark✓\\checkmark✓\\checkmark✓\\checkmark✓\\checkmarkAgent Security Bench\[[132](https://arxiv.org/html/2607.18548#bib.bib144)\]Agent security benchmarkingAdversarial benchmarking across prompts, tools, and workflows✓\\checkmark✓\\checkmark✓\\checkmark✓\\checkmark✓\\checkmark

Legend:✓\\checkmark= strong support;△\\triangle= partial support;×\\times= weak or missing support\. Rob\.: robustness/reliability; Interp\.: transparency/interpretability; Audit: accountability/auditability; Sec\.: privacy/security\. HITL: human\-in\-the\-loop; IBN: intent\-based networking; AD: autonomous driving; VLM: vision\-language model; MCP: Model Context Protocol\.

The reviewed application domains show that trustworthy agentic AI is not defined by a single architecture, benchmark, or evaluation criterion\. Figure[5](https://arxiv.org/html/2607.18548#S6.F5)makes this explicit: with the exception of dedicated evaluation frameworks such as Claw\-Eval\[[131](https://arxiv.org/html/2607.18548#bib.bib126)\], whose entire purpose is to probe all five dimensions at once\[[97](https://arxiv.org/html/2607.18548#bib.bib143),[132](https://arxiv.org/html/2607.18548#bib.bib144)\], no deployed or applied agentic system reviewed in this survey scores strongly on more than two or three trustworthiness dimensions simultaneously, and which dimension is left uncovered differs systematically by domain rather than by architecture\. This is because power systems, autonomous vehicles and UAVs, high\-performance computing, and communication networks all instantiate the same underlying agentic pipeline, perception, reasoning, planning, tool use, communication/coordination, memory update, validation, action, monitoring, and audit \(Section[III](https://arxiv.org/html/2607.18548#S3)\), but differ in*where along that pipeline interpretation becomes consequence*, how severe and reversible the resulting action is, and how much of the pipeline currently carries verifiable evidence rather than best\-effort engineering practice\. Power systems place that boundary at the solver\-to\-grid interface; robotics and UAVs place it at the planner\-to\-actuator interface; HPC places it at the detection\-to\-recovery interface; communication networks place it at the intent\-to\-configuration interface\. The consequence of crossing that boundary, not the underlying model architecture, is what determines how much trust engineering a given domain requires\.

This shared lens is what makes cross\-domain synthesis possible: it separates what is genuinely domain\-specific \(grid physics, actuation dynamics, HPC fault models, network intents\) from what is a general property of agentic AI as a class of systems\. Section[XII\-A](https://arxiv.org/html/2607.18548#S12.SS1)identifies the design patterns that recur across domains precisely because they answer the same underlying trust question under different physical constraints\. Section[XII\-B](https://arxiv.org/html/2607.18548#S12.SS2)shows that these same patterns leave behind a common residue of unresolved risk regardless of domain\.

### XII\-ARecurring Design Patterns

#### XII\-A1Tool\-Grounded Reasoning and Domain\-Expert Execution

A recurring pattern across all four domains is the separation of semantic reasoning from trusted execution: the LLM interprets, decomposes, and plans, but a deterministic, verifiable component actually acts\. In power systems, this means LLMs interpret operator requests, decompose tasks, and retrieve context, but hand off numerical work to power\-flow, optimal\-power\-flow, and contingency\-analysis solvers rather than computing grid state themselves\[[53](https://arxiv.org/html/2607.18548#bib.bib165),[122](https://arxiv.org/html/2607.18548#bib.bib164),[52](https://arxiv.org/html/2607.18548#bib.bib170),[13](https://arxiv.org/html/2607.18548#bib.bib166)\]\. Communication\-network agents follow the same logic in a different substrate: natural\-language intents and semantic content are converted into intermediate representations or routing decisions before they are allowed to touch network configuration\[[51](https://arxiv.org/html/2607.18548#bib.bib133),[70](https://arxiv.org/html/2607.18548#bib.bib139),[69](https://arxiv.org/html/2607.18548#bib.bib140)\], and tool\-using agents are stress\-tested against this same handoff boundary\[[97](https://arxiv.org/html/2607.18548#bib.bib143),[132](https://arxiv.org/html/2607.18548#bib.bib144)\]\. Robotics and UAV systems enforce the identical separation at the actuation boundary through Control Barrier Functions and Simplex\-style runtime monitors that sit between a learned planner and the motor commands it produces\[[10](https://arxiv.org/html/2607.18548#bib.bib146),[75](https://arxiv.org/html/2607.18548#bib.bib147),[20](https://arxiv.org/html/2607.18548#bib.bib148)\]\. Read together, these results indicate that trustworthy agentic AI is strongest not when the LLM is granted final authority, but when it is demoted to an orchestrator whose outputs are grounded in domain\-specific, independently verifiable execution, directly operationalizing the safety and robustness dimensions of Section[III](https://arxiv.org/html/2607.18548#S3)at the tool\-use and validation points of the ten\-point workflow\.

#### XII\-A2Modular and Hierarchical Agent Organization

A second pattern is the decomposition of a single monolithic agent into specialized roles connected by a coordination layer\. Power\-system deployments divide responsibility across planning, execution, validation, enhancement, and appliance\-level agents\[[135](https://arxiv.org/html/2607.18548#bib.bib167),[136](https://arxiv.org/html/2607.18548#bib.bib169),[30](https://arxiv.org/html/2607.18548#bib.bib177)\], while HPC multi\-agent systems separate resource monitoring, crash detection, recovery, workload distribution, and anomaly detection into distinct roles\[[93](https://arxiv.org/html/2607.18548#bib.bib113),[83](https://arxiv.org/html/2607.18548#bib.bib117),[110](https://arxiv.org/html/2607.18548#bib.bib115),[117](https://arxiv.org/html/2607.18548#bib.bib114)\]\. Communication\-network research shows a parallel move toward modular interpretation\-and\-action pipelines through intent abstraction, semantic routing, and dedicated tool\-use benchmarking\[[51](https://arxiv.org/html/2607.18548#bib.bib133),[69](https://arxiv.org/html/2607.18548#bib.bib140),[97](https://arxiv.org/html/2607.18548#bib.bib143),[132](https://arxiv.org/html/2607.18548#bib.bib144)\]\. This convergence suggests that modularity is not an engineering convenience but a trust mechanism in its own right: isolating responsibilities keeps any single component’s failure mode local and inspectable, which is a precondition for the accountability dimension discussed below, rather than a byproduct of it\.

#### XII\-A3Feedback, Validation, Rollback, and Recovery Loops

A third pattern treats trustworthy behavior as an iterative loop rather than a one\-shot response\. Power\-system agents use feedback correction, malformed\-argument repair, verified workflow trajectories, and rollback\[[52](https://arxiv.org/html/2607.18548#bib.bib170),[98](https://arxiv.org/html/2607.18548#bib.bib168),[13](https://arxiv.org/html/2607.18548#bib.bib166),[135](https://arxiv.org/html/2607.18548#bib.bib167)\]; HPC systems rely on checkpointing, algorithm\-based fault tolerance, and self\-healing to survive faults at scale\[[27](https://arxiv.org/html/2607.18548#bib.bib118),[16](https://arxiv.org/html/2607.18548#bib.bib152),[48](https://arxiv.org/html/2607.18548#bib.bib119),[46](https://arxiv.org/html/2607.18548#bib.bib125),[93](https://arxiv.org/html/2607.18548#bib.bib113),[83](https://arxiv.org/html/2607.18548#bib.bib117)\]; robotics and UAV systems achieve the equivalent through runtime assurance architectures that can revert to a verified safety controller the instant a learned component leaves its validated envelope\[[10](https://arxiv.org/html/2607.18548#bib.bib146),[75](https://arxiv.org/html/2607.18548#bib.bib147),[20](https://arxiv.org/html/2607.18548#bib.bib148)\]\. Despite operating on completely different timescales \(milliseconds for actuation, seconds for grid dispatch, and potentially hours for HPC job recovery\), all three implementations share the same structural commitment: a system is trusted not because it avoids error, but because it can detect, correct, and recover from error before the consequences propagate\.

#### XII\-A4Bounded Autonomy over Unrestricted Autonomy

The fourth and most consequential pattern is that the most credible deployments in every domain are bounded\-autonomy systems, not fully autonomous ones\. Power\-system agents remain grounded in solvers, advisory operation, and sandboxed, rollback\-capable execution\[[21](https://arxiv.org/html/2607.18548#bib.bib171),[53](https://arxiv.org/html/2607.18548#bib.bib165),[135](https://arxiv.org/html/2607.18548#bib.bib167)\]; robotics and UAV systems require actuation\-level safety filters precisely because a high\-level planning error can cause physical harm\[[10](https://arxiv.org/html/2607.18548#bib.bib146),[75](https://arxiv.org/html/2607.18548#bib.bib147),[20](https://arxiv.org/html/2607.18548#bib.bib148)\]; communication\-network agents require an explicit trust layer between intent interpretation and executable behavior\[[51](https://arxiv.org/html/2607.18548#bib.bib133),[70](https://arxiv.org/html/2607.18548#bib.bib139),[57](https://arxiv.org/html/2607.18548#bib.bib134)\]; and HPC agents require supervision before autonomous self\-healing or workload redistribution is trusted at scale\[[93](https://arxiv.org/html/2607.18548#bib.bib113),[83](https://arxiv.org/html/2607.18548#bib.bib117),[117](https://arxiv.org/html/2607.18548#bib.bib114)\]\. That this pattern reproduces itself independently across four unrelated engineering communities is the strongest cross\-domain evidence in this survey that unrestricted agentic autonomy is not currently a viable deployment target in any critical\-infrastructure setting, only its boundary location changes\.

### XII\-BShared Failure Modes

#### XII\-B1Unsafe Translation from Reasoning to Action

The design patterns above do not eliminate risk; they relocate it to the interface where interpretation becomes consequence, and that interface remains the most critical failure point in every domain\. In power systems, an incorrect recommendation can violate grid constraints or respond too slowly to a rare event\[[21](https://arxiv.org/html/2607.18548#bib.bib171),[135](https://arxiv.org/html/2607.18548#bib.bib167)\]; in robotics and UAVs, perception, planning, or control errors propagate directly into unsafe physical actuation\[[66](https://arxiv.org/html/2607.18548#bib.bib149),[64](https://arxiv.org/html/2607.18548#bib.bib150),[65](https://arxiv.org/html/2607.18548#bib.bib151)\]; in communication networks, an ambiguous or malicious intent can become an executable network action\[[51](https://arxiv.org/html/2607.18548#bib.bib133),[70](https://arxiv.org/html/2607.18548#bib.bib139),[57](https://arxiv.org/html/2607.18548#bib.bib134)\]\. The common thread is that grounding an agent in tools, solvers, or intermediate representations narrows this gap without closing it; the translation step itself is rarely subjected to independent, adversarial verification\.

#### XII\-B2Robustness Gaps under Rare, Degraded, or Adversarial Conditions

Most current evaluations demonstrate feasibility on curated tasks rather than the tail of the operating distribution\. Power\-system evaluations lean on test systems, curated simulation tasks, and historical disturbance records\[[53](https://arxiv.org/html/2607.18548#bib.bib165),[52](https://arxiv.org/html/2607.18548#bib.bib170),[13](https://arxiv.org/html/2607.18548#bib.bib166),[98](https://arxiv.org/html/2607.18548#bib.bib168),[30](https://arxiv.org/html/2607.18548#bib.bib177)\]; robotics and UAV systems are shown to be vulnerable to adversarial patches, trajectory\-prediction attacks, sensor spoofing, and GPS jamming\[[66](https://arxiv.org/html/2607.18548#bib.bib149),[64](https://arxiv.org/html/2607.18548#bib.bib150),[65](https://arxiv.org/html/2607.18548#bib.bib151),[31](https://arxiv.org/html/2607.18548#bib.bib156),[25](https://arxiv.org/html/2607.18548#bib.bib157)\]; HPC systems must tolerate data corruption, message loss, and scaling\-induced hardware failures\[[63](https://arxiv.org/html/2607.18548#bib.bib153),[27](https://arxiv.org/html/2607.18548#bib.bib118)\]; and communication\-network agents must withstand malicious intents, semantic misalignment, and unsafe tool use\[[57](https://arxiv.org/html/2607.18548#bib.bib134),[126](https://arxiv.org/html/2607.18548#bib.bib135),[123](https://arxiv.org/html/2607.18548#bib.bib136),[97](https://arxiv.org/html/2607.18548#bib.bib143),[132](https://arxiv.org/html/2607.18548#bib.bib144)\]\. None of these domains yet reports the kind of systematic operating\-envelope characterization, comparable to an Operational Design Domain analysis\[[106](https://arxiv.org/html/2607.18548#bib.bib73)\], that would say with confidence where an agent’s guarantees end\.

#### XII\-B3Partial Auditability instead of End\-to\-End Accountability

Several systems expose fragments of the workflow, a plan, a tool call, an intermediate representation, a reasoning trace, but fragment\-level visibility does not add up to a reconstructable accountability chain\. Power\-system systems provide partial auditability through workflow trajectories, solver state, and tool\-call plans\[[13](https://arxiv.org/html/2607.18548#bib.bib166),[53](https://arxiv.org/html/2607.18548#bib.bib165),[122](https://arxiv.org/html/2607.18548#bib.bib164),[98](https://arxiv.org/html/2607.18548#bib.bib168)\]; robotics and UAV systems require tamper\-evident logs spanning perception, decision, and actuation for forensic review\[[100](https://arxiv.org/html/2607.18548#bib.bib154),[99](https://arxiv.org/html/2607.18548#bib.bib155)\]; communication\-network systems need provenance across intent, semantic encoding, routing, and final network action\[[51](https://arxiv.org/html/2607.18548#bib.bib133),[126](https://arxiv.org/html/2607.18548#bib.bib135),[123](https://arxiv.org/html/2607.18548#bib.bib136),[97](https://arxiv.org/html/2607.18548#bib.bib143),[132](https://arxiv.org/html/2607.18548#bib.bib144)\]\. In every domain, the gap is the same: visibility into one component does not guarantee that a failure can be traced back to the decision, tool call, or human approval that caused it\.

#### XII\-B4Expanding Security Surface from Tools, Memory, and Multi\-Agent Coordination

The same tool use, retrieval, and coordination mechanisms that ground agent outputs and enable modularity also expand the attack surface\. Power\-system agents introduce risk through APIs, simulators, retrieval pipelines, and memory modules\[[133](https://arxiv.org/html/2607.18548#bib.bib173),[122](https://arxiv.org/html/2607.18548#bib.bib164),[53](https://arxiv.org/html/2607.18548#bib.bib165),[52](https://arxiv.org/html/2607.18548#bib.bib170),[30](https://arxiv.org/html/2607.18548#bib.bib177)\]; robotics and UAV agents face attacks that span physical, network, and model layers simultaneously\[[31](https://arxiv.org/html/2607.18548#bib.bib156),[25](https://arxiv.org/html/2607.18548#bib.bib157),[44](https://arxiv.org/html/2607.18548#bib.bib158),[62](https://arxiv.org/html/2607.18548#bib.bib159),[134](https://arxiv.org/html/2607.18548#bib.bib160)\]; communication\-network agents face malicious intent parsing, prompt injection, and memory manipulation\[[57](https://arxiv.org/html/2607.18548#bib.bib134),[97](https://arxiv.org/html/2607.18548#bib.bib143),[132](https://arxiv.org/html/2607.18548#bib.bib144)\]; and HPC multi\-agent systems must secure recovery, coordination, and workload\-management channels against exactly the kind of manipulation their autonomy depends on\[[93](https://arxiv.org/html/2607.18548#bib.bib113),[83](https://arxiv.org/html/2607.18548#bib.bib117),[110](https://arxiv.org/html/2607.18548#bib.bib115),[117](https://arxiv.org/html/2607.18548#bib.bib114)\]\. This is a structural tension rather than an engineering oversight: every mechanism identified in Section[XII\-A](https://arxiv.org/html/2607.18548#S12.SS1)as strengthening trust also introduces a new interface that an adversary can target\.

## XIIIOpen Challenges and Future Directions

### XIII\-AMandating Trustworthiness Metrics Alongside Task Success

Most current work still reports task success, workflow completion, or automation gains as the primary outcome measure\. The field needs to shift toward unsafe\-action rate, constraint\-violation severity, robustness to rare events, explanation usefulness, audit completeness, and human\-override behavior as first\-class reported metrics\[[21](https://arxiv.org/html/2607.18548#bib.bib171),[135](https://arxiv.org/html/2607.18548#bib.bib167),[97](https://arxiv.org/html/2607.18548#bib.bib143),[132](https://arxiv.org/html/2607.18548#bib.bib144)\], evaluated under long\-horizon operation, tool failure, corrupted telemetry, and cascading error rather than single\-shot tasks\[[53](https://arxiv.org/html/2607.18548#bib.bib165),[52](https://arxiv.org/html/2607.18548#bib.bib170),[13](https://arxiv.org/html/2607.18548#bib.bib166),[98](https://arxiv.org/html/2607.18548#bib.bib168),[63](https://arxiv.org/html/2607.18548#bib.bib153)\]\. Until trustworthiness metrics are reported with the same rigor as task accuracy, capability will continue to outpace assurance across every domain surveyed here\. We propose a standard trustworthiness scorecard, reported alongside task\-success metrics in every agentic\-AI evaluation, analogous to model cards for foundation models\.

### XIII\-BDefining Autonomy Boundaries before Deployment

A major open question is when an agent should advise, recommend, supervise, or act, and answering it requires domain\-specific commitments rather than a generic autonomy policy\. Power systems need explicit boundaries between advisory output, operator\-approved action, and autonomous grid\-control privilege\[[21](https://arxiv.org/html/2607.18548#bib.bib171),[135](https://arxiv.org/html/2607.18548#bib.bib167)\]; robotics and UAVs need actuation\-level safety constraints that bind before a high\-level plan can move a motor\[[10](https://arxiv.org/html/2607.18548#bib.bib146),[75](https://arxiv.org/html/2607.18548#bib.bib147),[20](https://arxiv.org/html/2607.18548#bib.bib148)\]; communication networks need policy checks between natural\-language intent and executable configuration\[[51](https://arxiv.org/html/2607.18548#bib.bib133),[70](https://arxiv.org/html/2607.18548#bib.bib139),[57](https://arxiv.org/html/2607.18548#bib.bib134)\]; HPC needs supervision policies for self\-healing and workload redistribution\[[93](https://arxiv.org/html/2607.18548#bib.bib113),[83](https://arxiv.org/html/2607.18548#bib.bib117),[117](https://arxiv.org/html/2607.18548#bib.bib114)\]\. What is missing is a shared vocabulary for expressing these boundaries so that an autonomy grant in one domain can be compared, audited, and reasoned about using the same terms as in another\. The human–AI autonomy spectrum in Fig\.[10](https://arxiv.org/html/2607.18548#S13.F10)– ranging from fully autonomous AI, through human\-in\-the\-loop and human\-on\-the\-loop configurations, to human\-in\-command, offers exactly this shared reference point: each domain\-specific boundary described above can be located on this spectrum rather than defined from scratch\. It is important to note that this placement is not static, as some applications can introduce a dynamic autonomy level that grows with positive feedback\.

![Refer to caption](https://arxiv.org/html/2607.18548v1/x3.png)Figure 10:Human–AI autonomy spectrum, illustrating more collaborative interactions in the human\-in\-the\-loop and human\-on\-the\-loop setups\.
### XIII\-CRobustness under Rare and Adversarial Conditions

Future evaluation must deliberately target rare events, degraded sensing, corrupted inputs, adversarial prompts, and tool\-chain outages rather than curated benchmarks\. This means testing power\-system agents against rare grid events and solver failures\[[21](https://arxiv.org/html/2607.18548#bib.bib171),[53](https://arxiv.org/html/2607.18548#bib.bib165),[52](https://arxiv.org/html/2607.18548#bib.bib170)\]; robotics and UAV agents against sensor and actuator degradation, jitter, packet loss, and adversarial perception\[[66](https://arxiv.org/html/2607.18548#bib.bib149),[64](https://arxiv.org/html/2607.18548#bib.bib150),[65](https://arxiv.org/html/2607.18548#bib.bib151),[31](https://arxiv.org/html/2607.18548#bib.bib156),[25](https://arxiv.org/html/2607.18548#bib.bib157)\]; HPC agents against data corruption, message loss, and processor\-level failure at scale\[[63](https://arxiv.org/html/2607.18548#bib.bib153),[27](https://arxiv.org/html/2607.18548#bib.bib118)\]; and communication agents against malicious intent, semantic misalignment, and prompt injection\[[57](https://arxiv.org/html/2607.18548#bib.bib134),[126](https://arxiv.org/html/2607.18548#bib.bib135),[123](https://arxiv.org/html/2607.18548#bib.bib136),[97](https://arxiv.org/html/2607.18548#bib.bib143),[132](https://arxiv.org/html/2607.18548#bib.bib144)\]\. A cross\-domain adversarial test suite, rather than four disconnected ones, would let the field compare the amount of residual risk that survives each domain’s safety filter under a common stress model\. We envision this as a common outer harness, fault injection, adversarial perturbation, and telemetry corruption, with pluggable domain\-specific modules\.

### XIII\-DProvenance Standards: Build Them Before Regulators Do

Trustworthy agents need records that connect user requests, retrieved data, intermediate reasoning, tool calls, validation results, human approval, and final actions into one recoverable chain\. Power\-system agents should move from tool\-call traces to utility\-grade audit trails\[[13](https://arxiv.org/html/2607.18548#bib.bib166),[53](https://arxiv.org/html/2607.18548#bib.bib165),[122](https://arxiv.org/html/2607.18548#bib.bib164),[98](https://arxiv.org/html/2607.18548#bib.bib168)\]; robotics and UAV systems should maintain tamper\-evident perception–decision, actuation logs for incident reconstruction\[[100](https://arxiv.org/html/2607.18548#bib.bib154),[99](https://arxiv.org/html/2607.18548#bib.bib155)\]; communication\-network agents should connect intent parsing, semantic encoding, routing, and tool invocation into a single chain\[[51](https://arxiv.org/html/2607.18548#bib.bib133),[126](https://arxiv.org/html/2607.18548#bib.bib135),[123](https://arxiv.org/html/2607.18548#bib.bib136),[97](https://arxiv.org/html/2607.18548#bib.bib143),[132](https://arxiv.org/html/2607.18548#bib.bib144)\]\. Automotive cybersecurity and lifecycle\-governance regimes such as UNECE WP\.29 R155 and ISO/SAE 21434 already require exactly this kind of end\-to\-end traceability for vehicle software\[[81](https://arxiv.org/html/2607.18548#bib.bib162),[109](https://arxiv.org/html/2607.18548#bib.bib163)\]; agentic AI in the other three domains has no equivalent requirement yet, despite facing a structurally identical accountability problem\. Absent a proactive standard, the first cross\-domain audit\-trail requirement will likely arrive only after an incident forces it, at which point the field is retrofitting rather than leading\.

### XIII\-ESecuring Tool\-Using and Multi\-Agent Workflows

Power\-system, robotics/UAV, communication\-network, and HPC agents each need conventional hardening — least\-privilege tool access, typed schemas, sandboxing, network\- and model\-layer protection\[[133](https://arxiv.org/html/2607.18548#bib.bib173),[122](https://arxiv.org/html/2607.18548#bib.bib164),[53](https://arxiv.org/html/2607.18548#bib.bib165),[52](https://arxiv.org/html/2607.18548#bib.bib170),[112](https://arxiv.org/html/2607.18548#bib.bib172),[31](https://arxiv.org/html/2607.18548#bib.bib156),[25](https://arxiv.org/html/2607.18548#bib.bib157),[44](https://arxiv.org/html/2607.18548#bib.bib158),[62](https://arxiv.org/html/2607.18548#bib.bib159),[134](https://arxiv.org/html/2607.18548#bib.bib160),[57](https://arxiv.org/html/2607.18548#bib.bib134),[97](https://arxiv.org/html/2607.18548#bib.bib143),[132](https://arxiv.org/html/2607.18548#bib.bib144),[93](https://arxiv.org/html/2607.18548#bib.bib113),[83](https://arxiv.org/html/2607.18548#bib.bib117),[110](https://arxiv.org/html/2607.18548#bib.bib115),[117](https://arxiv.org/html/2607.18548#bib.bib114)\], but this is standard software security practice applied to a new surface\. The open problem is agent\-to\-agent trust: impersonation, poisoned shared memory, and cascading failures as a compromised or hallucinating agent silently corrupts every agent downstream of it\. As multi\-agent deployments grow, this shift from securing a single model to securing trust relationships between models has not yet been reflected in the field’s threat models\.

### XIII\-FMaking Explanations Faithful and Decision\-Useful

Exposing a plan, a tool call, or a reasoning trace does not automatically make an explanation faithful\. Power\-system agents should evaluate whether solver outputs and natural\-language explanations actually improve operator decisions and trust calibration, rather than assuming that visibility equals understanding\[[53](https://arxiv.org/html/2607.18548#bib.bib165),[122](https://arxiv.org/html/2607.18548#bib.bib164),[98](https://arxiv.org/html/2607.18548#bib.bib168),[56](https://arxiv.org/html/2607.18548#bib.bib175),[37](https://arxiv.org/html/2607.18548#bib.bib176)\]; robotics and UAV systems should connect saliency and counterfactual explanations to accident reconstruction and pre\-deployment auditing\[[100](https://arxiv.org/html/2607.18548#bib.bib154),[99](https://arxiv.org/html/2607.18548#bib.bib155)\]; communication\-network agents should be able to explain how intent, semantic content, and routing choices became a specific network action\[[51](https://arxiv.org/html/2607.18548#bib.bib133),[70](https://arxiv.org/html/2607.18548#bib.bib139),[69](https://arxiv.org/html/2607.18548#bib.bib140)\]\. The open problem is measuring whether an explanation improves a human decision, not merely whether one was produced\. This requires human\-subject decision studies under realistic operational time pressure, not static proxies of faithfulness such as agent error correlation or attention\-weight agreement\.

### XIII\-GToward a Reusable Cross\-Domain Trustworthiness Framework

One thesis recurs across the challenges above: agentic AI trustworthiness is not four separate problems but one problem observed from four vantage points\. Evaluation, autonomy, robustness, provenance, security, and explanation are each a facet of this claim; this final subsection returns to it directly\.

A reusable framework should compare domains along the axes that determine risk: the consequences of actions, the required response time, the availability of formal constraints, the density of human oversight, the maturity of audit mechanisms, and the exposure of tool, memory, communication, and actuation interfaces\. On these axes, power systems represent constraint\-bound, human\-approved critical infrastructure; robotics and UAVs represent embodied, real\-time actuation with millisecond response budgets; HPC represents large\-scale resilience and recovery under weak real\-time pressure; and communication networks represent intent and semantic interpretation, connected to network behavior\.α3\\alpha^\{3\}\-Bench already demonstrates that a unified, multi\-pillar benchmark is achievable within a single domain\[[34](https://arxiv.org/html/2607.18548#bib.bib98)\]\.

Other safety\-critical engineering fields have already made this transition once\. Aviation software assurance and automotive functional safety converged, over decades, on graded assurance levels, tied to consequence severity, that make a certification granted in one product line legible to engineers, auditors, and regulators working on a different one\[[49](https://arxiv.org/html/2607.18548#bib.bib72),[50](https://arxiv.org/html/2607.18548#bib.bib80),[106](https://arxiv.org/html/2607.18548#bib.bib73),[81](https://arxiv.org/html/2607.18548#bib.bib162),[109](https://arxiv.org/html/2607.18548#bib.bib163)\]\. Agentic AI has not yet undergone this convergence: a validation result for a grid\-dispatch agent and a validation result for a UAV planner currently share no common unit of evidence, even though both are, in essence, claims about how an autonomous reasoning process behaves at the boundary of consequential action\. The EU AI Act’s conformity\-assessment requirements for high\-risk systems point in this direction but remain domain\-agnostic in a way that current agentic evaluation practice is not yet equipped to satisfy\[[33](https://arxiv.org/html/2607.18548#bib.bib83),[35](https://arxiv.org/html/2607.18548#bib.bib85)\]\. We expect the next phase of agentic AI research to be defined less by new architectures and more by this assurance infrastructure: graded, consequence\-indexed autonomy levels; adversarial benchmark suites that generalize across domains rather than multiplying within them; and provenance formats specific enough to support an incident investigation, yet general enough to be compared across power systems, embodied robotics, HPC, and communication networks\. Building shared infrastructure rather than further domain\-siloed capabilities is the central open challenge this survey identifies\.

## XIVConclusion

Large language models have moved from static, single\-turn prediction to agentic architectures that perceive, plan, invoke tools, and act over extended horizons, often with limited human oversight at each step\. This shift changes what “reliable” means: task competence is no longer sufficient evidence that a system can be trusted with consequential, physically or operationally binding decisions\. Trustworthiness in agentic AI must therefore be treated as an engineering property with the same rigor as latency, throughput, or accuracy, rather than a qualitative aspiration layered on afterward\.

Making that argument actionable rather than rhetorical means locating safety, robustness, interpretability, accountability, and security at specific points in an agent’s perception\-to\-action pipeline, organized around five trustworthiness dimensions and a ten\-point assurance workflow\. This backbone supports a unified taxonomy of agentic architectures, a catalog of concrete mechanisms and quantitative metrics that developers can apply when building or evaluating such systems, and an examination of four constraint\-bound engineering domains, power systems, autonomous vehicles/robotics/UAVs, high\-performance computing, and communication networks, where these mechanisms are already being tested in practice\. Reading these domains through a shared lens reveals a common set of failure modes: an unverified boundary between reasoning and action, robustness evidence that rarely extends to rare or adversarial conditions, auditability that covers fragments of a workflow rather than its full length, and a security surface that grows with every tool, memory module, or coordinating agent added to the system\.

Trustworthy\-by\-design agentic AI is the natural next phase for the field: extending this assurance framework beyond the four domains studied and validating it against real deployment incidents, not benchmark suites alone, so trust is engineered into the pipeline from the outset rather than retrofitted after failure\. Aviation and automotive engineering reached comparable maturity only once graded, consequence\-indexed assurance levels made trust evidence portable across products and organizations; agentic AI is at the beginning of that convergence, not the end of it\.

## References

- \[1\]\(2016\)Deep learning with differential privacy\.InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security,CCS ’16,New York, NY, USA,pp\. 308–318\.External Links:ISBN 9781450341394,[Link](https://doi.org/10.1145/2976749.2978318),[Document](https://dx.doi.org/10.1145/2976749.2978318)Cited by:[§III\-E](https://arxiv.org/html/2607.18548#S3.SS5.p1.1)\.
- \[2\]M\. Abou Ali, F\. Dornaika, and J\. Charafeddine\(2025\-11\)Agentic AI: a comprehensive survey of architectures, applications, and future directions\.Artificial Intelligence Review59\(1\),pp\. 11\.External Links:ISSN 1573\-7462,[Document](https://dx.doi.org/10.1007/s10462-025-11422-4),[Link](https://doi.org/10.1007/s10462-025-11422-4)Cited by:[§V\-B2](https://arxiv.org/html/2607.18548#S5.SS2.SSS2.p1.1)\.
- \[3\]D\. B\. Acharya, K\. Kuppan, and B\. Divya\(2025\)Agentic ai: autonomous intelligence for complex goals—a comprehensive survey\.IEEE Access13\(\),pp\. 18912–18936\.External Links:[Document](https://dx.doi.org/10.1109/ACCESS.2025.3532853)Cited by:[§I](https://arxiv.org/html/2607.18548#S1.p6.1),[§V\-B3](https://arxiv.org/html/2607.18548#S5.SS2.SSS3.p1.1)\.
- \[4\]J\. Achiam, D\. Held, A\. Tamar, and P\. Abbeel\(2017\)Constrained policy optimization\.InProceedings of the 34th International Conference on Machine Learning \- Volume 70,ICML’17,pp\. 22–31\.Cited by:[§III\-A](https://arxiv.org/html/2607.18548#S3.SS1.p1.1)\.
- \[5\]R\. Aksitov, S\. Miryoosefi, Z\. Li, D\. Li, S\. Babayan, K\. Kopparapu, Z\. Fisher, R\. Guo, S\. Prakash, P\. Srinivasan, M\. Zaheer, F\. Yu, and S\. Kumar\(2023\)ReST meets react: self\-improvement for multi\-step reasoning llm agent\.External Links:2312\.10003,[Link](https://arxiv.org/abs/2312.10003)Cited by:[§IV\-A](https://arxiv.org/html/2607.18548#S4.SS1.p2.1),[TABLE II](https://arxiv.org/html/2607.18548#S4.T2.1.1.2.1.2.1.1)\.
- \[6\]O\. Al\-Refai and A\. Alabed\(2025\)Explainable brain tumor classification using transfer learning of deep convolutional neural networks\.In2025 16th International Conference on Information and Communication Systems \(ICICS\),Vol\.,pp\. 1–6\.External Links:[Document](https://dx.doi.org/10.1109/ICICS65354.2025.11073099)Cited by:[§III\-C](https://arxiv.org/html/2607.18548#S3.SS3.p1.1)\.
- \[7\]O\. Al\-Refai, I\. Shahbaz, and E\. Hammad\(2026\)Composable trust in agentic ai: bridging architectural capability and system\-level assurance\.In2026 56th Annual IEEE International Conference on Dependable Systems and Networks Workshops \(DSN\-W\),Vol\.,pp\. 17–20\.External Links:[Document](https://dx.doi.org/10.1109/DSN-W70714.2026.00023)Cited by:[§VI\-E](https://arxiv.org/html/2607.18548#S6.SS5.p6.1)\.
- \[8\]O\. Al\-Refai, I\. Shahbaz, A\. A\. Husseinat, and E\. Hammad\(2026\)Federated physics\-grounded reinforcement learning for distributed stability control in smart grids\.External Links:2607\.05553,[Link](https://arxiv.org/abs/2607.05553)Cited by:[§VIII](https://arxiv.org/html/2607.18548#S8.p1.1)\.
- \[9\]O\. Al\-Refai, R\. Sufian, K\. Abo Rubeieh, N\. A\. M\. Abu Rmaileh, O\. M\. F\. Abu\-Sharkh, and S\. Krishnan\(2026\)Design of a web\-based platform to leverage matlab functionality for digital engineering\.InSoft Computing and Its Engineering Applications,K\. K\. Patel, K\. Santosh, G\. Gomes de Oliveira, A\. Patel, and A\. Ghosh \(Eds\.\),Cham,pp\. 69–83\.External Links:ISBN 978\-3\-032\-22065\-3Cited by:[§II\-A](https://arxiv.org/html/2607.18548#S2.SS1.p3.1)\.
- \[10\]A\. D\. Ames, S\. Coogan, M\. Egerstedt, G\. Notomista, K\. Sreenath, and P\. Tabuada\(2019\)Control barrier functions: theory and applications\.In2019 18th European control conference \(ECC\),pp\. 3420–3431\.Cited by:[§XII\-A1](https://arxiv.org/html/2607.18548#S12.SS1.SSS1.p1.1),[§XII\-A3](https://arxiv.org/html/2607.18548#S12.SS1.SSS3.p1.1),[§XII\-A4](https://arxiv.org/html/2607.18548#S12.SS1.SSS4.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.75.75.75.6.1.1),[§XIII\-B](https://arxiv.org/html/2607.18548#S13.SS2.p1.1),[§IX\-A1](https://arxiv.org/html/2607.18548#S9.SS1.SSS1.p1.1),[§IX\-B1](https://arxiv.org/html/2607.18548#S9.SS2.SSS1.p1.1)\.
- \[11\]M\. Andriushchenko, A\. Souly, M\. Dziemian, D\. Duenas, M\. Lin, J\. Wang, D\. Hendrycks, A\. Zou, Z\. Kolter, M\. Fredrikson, E\. Winsor, J\. Wynne, Y\. Gal, and X\. Davies\(2025\)AgentHarm: a benchmark for measuring harmfulness of llm agents\.External Links:2410\.09024,[Link](https://arxiv.org/abs/2410.09024)Cited by:[§V\-C2](https://arxiv.org/html/2607.18548#S5.SS3.SSS2.p4.1),[§VII\-B](https://arxiv.org/html/2607.18548#S7.SS2.p1.1)\.
- \[12\]R\. Arike, E\. Donoway, H\. Bartsch, and M\. Hobbhahn\(2025\)Technical report: evaluating goal drift in language model agents\.External Links:2505\.02709,[Link](https://arxiv.org/abs/2505.02709)Cited by:[§VII\-C1](https://arxiv.org/html/2607.18548#S7.SS3.SSS1.p1.1),[§VII\-C1](https://arxiv.org/html/2607.18548#S7.SS3.SSS1.p2.1),[§VII\-C](https://arxiv.org/html/2607.18548#S7.SS3.p1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.18.14.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.19.15.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.20.16.1.1.1)\.
- \[13\]E\. O\. Badmus, P\. Sang, D\. Stamoulis, and A\. Pandey\(2025\)PowerChain: automating distribution grid analysis with agentic AI workflows\.External Links:[Link](https://arxiv.org/abs/2508.17094)Cited by:[§XII\-A1](https://arxiv.org/html/2607.18548#S12.SS1.SSS1.p1.1),[§XII\-A3](https://arxiv.org/html/2607.18548#S12.SS1.SSS3.p1.1),[§XII\-B2](https://arxiv.org/html/2607.18548#S12.SS2.SSS2.p1.1),[§XII\-B3](https://arxiv.org/html/2607.18548#S12.SS2.SSS3.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.35.35.35.6.1.1),[§XIII\-A](https://arxiv.org/html/2607.18548#S13.SS1.p1.1),[§XIII\-D](https://arxiv.org/html/2607.18548#S13.SS4.p1.1),[§VIII\-A1](https://arxiv.org/html/2607.18548#S8.SS1.SSS1.p1.1),[§VIII\-A2](https://arxiv.org/html/2607.18548#S8.SS1.SSS2.p1.1),[§VIII\-A2](https://arxiv.org/html/2607.18548#S8.SS1.SSS2.p2.1),[§VIII\-A3](https://arxiv.org/html/2607.18548#S8.SS1.SSS3.p2.1),[§VIII\-A4](https://arxiv.org/html/2607.18548#S8.SS1.SSS4.p1.1),[§VIII\-B1](https://arxiv.org/html/2607.18548#S8.SS2.SSS1.p2.1),[§VIII\-B2](https://arxiv.org/html/2607.18548#S8.SS2.SSS2.p1.1),[§VIII\-B4](https://arxiv.org/html/2607.18548#S8.SS2.SSS4.p1.1),[§VIII\-C](https://arxiv.org/html/2607.18548#S8.SS3.p1.1)\.
- \[14\]A\. Bandi, B\. Kongari, R\. Naguru, S\. Pasnoor, and S\. V\. Vilipala\(2025\)The rise of agentic ai: a review of definitions, frameworks, architectures, applications, evaluation metrics, and challenges\.Future Internet17\(9\)\.External Links:[Link](https://www.mdpi.com/1999-5903/17/9/404),ISSN 1999\-5903,[Document](https://dx.doi.org/10.3390/fi17090404)Cited by:[§I](https://arxiv.org/html/2607.18548#S1.p1.1)\.
- \[15\]R\. Campbell\(2026\-02\)Zero trust for ai systems: a reference architecture and assurance framework\.Preprints\.External Links:[Document](https://dx.doi.org/10.20944/preprints202602.0085.v1),[Link](https://doi.org/10.20944/preprints202602.0085.v1)Cited by:[TABLE I](https://arxiv.org/html/2607.18548#S3.T1.1.1.5.3.6.1.1),[TABLE I](https://arxiv.org/html/2607.18548#S3.T1.1.1.6.4.6.1.1),[§V\-C4](https://arxiv.org/html/2607.18548#S5.SS3.SSS4.p1.1),[§V\-C4](https://arxiv.org/html/2607.18548#S5.SS3.SSS4.p2.1)\.
- \[16\]F\. Cappello, A\. Geist, W\. Gropp, L\. Kalé, B\. Kramer, and M\. Snir\(2009\)Toward exascale resilience\.23,pp\. 374 – 388\.External Links:[Document](https://dx.doi.org/10.1177/1094342009347767)Cited by:[§X\-B1](https://arxiv.org/html/2607.18548#S10.SS2.SSS1.p1.1),[§X](https://arxiv.org/html/2607.18548#S10.p1.1),[§XII\-A3](https://arxiv.org/html/2607.18548#S12.SS1.SSS3.p1.1)\.
- \[17\]N\. Carlini, J\. Rando, E\. Debenedetti, M\. Nasr, and F\. Tramèr\(2025\)AutoAdvExBench: benchmarking autonomous exploitation of adversarial example defenses\.External Links:2503\.01811,[Link](https://arxiv.org/abs/2503.01811)Cited by:[§VII\-D3](https://arxiv.org/html/2607.18548#S7.SS4.SSS3.p1.1)\.
- \[18\]E\. Y\. Chang and L\. Geng\(2025\-08\)SagaLLM: context management, validation, and transaction guarantees for multi\-agent llm planning\.Proc\. VLDB Endow\.18\(12\),pp\. 4874–4886\.External Links:ISSN 2150\-8097,[Link](https://doi.org/10.14778/3750601.3750611),[Document](https://dx.doi.org/10.14778/3750601.3750611)Cited by:[§X\-A2](https://arxiv.org/html/2607.18548#S10.SS1.SSS2.p2.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.161.161.161.6.1.1)\.
- \[19\]B\. Chen, G\. Li, X\. Lin, Z\. Wang, and J\. Li\(2024\)BlockAgents: towards byzantine\-robust llm\-based multi\-agent coordination via blockchain\.InProceedings of the ACM Turing Award Celebration Conference \- China 2024,ACM\-TURC ’24,New York, NY, USA,pp\. 187–192\.External Links:ISBN 9798400710117,[Link](https://doi.org/10.1145/3674399.3674445),[Document](https://dx.doi.org/10.1145/3674399.3674445)Cited by:[§IV\-E](https://arxiv.org/html/2607.18548#S4.SS5.p4.1)\.
- \[20\]S\. Chen, Y\. Sun, D\. Li, Q\. Wang, Q\. Hao, and J\. Sifakis\(2022\)Runtime safety assurance for learning\-enabled control of autonomous driving vehicles\.In2022 International Conference on Robotics and Automation \(ICRA\),pp\. 8978–8984\.Cited by:[§XII\-A1](https://arxiv.org/html/2607.18548#S12.SS1.SSS1.p1.1),[§XII\-A3](https://arxiv.org/html/2607.18548#S12.SS1.SSS3.p1.1),[§XII\-A4](https://arxiv.org/html/2607.18548#S12.SS1.SSS4.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.85.85.85.6.1.1),[§XIII\-B](https://arxiv.org/html/2607.18548#S13.SS2.p1.1),[§IX\-A1](https://arxiv.org/html/2607.18548#S9.SS1.SSS1.p1.1),[§IX\-B1](https://arxiv.org/html/2607.18548#S9.SS2.SSS1.p1.1)\.
- \[21\]Y\. Cheng, H\. Zhao, X\. Zhou, J\. Zhao, Y\. Cao, C\. Yang, and X\. Cai\(2025\)A large language model for advanced power dispatch\.15\.Cited by:[§XII\-A4](https://arxiv.org/html/2607.18548#S12.SS1.SSS4.p1.1),[§XII\-B1](https://arxiv.org/html/2607.18548#S12.SS2.SSS1.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.60.60.60.6.1.1),[§XIII\-A](https://arxiv.org/html/2607.18548#S13.SS1.p1.1),[§XIII\-B](https://arxiv.org/html/2607.18548#S13.SS2.p1.1),[§XIII\-C](https://arxiv.org/html/2607.18548#S13.SS3.p1.1),[§VIII\-A1](https://arxiv.org/html/2607.18548#S8.SS1.SSS1.p1.1),[§VIII\-A2](https://arxiv.org/html/2607.18548#S8.SS1.SSS2.p2.1),[§VIII\-A4](https://arxiv.org/html/2607.18548#S8.SS1.SSS4.p1.1),[§VIII\-B2](https://arxiv.org/html/2607.18548#S8.SS2.SSS2.p2.1),[§VIII\-C](https://arxiv.org/html/2607.18548#S8.SS3.p1.1)\.
- \[22\]Y\. Y\. Chiu, M\. S\. Lee, R\. Calcott, B\. Handoko, P\. de Font\-Reaulx, P\. Rodriguez, C\. B\. C\. Zhang, Z\. Han, U\. M\. Sehwag, Y\. Maurya, C\. Q\. Knight, H\. R\. Lloyd, F\. Bacus, M\. Mazeika, B\. Liu, Y\. Choi, M\. L\. Gordon, and S\. Levine\(2025\)MoReBench: evaluating procedural and pluralistic moral reasoning in language models, more than outcomes\.External Links:2510\.16380,[Link](https://arxiv.org/abs/2510.16380)Cited by:[TABLE I](https://arxiv.org/html/2607.18548#S3.T1.1.1.4.2.6.1.1),[§VI\-B](https://arxiv.org/html/2607.18548#S6.SS2.p1.1)\.
- \[23\]S\.\-H\. Cho and Y\.\-S\. Lee\(2025\-12\)A comparative study of modern AI frameworks based on architecture, integration, and scalability\.International Journal of Advanced Smart Convergence14\(4\),pp\. 158–167\.Cited by:[§IV\-D](https://arxiv.org/html/2607.18548#S4.SS4.p3.1),[TABLE II](https://arxiv.org/html/2607.18548#S4.T2.1.1.9.8.2.1.1)\.
- \[24\]S\. Damle\(2025\-12\-15\)Are we sleepwalking into an agentic AI crisis?\.ABA Banking Journal\.Note:American Bankers AssociationExternal Links:[Link](https://bankingjournal.aba.com/2025/12/are-we-sleepwalking-into-an-agentic-ai-crisis/)Cited by:[§I](https://arxiv.org/html/2607.18548#S1.p2.1)\.
- \[25\]B\. Davidovich, B\. Nassi, and Y\. Elovici\(2022\)Towards the detection of gps spoofing attacks against drones by analyzing camera’s video stream\.22\(7\),pp\. 2608\.Cited by:[§XII\-B2](https://arxiv.org/html/2607.18548#S12.SS2.SSS2.p1.1),[§XII\-B4](https://arxiv.org/html/2607.18548#S12.SS2.SSS4.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.146.146.146.6.1.1),[§XIII\-C](https://arxiv.org/html/2607.18548#S13.SS3.p1.1),[§XIII\-E](https://arxiv.org/html/2607.18548#S13.SS5.p1.1),[§IX\-A3](https://arxiv.org/html/2607.18548#S9.SS1.SSS3.p1.1),[§IX\-B2](https://arxiv.org/html/2607.18548#S9.SS2.SSS2.p1.1)\.
- \[26\]G\. C\. Developers and P\. Team\(2026\-05\)I/O ’26 news for agent developers on Google Cloud\(Website\)Google Cloud Blog\.Note:Accessed: 2026\-06\-30External Links:[Link](https://cloud.google.com/blog/topics/developers-practitioners/io26-news-for-agent-developers-on-google-cloud)Cited by:[§IV\-D](https://arxiv.org/html/2607.18548#S4.SS4.p3.1),[TABLE II](https://arxiv.org/html/2607.18548#S4.T2.1.1.10.9.2.1.1)\.
- \[27\]J\. Dongarra, T\. Herault, and Y\. Robert\(2015\)Fault tolerance techniques for high\-performance computing\.InFault\-tolerance techniques for high\-performance computing,pp\. 3–85\.Cited by:[§X\-A1](https://arxiv.org/html/2607.18548#S10.SS1.SSS1.p1.1),[§X](https://arxiv.org/html/2607.18548#S10.p1.1),[§XII\-A3](https://arxiv.org/html/2607.18548#S12.SS1.SSS3.p1.1),[§XII\-B2](https://arxiv.org/html/2607.18548#S12.SS2.SSS2.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.156.156.156.6.1.1),[§XIII\-C](https://arxiv.org/html/2607.18548#S13.SS3.p1.1)\.
- \[28\]Z\. Du, R\. Wang, H\. BAI, zouying cao, X\. Zhu, B\. Zheng, W\. Chen, and H\. Ying\(2026\)Enabling agents to communicate entirely in latent space\.External Links:[Link](https://openreview.net/forum?id=rmYbgsehTd)Cited by:[§IV\-E](https://arxiv.org/html/2607.18548#S4.SS5.p3.1),[TABLE II](https://arxiv.org/html/2607.18548#S4.T2.1.1.7.6.2.1.1)\.
- \[29\]R\. Dwivedi, D\. Dave, H\. Naik, S\. Singhal, R\. Omer, P\. Patel, B\. Qian, Z\. Wen, T\. Shah, G\. Morgan, and R\. Ranjan\(2023\-01\)Explainable ai \(xai\): core ideas, techniques, and solutions\.ACM Comput\. Surv\.55\(9\)\.External Links:ISSN 0360\-0300,[Link](https://doi.org/10.1145/3561048),[Document](https://dx.doi.org/10.1145/3561048)Cited by:[§III\-C](https://arxiv.org/html/2607.18548#S3.SS3.p1.1)\.
- \[30\]R\. El Makroum, S\. Zwickl\-Bernhard, and L\. Kranzl\(2026\)Agentic AI home energy management system: a large language model framework for residential load scheduling\.29,pp\. 109857\.External Links:[Document](https://dx.doi.org/10.1016/j.rineng.2026.109857)Cited by:[§XII\-A2](https://arxiv.org/html/2607.18548#S12.SS1.SSS2.p1.1),[§XII\-B2](https://arxiv.org/html/2607.18548#S12.SS2.SSS2.p1.1),[§XII\-B4](https://arxiv.org/html/2607.18548#S12.SS2.SSS4.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.70.70.70.6.1.1),[§VIII\-A3](https://arxiv.org/html/2607.18548#S8.SS1.SSS3.p1.1),[§VIII\-A4](https://arxiv.org/html/2607.18548#S8.SS1.SSS4.p1.1),[§VIII\-A4](https://arxiv.org/html/2607.18548#S8.SS1.SSS4.p2.1),[§VIII\-B2](https://arxiv.org/html/2607.18548#S8.SS2.SSS2.p1.1),[§VIII\-B5](https://arxiv.org/html/2607.18548#S8.SS2.SSS5.p1.1),[§VIII\-C](https://arxiv.org/html/2607.18548#S8.SS3.p1.1)\.
- \[31\]A\. Eldosouky, A\. Ferdowsi, and W\. Saad\(2019\)Drones in distress: a game\-theoretic countermeasure for protecting uavs against gps spoofing\.7\(4\),pp\. 2840–2854\.Cited by:[§XII\-B2](https://arxiv.org/html/2607.18548#S12.SS2.SSS2.p1.1),[§XII\-B4](https://arxiv.org/html/2607.18548#S12.SS2.SSS4.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.141.141.141.6.1.1),[§XIII\-C](https://arxiv.org/html/2607.18548#S13.SS3.p1.1),[§XIII\-E](https://arxiv.org/html/2607.18548#S13.SS5.p1.1),[§IX\-A3](https://arxiv.org/html/2607.18548#S9.SS1.SSS3.p1.1),[§IX\-B2](https://arxiv.org/html/2607.18548#S9.SS2.SSS2.p1.1)\.
- \[32\]M\. A\. Enright, E\. Hammad, and A\. Dutta\(2022\)A learning\-based zero\-trust architecture for 6g and future networks\.In2022 IEEE Future Networks World Forum \(FNWF\),pp\. 64–71\.Cited by:[§XI](https://arxiv.org/html/2607.18548#S11.p1.1)\.
- \[33\]European Artificial Intelligence Office\(2024\-09\)AI Pact: organisations’ commitments\.Technical reportEuropean Commission\.Note:Accessed: 2025\-02\-17External Links:[Link](https://artificialintelligenceact.eu/wp-content/uploads/2025/03/2024.09.25-AI-Pact-final.pdf)Cited by:[§XIII\-G](https://arxiv.org/html/2607.18548#S13.SS7.p3.1),[§III\-C](https://arxiv.org/html/2607.18548#S3.SS3.p1.1),[§III\-D](https://arxiv.org/html/2607.18548#S3.SS4.p1.1),[TABLE I](https://arxiv.org/html/2607.18548#S3.T1.1.1.4.2.6.1.1)\.
- \[34\]M\. A\. Ferrag, A\. Lakas, and M\. Debbah\(2026\)α3\\alpha^\{3\}\-Bench: a unified benchmark of safety, robustness, and efficiency for llm\-based uav agents over 6g networks\.External Links:2601\.03281,[Link](https://arxiv.org/abs/2601.03281)Cited by:[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.86.86.86.1.1.1),[§XIII\-G](https://arxiv.org/html/2607.18548#S13.SS7.p2.1),[2nd item](https://arxiv.org/html/2607.18548#S7.I6.i2.p1.1),[§VII\-D1](https://arxiv.org/html/2607.18548#S7.SS4.SSS1.p1.2),[§VII\-D1](https://arxiv.org/html/2607.18548#S7.SS4.SSS1.p3.4),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.23.19.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.24.20.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.25.21.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.26.22.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.27.23.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.28.24.1.1.1),[§IX\-A3](https://arxiv.org/html/2607.18548#S9.SS1.SSS3.p2.1),[§IX\-B5](https://arxiv.org/html/2607.18548#S9.SS2.SSS5.p1.1)\.
- \[35\]Future of Life Institute\(2025\-05\)AI act compliance checker flowchart \(v1\.0\)\(Website\)Future of Life Institute\.Note:Accessed: 2025\-02\-17External Links:[Link](https://artificialintelligenceact.eu/wp-content/uploads/2025/07/AI-Act-Compliance-Checker-Flowchart-v1.0_compressed.pdf)Cited by:[§XIII\-G](https://arxiv.org/html/2607.18548#S13.SS7.p3.1),[§III\-D](https://arxiv.org/html/2607.18548#S3.SS4.p1.1),[TABLE I](https://arxiv.org/html/2607.18548#S3.T1.1.1.5.3.6.1.1)\.
- \[36\]A\. Gholami, Z\. Yao, S\. Kim, C\. Hooper, M\. W\. Mahoney, and K\. Keutzer\(2024\)AI and memory wall\.IEEE Micro44\(3\),pp\. 33–39\.External Links:[Document](https://dx.doi.org/10.1109/MM.2024.3373763)Cited by:[§X\-B2](https://arxiv.org/html/2607.18548#S10.SS2.SSS2.p1.1)\.
- \[37\]S\. Ghosh and G\. Mittal\(2025\)Agentic AI systems in electrical engineering: current state\-of\-the\-art and challenges\.External Links:[Link](https://arxiv.org/abs/2511.14478)Cited by:[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.20.20.20.6.1.1),[§XIII\-F](https://arxiv.org/html/2607.18548#S13.SS6.p1.1),[§VIII\-B3](https://arxiv.org/html/2607.18548#S8.SS2.SSS3.p2.1),[§VIII\-B5](https://arxiv.org/html/2607.18548#S8.SS2.SSS5.p2.1),[§VIII](https://arxiv.org/html/2607.18548#S8.p1.1)\.
- \[38\]Google AI for Developers\(2026\)Building managed agents with the Gemini API\(Website\)Google AI Documentation\.Note:Accessed: 2026\-06\-30External Links:[Link](https://ai.google.dev/gemini-api/docs/custom-agents)Cited by:[§IV\-D](https://arxiv.org/html/2607.18548#S4.SS4.p3.1),[TABLE II](https://arxiv.org/html/2607.18548#S4.T2.1.1.10.9.2.1.1)\.
- \[39\]Google Cloud\(2026\)Building managed agents on the Gemini Enterprise Agent Platform\(Website\)Google Cloud Documentation\.Note:Accessed: 2026\-06\-30External Links:[Link](https://docs.cloud.google.com/gemini-enterprise-agent-platform/build/managed-agents)Cited by:[§IV\-D](https://arxiv.org/html/2607.18548#S4.SS4.p3.1),[TABLE II](https://arxiv.org/html/2607.18548#S4.T2.1.1.10.9.2.1.1)\.
- \[40\]Google Cloud\(2026\)Interacting with managed agents on the Gemini Enterprise Agent Platform\(Website\)Google Cloud Documentation\.Note:Accessed: 2026\-06\-30External Links:[Link](https://docs.cloud.google.com/gemini-enterprise-agent-platform/build/managed-agents/interact-with-agents)Cited by:[§IV\-D](https://arxiv.org/html/2607.18548#S4.SS4.p3.1),[TABLE II](https://arxiv.org/html/2607.18548#S4.T2.1.1.10.9.2.1.1)\.
- \[41\]A\. Gurram\(2025\)Generative ai for enhanced cybersecurity: building a zero\-trust architecture with agentic ai\.World J\. Adv\. Eng\. Technol\. Sci15\(1\),pp\. 2380–2396\.Cited by:[§V\-C4](https://arxiv.org/html/2607.18548#S5.SS3.SSS4.p5.1)\.
- \[42\]HackerNoon\(2024\)Inside the push to standardize communication between AI agents\(Website\)HackerNoon\.Note:Accessed: 2026\-04\-15External Links:[Link](https://hackernoon.com/inside-the-push-to-standardize-communication-between-ai-agents)Cited by:[§IV\-E](https://arxiv.org/html/2607.18548#S4.SS5.p2.1)\.
- \[43\]T\. Haikal, S\. Ismail, and E\. Hammad\(2026\)Bridging high\-level intent and network execution: detecting violations and intent drift through low\-level traffic analysis\.In2026 IEEE World AI IoT Congress \(AIIoT\),pp\. 0479–0485\.Cited by:[§XI\-B1](https://arxiv.org/html/2607.18548#S11.SS2.SSS1.p2.1)\.
- \[44\]M\. Hasan, S\. Mohan, T\. Shimizu, and H\. Lu\(2020\)Securing vehicle\-to\-everything \(v2x\) communication platforms\.5\(4\),pp\. 693–713\.Cited by:[§XII\-B4](https://arxiv.org/html/2607.18548#S12.SS2.SSS4.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.151.151.151.6.1.1),[§XIII\-E](https://arxiv.org/html/2607.18548#S13.SS5.p1.1),[§IX\-A3](https://arxiv.org/html/2607.18548#S9.SS1.SSS3.p1.1),[§IX\-B2](https://arxiv.org/html/2607.18548#S9.SS2.SSS2.p1.1)\.
- \[45\]D\. Hendrycks, M\. Mazeika, and T\. Woodside\(2023\)An overview of catastrophic ai risks\.External Links:2306\.12001,[Link](https://arxiv.org/abs/2306.12001)Cited by:[§III\-E](https://arxiv.org/html/2607.18548#S3.SS5.p1.1)\.
- \[46\]D\. Hespe, L\. Hübner, P\. Sanders, and A\. Stamatakis\(2022\)ReStore: in\-memory replicated storage for rapid recovery in fault\-tolerant algorithms\.InEuro\-Par 2022: Parallel Processing,J\. Cano and J\. L\. Träff \(Eds\.\),Cham,pp\. 203–217\.External Links:[Document](https://dx.doi.org/10.1007/978-3-031-12597-3%5F13),[Link](https://doi.org/10.1007/978-3-031-12597-3_13)Cited by:[§XII\-A3](https://arxiv.org/html/2607.18548#S12.SS1.SSS3.p1.1)\.
- \[47\]K\. Huang, V\. S\. Narajala, J\. Yeoh, J\. Ross, R\. Raskar, Y\. Harkati, J\. Huang, I\. Habler, and C\. Hughes\(2025\)A novel zero\-trust identity framework for agentic ai: decentralized authentication and fine\-grained access control\.External Links:2505\.19301,[Link](https://arxiv.org/abs/2505.19301)Cited by:[§V\-C4](https://arxiv.org/html/2607.18548#S5.SS3.SSS4.p4.1)\.
- \[48\]K\. Huang and J\. A\. Abraham\(1984\)Algorithm\-based fault tolerance for matrix operations\.IEEE Transactions on ComputersC\-33\(6\),pp\. 518–528\.External Links:[Document](https://dx.doi.org/10.1109/TC.1984.1676475)Cited by:[§X\-A1](https://arxiv.org/html/2607.18548#S10.SS1.SSS1.p1.1),[§XII\-A3](https://arxiv.org/html/2607.18548#S12.SS1.SSS3.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.166.166.166.6.1.1)\.
- \[49\]International Electrotechnical Commission\(2022\)IEC 61508 & functional safety\.Technical reportIEC\.Note:Accessed: 2025\-02\-16External Links:[Link](https://assets.iec.ch/public/acos/IEC%2061508%20&%20Functional%20Safety-2022.pdf?2023040501)Cited by:[§XIII\-G](https://arxiv.org/html/2607.18548#S13.SS7.p3.1),[§III\-A](https://arxiv.org/html/2607.18548#S3.SS1.p1.1)\.
- \[50\]International Electrotechnical Commission\(2022\)IEC 61508 & functional safety\.Technical reportIEC\.Note:Accessed: 2025\-02\-16External Links:[Link](https://assets.iec.ch/public/acos/IEC%2061508%20&%20Functional%20Safety-2022.pdf?2023040501)Cited by:[§XIII\-G](https://arxiv.org/html/2607.18548#S13.SS7.p3.1),[§III\-A](https://arxiv.org/html/2607.18548#S3.SS1.p1.1),[TABLE I](https://arxiv.org/html/2607.18548#S3.T1.1.1.3.1.6.1.1)\.
- \[51\]A\. S\. Jacobs, R\. J\. Pfitscher, R\. H\. Ribeiro, R\. A\. Ferreira, L\. Z\. Granville, W\. Willinger, and S\. G\. Rao\(2021\)Hey, lumi\! using natural language for intent\-based network management\.In2021 USENIX Annual Technical Conference \(USENIX ATC 21\),pp\. 625–639\.External Links:[Link](https://www.usenix.org/conference/atc21/presentation/jacobs)Cited by:[§XI\-A1](https://arxiv.org/html/2607.18548#S11.SS1.SSS1.p1.1),[§XI\-B1](https://arxiv.org/html/2607.18548#S11.SS2.SSS1.p1.1),[§XI\-B3](https://arxiv.org/html/2607.18548#S11.SS2.SSS3.p1.1),[§XII\-A1](https://arxiv.org/html/2607.18548#S12.SS1.SSS1.p1.1),[§XII\-A2](https://arxiv.org/html/2607.18548#S12.SS1.SSS2.p1.1),[§XII\-A4](https://arxiv.org/html/2607.18548#S12.SS1.SSS4.p1.1),[§XII\-B1](https://arxiv.org/html/2607.18548#S12.SS2.SSS1.p1.1),[§XII\-B3](https://arxiv.org/html/2607.18548#S12.SS2.SSS3.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.181.181.181.6.1.1),[§XIII\-B](https://arxiv.org/html/2607.18548#S13.SS2.p1.1),[§XIII\-D](https://arxiv.org/html/2607.18548#S13.SS4.p1.1),[§XIII\-F](https://arxiv.org/html/2607.18548#S13.SS6.p1.1)\.
- \[52\]M\. Jia, Z\. Cui, and G\. Hug\(2025\)Enhancing LLMs for power system simulations: a feedback\-driven multi\-agent framework\.16\(6\),pp\. 5556–5572\.Cited by:[§XII\-A1](https://arxiv.org/html/2607.18548#S12.SS1.SSS1.p1.1),[§XII\-A3](https://arxiv.org/html/2607.18548#S12.SS1.SSS3.p1.1),[§XII\-B2](https://arxiv.org/html/2607.18548#S12.SS2.SSS2.p1.1),[§XII\-B4](https://arxiv.org/html/2607.18548#S12.SS2.SSS4.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.55.55.55.6.1.1),[§XIII\-A](https://arxiv.org/html/2607.18548#S13.SS1.p1.1),[§XIII\-C](https://arxiv.org/html/2607.18548#S13.SS3.p1.1),[§XIII\-E](https://arxiv.org/html/2607.18548#S13.SS5.p1.1),[§VIII\-A2](https://arxiv.org/html/2607.18548#S8.SS1.SSS2.p1.1),[§VIII\-A2](https://arxiv.org/html/2607.18548#S8.SS1.SSS2.p2.1),[§VIII\-A3](https://arxiv.org/html/2607.18548#S8.SS1.SSS3.p2.1),[§VIII\-B1](https://arxiv.org/html/2607.18548#S8.SS2.SSS1.p2.1),[§VIII\-B2](https://arxiv.org/html/2607.18548#S8.SS2.SSS2.p1.1),[§VIII\-B5](https://arxiv.org/html/2607.18548#S8.SS2.SSS5.p1.1),[§VIII\-C](https://arxiv.org/html/2607.18548#S8.SS3.p1.1)\.
- \[53\]H\. Jin, K\. Kim, and J\. Kwon\(2025\)GridMind: LLMs\-powered agents for power system analysis and operations\.InProceedings of the SC’25 Workshops of the International Conference for High Performance Computing, Networking, Storage and Analysis,pp\. 560–568\.Cited by:[§XII\-A1](https://arxiv.org/html/2607.18548#S12.SS1.SSS1.p1.1),[§XII\-A4](https://arxiv.org/html/2607.18548#S12.SS1.SSS4.p1.1),[§XII\-B2](https://arxiv.org/html/2607.18548#S12.SS2.SSS2.p1.1),[§XII\-B3](https://arxiv.org/html/2607.18548#S12.SS2.SSS3.p1.1),[§XII\-B4](https://arxiv.org/html/2607.18548#S12.SS2.SSS4.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.30.30.30.6.1.1),[§XIII\-A](https://arxiv.org/html/2607.18548#S13.SS1.p1.1),[§XIII\-C](https://arxiv.org/html/2607.18548#S13.SS3.p1.1),[§XIII\-D](https://arxiv.org/html/2607.18548#S13.SS4.p1.1),[§XIII\-E](https://arxiv.org/html/2607.18548#S13.SS5.p1.1),[§XIII\-F](https://arxiv.org/html/2607.18548#S13.SS6.p1.1),[§VIII\-A1](https://arxiv.org/html/2607.18548#S8.SS1.SSS1.p1.1),[§VIII\-A2](https://arxiv.org/html/2607.18548#S8.SS1.SSS2.p1.1),[§VIII\-A2](https://arxiv.org/html/2607.18548#S8.SS1.SSS2.p2.1),[§VIII\-A4](https://arxiv.org/html/2607.18548#S8.SS1.SSS4.p1.1),[§VIII\-A4](https://arxiv.org/html/2607.18548#S8.SS1.SSS4.p2.1),[§VIII\-B1](https://arxiv.org/html/2607.18548#S8.SS2.SSS1.p2.1),[§VIII\-B2](https://arxiv.org/html/2607.18548#S8.SS2.SSS2.p1.1),[§VIII\-B4](https://arxiv.org/html/2607.18548#S8.SS2.SSS4.p1.1),[§VIII\-B5](https://arxiv.org/html/2607.18548#S8.SS2.SSS5.p1.1),[§VIII\-C](https://arxiv.org/html/2607.18548#S8.SS3.p1.1)\.
- \[54\]Y\. Jo and C\. Park\(2025\)Byzantine\-robust decentralized coordination of llm agents\.External Links:2507\.14928,[Link](https://arxiv.org/abs/2507.14928)Cited by:[§IV\-E](https://arxiv.org/html/2607.18548#S4.SS5.p4.1)\.
- \[55\]M\. Kaufmann, D\. Kang, Y\. Sun, S\. Basart, X\. Yin, M\. Mazeika, A\. Arora, A\. Dziedzic, F\. Boenisch, T\. Brown, J\. Steinhardt, and D\. Hendrycks\(2023\)Testing robustness against unforeseen adversaries\.External Links:1908\.08016,[Link](https://arxiv.org/abs/1908.08016)Cited by:[TABLE I](https://arxiv.org/html/2607.18548#S3.T1.1.1.1.6.1.1),[§V\-C1](https://arxiv.org/html/2607.18548#S5.SS3.SSS1.p1.1),[§V\-C1](https://arxiv.org/html/2607.18548#S5.SS3.SSS1.p2.1),[§V\-C1](https://arxiv.org/html/2607.18548#S5.SS3.SSS1.p3.1)\.
- \[56\]M\. Kiasari and H\. H\. Aly\(2026\)Agentic artificial intelligence for smart grids: a comprehensive review of autonomous, safe, and explainable control frameworks\.19\(3\),pp\. 617\.External Links:[Document](https://dx.doi.org/10.3390/en19030617)Cited by:[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.15.15.15.6.1.1),[§XIII\-F](https://arxiv.org/html/2607.18548#S13.SS6.p1.1),[§VIII\-B3](https://arxiv.org/html/2607.18548#S8.SS2.SSS3.p2.1),[§VIII\-B5](https://arxiv.org/html/2607.18548#S8.SS2.SSS5.p2.1),[§VIII](https://arxiv.org/html/2607.18548#S8.p1.1)\.
- \[57\]J\. Kim, D\. Kim, C\. Cutler, Z\. Lin, D\. Xu, and X\. Zhang\(2023\)INTENDER: fuzzing intent\-based networking with intent\-state transition guidance\.In32nd USENIX Security Symposium \(USENIX Security 23\),pp\. 8861–8878\.External Links:[Link](https://www.usenix.org/conference/usenixsecurity23/presentation/kim-jiwon)Cited by:[§XI\-B1](https://arxiv.org/html/2607.18548#S11.SS2.SSS1.p2.1),[§XII\-A4](https://arxiv.org/html/2607.18548#S12.SS1.SSS4.p1.1),[§XII\-B1](https://arxiv.org/html/2607.18548#S12.SS2.SSS1.p1.1),[§XII\-B2](https://arxiv.org/html/2607.18548#S12.SS2.SSS2.p1.1),[§XII\-B4](https://arxiv.org/html/2607.18548#S12.SS2.SSS4.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.196.196.196.6.1.1),[§XIII\-B](https://arxiv.org/html/2607.18548#S13.SS2.p1.1),[§XIII\-C](https://arxiv.org/html/2607.18548#S13.SS3.p1.1),[§XIII\-E](https://arxiv.org/html/2607.18548#S13.SS5.p1.1)\.
- \[58\]I\. Levy, B\. Wiesel, S\. Marreed, A\. Oved, A\. Yaeli, and S\. Shlomov\(2025\)ST\-webagentbench: a benchmark for evaluating safety and trustworthiness in web agents\.External Links:2410\.06703,[Link](https://arxiv.org/abs/2410.06703)Cited by:[§VII\-B](https://arxiv.org/html/2607.18548#S7.SS2.p1.1),[§VII\-B](https://arxiv.org/html/2607.18548#S7.SS2.p2.1),[§VII\-B](https://arxiv.org/html/2607.18548#S7.SS2.p4.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.14.10.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.15.11.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.16.12.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.17.13.1.1.1)\.
- \[59\]G\. Li, H\. A\. A\. K\. Hammoud, H\. Itani, D\. Khizbullin, and B\. Ghanem\(2023\)CAMEL: communicative agents for ”mind” exploration of large language model society\.External Links:2303\.17760,[Link](https://arxiv.org/abs/2303.17760)Cited by:[§IV\-C](https://arxiv.org/html/2607.18548#S4.SS3.p1.1),[TABLE II](https://arxiv.org/html/2607.18548#S4.T2.1.1.6.5.2.1.1)\.
- \[60\]N\. Li, A\. Pan, A\. Gopal, S\. Yue, D\. Berrios, A\. Gatti, J\. D\. Li, A\. Dombrowski, S\. Goel, L\. Phan, G\. Mukobi, N\. Helm\-Burger, R\. Lababidi, L\. Justen, A\. B\. Liu, M\. Chen, I\. Barrass, O\. Zhang, X\. Zhu, R\. Tamirisa, B\. Bharathi, A\. Khoja, Z\. Zhao, A\. Herbert\-Voss, C\. B\. Breuer, S\. Marks, O\. Patel, A\. Zou, M\. Mazeika, Z\. Wang, P\. Oswal, W\. Lin, A\. A\. Hunt, J\. Tienken\-Harder, K\. Y\. Shih, K\. Talley, J\. Guan, R\. Kaplan, I\. Steneker, D\. Campbell, B\. Jokubaitis, A\. Levinson, J\. Wang, W\. Qian, K\. K\. Karmakar, S\. Basart, S\. Fitz, M\. Levine, P\. Kumaraguru, U\. Tupakula, V\. Varadharajan, R\. Wang, Y\. Shoshitaishvili, J\. Ba, K\. M\. Esvelt, A\. Wang, and D\. Hendrycks\(2024\)The wmdp benchmark: measuring and reducing malicious use with unlearning\.External Links:2403\.03218,[Link](https://arxiv.org/abs/2403.03218)Cited by:[TABLE I](https://arxiv.org/html/2607.18548#S3.T1.1.1.6.4.6.1.1),[§V\-B3](https://arxiv.org/html/2607.18548#S5.SS2.SSS3.p2.1),[§V\-B3](https://arxiv.org/html/2607.18548#S5.SS2.SSS3.p3.1),[§VI\-D](https://arxiv.org/html/2607.18548#S6.SS4.p1.1)\.
- \[61\]X\. Li, S\. Wang, S\. Zeng, Y\. Wu, and Y\. Yang\(2024\-10\-08\)A survey on llm\-based multi\-agent systems: workflow, infrastructure, and challenges\.Vicinagearth1\(1\),pp\. 9\.External Links:ISSN 3005\-060X,[Document](https://dx.doi.org/10.1007/s44336-024-00009-2),[Link](https://doi.org/10.1007/s44336-024-00009-2)Cited by:[§IV\-C](https://arxiv.org/html/2607.18548#S4.SS3.p1.1),[TABLE II](https://arxiv.org/html/2607.18548#S4.T2.1.1.6.5.2.1.1)\.
- \[62\]C\. Ling, K\. Hu, H\. Liu, X\. Han, T\. Zhang, and C\. Ou\(2026\)Physical prompt injection attacks on large vision\-language models\.Cited by:[§XII\-B4](https://arxiv.org/html/2607.18548#S12.SS2.SSS4.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.96.96.96.6.1.1),[§XIII\-E](https://arxiv.org/html/2607.18548#S13.SS5.p1.1),[§IX\-A3](https://arxiv.org/html/2607.18548#S9.SS1.SSS3.p2.1),[§IX\-B2](https://arxiv.org/html/2607.18548#S9.SS2.SSS2.p1.1)\.
- \[63\]N\. Losada, P\. González, M\. J\. Martín, G\. Bosilca, A\. Bouteiller, and K\. Teranishi\(2020\)Fault tolerance of mpi applications in exascale systems: the ulfm solution\.106,pp\. 467–481\.External Links:[Document](https://dx.doi.org/10.1016/j.future.2020.01.026)Cited by:[§X\-A1](https://arxiv.org/html/2607.18548#S10.SS1.SSS1.p1.1),[§XII\-B2](https://arxiv.org/html/2607.18548#S12.SS2.SSS2.p1.1),[§XIII\-A](https://arxiv.org/html/2607.18548#S13.SS1.p1.1),[§XIII\-C](https://arxiv.org/html/2607.18548#S13.SS3.p1.1)\.
- \[64\]Y\. Lou, Y\. Zhu, Q\. Song, R\. Tan, C\. Qiao, W\. Lee, and J\. Wang\(2024\)A first\{\\\{physical\-world\}\\\}trajectory prediction attack via\{\\\{lidar\-induced\}\\\}deceptions in autonomous driving\.In33rd USENIX Security Symposium \(USENIX Security 24\),pp\. 6291–6308\.Cited by:[§XII\-B1](https://arxiv.org/html/2607.18548#S12.SS2.SSS1.p1.1),[§XII\-B2](https://arxiv.org/html/2607.18548#S12.SS2.SSS2.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.111.111.111.6.1.1),[§XIII\-C](https://arxiv.org/html/2607.18548#S13.SS3.p1.1),[§IX\-A3](https://arxiv.org/html/2607.18548#S9.SS1.SSS3.p1.1),[§IX\-B2](https://arxiv.org/html/2607.18548#S9.SS2.SSS2.p1.1)\.
- \[65\]C\. Ma, N\. Wang, Z\. Zhao, Q\. A\. Chen, and C\. Shen\(2024\)Slowperception: physical\-world latency attack against visual perception in autonomous driving\.Cited by:[§XII\-B1](https://arxiv.org/html/2607.18548#S12.SS2.SSS1.p1.1),[§XII\-B2](https://arxiv.org/html/2607.18548#S12.SS2.SSS2.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.116.116.116.6.1.1),[§XIII\-C](https://arxiv.org/html/2607.18548#S13.SS3.p1.1),[§IX\-A3](https://arxiv.org/html/2607.18548#S9.SS1.SSS3.p1.1),[§IX\-B2](https://arxiv.org/html/2607.18548#S9.SS2.SSS2.p1.1)\.
- \[66\]C\. Ma, N\. Wang, Z\. Zhao, Q\. Wang, Q\. A\. Chen, and C\. Shen\(2024\)Controlloc: physical\-world hijacking attack on visual perception in autonomous driving\.Cited by:[§XII\-B1](https://arxiv.org/html/2607.18548#S12.SS2.SSS1.p1.1),[§XII\-B2](https://arxiv.org/html/2607.18548#S12.SS2.SSS2.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.106.106.106.6.1.1),[§XIII\-C](https://arxiv.org/html/2607.18548#S13.SS3.p1.1),[§IX\-A3](https://arxiv.org/html/2607.18548#S9.SS1.SSS3.p1.1),[§IX\-B2](https://arxiv.org/html/2607.18548#S9.SS2.SSS2.p1.1)\.
- \[67\]A\. Madry, A\. Makelov, L\. Schmidt, D\. Tsipras, and A\. Vladu\(2018\)Towards deep learning models resistant to adversarial attacks\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=rJzIBfZAb)Cited by:[§III\-B](https://arxiv.org/html/2607.18548#S3.SS2.p1.1),[TABLE I](https://arxiv.org/html/2607.18548#S3.T1.1.1.1.6.1.1)\.
- \[68\]P\. Maini, S\. Goyal, D\. Sam, A\. Robey, Y\. Savani, Y\. Jiang, A\. Zou, M\. Fredrikson, Z\. C\. Lipton, and J\. Z\. Kolter\(2025\)Safety pretraining: toward the next generation of safe ai\.External Links:2504\.16980,[Link](https://arxiv.org/abs/2504.16980)Cited by:[§V\-A1](https://arxiv.org/html/2607.18548#S5.SS1.SSS1.p1.1)\.
- \[69\]D\. M\. Manias, A\. Chouman, and A\. Shami\(2024\)Semantic routing for enhanced performance of llm\-assisted intent\-based 5g core network management and orchestration\.In2024 IEEE Global Communications Conference \(GLOBECOM\),External Links:[Document](https://dx.doi.org/10.1109/GLOBECOM52923.2024.10901065),[Link](https://arxiv.org/abs/2404.15869)Cited by:[§XI\-A1](https://arxiv.org/html/2607.18548#S11.SS1.SSS1.p2.1),[§XII\-A1](https://arxiv.org/html/2607.18548#S12.SS1.SSS1.p1.1),[§XII\-A2](https://arxiv.org/html/2607.18548#S12.SS1.SSS2.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.191.191.191.6.1.1),[§XIII\-F](https://arxiv.org/html/2607.18548#S13.SS6.p1.1)\.
- \[70\]D\. M\. Manias, A\. Chouman, and A\. Shami\(2024\)Towards intent\-based network management: large language models for intent extraction in 5g core networks\.In2024 20th International Conference on the Design of Reliable Communication Networks \(DRCN\),External Links:[Document](https://dx.doi.org/10.1109/DRCN60692.2024.10539172),[Link](https://arxiv.org/abs/2403.02238)Cited by:[§XI\-A1](https://arxiv.org/html/2607.18548#S11.SS1.SSS1.p2.1),[§XI\-B1](https://arxiv.org/html/2607.18548#S11.SS2.SSS1.p1.1),[§XII\-A1](https://arxiv.org/html/2607.18548#S12.SS1.SSS1.p1.1),[§XII\-A4](https://arxiv.org/html/2607.18548#S12.SS1.SSS4.p1.1),[§XII\-B1](https://arxiv.org/html/2607.18548#S12.SS2.SSS1.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.186.186.186.6.1.1),[§XIII\-B](https://arxiv.org/html/2607.18548#S13.SS2.p1.1),[§XIII\-F](https://arxiv.org/html/2607.18548#S13.SS6.p1.1)\.
- \[71\]D\. Mason\(2025\-10\-01\)ISO/IEC 42001 AI security implementation guide\(Website\)BD Emerson\.Note:Accessed: 2026\-02\-24External Links:[Link](https://www.bdemerson.com/article/iso-iec-42001-ai-security-implementation-guide)Cited by:[1st item](https://arxiv.org/html/2607.18548#S7.I7.i1.p1.1),[2nd item](https://arxiv.org/html/2607.18548#S7.I7.i2.p1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.35.31.1.1.1)\.
- \[72\]V\. Mavroudis\(2024\-11\)LangChain v0\.3\.Preprints\.External Links:[Document](https://dx.doi.org/10.20944/preprints202411.0566.v1),[Link](https://doi.org/10.20944/preprints202411.0566.v1)Cited by:[§IV\-D](https://arxiv.org/html/2607.18548#S4.SS4.p3.1),[TABLE II](https://arxiv.org/html/2607.18548#S4.T2.1.1.9.8.2.1.1)\.
- \[73\]M\. Mazeika, L\. Phan, X\. Yin, A\. Zou, Z\. Wang, N\. Mu, E\. Sakhaee, N\. Li, S\. Basart, B\. Li, D\. Forsyth, and D\. Hendrycks\(2024\)HarmBench: a standardized evaluation framework for automated red teaming and robust refusal\.External Links:2402\.04249,[Link](https://arxiv.org/abs/2402.04249)Cited by:[§VI\-C](https://arxiv.org/html/2607.18548#S6.SS3.p1.1),[§VII\-D3](https://arxiv.org/html/2607.18548#S7.SS4.SSS3.p2.1),[§VII\-D3](https://arxiv.org/html/2607.18548#S7.SS4.SSS3.p3.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.33.29.1.1.1)\.
- \[74\]M\. Mazeika, X\. Yin, R\. Tamirisa, J\. Lim, B\. W\. Lee, R\. Ren, L\. Phan, N\. Mu, A\. Khoja, O\. Zhang, and D\. Hendrycks\(2025\)Utility engineering: analyzing and controlling emergent value systems in ais\.External Links:2502\.08640,[Link](https://arxiv.org/abs/2502.08640)Cited by:[§V\-B1](https://arxiv.org/html/2607.18548#S5.SS2.SSS1.p1.1)\.
- \[75\]U\. Mehmood, S\. Sheikhi, S\. Bak, S\. A\. Smolka, and S\. D\. Stoller\(2022\)The black\-box simplex architecture for runtime assurance of autonomous cps\.InNASA formal methods symposium,pp\. 231–250\.Cited by:[§XII\-A1](https://arxiv.org/html/2607.18548#S12.SS1.SSS1.p1.1),[§XII\-A3](https://arxiv.org/html/2607.18548#S12.SS1.SSS3.p1.1),[§XII\-A4](https://arxiv.org/html/2607.18548#S12.SS1.SSS4.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.80.80.80.6.1.1),[§XIII\-B](https://arxiv.org/html/2607.18548#S13.SS2.p1.1),[§IX\-A1](https://arxiv.org/html/2607.18548#S9.SS1.SSS1.p1.1),[§IX\-B1](https://arxiv.org/html/2607.18548#S9.SS2.SSS1.p1.1)\.
- \[76\]Meta Intelligence\(2026\)Reasoning model practical guide: enterprise comparison and deployment strategies for deepseek r1, openai o3, and gemini 3\(Website\)Meta Intelligence\.Note:Accessed: 2026\-06\-30External Links:[Link](https://www.meta-intelligence.tech/en/insight-reasoning-models)Cited by:[§IV\-B](https://arxiv.org/html/2607.18548#S4.SS2.p3.1),[TABLE II](https://arxiv.org/html/2607.18548#S4.T2.1.1.5.4.2.1.1)\.
- \[77\]Montana Department of Environmental Quality\(n\.d\.\)Failure modes effects analysis \(fmea\)\(Website\)Montana Department of Environmental Quality\.Note:PDF documentExternal Links:[Link](https://deq.mt.gov/files/Land/Hardrock/Documents/TintinaMines/App%20R%20Failure%20Modes%20Effects%20Analysis/App%20R%20Failure%20Modes%20Effects%20Analysis.pdf)Cited by:[§III\-B](https://arxiv.org/html/2607.18548#S3.SS2.p1.1)\.
- \[78\]F\. Morales Aguilera\(2025\-07\-30\)Building real\-world agentic AI systems: a practical guide\(Website\)AI Simplified in Plain English\.Note:Accessed: 2026\-02\-18External Links:[Link](https://medium.com/ai-simplified-in-plain-english/building-real-world-agentic-ai-systems-a-practical-guide-9748d572b58b)Cited by:[3rd item](https://arxiv.org/html/2607.18548#S7.I1.i3.p1.2),[§VII\-A1](https://arxiv.org/html/2607.18548#S7.SS1.SSS1.p1.1),[§VII\-A1](https://arxiv.org/html/2607.18548#S7.SS1.SSS1.p3.1),[§VII\-A3](https://arxiv.org/html/2607.18548#S7.SS1.SSS3.p6.1)\.
- \[79\]N\. Mu, S\. Chen, Z\. Wang, S\. Chen, D\. Karamardian, L\. Aljeraisy, B\. Alomair, D\. Hendrycks, and D\. Wagner\(2024\)Can llms follow simple rules?\.External Links:2311\.04235,[Link](https://arxiv.org/abs/2311.04235)Cited by:[§V\-A3](https://arxiv.org/html/2607.18548#S5.SS1.SSS3.p1.1)\.
- \[80\]A\. Nithrakashyap\(2025\-09\-15\)AI agents are breaking bad and CISOs aren’t ready\.Note:Fast CompanyImpact CouncilExternal Links:[Link](https://www.fastcompany.com/91404298/ai-agents-are-breaking-bad-and-cisos-arent-ready)Cited by:[§I](https://arxiv.org/html/2607.18548#S1.p2.1)\.
- \[81\]U\. R\. No\(2021\)155 \[uniform provisions concerning the approval of vehicles with regards to cyber security and cyber security management system\]\.Cited by:[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.131.131.131.6.1.1),[§XIII\-D](https://arxiv.org/html/2607.18548#S13.SS4.p1.1),[§XIII\-G](https://arxiv.org/html/2607.18548#S13.SS7.p3.1),[§IX\-A2](https://arxiv.org/html/2607.18548#S9.SS1.SSS2.p1.1),[§IX\-A4](https://arxiv.org/html/2607.18548#S9.SS1.SSS4.p2.1),[§IX\-B4](https://arxiv.org/html/2607.18548#S9.SS2.SSS4.p1.1)\.
- \[82\]A\. Pan, J\. S\. Chan, A\. Zou, N\. Li, S\. Basart, T\. Woodside, J\. Ng, H\. Zhang, S\. Emmons, and D\. Hendrycks\(2023\)Do the rewards justify the means? measuring trade\-offs between rewards and ethical behavior in the machiavelli benchmark\.External Links:2304\.03279,[Link](https://arxiv.org/abs/2304.03279)Cited by:[§V\-B2](https://arxiv.org/html/2607.18548#S5.SS2.SSS2.p1.1),[§V\-B2](https://arxiv.org/html/2607.18548#S5.SS2.SSS2.p2.1),[§V\-B](https://arxiv.org/html/2607.18548#S5.SS2.p1.1)\.
- \[83\]J\. Park, G\. Yoo, and E\. Lee\(2005\)Proactive self\-healing system based on multi\-agent technologies\.InThird ACIS Int’l Conference on Software Engineering Research, Management and Applications \(SERA’05\),Vol\.,pp\. 256–263\.External Links:[Document](https://dx.doi.org/10.1109/SERA.2005.55)Cited by:[§X\-A2](https://arxiv.org/html/2607.18548#S10.SS1.SSS2.p1.1),[§XII\-A2](https://arxiv.org/html/2607.18548#S12.SS1.SSS2.p1.1),[§XII\-A3](https://arxiv.org/html/2607.18548#S12.SS1.SSS3.p1.1),[§XII\-A4](https://arxiv.org/html/2607.18548#S12.SS1.SSS4.p1.1),[§XII\-B4](https://arxiv.org/html/2607.18548#S12.SS2.SSS4.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.171.171.171.6.1.1),[§XIII\-B](https://arxiv.org/html/2607.18548#S13.SS2.p1.1),[§XIII\-E](https://arxiv.org/html/2607.18548#S13.SS5.p1.1)\.
- \[84\]L\. Phan, A\. Gatti, Z\. Han, N\. Li, J\. Hu, H\. Zhang, C\. B\. C\. Zhang, M\. Shaaban, J\. Ling, S\. Shi, M\. Choi, A\. Agrawal, A\. Chopra, A\. Khoja, R\. Kim, R\. Ren, J\. Hausenloy, O\. Zhang, M\. Mazeika, D\. Dodonov, T\. Nguyen, J\. Lee, D\. Anderson, M\. Doroshenko, A\. C\. Stokes, M\. Mahmood, O\. Pokutnyi, O\. Iskra, J\. P\. Wang, J\. Levin, M\. Kazakov, F\. Feng, S\. Y\. Feng, H\. Zhao, M\. Yu, V\. Gangal, C\. Zou, Z\. Wang, S\. Popov, R\. Gerbicz, G\. Galgon, J\. Schmitt, W\. Yeadon, Y\. Lee, S\. Sauers, A\. Sanchez, F\. Giska, M\. Roth, S\. Riis, S\. Utpala, N\. Burns, G\. M\. Goshu, M\. M\. Naiya, C\. Agu, Z\. Giboney, A\. Cheatom, F\. Fournier\-Facio, S\. Crowson, L\. Finke, Z\. Cheng, J\. Zampese, R\. G\. Hoerr, M\. Nandor, H\. Park, T\. Gehrunger, J\. Cai, B\. McCarty, A\. C\. Garretson, E\. Taylor, D\. Sileo, Q\. Ren, U\. Qazi, L\. Li, J\. Nam, J\. B\. Wydallis, P\. Arkhipov, J\. W\. L\. Shi, A\. Bacho, C\. G\. Willcocks, H\. Cao, S\. Motwani, E\. de Oliveira Santos, J\. Veith, E\. Vendrow, D\. Cojoc, K\. Zenitani, J\. Robinson, L\. Tang, Y\. Li, J\. Vendrow, N\. W\. Fraga, V\. Kuchkin, A\. P\. Maksimov, P\. Marion, D\. Efremov, J\. Lynch, K\. Liang, A\. Mikov, A\. Gritsevskiy, J\. Guillod, G\. Demir, D\. Martinez, B\. Pageler, K\. Zhou, S\. Soori, O\. Press, H\. Tang, P\. Rissone, S\. R\. Green, L\. Brüssel, M\. Twayana, A\. Dieuleveut, J\. M\. Imperial, A\. Prabhu, J\. Yang, N\. Crispino, A\. Rao, D\. Zvonkine, G\. Loiseau, M\. Kalinin, M\. Lukas, C\. Manolescu, N\. Stambaugh, S\. Mishra, T\. Hogg, C\. Bosio, B\. P\. Coppola, J\. Salazar, J\. Jin, R\. Sayous, S\. Ivanov, P\. Schwaller, S\. Senthilkuma, A\. M\. Bran, A\. Algaba, K\. V\. den Houte, L\. V\. D\. Sypt, B\. Verbeken, D\. Noever, A\. Kopylov, B\. Myklebust, B\. Li, L\. Schut, E\. Zheltonozhskii, Q\. Yuan, D\. Lim, R\. Stanley, T\. Yang, J\. Maar, J\. Wykowski, M\. Oller, A\. Sahu, C\. G\. Ardito, Y\. Hu, A\. G\. K\. Kamdoum, A\. Jin, T\. G\. Vilchis, Y\. Zu, M\. Lackner, J\. Koppel, G\. Sun, D\. S\. Antonenko, S\. Chern, B\. Zhao, P\. Arsene, J\. M\. Cavanagh, D\. Li, J\. Shen, D\. Crisostomi, W\. Zhang, A\. Dehghan, S\. Ivanov, D\. Perrella, N\. Kaparov, A\. Zang, I\. Sucholutsky, A\. Kharlamova, D\. Orel, V\. Poritski, S\. Ben\-David, Z\. Berger, P\. Whitfill, M\. Foster, D\. Munro, L\. Ho, S\. Sivarajan, D\. B\. Hava, A\. Kuchkin, D\. Holmes, A\. Rodriguez\-Romero, F\. Sommerhage, A\. Zhang, R\. Moat, K\. Schneider, Z\. Kazibwe, D\. Clarke, D\. H\. Kim, F\. M\. Dias, S\. Fish, V\. Elser, T\. Kreiman, V\. E\. G\. Vilchis, I\. Klose, U\. Anantheswaran, A\. Zweiger, K\. Rawal, J\. Li, J\. Nguyen, N\. Daans, H\. Heidinger, M\. Radionov, V\. Rozhoň, V\. Ginis, C\. Stump, N\. Cohen, R\. Poświata, J\. Tkadlec, A\. Goldfarb, C\. Wang, P\. Padlewski, S\. Barzowski, K\. Montgomery, R\. Stendall, J\. Tucker\-Foltz, J\. Stade, T\. R\. Rogers, T\. Goertzen, D\. Grabb, A\. Shukla, A\. Givré, J\. A\. Ambay, A\. Sen, M\. F\. Aziz, M\. H\. Inlow, H\. He, L\. Zhang, Y\. Kaddar, I\. Ängquist, Y\. Chen, H\. K\. Wang, K\. Ramakrishnan, E\. Thornley, A\. Terpin, H\. Schoelkopf, E\. Zheng, A\. Carmi, E\. D\. L\. Brown, K\. Zhu, M\. Bartolo, R\. Wheeler, M\. Stehberger, P\. Bradshaw, J\. Heimonen, K\. Sridhar, I\. Akov, J\. Sandlin, Y\. Makarychev, J\. Tam, H\. Hoang, D\. M\. Cunningham, V\. Goryachev, D\. Patramanis, M\. Krause, A\. Redenti, D\. Aldous, J\. Lai, S\. Coleman, J\. Xu, S\. Lee, I\. Magoulas, S\. Zhao, N\. Tang, M\. K\. Cohen, O\. Paradise, J\. H\. Kirchner, M\. Ovchynnikov, J\. O\. Matos, A\. Shenoy, M\. Wang, Y\. Nie, A\. Sztyber\-Betley, P\. Faraboschi, R\. Riblet, J\. Crozier, S\. Halasyamani, S\. Verma, P\. Joshi, E\. Meril, Z\. Ma, J\. Andréoletti, R\. Singhal, J\. Platnick, V\. Nevirkovets, L\. Basler, A\. Ivanov, S\. Khoury, N\. Gustafsson, M\. Piccardo, H\. Mostaghimi, Q\. Chen, V\. Singh, T\. Q\. Khánh, P\. Rosu, H\. Szlyk, Z\. Brown, H\. Narayan, A\. Menezes, J\. Roberts, W\. Alley, K\. Sun, A\. Patel, M\. Lamparth, A\. Reuel, L\. Xin, H\. Xu, J\. Loader, F\. Martin, Z\. Wang, A\. Achilleos, T\. Preu, T\. Korbak, I\. Bosio, F\. Kazemi, Z\. Chen, B\. Bálint, E\. J\. Y\. Lo, J\. Wang, M\. I\. S\. Nunes, J\. Milbauer, M\. S\. Bari, Z\. Wang, B\. Ansarinejad, Y\. Sun, S\. Durand, H\. Elgnainy, G\. Douville, D\. Tordera, G\. Balabanian, H\. Wolff, L\. Kvistad, H\. Milliron, A\. Sakor, M\. Eron, A\. F\. D\. O\., S\. Shah, X\. Zhou, F\. Kamalov, S\. Abdoli, T\. Santens, S\. Barkan, A\. Tee, R\. Zhang, A\. Tomasiello, G\. B\. D\. Luca, S\. Looi, V\. Le, N\. Kolt, J\. Pan, E\. Rodman, J\. Drori, C\. J\. Fossum, N\. Muennighoff, M\. Jagota, R\. Pradeep, H\. Fan, J\. Eicher, M\. Chen, K\. Thaman, W\. Merrill, M\. Firsching, C\. Harris, S\. Ciobâcă, J\. Gross, R\. Pandey, I\. Gusev, A\. Jones, S\. Agnihotri, P\. Zhelnov, M\. Mofayezi, A\. Piperski, D\. K\. Zhang, K\. Dobarskyi, R\. Leventov, I\. Soroko, J\. Duersch, V\. Taamazyan, A\. Ho, W\. Ma, W\. Held, R\. Xian, A\. R\. Zebaze, M\. Mohamed, J\. N\. Leser, M\. X\. Yuan, L\. Yacar, J\. Lengler, K\. Olszewska, C\. D\. Fratta, E\. Oliveira, J\. W\. Jackson, A\. Zou, M\. Chidambaram, T\. Manik, H\. Haffenden, D\. Stander, A\. Dasouqi, A\. Shen, B\. Golshani, D\. Stap, E\. Kretov, M\. Uzhou, A\. B\. Zhidkovskaya, N\. Winter, M\. O\. Rodriguez, R\. Lauff, D\. Wehr, C\. Tang, Z\. Hossain, S\. Phillips, F\. Samuele, F\. Ekström, A\. Hammon, O\. Patel, F\. Farhidi, G\. Medley, F\. Mohammadzadeh, M\. Peñaflor, H\. Kassahun, A\. Friedrich, R\. H\. Perez, D\. Pyda, T\. Sakal, O\. Dhamane, A\. K\. Mirabadi, E\. Hallman, K\. Okutsu, M\. Battaglia, M\. Maghsoudimehrabani, A\. Amit, D\. Hulbert, R\. Pereira, S\. Weber, Handoko, A\. Peristyy, S\. Malina, M\. Mehkary, R\. Aly, F\. Reidegeld, A\. Dick, C\. Friday, M\. Singh, H\. Shapourian, W\. Kim, M\. Costa, H\. Gurdogan, H\. Kumar, C\. Ceconello, C\. Zhuang, H\. Park, M\. Carroll, A\. R\. Tawfeek, S\. Steinerberger, D\. Aggarwal, M\. Kirchhof, L\. Dai, E\. Kim, J\. Ferret, J\. Shah, Y\. Wang, M\. Yan, K\. Burdzy, L\. Zhang, A\. Franca, D\. T\. Pham, K\. Y\. Loh, J\. Robinson, A\. Jackson, P\. Giordano, P\. Petersen, A\. Cosma, J\. Colino, C\. White, J\. Votava, V\. Vinnikov, E\. Delaney, P\. Spelda, V\. Stritecky, S\. M\. Shahid, J\. Mourrat, L\. Vetoshkin, K\. Sponselee, R\. Bacho, Z\. Yong, F\. de la Rosa, N\. Cho, X\. Li, G\. Malod, O\. Weller, G\. Albani, L\. Lang, J\. Laurendeau, D\. Kazakov, F\. Adesanya, J\. Portier, L\. Hollom, V\. Souza, Y\. A\. Zhou, J\. Degorre, Y\. Yalın, G\. D\. Obikoya, Rai, F\. Bigi, M\. C\. Boscá, O\. Shumar, K\. Bacho, G\. Recchia, M\. Popescu, N\. Shulga, N\. M\. Tanwie, T\. C\. H\. Lux, B\. Rank, C\. Ni, M\. Brooks, A\. Yakimchyk, Huanxu, Liu, S\. Cavalleri, O\. Häggström, E\. Verkama, J\. Newbould, H\. Gundlach, L\. Brito\-Santana, B\. Amaro, V\. Vajipey, R\. Grover, T\. Wang, Y\. Kratish, W\. Li, S\. Gopi, A\. Caciolai, C\. S\. de Witt, P\. Hernández\-Cámara, E\. Rodolà, J\. Robins, D\. Williamson, V\. Cheng, B\. Raynor, H\. Qi, B\. Segev, J\. Fan, S\. Martinson, E\. Y\. Wang, K\. Hausknecht, M\. P\. Brenner, M\. Mao, C\. Demian, P\. Kassani, X\. Zhang, D\. Avagian, E\. J\. Scipio, A\. Ragoler, J\. Tan, B\. Sims, R\. Plecnik, A\. Kirtland, O\. F\. Bodur, D\. P\. Shinde, Y\. C\. L\. Labrador, Z\. Adoul, M\. Zekry, A\. Karakoc, T\. C\. B\. Santos, S\. Shamseldeen, L\. Karim, A\. Liakhovitskaia, N\. Resman, N\. Farina, J\. C\. Gonzalez, G\. Maayan, E\. Anderson, R\. D\. O\. Pena, E\. Kelley, H\. Mariji, R\. Pouriamanesh, W\. Wu, R\. Finocchio, I\. Alarab, J\. Cole, D\. Ferreira, B\. Johnson, M\. Safdari, L\. Dai, S\. Arthornthurasuk, I\. C\. McAlister, A\. J\. Moyano, A\. Pronin, J\. Fan, A\. Ramirez\-Trinidad, Y\. Malysheva, D\. Pottmaier, O\. Taheri, S\. Stepanic, S\. Perry, L\. Askew, R\. A\. H\. Rodríguez, A\. M\. R\. Minissi, R\. Lorena, K\. Iyer, A\. A\. Fasiludeen, R\. Clark, J\. Ducey, M\. Piza, M\. Somrak, E\. Vergo, J\. Qin, B\. Borbás, E\. Chu, J\. Lindsey, A\. Jallon, I\. M\. J\. McInnis, E\. Chen, A\. Semler, L\. Gloor, T\. Shah, M\. Carauleanu, P\. Lauer, T\. Đ\. Huy, H\. Shahrtash, E\. Duc, L\. Lewark, A\. Brown, S\. Albanie, B\. Weber, W\. S\. Vaz, P\. Clavier, Y\. Fan, G\. P\. R\. e Silva, Long, Lian, M\. Abramovitch, X\. Jiang, S\. Mendoza, M\. Islam, J\. Gonzalez, V\. Mavroudis, J\. Xu, P\. Kumar, L\. P\. Goswami, D\. Bugas, N\. Heydari, F\. Jeanplong, T\. Jansen, A\. Pinto, A\. Apronti, A\. Galal, N\. Ze\-An, A\. Singh, T\. Jiang, J\. of Arc Xavier, K\. P\. Agarwal, M\. Berkani, G\. Zhang, Z\. Du, B\. A\. de Oliveira Junior, D\. Malishev, N\. Remy, T\. D\. Hartman, T\. Tarver, S\. Mensah, G\. A\. Loume, W\. Morak, F\. Habibi, S\. Hoback, W\. Cai, J\. Gimenez, R\. G\. Montecillo, J\. Łucki, R\. Campbell, A\. Sharma, K\. Meer, S\. Gul, D\. E\. Gonzalez, X\. Alapont, A\. Hoover, G\. Chhablani, F\. Vargus, A\. Agarwal, Y\. Jiang, D\. Patil, D\. Outevsky, K\. J\. Scaria, R\. Maheshwari, A\. Dendane, P\. Shukla, A\. Cartwright, S\. Bogdanov, N\. Mündler, S\. Möller, L\. Arnaboldi, K\. Thaman, M\. R\. Siddiqi, P\. Saxena, H\. Gupta, T\. Fruhauff, G\. Sherman, M\. Vincze, S\. Usawasutsakorn, D\. Ler, A\. Radhakrishnan, I\. Enyekwe, S\. M\. Salauddin, J\. Muzhen, A\. Maksapetyan, V\. Rossbach, C\. Harjadi, M\. Bahaloohoreh, C\. Sparrow, J\. Sidhu, S\. Ali, S\. Bian, J\. Lai, E\. Singer, J\. L\. Uro, G\. Bateman, M\. Sayed, A\. Menshawy, D\. Duclosel, D\. Bezzi, Y\. Jain, A\. Aaron, M\. Tiryakioglu, S\. Siddh, K\. Krenek, I\. A\. Shah, J\. Jin, S\. Creighton, D\. Peskoff, Z\. EL\-Wasif, R\. P\. V, M\. Richmond, J\. McGowan, T\. Patwardhan, H\. Sun, T\. Sun, N\. Zubić, S\. Sala, S\. Ebert, J\. Kaddour, M\. Schottdorf, D\. Wang, G\. Petruzella, A\. Meiburg, T\. Medved, A\. ElSheikh, S\. A\. Hebbar, L\. Vaquero, X\. Yang, J\. Poulos, V\. Zouhar, S\. Bogdanik, M\. Zhang, J\. Sanz\-Ros, D\. Anugraha, Y\. Dai, A\. N\. Nhu, X\. Wang, A\. A\. Demircali, Z\. Jia, Y\. Zhou, J\. Wu, M\. He, N\. Chandok, A\. Sinha, G\. Luo, L\. Le, M\. Noyé, M\. Perełkiewicz, I\. Pantidis, T\. Qi, S\. S\. Purohit, L\. Parcalabescu, T\. Nguyen, G\. I\. Winata, E\. M\. Ponti, H\. Li, K\. Dhole, J\. Park, D\. Abbondanza, Y\. Wang, A\. Nayak, D\. M\. Caetano, A\. A\. W\. L\. Wong, M\. del Rio\-Chanona, D\. Kondor, P\. Francois, E\. Chalstrey, J\. Zsambok, D\. Hoyer, J\. Reddish, J\. Hauser, F\. Rodrigo\-Ginés, S\. Datta, M\. Shepherd, T\. Kamphuis, Q\. Zhang, H\. Kim, R\. Sun, J\. Yao, F\. Dernoncourt, S\. Krishna, S\. Rismanchian, B\. Pu, F\. Pinto, Y\. Wang, K\. Shridhar, K\. J\. Overholt, G\. Briia, H\. Nguyen, David, S\. Bartomeu, T\. C\. Pang, A\. Wecker, Y\. Xiong, F\. Li, L\. S\. Huber, J\. Jaeger, R\. D\. Maddalena, X\. H\. Lù, Y\. Zhang, C\. Beger, P\. T\. J\. Kon, S\. Li, V\. Sanker, M\. Yin, Y\. Liang, X\. Zhang, A\. Agrawal, L\. S\. Yifei, Z\. Zhang, M\. Cai, Y\. Sonmez, C\. Cozianu, C\. Li, A\. Slen, S\. Yu, H\. K\. Park, G\. Sarti, M\. Briański, A\. Stolfo, T\. A\. Nguyen, M\. Zhang, Y\. Perlitz, J\. Hernandez\-Orallo, R\. Li, A\. Shabani, F\. Juefei\-Xu, S\. Dhingra, O\. Zohar, M\. C\. Nguyen, A\. Pondaven, A\. Yilmaz, X\. Zhao, C\. Jin, M\. Jiang, S\. Todoran, X\. Han, J\. Kreuer, B\. Rabern, A\. Plassart, M\. Maggetti, L\. Yap, R\. Geirhos, J\. Kean, D\. Wang, S\. Mollaei, C\. Sun, Y\. Yin, S\. Wang, R\. Li, Y\. Chang, A\. Wei, A\. Bizeul, X\. Wang, A\. O\. Arrais, K\. Mukherjee, J\. Chamorro\-Padial, J\. Liu, X\. Qu, J\. Guan, A\. Bouyamourn, S\. Wu, M\. Plomecka, J\. Chen, M\. Tang, J\. Deng, S\. Subramanian, H\. Xi, H\. Chen, W\. Zhang, Y\. Ren, H\. Tu, S\. Kim, Y\. Chen, S\. V\. Marjanović, J\. Ha, G\. Luczyna, J\. J\. Ma, Z\. Shen, D\. Song, C\. E\. Zhang, Z\. Wang, G\. Gendron, Y\. Xiao, L\. Smucker, E\. Weng, K\. H\. Lee, Z\. Ye, S\. Ermon, I\. D\. Lopez\-Miguel, T\. Knights, A\. Gitter, N\. Park, B\. Wei, H\. Chen, K\. Pai, A\. Elkhanany, H\. Lin, P\. D\. Siedler, J\. Fang, R\. Mishra, K\. Zsolnai\-Fehér, X\. Jiang, S\. Khan, J\. Yuan, R\. K\. Jain, X\. Lin, M\. Peterson, Z\. Wang, A\. Malusare, M\. Tang, I\. Gupta, I\. Fosin, T\. Kang, B\. Dworakowska, K\. Matsumoto, G\. Zheng, G\. Sewuster, J\. P\. Villanueva, I\. Rannev, I\. Chernyavsky, J\. Chen, D\. Banik, B\. Racz, W\. Dong, J\. Wang, L\. Bashmal, D\. V\. Gonçalves, W\. Hu, K\. Bar, O\. Bohdal, A\. S\. Patlan, S\. Dhuliawala, C\. Geirhos, J\. Wist, Y\. Kansal, B\. Chen, K\. Tire, A\. T\. Yücel, B\. Christof, V\. Singla, Z\. Song, S\. Chen, J\. Ge, K\. Ponkshe, I\. Park, T\. Shi, M\. Q\. Ma, J\. Mak, S\. Lai, A\. Moulin, Z\. Cheng, Z\. Zhu, Z\. Zhang, V\. Patil, K\. Jha, Q\. Men, J\. Wu, T\. Zhang, B\. H\. Vieira, A\. F\. Aji, J\. Chung, M\. Mahfoud, H\. T\. Hoang, M\. Sperzel, W\. Hao, K\. Meding, S\. Xu, V\. Kostakos, D\. Manini, Y\. Liu, C\. Toukmaji, J\. Paek, E\. Yu, A\. E\. Demircali, Z\. Sun, I\. Dewerpe, H\. Qin, R\. Pflugfelder, J\. Bailey, J\. Morris, V\. Heilala, S\. Rosset, Z\. Yu, P\. E\. Chen, W\. Yeo, E\. Jain, R\. Yang, S\. Chigurupati, J\. Chernyavsky, S\. P\. Reddy, S\. Venugopalan, H\. Batra, C\. F\. Park, H\. Tran, G\. Maximiano, G\. Zhang, Y\. Liang, H\. Shiyu, R\. Xu, R\. Pan, S\. Suresh, Z\. Liu, S\. Gulati, S\. Zhang, P\. Turchin, C\. W\. Bartlett, C\. R\. Scotese, P\. M\. Cao, B\. Wu, J\. Karwowski, D\. Scaramuzza, A\. Nattanmai, G\. McKellips, A\. Cheraku, A\. Suhail, E\. Luo, M\. Deng, J\. Luo, A\. Zhang, K\. Jindel, J\. Paek, K\. Halevy, A\. Baranov, M\. Liu, A\. Avadhanam, D\. Zhang, V\. Cheng, B\. Ma, E\. Fu, L\. Do, J\. Lass, H\. Yang, S\. Sunkari, V\. Bharath, V\. Ai, J\. Leung, R\. Agrawal, A\. Zhou, K\. Chen, T\. Kalpathi, Z\. Xu, G\. Wang, T\. Xiao, E\. Maung, S\. Lee, R\. Yang, R\. Yue, B\. Zhao, J\. Yoon, S\. Sun, A\. Singh, E\. Luo, C\. Peng, T\. Osbey, T\. Wang, D\. Echeazu, H\. Yang, T\. Wu, S\. Patel, V\. Kulkarni, V\. Sundarapandiyan, A\. Zhang, A\. Le, Z\. Nasim, S\. Yalam, R\. Kasamsetty, S\. Samal, H\. Yang, D\. Sun, N\. Shah, A\. Saha, A\. Zhang, L\. Nguyen, L\. Nagumalli, K\. Wang, A\. Zhou, A\. Wu, J\. Luo, A\. Telluri, S\. Yue, A\. Wang, and D\. Hendrycks\(2025\)Humanity’s last exam\.External Links:2501\.14249,[Link](https://arxiv.org/abs/2501.14249)Cited by:[§V\-C1](https://arxiv.org/html/2607.18548#S5.SS3.SSS1.p4.1)\.
- \[85\]Q\. Qin, Y\. Rong, G\. Nan, S\. Wu, X\. Zhang, Q\. Cui, and X\. Tao\(2023\)Securing semantic communications with physical\-layer semantic encryption and obfuscation\.In2023 IEEE International Conference on Communications \(ICC\),External Links:[Document](https://dx.doi.org/10.1109/ICC45041.2023.10279807),[Link](https://arxiv.org/pdf/2304.10147)Cited by:[§XI\-A3](https://arxiv.org/html/2607.18548#S11.SS1.SSS3.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.211.211.211.6.1.1)\.
- \[86\]J\. Qiu, X\. Ma, Y\. Xu, Z\. Zhang, and H\. Zhao\(2025\)Chain\-of\-trigger: an agentic backdoor that paradoxically enhances agentic robustness\.External Links:2510\.08238,[Link](https://arxiv.org/abs/2510.08238)Cited by:[3rd item](https://arxiv.org/html/2607.18548#S7.I7.i3.p1.1),[4th item](https://arxiv.org/html/2607.18548#S7.I7.i4.p1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.36.32.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.37.33.1.1.1)\.
- \[87\]RagaAI\(2024\-06\-12\)Whitepaper: agentic application evaluation framework \(AAEF\)\.Technical reportRagaAI, Inc\.\.Note:Accessed: 2025\-02\-18External Links:[Link](https://raga.ai/resources/patentsandpublications/whitepaper-agentic-application-evaluation-framework)Cited by:[3rd item](https://arxiv.org/html/2607.18548#S7.I1.i3.p1.2),[3rd item](https://arxiv.org/html/2607.18548#S7.I2.i3.p1.1),[3rd item](https://arxiv.org/html/2607.18548#S7.I3.i3.p1.1),[§VII\-A1](https://arxiv.org/html/2607.18548#S7.SS1.SSS1.p2.2),[§VII\-A4](https://arxiv.org/html/2607.18548#S7.SS1.SSS4.p3.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.1.1.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.2.2.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.10.6.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.11.7.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.12.8.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.13.9.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.3.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.5.1.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.6.2.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.7.3.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.8.4.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.9.5.1.1.1),[§VII](https://arxiv.org/html/2607.18548#S7.p1.1)\.
- \[88\]RagaAI\(2025\)RagaAI AAEF \(Agentic Application Evaluation Framework\)\(Website\)RagaAI Catalyst\.Note:Accessed: 2026\-02\-18External Links:[Link](https://docs.raga.ai/ragaai-aaef-agentic-application-evaluation-framework)Cited by:[3rd item](https://arxiv.org/html/2607.18548#S7.I1.i3.p1.2),[§VII\-A4](https://arxiv.org/html/2607.18548#S7.SS1.SSS4.p3.1),[§VII](https://arxiv.org/html/2607.18548#S7.p1.1)\.
- \[89\]T\. Raheem and G\. Hossain\(2025\)Agentic ai systems: opportunities, challenges, and trustworthiness\.In2025 IEEE International Conference on Electro Information Technology \(eIT\),Vol\.,pp\. 618–624\.External Links:[Document](https://dx.doi.org/10.1109/eIT64391.2025.11103638)Cited by:[§I](https://arxiv.org/html/2607.18548#S1.p2.1)\.
- \[90\]T\. Raheem and G\. Hossain\(2025\)Agentic ai systems: opportunities, challenges, and trustworthiness\.In2025 IEEE International Conference on Electro Information Technology \(eIT\),Vol\.,pp\. 618–624\.External Links:[Document](https://dx.doi.org/10.1109/eIT64391.2025.11103638)Cited by:[§III](https://arxiv.org/html/2607.18548#S3.p1.1)\.
- \[91\]Md\. H\. Rahman, A\. Shamji, S\. Guo, and G\. Li\(2021\)PEPPA\-x: finding program test inputs to bound silent data corruption vulnerability in hpc applications\.InSC21: International Conference for High Performance Computing, Networking, Storage and Analysis,pp\. 1–14\.External Links:[Document](https://dx.doi.org/10.1145/3458817.3476147)Cited by:[§X\-B1](https://arxiv.org/html/2607.18548#S10.SS2.SSS1.p1.1)\.
- \[92\]I\. D\. Raji, A\. Smart, R\. N\. White, M\. Mitchell, T\. Gebru, B\. Hutchinson, J\. Smith\-Loud, D\. Theron, and P\. Barnes\(2020\)Closing the ai accountability gap: defining an end\-to\-end framework for internal algorithmic auditing\.InProceedings of the 2020 Conference on Fairness, Accountability, and Transparency,FAT\* ’20,New York, NY, USA,pp\. 33–44\.External Links:ISBN 9781450369367,[Link](https://doi.org/10.1145/3351095.3372873),[Document](https://dx.doi.org/10.1145/3351095.3372873)Cited by:[§III\-D](https://arxiv.org/html/2607.18548#S3.SS4.p1.1),[TABLE I](https://arxiv.org/html/2607.18548#S3.T1.1.1.5.3.6.1.1)\.
- \[93\]P\. Rajput and G\. Sikka\(2020\)Multi\-agent architecture for fault recovery in self\-healing systems\.Journal of Ambient Intelligence and Humanized Computing12,pp\. 2849 – 2866\.External Links:[Document](https://dx.doi.org/10.1007/s12652-020-02443-8)Cited by:[§X\-A2](https://arxiv.org/html/2607.18548#S10.SS1.SSS2.p1.1),[§XII\-A2](https://arxiv.org/html/2607.18548#S12.SS1.SSS2.p1.1),[§XII\-A3](https://arxiv.org/html/2607.18548#S12.SS1.SSS3.p1.1),[§XII\-A4](https://arxiv.org/html/2607.18548#S12.SS1.SSS4.p1.1),[§XII\-B4](https://arxiv.org/html/2607.18548#S12.SS2.SSS4.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.176.176.176.6.1.1),[§XIII\-B](https://arxiv.org/html/2607.18548#S13.SS2.p1.1),[§XIII\-E](https://arxiv.org/html/2607.18548#S13.SS5.p1.1)\.
- \[94\]A\. Ramachandran\(2025\-01\)DeepSeek: revolutionizing ai with open\-source reasoning models \-advancing innovation, accessibility, and competition with openai and gemini 2\.0\.Cited by:[§IV\-B](https://arxiv.org/html/2607.18548#S4.SS2.p3.1),[TABLE II](https://arxiv.org/html/2607.18548#S4.T2.1.1.5.4.2.1.1)\.
- \[95\]R\. Ren, A\. Agarwal, M\. Mazeika, C\. Menghini, R\. Vacareanu, B\. Kenstler, M\. Yang, I\. Barrass, A\. Gatti, X\. Yin, E\. Trevino, M\. Geralnik, A\. Khoja, D\. Lee, S\. Yue, and D\. Hendrycks\(2026\)The mask benchmark: disentangling honesty from accuracy in ai systems\.External Links:2503\.03750,[Link](https://arxiv.org/abs/2503.03750)Cited by:[§VI\-A](https://arxiv.org/html/2607.18548#S6.SS1.p1.1)\.
- \[96\]L\. Rijo\(2026\-02\-15\)UC berkeley unveils framework as AI agents threaten to outrun oversight\(Website\)PPC Land\.Note:Accessed: 2026\-02\-24External Links:[Link](https://ppc.land/uc-berkeley-unveils-framework-as-ai-agents-threaten-to-outrun-oversight/)Cited by:[§VII\-D3](https://arxiv.org/html/2607.18548#S7.SS4.SSS3.p3.1)\.
- \[97\]Y\. Ruan, H\. Dong, A\. Wang, S\. Pitis, Y\. Zhou, J\. Ba, Y\. Dubois, C\. J\. Maddison, and T\. Hashimoto\(2024\)Identifying the risks of lm agents with an lm\-emulated sandbox\.InThe Twelfth International Conference on Learning Representations \(ICLR 2024\),External Links:[Link](https://openreview.net/forum?id=GEcwtMk1uA)Cited by:[§XI\-A3](https://arxiv.org/html/2607.18548#S11.SS1.SSS3.p2.1),[§XI\-B3](https://arxiv.org/html/2607.18548#S11.SS2.SSS3.p1.1),[§XII\-A1](https://arxiv.org/html/2607.18548#S12.SS1.SSS1.p1.1),[§XII\-A2](https://arxiv.org/html/2607.18548#S12.SS1.SSS2.p1.1),[§XII\-B2](https://arxiv.org/html/2607.18548#S12.SS2.SSS2.p1.1),[§XII\-B3](https://arxiv.org/html/2607.18548#S12.SS2.SSS3.p1.1),[§XII\-B4](https://arxiv.org/html/2607.18548#S12.SS2.SSS4.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.216.216.216.6.1.1),[§XII](https://arxiv.org/html/2607.18548#S12.p1.1),[§XIII\-A](https://arxiv.org/html/2607.18548#S13.SS1.p1.1),[§XIII\-C](https://arxiv.org/html/2607.18548#S13.SS3.p1.1),[§XIII\-D](https://arxiv.org/html/2607.18548#S13.SS4.p1.1),[§XIII\-E](https://arxiv.org/html/2607.18548#S13.SS5.p1.1)\.
- \[98\]B\. K\. Saha, Aarthi V\., and O\. D\. Naidu\(2025\)DrAgent: an agentic approach to fault analysis in power grids using large language models\.In2025 International Conference on Artificial Intelligence in Information and Communication \(ICAIIC\),pp\. 938–945\.Cited by:[§XII\-A3](https://arxiv.org/html/2607.18548#S12.SS1.SSS3.p1.1),[§XII\-B2](https://arxiv.org/html/2607.18548#S12.SS2.SSS2.p1.1),[§XII\-B3](https://arxiv.org/html/2607.18548#S12.SS2.SSS3.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.45.45.45.6.1.1),[§XIII\-A](https://arxiv.org/html/2607.18548#S13.SS1.p1.1),[§XIII\-D](https://arxiv.org/html/2607.18548#S13.SS4.p1.1),[§XIII\-F](https://arxiv.org/html/2607.18548#S13.SS6.p1.1),[§VIII\-A1](https://arxiv.org/html/2607.18548#S8.SS1.SSS1.p1.1),[§VIII\-A3](https://arxiv.org/html/2607.18548#S8.SS1.SSS3.p2.1),[§VIII\-A4](https://arxiv.org/html/2607.18548#S8.SS1.SSS4.p1.1),[§VIII\-A4](https://arxiv.org/html/2607.18548#S8.SS1.SSS4.p2.1),[§VIII\-B2](https://arxiv.org/html/2607.18548#S8.SS2.SSS2.p1.1),[§VIII\-B4](https://arxiv.org/html/2607.18548#S8.SS2.SSS4.p1.1),[§VIII\-C](https://arxiv.org/html/2607.18548#S8.SS3.p1.1)\.
- \[99\]A\. Samadi, K\. Koufos, K\. Debattista, and M\. Dianati\(2024\)SAFE\-rl: saliency\-aware counterfactual explainer for deep reinforcement learning policies\.9\(11\),pp\. 9994–10001\.Cited by:[§XII\-B3](https://arxiv.org/html/2607.18548#S12.SS2.SSS3.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.126.126.126.6.1.1),[§XIII\-D](https://arxiv.org/html/2607.18548#S13.SS4.p1.1),[§XIII\-F](https://arxiv.org/html/2607.18548#S13.SS6.p1.1),[§IX\-A4](https://arxiv.org/html/2607.18548#S9.SS1.SSS4.p1.1),[§IX\-B3](https://arxiv.org/html/2607.18548#S9.SS2.SSS3.p1.1)\.
- \[100\]A\. Samadi, A\. Shirian, K\. Koufos, K\. Debattista, and M\. Dianati\(2023\)SAFE: saliency\-aware counterfactual explanations for dnn\-based automated driving systems\.In2023 IEEE 26th International Conference on Intelligent Transportation Systems \(ITSC\),pp\. 5655–5662\.Cited by:[§XII\-B3](https://arxiv.org/html/2607.18548#S12.SS2.SSS3.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.121.121.121.6.1.1),[§XIII\-D](https://arxiv.org/html/2607.18548#S13.SS4.p1.1),[§XIII\-F](https://arxiv.org/html/2607.18548#S13.SS6.p1.1),[§IX\-A4](https://arxiv.org/html/2607.18548#S9.SS1.SSS4.p1.1),[§IX\-B3](https://arxiv.org/html/2607.18548#S9.SS2.SSS3.p1.1)\.
- \[101\]L\. R\. Sammeta\(2025\-12\-05\)The AI agent report card you’ve been ignoring: why 30% of your agent’s “successes” are actually failures\(Website\)Note:Accessed: 2026\-02\-23External Links:[Link](https://laxmikumars.medium.com/the-ai-agent-report-card-youve-been-ignoring-why-30-of-your-agent-s-successes-are-actually-498fbebf44f9)Cited by:[§VII\-B](https://arxiv.org/html/2607.18548#S7.SS2.p2.1),[§VII\-B](https://arxiv.org/html/2607.18548#S7.SS2.p4.1)\.
- \[102\]T\. Schick, J\. Dwivedi\-Yu, R\. Dessì, R\. Raileanu, M\. Lomeli, L\. Zettlemoyer, N\. Cancedda, and T\. Scialom\(2023\)Toolformer: language models can teach themselves to use tools\.External Links:2302\.04761,[Link](https://arxiv.org/abs/2302.04761)Cited by:[§IV\-D](https://arxiv.org/html/2607.18548#S4.SS4.p1.1),[TABLE II](https://arxiv.org/html/2607.18548#S4.T2.1.1.8.7.2.1.1)\.
- \[103\]I\. Shahbaz, O\. Al\-Refai, and E\. Hammad\(2026\)Inertia\-informed federated learning control framework for distributed smart grid resilience\.External Links:2607\.05720,[Link](https://arxiv.org/abs/2607.05720)Cited by:[§VIII](https://arxiv.org/html/2607.18548#S8.p1.1)\.
- \[104\]I\. Shahbaz, E\. Hammad, and A\. Farraj\(2026\)An interpretable federated learning control framework design for smart grid resilience\.In2026 IEEE/PES Transmission and Distribution Conference and Exposition \(T&D\),Vol\.,pp\. 1–5\.External Links:[Document](https://dx.doi.org/10.1109/TD48022.2026.11562857)Cited by:[§VIII](https://arxiv.org/html/2607.18548#S8.p1.1)\.
- \[105\]I\. Shahbaz, I\. Lagoy, O\. Al\-Refai, and E\. Hammad\(2026\)Evaluating interpretable kolmogorov–arnold network controllers for smart grid resilience\.In2026 IEEE Texas Power and Energy Conference \(TPEC\),Vol\.,pp\. 1–6\.External Links:[Document](https://dx.doi.org/10.1109/TPEC67884.2026.11513111)Cited by:[§VIII](https://arxiv.org/html/2607.18548#S8.p1.1)\.
- \[106\]C\. Shinde\(2024\-03\-25\)Navigating SOTIF \(ISO 21448\) and ensuring safety in autonomous driving\(Website\)Automotive IQ\.Note:Accessed: 2025\-02\-16External Links:[Link](https://www.automotive-iq.com/functional-safety/articles/navigating-sotif-iso-21448-and-ensuring-safety-in-autonomous-driving)Cited by:[§XII\-B2](https://arxiv.org/html/2607.18548#S12.SS2.SSS2.p1.1),[§XIII\-G](https://arxiv.org/html/2607.18548#S13.SS7.p3.1),[§III\-A](https://arxiv.org/html/2607.18548#S3.SS1.p1.1),[§III\-B](https://arxiv.org/html/2607.18548#S3.SS2.p1.1),[§III\-E](https://arxiv.org/html/2607.18548#S3.SS5.p1.1),[TABLE I](https://arxiv.org/html/2607.18548#S3.T1.1.1.3.1.6.1.1)\.
- \[107\]N\. Shinn, F\. Cassano, E\. Berman, A\. Gopinath, K\. Narasimhan, and S\. Yao\(2023\)Reflexion: language agents with verbal reinforcement learning\.External Links:2303\.11366,[Link](https://arxiv.org/abs/2303.11366)Cited by:[§I](https://arxiv.org/html/2607.18548#S1.p2.1),[§IV\-A](https://arxiv.org/html/2607.18548#S4.SS1.p3.1),[TABLE II](https://arxiv.org/html/2607.18548#S4.T2.1.1.3.2.2.1.1)\.
- \[108\]M\. Shukla\(2025\-08\)Evaluating agentic ai systems: a balanced framework for performance, robustness, safety and beyond\.Preprints\.External Links:[Document](https://dx.doi.org/10.20944/preprints202508.1847.v1),[Link](https://doi.org/10.20944/preprints202508.1847.v1)Cited by:[§VII\-C2](https://arxiv.org/html/2607.18548#S7.SS3.SSS2.p1.1),[§VII\-C2](https://arxiv.org/html/2607.18548#S7.SS3.SSS2.p4.1),[§VII\-C](https://arxiv.org/html/2607.18548#S7.SS3.p1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.21.17.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.22.18.1.1.1)\.
- \[109\]F\. Siddiqui, R\. Khan, S\. Y\. Tasdemir, H\. Hui, B\. Sonigara, S\. Sezer, and K\. McLaughlin\(2023\)Cybersecurity engineering: bridging the security gaps in advanced automotive systems and iso/sae 21434\.In2023 IEEE 97th Vehicular Technology Conference \(VTC2023\-Spring\),pp\. 1–6\.Cited by:[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.136.136.136.6.1.1),[§XIII\-D](https://arxiv.org/html/2607.18548#S13.SS4.p1.1),[§XIII\-G](https://arxiv.org/html/2607.18548#S13.SS7.p3.1),[§IX\-A2](https://arxiv.org/html/2607.18548#S9.SS1.SSS2.p1.1),[§IX\-A4](https://arxiv.org/html/2607.18548#S9.SS1.SSS4.p2.1),[§IX\-B4](https://arxiv.org/html/2607.18548#S9.SS2.SSS4.p1.1)\.
- \[110\]I\.A\. Sidorov\(2016\)Methods and tools to increase fault tolerance of high\-performance computing systems\.In2016 39th International Convention on Information and Communication Technology, Electronics and Microelectronics \(MIPRO\),Vol\.,pp\. 226–230\.External Links:[Document](https://dx.doi.org/10.1109/MIPRO.2016.7522142)Cited by:[§X\-A2](https://arxiv.org/html/2607.18548#S10.SS1.SSS2.p1.1),[§XII\-A2](https://arxiv.org/html/2607.18548#S12.SS1.SSS2.p1.1),[§XII\-B4](https://arxiv.org/html/2607.18548#S12.SS2.SSS4.p1.1),[§XIII\-E](https://arxiv.org/html/2607.18548#S13.SS5.p1.1)\.
- \[111\]M\. Siman Tov Bustan and N\. Zadok\(2026\-01\-29\)One step away from a massive data breach: what we found inside MoltBot\.Note:OX Security BlogAccessed: 2026\-02\-04External Links:[Link](https://www.ox.security/blog/one-step-away-from-a-massive-data-breach-what-we-found-inside-moltbot/)Cited by:[TABLE I](https://arxiv.org/html/2607.18548#S3.T1.1.1.6.4.6.1.1),[§V\-C3](https://arxiv.org/html/2607.18548#S5.SS3.SSS3.p1.1)\.
- \[112\]N\. Slavchev, E\. M\. Keller, J\. M\. Snodgrass, and T\. J\. Overbye\(2026\-02\)Testing fine\-tuned large language models for power system analysis\.In2026 Texas Power and Energy Conference \(TPEC\),College Station, TX, USA\.Cited by:[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.65.65.65.6.1.1),[§XIII\-E](https://arxiv.org/html/2607.18548#S13.SS5.p1.1),[§VIII\-A1](https://arxiv.org/html/2607.18548#S8.SS1.SSS1.p1.1),[§VIII\-B5](https://arxiv.org/html/2607.18548#S8.SS2.SSS5.p2.1)\.
- \[113\]A\. Srivastava, A\. Rastogi, A\. Rao, A\. A\. M\. Shoeb, A\. Abid, A\. Fisch, A\. R\. Brown, A\. Santoro, A\. Gupta, A\. Garriga\-Alonso, A\. Kluska, A\. Lewkowycz, A\. Agarwal, A\. Power, A\. Ray, A\. Warstadt, A\. W\. Kocurek, A\. Safaya, A\. Tazarv, A\. Xiang, A\. Parrish, A\. Nie, A\. Hussain, A\. Askell, A\. Dsouza, A\. Slone, A\. Rahane, A\. S\. Iyer, A\. Andreassen, A\. Madotto, A\. Santilli, A\. Stuhlmüller, A\. Dai, A\. La, A\. Lampinen, A\. Zou, A\. Jiang, A\. Chen, A\. Vuong, A\. Gupta, A\. Gottardi, A\. Norelli, A\. Venkatesh, A\. Gholamidavoodi, A\. Tabassum, A\. Menezes, A\. Kirubarajan, A\. Mullokandov, A\. Sabharwal, A\. Herrick, A\. Efrat, A\. Erdem, A\. Karakaş, B\. R\. Roberts, B\. S\. Loe, B\. Zoph, B\. Bojanowski, B\. Özyurt, B\. Hedayatnia, B\. Neyshabur, B\. Inden, B\. Stein, B\. Ekmekci, B\. Y\. Lin, B\. Howald, B\. Orinion, C\. Diao, C\. Dour, C\. Stinson, C\. Argueta, C\. F\. Ramírez, C\. Singh, C\. Rathkopf, C\. Meng, C\. Baral, C\. Wu, C\. Callison\-Burch, C\. Waites, C\. Voigt, C\. D\. Manning, C\. Potts, C\. Ramirez, C\. E\. Rivera, C\. Siro, C\. Raffel, C\. Ashcraft, C\. Garbacea, D\. Sileo, D\. Garrette, D\. Hendrycks, D\. Kilman, D\. Roth, D\. Freeman, D\. Khashabi, D\. Levy, D\. M\. González, D\. Perszyk, D\. Hernandez, D\. Chen, D\. Ippolito, D\. Gilboa, D\. Dohan, D\. Drakard, D\. Jurgens, D\. Datta, D\. Ganguli, D\. Emelin, D\. Kleyko, D\. Yuret, D\. Chen, D\. Tam, D\. Hupkes, D\. Misra, D\. Buzan, D\. C\. Mollo, D\. Yang, D\. Lee, D\. Schrader, E\. Shutova, E\. D\. Cubuk, E\. Segal, E\. Hagerman, E\. Barnes, E\. Donoway, E\. Pavlick, E\. Rodola, E\. Lam, E\. Chu, E\. Tang, E\. Erdem, E\. Chang, E\. A\. Chi, E\. Dyer, E\. Jerzak, E\. Kim, E\. E\. Manyasi, E\. Zheltonozhskii, F\. Xia, F\. Siar, F\. Martínez\-Plumed, F\. Happé, F\. Chollet, F\. Rong, G\. Mishra, G\. I\. Winata, G\. de Melo, G\. Kruszewski, G\. Parascandolo, G\. Mariani, G\. Wang, G\. Jaimovitch\-López, G\. Betz, G\. Gur\-Ari, H\. Galijasevic, H\. Kim, H\. Rashkin, H\. Hajishirzi, H\. Mehta, H\. Bogar, H\. Shevlin, H\. Schütze, H\. Yakura, H\. Zhang, H\. M\. Wong, I\. Ng, I\. Noble, J\. Jumelet, J\. Geissinger, J\. Kernion, J\. Hilton, J\. Lee, J\. F\. Fisac, J\. B\. Simon, J\. Koppel, J\. Zheng, J\. Zou, J\. Kocoń, J\. Thompson, J\. Wingfield, J\. Kaplan, J\. Radom, J\. Sohl\-Dickstein, J\. Phang, J\. Wei, J\. Yosinski, J\. Novikova, J\. Bosscher, J\. Marsh, J\. Kim, J\. Taal, J\. Engel, J\. Alabi, J\. Xu, J\. Song, J\. Tang, J\. Waweru, J\. Burden, J\. Miller, J\. U\. Balis, J\. Batchelder, J\. Berant, J\. Frohberg, J\. Rozen, J\. Hernandez\-Orallo, J\. Boudeman, J\. Guerr, J\. Jones, J\. B\. Tenenbaum, J\. S\. Rule, J\. Chua, K\. Kanclerz, K\. Livescu, K\. Krauth, K\. Gopalakrishnan, K\. Ignatyeva, K\. Markert, K\. D\. Dhole, K\. Gimpel, K\. Omondi, K\. Mathewson, K\. Chiafullo, K\. Shkaruta, K\. Shridhar, K\. McDonell, K\. Richardson, L\. Reynolds, L\. Gao, L\. Zhang, L\. Dugan, L\. Qin, L\. Contreras\-Ochando, L\. Morency, L\. Moschella, L\. Lam, L\. Noble, L\. Schmidt, L\. He, L\. O\. Colón, L\. Metz, L\. K\. Şenel, M\. Bosma, M\. Sap, M\. ter Hoeve, M\. Farooqi, M\. Faruqui, M\. Mazeika, M\. Baturan, M\. Marelli, M\. Maru, M\. J\. R\. Quintana, M\. Tolkiehn, M\. Giulianelli, M\. Lewis, M\. Potthast, M\. L\. Leavitt, M\. Hagen, M\. Schubert, M\. O\. Baitemirova, M\. Arnaud, M\. McElrath, M\. A\. Yee, M\. Cohen, M\. Gu, M\. Ivanitskiy, M\. Starritt, M\. Strube, M\. Swędrowski, M\. Bevilacqua, M\. Yasunaga, M\. Kale, M\. Cain, M\. Xu, M\. Suzgun, M\. Walker, M\. Tiwari, M\. Bansal, M\. Aminnaseri, M\. Geva, M\. Gheini, M\. V\. T, N\. Peng, N\. A\. Chi, N\. Lee, N\. G\. Krakover, N\. Cameron, N\. Roberts, N\. Doiron, N\. Martinez, N\. Nangia, N\. Deckers, N\. Muennighoff, N\. S\. Keskar, N\. S\. Iyer, N\. Constant, N\. Fiedel, N\. Wen, O\. Zhang, O\. Agha, O\. Elbaghdadi, O\. Levy, O\. Evans, P\. A\. M\. Casares, P\. Doshi, P\. Fung, P\. P\. Liang, P\. Vicol, P\. Alipoormolabashi, P\. Liao, P\. Liang, P\. Chang, P\. Eckersley, P\. M\. Htut, P\. Hwang, P\. Miłkowski, P\. Patil, P\. Pezeshkpour, P\. Oli, Q\. Mei, Q\. Lyu, Q\. Chen, R\. Banjade, R\. E\. Rudolph, R\. Gabriel, R\. Habacker, R\. Risco, R\. Millière, R\. Garg, R\. Barnes, R\. A\. Saurous, R\. Arakawa, R\. Raymaekers, R\. Frank, R\. Sikand, R\. Novak, R\. Sitelew, R\. LeBras, R\. Liu, R\. Jacobs, R\. Zhang, R\. Salakhutdinov, R\. Chi, R\. Lee, R\. Stovall, R\. Teehan, R\. Yang, S\. Singh, S\. M\. Mohammad, S\. Anand, S\. Dillavou, S\. Shleifer, S\. Wiseman, S\. Gruetter, S\. R\. Bowman, S\. S\. Schoenholz, S\. Han, S\. Kwatra, S\. A\. Rous, S\. Ghazarian, S\. Ghosh, S\. Casey, S\. Bischoff, S\. Gehrmann, S\. Schuster, S\. Sadeghi, S\. Hamdan, S\. Zhou, S\. Srivastava, S\. Shi, S\. Singh, S\. Asaadi, S\. S\. Gu, S\. Pachchigar, S\. Toshniwal, S\. Upadhyay, Shyamolima, Debnath, S\. Shakeri, S\. Thormeyer, S\. Melzi, S\. Reddy, S\. P\. Makini, S\. Lee, S\. Torene, S\. Hatwar, S\. Dehaene, S\. Divic, S\. Ermon, S\. Biderman, S\. Lin, S\. Prasad, S\. T\. Piantadosi, S\. M\. Shieber, S\. Misherghi, S\. Kiritchenko, S\. Mishra, T\. Linzen, T\. Schuster, T\. Li, T\. Yu, T\. Ali, T\. Hashimoto, T\. Wu, T\. Desbordes, T\. Rothschild, T\. Phan, T\. Wang, T\. Nkinyili, T\. Schick, T\. Kornev, T\. Tunduny, T\. Gerstenberg, T\. Chang, T\. Neeraj, T\. Khot, T\. Shultz, U\. Shaham, V\. Misra, V\. Demberg, V\. Nyamai, V\. Raunak, V\. Ramasesh, V\. U\. Prabhu, V\. Padmakumar, V\. Srikumar, W\. Fedus, W\. Saunders, W\. Zhang, W\. Vossen, X\. Ren, X\. Tong, X\. Zhao, X\. Wu, X\. Shen, Y\. Yaghoobzadeh, Y\. Lakretz, Y\. Song, Y\. Bahri, Y\. Choi, Y\. Yang, Y\. Hao, Y\. Chen, Y\. Belinkov, Y\. Hou, Y\. Hou, Y\. Bai, Z\. Seid, Z\. Zhao, Z\. Wang, Z\. J\. Wang, Z\. Wang, and Z\. Wu\(2023\)Beyond the imitation game: quantifying and extrapolating the capabilities of language models\.External Links:2206\.04615,[Link](https://arxiv.org/abs/2206.04615)Cited by:[§V\-C1](https://arxiv.org/html/2607.18548#S5.SS3.SSS1.p4.1)\.
- \[114\]A\. Starkloff, S\. Kokaina, and S\. RahimiJ\. Stichbury \(Ed\.\)\(2026\-01\-29\)Evaluations for the agentic world\(Website\)QuantumBlack, AI by McKinsey\.Note:Accessed: 2026\-02\-18External Links:[Link](https://medium.com/quantumblack/evaluations-for-the-agentic-world-c3c150f0dd5a)Cited by:[§VII\-A1](https://arxiv.org/html/2607.18548#S7.SS1.SSS1.p1.1),[§VII\-A4](https://arxiv.org/html/2607.18548#S7.SS1.SSS4.p3.1)\.
- \[115\]Synopsys\(n\.d\.\)What is ISO 26262 functional safety standard?\(Website\)Synopsys, Inc\.\.Note:Accessed: 2025\-02\-17External Links:[Link](https://www.synopsys.com/glossary/what-is-iso-26262.html)Cited by:[§III\-E](https://arxiv.org/html/2607.18548#S3.SS5.p1.1)\.
- \[116\]R\. Tamirisa, B\. Bharathi, L\. Phan, A\. Zhou, A\. Gatti, T\. Suresh, M\. Lin, J\. Wang, R\. Wang, R\. Arel, A\. Zou, D\. Song, B\. Li, D\. Hendrycks, and M\. Mazeika\(2024\)Tamper\-resistant safeguards for open\-weight llms\.External Links:2408\.00761,[Link](https://arxiv.org/abs/2408.00761)Cited by:[TABLE I](https://arxiv.org/html/2607.18548#S3.T1.1.1.3.1.6.1.1),[§V\-A4](https://arxiv.org/html/2607.18548#S5.SS1.SSS4.p1.1),[§V\-C4](https://arxiv.org/html/2607.18548#S5.SS3.SSS4.p3.1)\.
- \[117\]P\. Tejas Vinay and S\. K\. Saurav\(2025\)CoMAS\-hpc: a collaborative multi\-agent system for hpc administration\.In2025 Supercomputing India \(SCI\),Vol\.,pp\. 1–8\.External Links:[Document](https://dx.doi.org/10.1109/SCI68648.2025.11333875)Cited by:[§X\-A2](https://arxiv.org/html/2607.18548#S10.SS1.SSS2.p1.1),[§XII\-A2](https://arxiv.org/html/2607.18548#S12.SS1.SSS2.p1.1),[§XII\-A4](https://arxiv.org/html/2607.18548#S12.SS1.SSS4.p1.1),[§XII\-B4](https://arxiv.org/html/2607.18548#S12.SS2.SSS4.p1.1),[§XIII\-B](https://arxiv.org/html/2607.18548#S13.SS2.p1.1),[§XIII\-E](https://arxiv.org/html/2607.18548#S13.SS5.p1.1)\.
- \[118\]UK Ministry of Defence\(2020\)ASEMS toolkit: FMEA/FMECA\(Website\)Defence Equipment and Support \(DE&S\)\.Note:Archived version from August 13, 2020External Links:[Link](https://web.archive.org/web/20200813203140/https://www.asems.mod.uk/toolkit/fmeafmeca)Cited by:[§III\-B](https://arxiv.org/html/2607.18548#S3.SS2.p1.1),[§III\-C](https://arxiv.org/html/2607.18548#S3.SS3.p1.1)\.
- \[119\]T\. Vangalapat and S\. Shaikh\(2026\-02\)Trustworthy agentic ai: a survey and taxonomy of secure coordination and hallucination mitigation in multi\-agent large language model systems\.pp\. 1660\.External Links:[Document](https://dx.doi.org/10.38124/ijisrt/26feb1090)Cited by:[§IV\-E](https://arxiv.org/html/2607.18548#S4.SS5.p1.1),[§IV\-E](https://arxiv.org/html/2607.18548#S4.SS5.p2.1),[TABLE II](https://arxiv.org/html/2607.18548#S4.T2.1.1.7.6.2.1.1)\.
- \[120\]C\. Wang, Y\. Deng, Z\. Lyu, L\. Zeng, J\. He, S\. Yan, and B\. An\(2024\)Q\*: improving multi\-step reasoning for llms with deliberative planning\.External Links:2406\.14283,[Link](https://arxiv.org/abs/2406.14283)Cited by:[§IV\-B](https://arxiv.org/html/2607.18548#S4.SS2.p2.1),[TABLE II](https://arxiv.org/html/2607.18548#S4.T2.1.1.4.3.2.1.1)\.
- \[121\]G\. Wang, Y\. Xie, Y\. Jiang, A\. Mandlekar, C\. Xiao, Y\. Zhu, L\. Fan, and A\. Anandkumar\(2023\)Voyager: an open\-ended embodied agent with large language models\.External Links:2305\.16291,[Link](https://arxiv.org/abs/2305.16291)Cited by:[§IV\-D](https://arxiv.org/html/2607.18548#S4.SS4.p1.1),[TABLE II](https://arxiv.org/html/2607.18548#S4.T2.1.1.8.7.2.1.1)\.
- \[122\]Y\. Wen and X\. Chen\(2025\)X\-GridAgent: an LLM\-powered agentic AI system for assisting power grid analysis\.External Links:[Link](https://arxiv.org/abs/2512.20789)Cited by:[§XII\-A1](https://arxiv.org/html/2607.18548#S12.SS1.SSS1.p1.1),[§XII\-B3](https://arxiv.org/html/2607.18548#S12.SS2.SSS3.p1.1),[§XII\-B4](https://arxiv.org/html/2607.18548#S12.SS2.SSS4.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.25.25.25.6.1.1),[§XIII\-D](https://arxiv.org/html/2607.18548#S13.SS4.p1.1),[§XIII\-E](https://arxiv.org/html/2607.18548#S13.SS5.p1.1),[§XIII\-F](https://arxiv.org/html/2607.18548#S13.SS6.p1.1),[§VIII\-A1](https://arxiv.org/html/2607.18548#S8.SS1.SSS1.p1.1),[§VIII\-A2](https://arxiv.org/html/2607.18548#S8.SS1.SSS2.p1.1),[§VIII\-A2](https://arxiv.org/html/2607.18548#S8.SS1.SSS2.p2.1),[§VIII\-A4](https://arxiv.org/html/2607.18548#S8.SS1.SSS4.p1.1),[§VIII\-A4](https://arxiv.org/html/2607.18548#S8.SS1.SSS4.p2.1),[§VIII\-B1](https://arxiv.org/html/2607.18548#S8.SS2.SSS1.p2.1),[§VIII\-B4](https://arxiv.org/html/2607.18548#S8.SS2.SSS4.p1.1),[§VIII\-B5](https://arxiv.org/html/2607.18548#S8.SS2.SSS5.p1.1),[§VIII\-C](https://arxiv.org/html/2607.18548#S8.SS3.p1.1)\.
- \[123\]Z\. Weng and Z\. Qin\(2021\)Semantic communication systems for speech transmission\.39\(8\),pp\. 2434–2444\.External Links:[Document](https://dx.doi.org/10.1109/JSAC.2021.3087240),[Link](https://arxiv.org/pdf/2102.12605)Cited by:[§XI\-A2](https://arxiv.org/html/2607.18548#S11.SS1.SSS2.p1.1),[§XI\-B2](https://arxiv.org/html/2607.18548#S11.SS2.SSS2.p1.1),[§XI\-B3](https://arxiv.org/html/2607.18548#S11.SS2.SSS3.p1.1),[§XII\-B2](https://arxiv.org/html/2607.18548#S12.SS2.SSS2.p1.1),[§XII\-B3](https://arxiv.org/html/2607.18548#S12.SS2.SSS3.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.206.206.206.6.1.1),[§XIII\-C](https://arxiv.org/html/2607.18548#S13.SS3.p1.1),[§XIII\-D](https://arxiv.org/html/2607.18548#S13.SS4.p1.1)\.
- \[124\]Wiz Experts Team\(2025\-05\-22\)MDR vs\. SOC: what’s the difference?\(Website\)Wiz, Inc\.\.Note:Accessed: 2026\-02\-18External Links:[Link](https://www.wiz.io/academy/detection-and-response/mdr-vs-soc)Cited by:[§VII\-A2](https://arxiv.org/html/2607.18548#S7.SS1.SSS2.p3.1),[§VII\-D2](https://arxiv.org/html/2607.18548#S7.SS4.SSS2.p1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.29.25.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.30.26.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.31.27.1.1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.32.28.1.1.1)\.
- \[125\]Z\. Xi, S\. Liang, Q\. Liu, J\. Zhang, L\. Peng, F\. Nan, M\. Nayim, T\. Zhang, R\. Mundada, L\. Qin, B\. Huang, and K\. Zhou\(2026\)ToolGym: an open\-world tool\-using environment for scalable agent testing and data curation\.External Links:2601\.06328,[Link](https://arxiv.org/abs/2601.06328)Cited by:[§IV\-D](https://arxiv.org/html/2607.18548#S4.SS4.p2.1),[TABLE II](https://arxiv.org/html/2607.18548#S4.T2.1.1.8.7.2.1.1)\.
- \[126\]H\. Xie, Z\. Qin, G\. Y\. Li, and B\. Juang\(2021\)Deep learning enabled semantic communication systems\.69,pp\. 2663–2675\.External Links:[Document](https://dx.doi.org/10.1109/TSP.2021.3071210),[Link](https://arxiv.org/abs/2006.10685)Cited by:[§XI\-A2](https://arxiv.org/html/2607.18548#S11.SS1.SSS2.p1.1),[§XI\-B2](https://arxiv.org/html/2607.18548#S11.SS2.SSS2.p1.1),[§XI\-B3](https://arxiv.org/html/2607.18548#S11.SS2.SSS3.p1.1),[§XII\-B2](https://arxiv.org/html/2607.18548#S12.SS2.SSS2.p1.1),[§XII\-B3](https://arxiv.org/html/2607.18548#S12.SS2.SSS3.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.201.201.201.6.1.1),[§XIII\-C](https://arxiv.org/html/2607.18548#S13.SS3.p1.1),[§XIII\-D](https://arxiv.org/html/2607.18548#S13.SS4.p1.1)\.
- \[127\]L\. Xie, Q\. Zhang, M\. Yu, P\. L\. Joskow, and C\. Singh\(2026\-02\)Crucial role of foundation models in enhancing the interaction of AI and power systems: achieving integrated frameworks\.pp\. 22–28\.External Links:[Document](https://dx.doi.org/10.1109/ESM.2025.3630998)Cited by:[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.10.10.10.6.1.1),[§VIII\-A4](https://arxiv.org/html/2607.18548#S8.SS1.SSS4.p1.1),[§VIII](https://arxiv.org/html/2607.18548#S8.p1.1)\.
- \[128\]N\. Yadav\(2025\-11\-26\)10 essential steps for evaluating the reliability of AI agents\(Website\)Maxim AI\.Note:Accessed: 2026\-02\-24External Links:[Link](https://www.getmaxim.ai/articles/10-essential-steps-for-evaluating-the-reliability-of-ai-agents/)Cited by:[1st item](https://arxiv.org/html/2607.18548#S7.I7.i1.p1.1),[TABLE IV](https://arxiv.org/html/2607.18548#S7.T4.3.34.30.1.1.1)\.
- \[129\]S\. Yao, D\. Yu, J\. Zhao, I\. Shafran, T\. L\. Griffiths, Y\. Cao, and K\. Narasimhan\(2023\)Tree of thoughts: deliberate problem solving with large language models\.External Links:2305\.10601,[Link](https://arxiv.org/abs/2305.10601)Cited by:[§I](https://arxiv.org/html/2607.18548#S1.p2.1),[§IV\-B](https://arxiv.org/html/2607.18548#S4.SS2.p1.1),[TABLE II](https://arxiv.org/html/2607.18548#S4.T2.1.1.4.3.2.1.1)\.
- \[130\]S\. Yao, J\. Zhao, D\. Yu, N\. Du, I\. Shafran, K\. Narasimhan, and Y\. Cao\(2023\)ReAct: synergizing reasoning and acting in language models\.External Links:2210\.03629,[Link](https://arxiv.org/abs/2210.03629)Cited by:[§I](https://arxiv.org/html/2607.18548#S1.p2.1),[§IV\-A](https://arxiv.org/html/2607.18548#S4.SS1.p1.1),[TABLE II](https://arxiv.org/html/2607.18548#S4.T2.1.1.2.1.2.1.1)\.
- \[131\]B\. Ye, R\. Li, Q\. Yang, Y\. Liu, L\. Yao, H\. Lv, Z\. Xie, C\. An, L\. Li, L\. Kong, Q\. Liu, Z\. Sui, and T\. Yang\(2026\)Claw\-eval: toward trustworthy evaluation of autonomous agents\.External Links:2604\.06132,[Link](https://arxiv.org/abs/2604.06132)Cited by:[§XII](https://arxiv.org/html/2607.18548#S12.p1.1),[§VI\-E](https://arxiv.org/html/2607.18548#S6.SS5.p2.1)\.
- \[132\]H\. Zhang, J\. Huang, K\. Mei, Y\. Yao, Z\. Wang, C\. Zhan, H\. Wang, and Y\. Zhang\(2025\)Agent security bench \(asb\): formalizing and benchmarking attacks and defenses in llm\-based agents\.InThe Thirteenth International Conference on Learning Representations \(ICLR 2025\),External Links:[Link](https://openreview.net/forum?id=V4y0CpX4hK)Cited by:[§XI\-A3](https://arxiv.org/html/2607.18548#S11.SS1.SSS3.p2.1),[§XI\-B3](https://arxiv.org/html/2607.18548#S11.SS2.SSS3.p1.1),[§XII\-A1](https://arxiv.org/html/2607.18548#S12.SS1.SSS1.p1.1),[§XII\-A2](https://arxiv.org/html/2607.18548#S12.SS1.SSS2.p1.1),[§XII\-B2](https://arxiv.org/html/2607.18548#S12.SS2.SSS2.p1.1),[§XII\-B3](https://arxiv.org/html/2607.18548#S12.SS2.SSS3.p1.1),[§XII\-B4](https://arxiv.org/html/2607.18548#S12.SS2.SSS4.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.221.221.221.6.1.1),[§XII](https://arxiv.org/html/2607.18548#S12.p1.1),[§XIII\-A](https://arxiv.org/html/2607.18548#S13.SS1.p1.1),[§XIII\-C](https://arxiv.org/html/2607.18548#S13.SS3.p1.1),[§XIII\-D](https://arxiv.org/html/2607.18548#S13.SS4.p1.1),[§XIII\-E](https://arxiv.org/html/2607.18548#S13.SS5.p1.1)\.
- \[133\]Q\. Zhang and L\. Xie\(2025\-09\)PowerAgent: a road map toward agentic intelligence in power systems: foundation model, model context protocol, and workflow\.23\(5\),pp\. 93–101\.External Links:[Document](https://dx.doi.org/10.1109/MPE.2025.3579718)Cited by:[§XII\-B4](https://arxiv.org/html/2607.18548#S12.SS2.SSS4.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.5.5.5.6.1.1),[§XIII\-E](https://arxiv.org/html/2607.18548#S13.SS5.p1.1),[§VIII\-A4](https://arxiv.org/html/2607.18548#S8.SS1.SSS4.p1.1),[§VIII\-B5](https://arxiv.org/html/2607.18548#S8.SS2.SSS5.p1.1),[§VIII](https://arxiv.org/html/2607.18548#S8.p1.1)\.
- \[134\]T\. Zhang, L\. Wang, X\. Zhang, Y\. Zhang, B\. Jia, S\. Liang, S\. Hu, Q\. Fu, A\. Liu, and X\. Liu\(2024\)Visual adversarial attack on vision\-language models for autonomous driving\.Cited by:[§XII\-B4](https://arxiv.org/html/2607.18548#S12.SS2.SSS4.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.101.101.101.6.1.1),[§XIII\-E](https://arxiv.org/html/2607.18548#S13.SS5.p1.1),[§IX\-A3](https://arxiv.org/html/2607.18548#S9.SS1.SSS3.p2.1),[§IX\-B2](https://arxiv.org/html/2607.18548#S9.SS2.SSS2.p1.1)\.
- \[135\]Y\. Zhang, A\. M\. Saber, A\. Youssef, and D\. Kundur\(2025\)Semantic reasoning meets numerical precision: an LLM\-powered multi\-agent system for power grid control\.External Links:[Link](https://arxiv.org/abs/2508.05702)Cited by:[§XII\-A2](https://arxiv.org/html/2607.18548#S12.SS1.SSS2.p1.1),[§XII\-A3](https://arxiv.org/html/2607.18548#S12.SS1.SSS3.p1.1),[§XII\-A4](https://arxiv.org/html/2607.18548#S12.SS1.SSS4.p1.1),[§XII\-B1](https://arxiv.org/html/2607.18548#S12.SS2.SSS1.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.40.40.40.6.1.1),[§XIII\-A](https://arxiv.org/html/2607.18548#S13.SS1.p1.1),[§XIII\-B](https://arxiv.org/html/2607.18548#S13.SS2.p1.1),[§VIII\-A1](https://arxiv.org/html/2607.18548#S8.SS1.SSS1.p1.1),[§VIII\-A2](https://arxiv.org/html/2607.18548#S8.SS1.SSS2.p2.1),[§VIII\-A3](https://arxiv.org/html/2607.18548#S8.SS1.SSS3.p1.1),[§VIII\-A3](https://arxiv.org/html/2607.18548#S8.SS1.SSS3.p2.1),[§VIII\-A4](https://arxiv.org/html/2607.18548#S8.SS1.SSS4.p1.1),[§VIII\-B1](https://arxiv.org/html/2607.18548#S8.SS2.SSS1.p2.1),[§VIII\-B5](https://arxiv.org/html/2607.18548#S8.SS2.SSS5.p2.1),[§VIII\-C](https://arxiv.org/html/2607.18548#S8.SS3.p1.1)\.
- \[136\]X\. Zheng, S\. Zhao, T\. Shi, T\. Wang, R\. Chen, S\. Yu, S\. Xue, and H\. Cao\(2025\)Agentic planning for power system simulation task orchestrations based on multi\-agent systems\.In2025 8th International Conference on Robotics, Control and Automation Engineering \(RCAE\),pp\. 576–581\.External Links:[Document](https://dx.doi.org/10.1109/RCAE66389.2025.11355202)Cited by:[§XII\-A2](https://arxiv.org/html/2607.18548#S12.SS1.SSS2.p1.1),[TABLE V](https://arxiv.org/html/2607.18548#S12.T5.50.50.50.6.1.1),[§VIII\-A1](https://arxiv.org/html/2607.18548#S8.SS1.SSS1.p1.1),[§VIII\-A3](https://arxiv.org/html/2607.18548#S8.SS1.SSS3.p1.1),[§VIII\-C](https://arxiv.org/html/2607.18548#S8.SS3.p1.1)\.
- \[137\]Y\. Zheng, Z\. Zhao, Z\. Li, Y\. Xie, M\. Gao, L\. Zhang, and K\. Zhang\(2025\)Thought communication in multiagent collaboration\.InThe Thirty\-ninth Annual Conference on Neural Information Processing Systems,External Links:[Link](https://openreview.net/forum?id=tq9lyV9Cml)Cited by:[§IV\-E](https://arxiv.org/html/2607.18548#S4.SS5.p3.1),[TABLE II](https://arxiv.org/html/2607.18548#S4.T2.1.1.7.6.2.1.1)\.
- \[138\]A\. Zou, L\. Phan, S\. Chen, J\. Campbell, P\. Guo, R\. Ren, A\. Pan, X\. Yin, M\. Mazeika, A\. Dombrowski, S\. Goel, N\. Li, M\. J\. Byun, Z\. Wang, A\. Mallen, S\. Basart, S\. Koyejo, D\. Song, M\. Fredrikson, J\. Z\. Kolter, and D\. Hendrycks\(2025\)Representation engineering: a top\-down approach to ai transparency\.External Links:2310\.01405,[Link](https://arxiv.org/abs/2310.01405)Cited by:[TABLE I](https://arxiv.org/html/2607.18548#S3.T1.1.1.4.2.6.1.1),[§VI\-A](https://arxiv.org/html/2607.18548#S6.SS1.p1.1),[§VI\-A](https://arxiv.org/html/2607.18548#S6.SS1.p3.1)\.
- \[139\]A\. Zou, L\. Phan, J\. Wang, D\. Duenas, M\. Lin, M\. Andriushchenko, R\. Wang, Z\. Kolter, M\. Fredrikson, and D\. Hendrycks\(2024\)Improving alignment and robustness with circuit breakers\.External Links:2406\.04313,[Link](https://arxiv.org/abs/2406.04313)Cited by:[TABLE I](https://arxiv.org/html/2607.18548#S3.T1.1.1.1.6.1.1),[§V\-A2](https://arxiv.org/html/2607.18548#S5.SS1.SSS2.p1.1),[§V\-A](https://arxiv.org/html/2607.18548#S5.SS1.p1.1),[§V\-C4](https://arxiv.org/html/2607.18548#S5.SS3.SSS4.p3.1)\.
- \[140\]A\. Zou, Z\. Wang, N\. Carlini, M\. Nasr, J\. Z\. Kolter, and M\. Fredrikson\(2023\)Universal and transferable adversarial attacks on aligned language models\.External Links:2307\.15043,[Link](https://arxiv.org/abs/2307.15043)Cited by:[TABLE I](https://arxiv.org/html/2607.18548#S3.T1.1.1.6.4.6.1.1),[§V\-A2](https://arxiv.org/html/2607.18548#S5.SS1.SSS2.p1.1),[§V\-A](https://arxiv.org/html/2607.18548#S5.SS1.p1.1),[§V\-C2](https://arxiv.org/html/2607.18548#S5.SS3.SSS2.p2.1),[§V\-C2](https://arxiv.org/html/2607.18548#S5.SS3.SSS2.p3.1)\.

![[Uncaptioned image]](https://arxiv.org/html/2607.18548v1/Authors/Al-Refai.jpeg)Omar Al\-Refai\(Student Member, IEEE\) received the B\.Sc\. degree in computer engineering from Princess Sumaya University for Technology, Amman, Jordan\. He is currently pursuing the Ph\.D\. degree in computer engineering at Texas A&M University, College Station, TX, USA\. His research at the Innovations in Systems Trust and Resilience \(iSTAR\) Laboratory focuses on enhancing trust and resilience in autonomous, collaborative, and human\-in\-the\-loop systems and on connecting digital realms through the integration of humans, machines, and agents\. His broader research interests include artificial intelligence, machine learning, and security\.![[Uncaptioned image]](https://arxiv.org/html/2607.18548v1/Authors/Shahbaz.png)Ibrahim Shahbaz\(Student Member, IEEE\) received the B\.Sc\. degree in electrical engineering from the University of Jordan, Amman, Jordan, and the M\.Sc\. degree in Data Science from Princess Sumaya University for Technology, Amman, Jordan\. He is currently a Ph\.D\. student in electrical engineering at Texas A&M University, College Station, TX, USA\. His research interests at the iSTAR Lab include intelligent cyber\-physical systems, resilient smart grids, and scientific machine learning\.![[Uncaptioned image]](https://arxiv.org/html/2607.18548v1/Authors/Adam.png)Adam Ali Husseinat\(Member, IEEE\) received the B\.Sc\. degree in electrical engineering from Jordan University of Science and Technology, Jordan, in 2009, and the M\.Sc\. degree in systems and computer engineering from Carleton University, Canada, in 2025\. He is currently pursuing the Ph\.D\. degree in electrical and computer engineering at Texas A&M University, College Station, TX, USA\. His research interests include wireless communications, machine learning for communications, semantic communication, and 5G/6G intelligent networks\.![[Uncaptioned image]](https://arxiv.org/html/2607.18548v1/Authors/Michael.jpeg)Michael Mandulakreceived his Ph\.D\. in Computer Science from Rensselaer Polytechnic Institute \(RPI\), Troy, NY, USA\. in 2025\. He is currently a Postdoctoral Research Associate at the Texas A&M University Institute of Data Science \(TAMIDS\) in the Security, Privacy and Resilience for Trusted AI \(SPARTA\) Laboratory\. His research interests include high\-performance computing, large\-scale graph analytics, distributed graph processing, matching algorithms, and security in graph\-based AI systems\.![[Uncaptioned image]](https://arxiv.org/html/2607.18548v1/Authors/Jaewon.png)Jaewon Kim\(Member, IEEE\) received his Ph\.D\. degree in Computer Engineering from Texas A&M University in 2023\. He is currently an Assistant Research Scientist at the Texas A&M Global Cyber Research Institute \(GCRI\)\. Prior to joining GCRI, he was a Postdoctoral Associate in the Laboratory for Information & Decision Systems \(LIDS\) at the Massachusetts Institute of Technology \(MIT\)\. He spearheads an interdisciplinary research program at the critical intersection of cyber\-physical systems \(CPS\) and security of future autonomous infrastructures\. His work investigates resilient real\-time network and zero\-trust architectures \(ZTA\), incorporating robust authentication and micro\-segmentation, to secure unmanned aerial and ground vehicles \(UAVs/UGVs\)\.![[Uncaptioned image]](https://arxiv.org/html/2607.18548v1/Authors/Hammad.png)Eman Hammad\(Senior Member, IEEE\) is an Assistant Professor and the Director of the Innovations in Systems Trust and Resilience \(iSTAR\) Laboratory at Texas A&M University, College Station, TX, USA\. She is also the Director of the Texas A&M Data Institute Thematic Laboratory for Security, Privacy, and Resilience for Trusted AI \(SPARTA\)\. She received the Ph\.D\. degree from the Department of Electrical and Computer Engineering at the University of Toronto, Toronto, ON, Canada\. Her research is primarily in the domain of security and resilience of complex network, cyber\-physical systems and critical infrastructures’ with applications in power systems, 6G/NG wireless networks, connected and autonomous vehicles \(UAV/UGV\), and public safety\. Focus areas include trustworthy autonomous systems, physical AI, human\-AI interactions, risk\-informed operations, 6G/NG communication networks, semantic and graph\-based methods, digital well\-being, and CyberAI education\.