Neuro-Agentic Control Achieves 33.3% Breach Prevention on SWaT with Zero Invalid Actions

The architecture inserts a Counterfactual Physics Injection step that evaluates each LLM-proposed intervention inside the TimesFM latent space before any control signal reaches actuators. This produces a deterministic filter that discards unsafe or physically inconsistent plans generated by the agentic LLM component. On the Secure Water Treatment testbed the loop executed zero invalid commands across the evaluated attack scenarios.

SWaT results show the neuro-agentic loop prevented breaches below threshold in 33.3 percent of cases versus 26.7 percent for LSTM and 13.3 percent for TCN baselines. No physically invalid actions reached actuation, confirming the sentinel mechanism eliminated the hallucination risk that otherwise precludes closed-loop LLM deployment in OT. The performance delta arises directly from the physics-grounded rejection step rather than from improved planning alone.

Enterprise OT environments currently lack governance mechanisms that treat agentic controllers as first-class control elements subject to pre-actuation validation. Existing rule-based monitors and anomaly detectors do not address semantic proposals from LLMs that could drive physical state outside safe envelopes. The reported zero-invalid result indicates that foundation-model sentinels can close this gap, yet no standard audit framework or certification path exists for such hybrid stacks.

Operational rollout requires explicit integration of TimesFM-style numerical models into every agentic security pipeline and mandatory counterfactual checks before any set-point change. Without these controls, scaling agentic LLMs into ICS and critical infrastructure will reintroduce the exact safety liabilities the paper isolates.