Neuro-Agentic Control: A Deep Learning-based LLM-Powered Agentic AI Framework for Controlling Security Controls
06:00 · July 13, 2026 · arXiv cs.AI RSS
Cyberattacks on operational technology are increasingly causing costly downtime and physical damage, exposing the limitations of traditional rule-based monitoring in industrial IoT environments. While Large Language Models (LLMs) have strong semantic reasoning abilities to assist in decision support, their hallucinatory nature presents unacceptable safety liabilities for closed-loop control. This paper introduces a neuro-agentic control framework, a novel architecture that couples an LLM-based planner (i.e., such as Gemini 2.5 Flash-Lite) with a pre-trained Time-Series Foundation Model (TimesFM), to achieve physics-grounded autonomous defense. The paper introduces a ``Counterfactual Physics Injection'' mechanism that simulates the impact of LLM-proposed interventions within the numerical latent space of the foundation model before actuation, while allowing the system to reject hallucinatory or unsafe actions. Evaluated on an industrial dataset (e.g., the Secure Water Treatment (SWaT)) in the context of stochastic attack scenarios, the framework exhibited better performance compared to LSTM and TCN baselines. The Neuro-Agentic Loop prevented five breaches (33.3%) below the threshold versus LSTM (26.7%) and TCN (13.3%), with zero physically invalid (hallucinated) actions executed. These results demonstrate the efficacy of using foundation models as deterministic ``Sentinels'' to safeguard agentic AI in critical infrastructure.
Summary
The Neuro-Agentic Control framework addresses the safety risks of deploying large language models directly in closed-loop control of industrial IoT systems. Traditional rule-based monitors struggle with the scale and stochastic nature of cyberattacks on operational technology, while LLMs offer semantic reasoning for threat response but remain prone to hallucinations that could trigger unsafe actuator commands. The architecture therefore pairs an LLM planner, instantiated with Gemini 2.5 Flash-Lite, with the pre-trained TimesFM time-series foundation model to separate high-level decision generation from physics-grounded validation.
A central component is the Counterfactual Physics Injection mechanism. Rather than fine-tuning TimesFM, the system injects each LLM-proposed control action as a cumulative linear perturbation into the recent historical window of multivariate sensor data. TimesFM then forecasts the resulting system trajectory, allowing the framework to evaluate whether the intervention would keep critical variables, such as tank level LIT301 in the SWaT testbed, within safe bounds. Actions that produce unsafe or inconsistent forecasts are rejected before any physical actuation occurs, providing a deterministic safeguard that the authors term a “Sentinel” layer.
Evaluations on the public Secure Water Treatment (SWaT) dataset under multiple injected attack patterns show measurable gains over LSTM and TCN baselines. The Neuro-Agentic Loop prevented five breaches below threshold (33.3 percent success) compared with 26.7 percent for LSTM and 13.3 percent for TCN, while executing zero physically invalid actions. These outcomes indicate that coupling semantic planning with a frozen time-series foundation model can reduce both breach incidence and hallucination exposure in safety-critical cyber-physical environments without requiring online model updates.
Why it matters
Provides novel, technically rigorous methods for safe agentic AI in critical infrastructure that Dutch researchers and advanced practitioners can directly apply or extend, especially under EU AI Act safety requirements.
