Hierarchical multi-agent AI framework for cybersecurity in cyber–physical systems

Cyber-Physical Systems (CPS) drive modern critical infrastructures by tightly integrating physical processes with computation and communication networks. This convergence exposes CPS to sophisticated cyber threats propagating across physical, control, and network layers, where stealthy and multi-stage attacks manifest through weak and distributed signals, challenging centralized intrusion detection systems and monolithic AI models that struggle to scale across heterogeneous subsystems and lack the interpretability required in safety-critical environments. This paper proposes a hierarchical multi-agent AI framework for automated cybersecurity assessment with human-understandable explanations in networked CPS. The framework dynamically instantiates a task-specific agent hierarchy from a natural language description of the target system, aligning the security analysis process with the underlying CPS architecture. Specialized agents perform fine-grained analysis of heterogeneous data sources, subsystem supervisors aggregate and contextualize local findings, and a deliberative round-table consensus mechanism enables cross-subsystem correlation for detecting coordinated and stealthy attacks. The framework is evaluated using four LLMs (Qwen 3 4B, Qwen 3 8B, Llama 3.1 8B, and Llama 3.3 70B) across three datasets (PicoDomain, CERT r5.2, and SWaT), achieving perfect recall for models with 8B parameters and above (i.e., zero missed attacks), while reaching an accuracy of 90.18% on PicoDomain, 92.77% on CERT r5.2, and 96.97% on SWaT. An ablation study confirms the effectiveness of the cross-subsystem consensus mechanism, demonstrating substantial precision gains when collaborative deliberation is enabled. Overall, this work establishes hierarchical multi-agent architectures as a scalable, interpretable, and structure-aware foundation for AI-driven cybersecurity in networked CPS.