Study: local, secure, reliable agents for engineering design

Human-in-the-loop CAD change agents, measured locally

Which agent architecture can safely change aircraft structural parts from natural-language engineering change requests, using only local LLMs? Three designs compared on 36 change requests and 24 attacks, with every proposal gated by a reviewer. All numbers below are measured on one (no cloud).

Code on GitHub - MIT licence - Pavan Yadav Annappa

Architecture

Change requestuntrusted text Part notes (PLM)untrusted metadata Local LLM (Ollama)A: CadQuery scriptB/C: JSON parameter patch Security layer + checker deny-by-default tool policyschema validation (B/C) AST allowlist + no-network sandbox (A)output path jail trusted CadQuery builddesign rules on real geometryhash-chained audit log Reviewerdiff: params,mass, e/D, SVGapprove / reject MergeSTEP + SVG C only: rule failures fed back, max 3 rounds rejection reason back to the agent (max 3 reviews)

Headline numbers

Change requests: autonomous vs. human-in-the-loop

Task success = first proposal meets every acceptance criterion and design rule and touches nothing else (or refuses an infeasible request). "Wrong merges" are first proposals that pass the automatic rule gate but are still wrong; only the reviewer catches them.

Security: attack success rate

The same model reply is evaluated with the security layer off and on. With a reviewer gate, tools only run after approval, but in approach A the generated code must run before the reviewer can see the geometry.

Per attack case

Latency on the local GPU

Before / after renders from real runs

Left: baseline part. Right: the revision the reviewer approved (exported by the run named under each pair).

Replay of real review sessions

Logged sessions in which the reviewer rejected at least once. Step through the rounds.

Benchmark

36 engineering change requests over 4 parametric parts (wing rib, L-bracket, stringer clip, lug fitting), 9 of them infeasible on purpose. The benchmark is self-checked without an LLM:

Limits

  • The reviewer in the evaluation is a scripted oracle that knows the acceptance criteria. Real reviewers are slower and miss things; review counts are a lower bound on effort.
  • Parts are simplified parametric models with a small rule set (thickness, e/D, pitch, ligament, mass, envelope). No FEA, no certification rules.
  • Attack side effects with defences off are recorded by instrumented stubs and a host safety net; "success" means the agent made the call, not that the host was changed.
  • Temperature 0: seeds change little. Rates come with Wilson 95% intervals, small n per cell.
  • Prompt-level defences (spotlighting, instruction hierarchy) were not tested; only execution-layer defences were.