International Conference on Dependable Systems and Networks workshops : [proceedings]

Autonomous systems increasingly rely on Large Language Models (LLMs) yet the safety infrastructure surrounding these models introduces latency and compute overhead. This limits utility in resource-constrained, time-critical deployments. Existing external guardrail models remain blind to the model’s internal workings, creating a fundamental assurance gap. We ask: does the model already know when the content is harmful? We extract activations from LLaMA-3.1-8B and train lightweight classifier probes (12.6M parameters) to detect harmful prompts. Evaluated on WildJailbreak, Beavertails, and AEGIS 2.0, our probes achieve F1 scores of 99%, 83%, and 84%, respectively competitive with 1000× + larger guard models while cutting latency and compute costs.

Agentic artificial intelligence (Agentic AI) systems have undergone a significant evolution, progressing from static predictive models to autonomous entities capable of intricate reasoning, planning, and action over extended temporal horizons. While Agentic AI demonstrates considerable utility across diverse application domains, its deployment in critical infrastructure increasingly highlights fundamental challenges concerning its trustworthiness. Current agentic architectures primarily prioritize performance and flexibility, yet they frequently lack inherent compositional guarantees for critical attributes such as safety, robustness, and accountability. In this position paper, we contend that trust in agentic AI remains largely fragmented and is predominantly established through external mechanisms rather than being intrinsically integrated into system design. We present a perspective on composable trust that bridges the gap between advanced agentic capability and dependable deployment by conceptualizing trust as a compositional property spanning agent loops, interactions, and operational environments. We further outline a roadmap toward system-level assurance by identifying structural limitations in existing architectures and defining the prerequisites for enforceable trust.

The Ising model is useful in searching for (sub)-optimal solutions of combinatorial optimization problems (COPs). CMOS implementations of Ising model-based solvers, commonly referred to as Ising machines, provide reliable and accurate solutions with flexible and dense connectivity. However, they incur a significant hardware overhead. Approximate computing, as a low-power technique, offers a way to reduce hardware complexity, while stochastic computing is efficient in simulating the dynamics of the Ising model. The approximations introduced by these techniques may be beneficial in helping the system escape from local minima. In this talk, we discuss the potential of using approximate and stochastic computing to improve the performance of Ising machines.

Graphical security models–such as attack graphs, attack trees, and Hierarchical Attack Representation Models (HARMs)–are widely used for threat, attack, and security modeling and analysis. This talk introduces their core concepts, including key terminology, security metrics, and the model life cycle. It then highlights recent advances in graphical modeling techniques and their applications, with a focus on domains such as the Internet of Things (IoT) and the security and safety analysis of autonomous vehicles.

The next generation of IoT and edge computing platforms must address security, safety, and reliability requirements. This talk presents the advancements made in two European-funded projects, LoLiPoP IoT and SuzECK, that concentrate on safe, interference-free gateway architectures and a robust, self-managed platform for critical edge applications. In LoLiPoP IoT, a modular gateway integrates Mioty and BLE-based applications, ensuring isolation, real-time security key provisioning via HSM over an NXP S32G3 System on Chip (SOC), and a PikeOSbased execution environment enhanced by Grafana visualization, firewalling, and intrusion detection/prevention mechanisms. SuzECK enhances this strategy by creating a secure computing platform powered by Kubernetes, in which nodes are dynamically managed as computing units. For safety-critical edge services, fault-tolerant execution is ensured by hardware-level failover, redundant application copies, and an intelligent voting mechanism. This keynote will explore the architectural challenges, security designs, deployment strategies, and future research perspectives in secure IoT and edge computing. It will also provide insights into leveraging containerization, modular security frameworks, and self-healing node orchestration for next-generation digital infrastructures.

Indirect surveys have been used for decades by epidemiologists and social scientists to estimate the size of sub-populations within social networks. In these surveys, respondents provide information about their social connections, making them particularly useful for monitoring hardto- reach or sensitive populations, such as disaster casualties, drug use prevalence, or the spread of infectious diseases. These indirect responses, known as Aggregated Relational Data (ARD), are analyzed using various statistical methods collectively referred to as the Network Scale-Up Method (NSUM). In this talk, we describe how indirect surveys and NSUM have been used in the CoronaSurveys project to track and estimate over 5 years the evolution of the COVID-19 pandemic. The presentation will describe the software system deployed, and the algorithms used to estimate pandemic parameters over time.

Risk in Cyber-Physical Systems (CPSs) and the Internet of Things (IoT) results from the interplay of threat probabilities, system vulnerabilities, and potential consequences. Traditional risk assessments are typically static, conducted at design time, and lack the capability to reflect dynamic system states and evolving threat conditions. A major objective in this domain is to improve resilience by providing non-trivial mechanisms for run-time threat detection, risk estimation and system reconfiguration following Self-X principles. This keynote addresses how Digital Twins (DTs) can facilitate continuous monitoring, dynamic threat detection, risk analysis and system adaptation by leveraging Self-X capabilities such as self-diagnosis and self-healing. Both intentional (e.g., security attacks) and unintentional (e.g., random faults) threats are considered, highlighting the need for robust, model-based approaches capable of operating under uncertainty. To address the increasing complexity, distribution, and criticality of modern CPSs, a multiparadigm modelling approach is advocated, combining probabilistic reasoning methods (e.g., Bayesian Networks) with formal verification techniques (e.g., high-level Petri Nets). To operationalize these models at run time, a conceptual framework grounded in autonomic computing is introduced. This framework provides the architectural basis for embedding Digital Twins into CPS, where they function as intelligent, real-time models that continuously monitor system parameters, detect anomalies, and trigger adaptive responses. By incorporating selfadaptive mechanisms–such as self-configuration, self-diagnosis, and self-healing–the framework enables CPS to exhibit proactive dependability and collaborative security. These capabilities are essential for Industry 4.0 and other smart-X environments, where autonomous systems must ensure safety and resilience in the face of uncertainty and evolving threats.

Real-time risk assessment has become essential in modern risk management, enabling organizations to effectively react to dynamic threats in various sectors. Real-time risk assessment leverages advanced technologies such as machine learning, data analytics, and Internet of Things ((IoT) devices to provide timely insights for decision-making. Cyber-physical systems can play a crucial role by integrating computational and physical processes, allowing real-time monitoring and control of complex systems. The synergy between cyber-physical systems and real-time risk assessment is particularly crucial in urban environments, where the complexity of risks makes it essential for them to be mutually dependable and resilient. Digital twins can further enhance urban management by providing virtual representations that facilitate real-time monitoring and analysis. This paper proposes an architectural framework compliant with the Digital Twin Space model, which integrates digital twins and data spaces to improve urban data management while ensuring privacy and security. A case study on hydrogeological risk management is proposed to demonstrate the effectiveness of the framework through a minimal FIWARE-based early warning system. The findings highlight the importance of developing systematic methodologies for urban digital twin design to ensure its functionality, reliability, and adaptability in increasingly complex urban environments.

The model checking of multi-threaded programs often involves reasoning about the happens-before relation of concurrent program instructions. Several algorithms exist for finding a partial order of instructions that is consistent with ordering constraints of the assumed memory model and that violates a safety property; or for proving that such partial orders do not exist. We present existing and novel bounded model checking approaches reasoning with happens-before relations of concurrent programs. These algorithms are implemented in THETA, a modular model checking framework. We also give a comparative evaluation of our THETA implementations and state-of-the-art verifiers.

Safety and reliability requirements are fundamental for any Autonomous Driving System (ADS) to ensure optimal performance, regulatory compliance, and overall safety. However, the standardization of ADS requirements remains a challenge due to the complexity of AI-based systems. This study initially focused on obtaining a textual description of the environmental requirements of ADS. A detailed literature review revealed a lack of structured information in this domain. Consequently, we identified the Functional Requirements for Automated Vehicles (FRAV)1 framework as a viable source for defining the environmental requirements of ADS. To evaluate the completeness of these requirements, we performed a comparative analysis of environmental attributes with the Safety Controller for Autonomous Driving (SCAD) case study and the FRAV framework. This comparison highlights how existing formal approaches address real-world environmental factors and identifies potential gaps that need further refinement. This study initiates the verification and validation process for ADS through the elicitation of relevant requirements. In the future, these requirements will be further refined by adopting a set of activities such as cognitive linguistics, crowd-based requirement engineering, and empirical validation with industry experts. In addition, traceability from the natural language requirements to their formal specification using the Formal Requirements Elicitation Tool (FRET) will be implemented to support the validation and verification of the ADS requirements. Our proposed approach can contribute to obtaining safer and more stable ADS requirements while also having the potential to serve as a standardized framework for eliciting AI-based requirements in future systems.

Federated Learning (FL) enables collaborative model training without centralizing data, but traditional server-assisted FL faces challenges such as single points of failure, communication bottlenecks, and trust dependency. Decentralized Federated Learning (DFL) addresses these issues by eliminating the central server, allowing peer-to-peer communication among clients. However, DFL introduces new vulnerabilities, including exposure to adversarial attacks and the risk of free-riding behavior. To ensure sustainable and secure participation, effective incentive and reputation mechanisms are essential. In this work, we propose a lightweight, reputation-based algorithm tailored for resource-constrained edge devices in decentralized settings. Our approach prioritizes model sharing based on peer-evaluated contributions, discourages selfish behavior, and mitigates the impact of malicious clients through adaptive reputation adjustments. Unlike prior methods, our scheme explicitly accounts for clients' limited sending and receiving capacities, promoting fairness and practical applicability. Experimental results demonstrate that our method incentivizes meaningful participation and enhances the robustness of decentralized learning systems against both selfish and adversarial threats.

Large Language Models (LLMs) have revolutionized natural language processing, enabling high-quality content generation. However, they remain prone to hallucinations, instances where generated outputs deviate from factual truth. In this paper, we propose a novel approach that integrates Beam Search Sampling (BSS) with Semantic Consistency Analysis to systematically detect factual hallucinations. Our method leverages BSS to generate multiple candidate answers, capturing the model's confidence distribution across different plausible answers. These answers are then clustered based on semantic similarity, and a Natural Language Inference (NLI) model is applied to assess entailment and contradiction relationships. To quantify hallucinations, we introduce a scoring mechanism that combines token probabilities with semantic similarity metrics. Additionally, for cases where BSS produces a single answer, we incorporate a Chain-of-Verification (CoVe) mechanism to perform self-consistency checks. We evaluate our approach using Llama3.8B on the TruthfulQA dataset, achieving a precision of 0.87 and an AUROC of 0.81 for multi-answer generation. For single-answer verification with CoVe, we report a precision of 0.64 and accuracy of 0.71. Our approach outperforms conventional semantic entropy-based methods.

Reliable drone operation in real-time is critical for missions in extreme environments such as post-disaster zones or contested airspace, where timing failures can lead to catastrophic outcomes. We develop a Software-in-the-Loop framework to evaluate drone operating systems under stress, focusing on latency, jitter, and resource contention. These metrics directly impact flight stability, responsiveness, and safety in uncertain or degraded conditions. Our approach enables systematic testing of flight software behavior in adversarial scenarios that are difficult to reproduce in the field.

This research evaluates the ability of adversarial attacks, primarily designed for CNN-based classifiers, to target the multimodal image captioning tasks executed by large vision language models, such as ChatGPT4. The study included different versions of ChatGPT4, several attacks, with a particular emphasis on the Projected Gradient Descent (PGD) attack, considering various parameters, surrogate models, and datasets. Initial but limited experiments support the hypothesis that PGD attacks are partly transferable to ChatGPT4. Subsequently, results demonstrated that PGD attacks could be adaptively transferred to disrupt the normal functioning of ChatGPT. On the other hand, other adversarial attack strategies showed a limited ability to compromise ChatGPT. These findings provide insights into the security vulnerabilities of emerging neural network architectures used for generative AI. Moreover, they underscore the possibility of cost-effectively crafting adversarial examples against novel architectures, necessitating the development of robust defense mechanisms for large vision language models in practical applications.

As machine learning continues to integrate into critical systems, ensuring the safety and correctness of these models becomes essential. Decision tree ensembles, which combine multiple decision trees to improve performance and robustness, present unique challenges for verification due to their complexity. This paper explores the application of program verification techniques for the formal analysis of decision tree ensembles against specified requirements. Theorem proving can identify and mitigate potential specification violations, enhancing the trustworthiness and safety of machine learning ensembles. Two case studies and experimental results show the effectiveness of the approach, highlighting its potential to serve as a critical tool in the deployment of reliable machine learning systems. Moreover, the paper describes an evaluation of the complexity of the verification process, focusing on the computational considerations and feasibility of applying theorem proving to random forests.

Quantized Neural Networks (QNNs) are increasingly employed to bring Machine Learning (ML) capabilities to edge devices by reducing memory and computational requirements through low-precision arithmetic. QNNs are generally considered more robust to hardware faults, but prior reliability studies, with rare exceptions, have largely relied on high-level fault injection (FI) methodologies that abstract away from hardware details. This paper presents a hardware-level fault injection methodology that integrates Verilator-generated gate-level simulations into QNN inference pipelines, enabling the injection of permanent faults directly into gate-level descriptions of functional units during inferences. Optimizations for small quantization bit widths are also presented to address performance limitations, for instance, leveraging lookup tables and GPU parallelization to speed up simulations. FI campaigns were conducted on multiple networks (MobileNet, MobileNetV2, ResNet18, ResNet34) trained on CIFAR-10 and GTSRB and quantized to INT8 (CIFAR-10 and GTSRB) and UINT8 (CIFAR-10), revealing severe accuracy degradation-averaging a -72.7% drop in classification accuracy - under single stuck faults in an integer multiplier. The results obtained confirm that QNNs may not be as robust as previously thought.

The increasing complexity of modern software supply chains has led to heightened security concerns, particularly regarding vulnerabilities hidden within source code. Classical machine learning (ML) algorithms have been extensively used to detect these vulnerabilities, but their effectiveness is often constrained by computational limitations and feature-extraction challenges. Recent advancements in quantum machine learning (QML) offer a promising alternative by leveraging quantum computing's superior computational power and parallelism. This study presents a performance comparison between classical ML and QML algorithms for detecting software supply chain vulnerabilities in source code. We evaluate key metrics, including precision, accuracy, recall, and computational efficiency, to assess their effectiveness in real-world scenarios. Our results demon-strate the potential advantages of QML in handling complex security threats, though practical implementation challenges remain. This research contributes to the growing field of quantum cybersecurity and provides insights into the future adoption of QML in securing software supply chains.

Cyber-Physical Systems (CPS), characterized by the tight integration of computation, networking, and physical processes, are becoming increasingly vital across societal domains [1]. As long-living and autonomous entities deeply embedded within complex and dynamic runtime environments, CPS are best understood not just as engineered artifacts interacting with their surroundings, but as integral components fostering a symbiotic relationship characterized by potentially unexpected interactions and co-evolution [2]. This perspective challenges traditional system design and management paradigms. As CPS grow in scale and complexity, interacting intricately with their surroundings, the limitations of more traditional approaches adopted in conventional control solutions become evident. These methods often struggle with scale, heterogeneity, environmental uncertainty, and, crucially, the inherent non-linearities that can lead to emergent behavior - complex and system-level patterns arising unpredictably from local component interactions [3].

In an era where AI code generators are reshaping software development, the risk of introducing vulnerabilities is a growing concern. With the increasing reliance on machine learning-driven tools, it is essential to support developers with effective automated vulnerability patching while prioritizing the reliability and security of AI. However, current methods face significant challenges, including a high rate of false positives and difficulties in generating high-quality patches. This paper presents PatchitPy, a new patching solution that leverages a pattern-matching approach to detect and patch Python vulnerabilities. We generated 609 Python code using three popular AI code generators (i.e., GitHub Copilot, Claude-3.7-Sonnet, and DeepSeek- V3)and evaluated our solution's performance on these samples. The results demonstrate the effectiveness of PatchitPy, which outperforms state-of-the-art solutions in both detection and patching. PatchitPy achieved an F1 score of 93% and an Accuracy of 89% for vulnerability detection, and produced high-quality patches with a 80% repair rate for identified vulnerabilities. Furthermore, the patches preserve code quality with minimal impact on complexity, ensuring long-term code maintainability.

Uncrewed Aerial Vehicles (UAVs) are increasingly employed for deforestation monitoring due to their flexibility, cost-effectiveness, and high-resolution sensing capabilities. However, their performance is highly susceptible to adverse weather conditions such as rainfall and wind, which significantly reduce flight endurance and detection accuracy. Among various adverse weather factors, rainfall intensity and wind speed emerge as the most influential contributors to heavy rainfall conditions, which represent one of the most critical external risks to UAV operations. This study presents an integrated methodology combining Failure Mode and Effects Analysis (FMEA) and Causal Loop Diagrams (CLDs) to identify weather-induced vulnerabilities and model their cascading impact on UAV-based monitoring systems. We extend an existing CLD model by incorporating rainfall intensity rate and wind speed. Based on the causal relationships identified, we develop a functional model to quantitatively evaluate UAV performance degradation. A numerical experiment is conducted to evaluate the impact of four representative weather scenarios: Clear, Light, Moderate, and Severe, on battery life, detection accuracy, and ultimately, the UAV's ability to reduce CO2 emissions through timely deforestation detection. Results show that battery life declines from 120 minutes to 27.3 minutes, and accuracy drops from 95% to 78.8% as weather severity increases. Consequently, annual CO2 emission reduction falls from 179.6 tons under clear conditions to just 32.9 tons under severe conditions. These findings illustrate how environmental risks propagate through system performance degradation, reducing environmental effectiveness. The proposed approach offers a valuable basis for resilience-oriented design and weather-aware mission planning in UAV-based environmental monitoring systems.