In self-adaptive software systems, the role of context is paramount, especially for proactive self-adaptation. Current research, however, does not fully explore context's impact, for example on priorities of the requirements. To address this gap, we introduce a novel contextual goal model to capture these factors and their influence on the system. Using this, we propose a two-layer control mechanism with a context-aware model predictive control to achieve proactive adaptation for the software system and adaptation for the controller itself. By contextual prediction and a more accurate system model, our approach utilizes model predictive control to facilitate timely and efficient system adaptations, improving both performance and adaptability. Meanwhile, we perform requirement adaptation to update the contextual goal model, which in turn updates the objective function and constraints of the controller. Our experimental evaluations across two scenarios demonstrate the significant benefits of our approach in enhancing system performance.

Abstract Federated Learning (FL) enables multiple clients to collaboratively train a shared model without exposing local data, making it a fundamental paradigm for large-scale distributed intelligence. However, in practical edge-cloud deployments, the server must inspect a large volume of high-dimensional client updates within tight communication windows, which makes secure aggregation a problem closely tied to parallel processing, real-time response, and high-performance computing (HPC) resources. Among the major threats to FL, backdoor attacks are particularly insidious because they implant malicious behaviors into the global model while preserving benign-task performance. Although pre-aggregation defenses based on gradient analysis are promising, the current state-of-the-art methods such as Scope suffer from two key limitations: fixed parameters are ineffective against adaptive attackers, and single-point clustering is vulnerable to failure under heterogeneous (non-IID) data distributions. To address these limitations, we propose FAROS, a robust and HPC-friendly defense framework that generalizes the transform-and-cluster paradigm. FAROS incorporates two key components: Adaptive Differential Scaling (ADS), which dynamically adjusts defense sensitivity according to the dispersion of client gradients, and Robust Core-set Computing (RCC), which replaces single-point clustering with a consensus-based centroid derived from a stable core-set. This design improves robustness while preserving server-side efficiency through vectorizable similarity computation and parallelizable filtering. Extensive experiments on multiple datasets, models, and attack settings show that FAROS consistently outperforms existing defenses in both attack suppression and benign-task accuracy, while remaining compatible with scalable distributed FL infrastructures.

Multi-agent path finding (MAPF) is a safety-critical scenario where the goal is to secure collision-free trajectories from initial to desired locations. However, due to system complexity and uncertainty, integrating learning-based controllers with MAPF is challenging and cannot theoretically guarantee the safety of the learned controllers. In response, our study proposes a verified safe multi-agent neural control (VSMANC) approach for MAPF, focusing on the unified training of Decentralized Control Barrier Functions (DCBF) and controllers to enhence safety. VSMANC enables all agents to concurrently learn controllers and DCBFs using a unified loss function designed to maximize safety, adhere to standard control policies, and incorporate path-finding-related heuristics. We also propose a formal verification-guided retraining process to both verify the properties of the learned DCBFs and generate counterexamples for retraining, thereby providing a verified safety guarantee. We validate our approach through shape formation experiments and UAV simulations, demonstrating significant improvements in safety and effectiveness in complex multi-agent environments.

With the rapid growth of open-source ecosystems (e.g., Linux) and domain-specific software projects (e.g., aerospace), efficient management of reusable artifacts is becoming increasingly crucial for software reuse. The multi-level feature tree enables semantic management based on functionality and supports requirements-driven artifact selection. However, constructing such a tree heavily relies on domain expertise, which is time-consuming and labor-intensive.To address this issue, this paper proposes an automatic multilevel feature tree construction framework named FTBUILDER, which consists of three stages. ❶ It automatically crawls domain-specific software repositories and merges their metadata to construct a structured artifact library. ❷ It employs clustering algorithms to identify a set of artifacts with common features. ❸ It constructs a prompt and uses LLMs to summarize their common features. FTBUILDER recursively applies the identification and summarization stages to construct a multi-level feature tree from the bottom up. To validate FTBUILDER, we conduct experiments from multiple aspects (e.g., tree quality and time cost) using the Linux distribution ecosystem. Specifically, we first simultaneously develop and evaluate 24 alternative solutions in the FTBUILDER. Then we construct a three-level feature tree using the best solution among them. Compared to the official feature tree, our tree exhibits higher quality, with a 9% improvement in the silhouette coefficient and an 11% increase in GValue. Furthermore, it can save developers more time in selecting artifacts by 26% and improve the accuracy of artifact recommendations with GPT-4 by 235%. FTBUILDER can be extended to other open-source software communities and domain-specific industrial enterprises.1

Reusing third-party software packages is a common practice in software development. As the scale and complexity of open-source software (OSS) projects continue to grow (e.g., Linux distributions), the number of reused third-party packages has significantly increased. Therefore, effective package management is essential for the development and evolution of the OSS project. To achieve this, a package-to-group mechanism (P2G) is used to enable the unified installation, uninstallation, and updates of multiple packages at once. To better understand the mechanism, this paper takes Linux distributions as a case study and presents an empirical study focusing on its application trends, evolution patterns, group quality, and group tendency. By analyzing 11,746 groups and 193,548 packages from 89 versions of 5 popular Linux distributions and conducting questionnaire surveys with Linux practitioners and researchers, we derive several key insights. Our findings show that P2G is increasingly being adopted, particularly in popular Linux distributions. P2G follows six evolutionary patterns (e.g., splitting and merging groups). Interestingly, packages no longer managed through P2G are more likely to remain in Linux distributions rather than being directly removed. In addition, we propose a metric called GValue to evaluate the quality of groups and identify issues such as inadequate group descriptions and insufficient group sizes. We also summarize five types of packages that tend to adopt P2G, including graphical desktops and networks. To our knowledge, this is the first study to focus on P2G mechanisms. We hope that our study can assist in the efficient management of packages and reduce the burden on practitioners in the rapidly growing Linux distributions and other open-source software projects.

Correct behavior of flight software against its requirements is a prime concern spanning its design, implementation, and operation. The emergence of “New Space” presents new challenges associated with small-scale missions which often involve open software frameworks, are developed by diverse teams, and employ rapid development methodologies which may not enjoy the rigorous quality assurance that institutional missions do. Hence, there is an overarching need to incor-porate contemporary engineering techniques and methods for checking requirement satisfaction for such flight software. To this end, this paper proposes GOP RIM E, designed to integrate goal monitoring within F’, a renowned software development framework developed by the Jet Propulsion Laboratory for embedded and spaceflight systems. GOPRIME consists of three phases: (i) a design phase, where annotations are used to align system-level objectives with architectural components; (ii) an implementation phase, where code generation tailored for the DSL of F’ is used to seamlessly automate the integration of goal monitoring functionality, and (iii) the operational phase, where the runtime state of annotated components is monitored, enabling evaluation of satisfaction of the overall goal model. We assess the development and operation overheads of instrumenting runtime goal monitoring over a characteristic case of a miniaturized satellite application.

Security attacks present unique challenges to the design of self-adaptation mechanism for software-intensive systems due to the adversarial nature of the environment. Game-theoretical approaches have been explored in security to model malicious behaviors and design reliable defense for the system in a mathematically grounded manner. However, modeling the system as a single player, as done in prior works, is insufficient for the system under partial compromise and for the design of fine-grained defensive policies where the rest of the system with autonomy can cooperate to mitigate the impact of attacks. To address such issues, we propose a new self-adaptation framework incorporating Bayesian game theory and model the defender (i.e., the system) at the granularity of components. Under security attacks, the architecture model of the system is automatically translated, by the proposed translation process with designed algorithms, into a multi-player Bayesian game. This representation allows each component to be modeled as an independent player, while security attacks are encoded as variant types for the components. By solving for pure equilibrium (i.e., adaptation response), the system’s optimal defensive strategy is dynamically computed, enhancing system resilience against security attacks by maximizing system utility. We validate the effectiveness of our framework through two sets of experiments using generic benchmark tasks tailored for the security domain. Additionally, we exemplify the practical application of our approach through a real-world implementation in the Secure Water Treatment System to demonstrate the applicability and potency in mitigating security risks.

Self-adaptive systems (SASs) are designed to handle changes and uncertainties through a feedback loop with four core functionalities: monitoring, analyzing, planning, and execution. Recently, generative artificial intelligence (GenAI), especially the area of large language models, has shown impressive performance in data comprehension and logical reasoning. These capabilities are highly aligned with the functionalities required in SASs, suggesting a strong potential to employ GenAI to enhance SASs. However, the specific benefits and challenges of employing GenAI in SASs remain unclear. Yet, providing a comprehensive understanding of these benefits and challenges is complex due to several reasons: limited publications in the SAS field, the technological and application diversity within SASs, and the rapid evolution of GenAI technologies. To that end, this article aims to provide researchers and practitioners a comprehensive snapshot that outlines the potential benefits and challenges of employing GenAI’s within SAS. Specifically, we gather, filter, and analyze literature from four distinct research fields and organize them into two main categories to potential benefits: (i) enhancements to the autonomy of SASs centered around the specific functions of the MAPE-K feedback loop, and (ii) improvements in the interaction between humans and SASs within human-on-the-loop settings. From our study, we outline a research roadmap that highlights the challenges of integrating GenAI into SASs. The roadmap starts with outlining key research challenges that need to be tackled to exploit the potential for applying GenAI in the field of SAS. The roadmap concludes with a practical reflection, elaborating on current shortcomings of GenAI and proposing possible mitigation strategies. †

Decision making in self-adaptive systems often involves trade-offs between multiple quality attributes, with user preferences that indicate the relative importance and priorities among the attributes. However, eliciting such preferences accurately from users is a difficult task, as they may find it challenging to specify their preference in a precise, mathematical form. Instead, they may have an easier time expressing their displeasure when the system does not exhibit behaviors that satisfy their internal preferences. Furthermore, the user’s preference may change over time depending on the environmental context; thus, the system may be required to continuously adapt its behavior to satisfy this change in preference. However, existing self-adaptive frameworks do not explicitly consider dynamic human preference as one of the sources of uncertainty. In this paper, we propose a new adaptation framework that is specifically designed to support self-adaptation to user preference. Our framework takes a human-on-the-loop approach where the user is given an ability to intervene and indicate dissatisfaction and corrections with the current behavior of the system; in such a scenario, the system automatically updates the existing preference values so that the new, resulting behavior of the system is consistent with the user’s notion of satisfactory behavior. To perform this adaptation, we propose a novel similarity analysis to produce changes in the preference that are optimal with respect to the system utility. We illustrate our approach in a case study involving a delivery robot system. Our preliminary results indicate that our approach can effectively adapt its behavior to changing human preference.

Many self-adaptive systems benefit from human involvement and oversight, where a human operator can provide expertise not available to the system and detect problems that the system is unaware of. One way of achieving this synergy is by placing the human operator on the loop —i.e., providing supervisory oversight and intervening in the case of questionable adaptation decisions. To make such interaction effective, an explanation can play an important role in allowing the human operator to understand why the system is making certain decisions and improve the level of knowledge that the operator has about the system. This, in turn, may improve the operator’s capability to intervene and, if necessary, override the decisions being made by the system. However, explanations may incur costs, in terms of delay in actions and the possibility that a human may make a bad judgment. Hence, it is not always obvious whether an explanation will improve overall utility and, if so, then what kind of explanation should be provided to the operator. In this work, we define a formal framework for reasoning about explanations of adaptive system behaviors and the conditions under which they are warranted. Specifically, we characterize explanations in terms of explanation content , effect , and cost . We then present a dynamic system adaptation approach that leverages a probabilistic reasoning technique to determine when an explanation should be used to improve overall system utility. We evaluate our explanation framework in the context of a realistic industrial control system with adaptive behaviors.

Abstract Security attacks present unique challenges to self-adaptive system design due to the adversarial nature of the environment. Game theory approaches have been explored in security to model malicious behaviors and design reliable defense for the system in a mathematically grounded manner. However, modeling the system as a single player, as done in prior works, is insufficient for the system under partial compromise and for the design of fine-grained defensive strategies where the rest of the system with autonomy can cooperate to mitigate the impact of attacks. To deal with such issues, we propose a new self-adaptive framework incorporating Bayesian game theory and model the defender (i.e., the system) at the granularity ofcomponents. Under security attacks, the architecture model of the system is translated into aBayesian multi-player game, where each component is explicitly modeled as an independent player while security attacks are encoded as variant types for the components. The optimal defensive strategy for the system is dynamically computed by solving the pure equilibrium (i.e., adaptation response) to achieve the best possible system utility, improving the resiliency of the system against security attacks. We illustrate our approach using an example involving load balancing and a case study on inter-domain routing.

Systematic model-driven design and early validation enable engineers to verify that a reactive system does not violate its requirements before actually implementing it. Requirements may come from multiple stakeholders, who are often concerned with different facets - design typically involves different experts having different concerns and views of the system. Engineers start from a specification which may be sourced from some domain model, while validation is often done on state-transition structures that support model checking. Two computationally expensive steps may work against scalability: transformation from specification to state-transition structures, and model checking. We propose a technique that makes the former efficient and also makes the resulting transition systems small enough to be efficiently verified. The technique automatically projects the specification into submodels depending on a property sought to be evaluated, which captures some stakeholder's viewpoint. The resulting reactive system submodel is then transformed into a state-transition structure and verified. The technique achieves cone-of-influence reduction, by slicing at the specification model level. Submodels are analysis-equivalent to the corresponding full model. If stakeholders propose a change to a submodel based on their own view, changes are automatically propagated to the specification model and other views affected. Automated reflection is achieved thanks to bidirectional model transformations, ensuring correctness. We cast our proposal in the context of graph-based reactive systems whose dynamics is described by rewriting rules. We demonstrate our view-based framework in practice on a case study within cyber-physical systems.

Comprehensive privacy mechanisms are essential in the pervasive internet-of-things systems of today, which are comprised of multiple distributed devices and diverse software stacks, while located in different legal or administrative domains. In such systems, often consisting of resource-constrained devices, guarantees of correctness and conformance to privacy policies is required, while data need to be synchronized among different software components. Motivated by the "data protection by design and by default" principle, we propose a technical framework to support data synchronization among edge components tailored for pervasive IoT applications. Our privacy-driven synchronization approach is based on a generically applicable privacy model and able to capture roles and permissions, actions on data, conditions and obligations that arise in privacy requirements. For automated and correct reflection of synchronized data among components, we adopt bidirectional transformations, a mechanism where synchronization between models, consistency, and well-behavedness are formally guaranteed. Thus, automatically generated privacy-aware data transformations are correct by construction. We evaluate POET, our framework and accompanying tool with a case study on medical information privacy and demonstrate its performance in resource-constrained edge devices.

The development of self-adaptive software has attracted a lot of attention. Decentralization is an effective way to manage the complexity of modern self-adaptive software systems. However, there are still tremendous challenges remained in decentralized self-adaptive systems. One major challenge is to guarantee the achievements of both local goals and global goals. Another challenge is to ensure the performance of the systems operating in highly dynamic environments with existence of internal changes. To solve these problems, we introduce an integrated system framework combining self-adaptive mechanisms with decentralization features, with a formal modeling method based on stochastic timed automata to allow the system to be analyzed and verified. Timed computational tree logic is used to specify the system properties and then stochastic simulations in a dynamic environment are conducted to study system performance. The whole approach is illustrated and evaluated with a motivation example from practical applications in UAV emergency mission scenarios.