Post-Compromise Security for Physical AI: Deterministic Runtime Enforcement of Physical Action Authority in Autonomous UAVs / 具身智能之攻陷後安全:自主無人機實體動作權 限之確定性運行時強制執行

Autonomous Physical AI systems increasingly connect learned or language-based controllers to cyber-physical actuators. This creates a security problem that differs from conventional model robustness: when a Physical AI controller is fully compromised, where does the last enforceable security boundary remain? We formulate the Post-Compromise Physical Action Authority Problem and investigate whether execution authority can be placed at the transition from autonomous intent to physical action, bounding action authority independently of cognitive controller integrity.We present DROS-Kinetic, a reference implementation that places a deterministic authorization gate between an autonomouscontrol process and the flight-control command interface. The design separates cognitive compromise from physical execution authority through explicit action, principal, capability, and policy checks. We formalize three core properties: Unauthorized Command-Induced Actuation Invariance (UCIAI) (an enforcement property), Conditional Empirical Safety-Envelope Preservation (a conditional cyber-physical system property), and Delegation Non-Escalation (a multi-agent governance property) under explicitly stated vehicle, dynamic, and disturbance assumptions.We evaluate the system using a six-stage experimental ladder (T1–T6) covering nominal execution, adversarial controller compromise, execution containment, physical safety-envelope enforcement, multi-agent delegation, and revocation under boundary-oriented stress workloads. Results are reported in terms of unauthorized-actuation containment, safety-envelope violations, delegation propagation depth, and decomposed latency layers (Lenforcement ≪ Ltransport ≪ Lphysical). The study provides an experimentally testable basis for evaluating postcompromise security at the boundary between autonomous cognition and physical actuation.自主具身智能(Physical AI)系統日益將基於學習或大型語言模型(LLM/VLA)的認知控制器直接連接至網絡-實體致動器。這引發了一個與傳統模型魯棒性本質不同的安全挑戰:當具身智能的認知控制器被完全攻陷後,最後一道可強制執行的安全邊界究竟還剩在哪裡?