Nicolò Romandini

Multi‐agent systems (MAS)—a uniquely important subset of the wider field commonly called “Agentic AI”—enable complex work processes involving distributed networks of multiple AIs, people, and technology tools. However, they also carry big risks. Root causes of catastrophic safety failures in multi‐agent collaboration (as in human collaboration) can be classed into three overlapping categories: 1. Deliberative —deviating from shared MAS commitments to fulfill explicitly expressed joint intentions; 2. Performative —inability to coordinate well or to adapt to changing circumstances; and 3. Infrastructural —safety, reliability, and trust in the operating environment. In the spirit of the international Multi‐Agent System Safety and Teamwork (MASST) initiative (Bradshaw et al., 2026), our multi‐disciplinary research team seeks to tackle the root causes of these three challenges through development, experimentation, and deployment of an integrated multi‐layered safety pipeline, enabling “safety in numbers” as increasingly powerful multi‐agent systems are deployed. Although this proposal is merely an initial sketch, it is our hope that sharing these ideas will inspire others to contribute to the discussion as we continue moving forward. We look forward not only to exciting discoveries within laboratory settings while also being committed to improving safe rollout of large‐scale MAS into the world to perform work in high‐consequence applications.

Agentic AI systems are increasingly capable of autonomous decision‐making and collaboration across distributed environments. However, existing frameworks largely assume trust among agents, without providing mechanisms for verifiable identity, behavioral accountability, or interaction transparency. This work proposes a blockchain‐based backbone infrastructure that enables a verifiable trust layer for autonomous multi‐agent systems. Agent identities are bound to decentralized identifiers (DIDs) registered on‐chain, while an on‐chain Agent Registry enables reputation‐aware capability discovery. By integrating smart contracts, DIDs, and verifiable credentials (VCs), the framework ensures that trust is not assumed but earned through interactions: agents issue VC endorsements after each task, and dedicated smart contracts automatically update reputation scores, applying incentives and penalties accordingly. Blockchain provides immutability, transparency, and programmability, transforming trust from an implicit assumption into an explicit, auditable, and enforceable property of the multi‐agent ecosystem.

Mobile Edge Computing (MEC) facilitates low-latency service delivery by bringing computation to the network edge, while microservice architectures enhance system flexibility and scalability through modular application decomposition. Their integration allows applications to dynamically scale and efficiently isolate faults in response to fluctuating demand. However, the heterogeneous and dynamic nature of edge environments poses significant challenges to the cost efficiency, security, and privacy of such deployments. Unlike prior work that handle security and privacy as constraints or overlook AN dynamics, we characterize both AN selection and service placement as mutually dependent decision layers within a unified control structure. Our proposal balances the computational overheads incurred by security and privacy verification against deployment costs, preventing aggressive cost-reduction efforts from compromising system protections. Considering the unpredictability of run-time and network conditions, we propose an online algorithm for progressive decision-making. The deployment problem is decomposed into one-slot optimization sub-problems, each NP-hard, for which we develop a greedy-based heuristic algorithm. Experiments across diverse loads, request patterns, and security/privacy thresholds show that the proposed algorithm consistently achieves the lowest average deployment cost, with cost reductions of at least 41.67% compared with the baselines, while maintaining comparable or higher request acceptance ratios and generally lower, well-balanced edge-server workloads.

In Federated Learning (FL) clients collaboratively train a Machine Learning (ML) model by sharing updates computed over their private data. These updates are aggregated to form a global model, which requires clients to trust the central server. However, clients have no direct means to verify whether their updates were incorporated into the global model. This lack of transparency raises challenges that may discourage participation in the federation. For instance, a malicious server might exclude legitimate clients to deny them rewards or recognition. Even in benign scenarios, updates may be disregarded due to network failures or predefined aggregation conditions (e.g., a quorum). This highlights the need for mechanisms that let clients independently verify their inclusion. To this specific purpose, we propose a novel approach called Membership Proof in Federated Learning (MPFL), which enables client-side verifiability of participation. In MPFL, model updates are aggregated via a smart contract, which also generates a unique cryptographic proof of participation for each update by using cryptographic accumulators. By leveraging blockchain and smart contracts, our approach enhances system trustworthiness, while cryptographic proofs provide an efficient and privacy-preserving method for clients to verify inclusion. In addition, the paper reports on how we have implemented MPFL and extensively evaluated it across three diverse datasets and ML architectures, thus demonstrating its effectiveness and practical viability.

Federated learning (FL) enables collaborative training of a machine learning (ML) model across multiple parties, facilitating the preservation of users’ and institutions’ privacy by maintaining data stored locally. Instead of centralizing raw data, FL exchanges locally refined model parameters to build a global model incrementally. While FL is more compliant with emerging regulations such as the European General Data Protection Regulation (GDPR), ensuring the right to be forgotten in this context—allowing FL participants to remove their data contributions from the learned model—remains unclear. In addition, it is recognized that malicious clients may inject backdoors into the global model through updates, e.g., to generate mispredictions on specially crafted data examples. Consequently, there is the need for mechanisms that can guarantee individuals the possibility to remove their data and erase malicious contributions even after aggregation, without compromising the already acquired “good” knowledge. This highlights the necessity for novel federated unlearning (FU) algorithms, which can efficiently remove specific clients’ contributions without full model retraining. This article provides background concepts, empirical evidence, and practical guidelines to design/implement efficient FU schemes. This study includes a detailed analysis of the metrics for evaluating unlearning in FL and presents an in-depth literature review categorizing state-of-the-art FU contributions under a novel taxonomy. Finally, we outline the most relevant and still open technical challenges, by identifying the most promising research directions in the field.

The increasing availability of data generated by Internet of Things (IoT) and Industrial Internet of Things (IIoT) devices, as well as privacy and law regulations, have significantly boosted the interest in collaborative machine learning (ML) approaches. In this direction, we claim federated learning (FL) as a promising ML paradigm where participants collaboratively train a global model without outsourcing on-premises data. However, setting up and using FL can be extremely costly and time-consuming. To effectively promote the adoption of FL in real-world scenarios, while limiting the overhead and knowledge of the underlying technology, service providers should offer federated learning as a service (FLaaS). One of the major concerns while designing an architecture that provides FLaaS is achieving trustworthiness among involved typically unknown participants. This article presents a blockchain-based architecture that achieves Trustworthy federated learning as a service (TruFLaaS). Our solution provides trustworthiness among 3rd-party organizations by leveraging blockchain, smart contracts, and a decentralized oracle network. Specifically, during each FL round, the service provider supplies a sample, without overlapping, of its validation set to validate all partial models submitted by clients. By doing so, poor models, which tend to degrade performance or introduce malicious backdoors, are identified and discarded. Due to the transparency of the blockchain, not changing the validation set would enable participants to forge a malicious partial model that passes the validation phase. We evaluate our approach over two well-known IIoT datasets: the reported experimental results show that TruFLaaS outperforms the state-of-the-art literature solutions in the field.

The recent widespread novel network technologies for programming data planes are remarkably enhancing the customization of data packet processing. In this direction, the Programming Protocol-independent Packet Processors (P4) is envisioned as a disruptive technology, capable of configuring network devices in a highly customizable way. P4 enables network devices to adapt their behaviors to mitigate malicious attacks (e.g., denial of service). Distributed ledger technologies (DLTs), such as blockchain, allow secure reporting alerts on malicious actions detected across different areas. However, the blockchain suffers from major scalability concerns due to the consensus protocols needed to agree on a global state of the network. To overcome these limitations, new solutions have recently emerged. IOTA is a next-generation distributed ledger engineered to tackle the scalability limits while still providing the same security capabilities such as immutability, traceability, and transparency. This article proposes an architecture that integrates a P4-based data plane software-defined network (SDN) and an IOTA layer employed to notify about networking attacks. Specifically, we propose a fast, secure, and energy-efficient DLT-enabled architecture that combines the IOTA data structure, named Tangle, with the SDN layer to detect and notify about network threats.

Modern healthcare systems operate in highly dynamic environments requiring adaptable access control mechanisms. Access to sensitive data and medical equipment should be granted or denied according to the current health situation of the patient. To handle the need for adaptable access control of healthcare scenarios, we propose a novel model that allows dynamic access control decisions based on the context characterizing the source, type of access request, patient, and estimated risk corresponding to the conditions of the patient. Estimating patient status risk requires analyzing vital physiological data whose availability is growing, thanks to the widespread diffusion of the Internet of Medical Things (IoMT) devices. Inferring the patient health status risk through machine learning (ML) techniques is possible, but to achieve better accuracy, the training phase requires the aggregation of vast amounts of data from different sources. This aggregation could be difficult or even impossible due to organization regulations and privacy laws. To address these issues, this article proposes a novel federated learning risk-based authorization middleware for healthcare (FRAMH) that supports risk-based access control to deal with changing and unforeseen medical situations. Our solution infers the risk of health status through a federated learning (FL) approach enriched with blockchain to avoid the weaknesses of centralized servers. The implemented prototype and a large set of experimental results demonstrate the advantages of FL in estimating the risk in healthcare scenarios. Through this approach, even a medical institution with a limited dataset can achieve a satisfying risk estimation and efficient access control enforcement.