Electronic warfare has made GPS unreliable in the exact places autonomous drones now earn their keep: contested airspace, mining pits, tunnels, urban canyons. The reflex across the industry is to make the estimator better. Add visual-inertial odometry, couple it tighter, buy a smarter backend. That race is worth running, but it answers the wrong question. In GPS-denied airspace the failure that flies a drone into a wall is rarely a slightly-worse position. It is a confident-but-wrong one, and a better estimator does not remove it, because "can I trust this position right now?" is a different question than "what is this position?"
We built Lodestar, a navigation integrity engine for GPS-denied drone navigation, around that second question. You can run the demo yourself at veriprajna.com/demos/gps-denied-drone-autonomy. It does keep an accurate position through a jamming bubble. But the part we think is durable is the part that decides, deterministically, whether that position can be trusted at all, and fails safe when it can't.
Seconds after GPS is denied inside the R-330Zh jamming bubble (t=21 s), integrity holds GREEN and our drift reads 0.41 m. The EKF handed off to vision with no operator-visible mode change.
The failure mode nobody instruments
Bolt-on VIO fails in two ways, and only one of them is the one people design for. It drifts, which is visible and correctable. Worse, it fails silently: it locks onto a moving object or an empty scene and reports a confident position that is simply wrong. The canonical case is the documented failure where a SLAM front-end locks onto a passing truck as if it were fixed ground and flies off. For a defense, mining, or Blue UAS buyer (Blue UAS is the U.S. Defense Innovation Unit's cleared list of NDAA-compliant drones), a confidently-wrong position is more dangerous than an honest "I don't know," because the autopilot acts on it.
We saw this cleanly when we built the demo. On one seeded synthetic mission, an 80-second flight over a 245.3 m path, a moving convoy crosses a feature-sparse clearing and sprays spurious features. Stock VIO with dynamic-feature masking off locks onto the vehicles and flies off, ending the run at 28.79% drift with an ATE of 32.95 m, worse on trajectory error than plain dead-reckoning. Our integrity-aware configuration, with semantic masking on, rejects the moving features and holds the line at roughly 0.9% drift on the same mission. Same EKF, one honest setting changed.
During the convoy beat the monitor holds AMBER on 2 usable static features (10 dynamic features masked), our track stays near 0.9% drift, and the benchmark panel shows stock VIO ending at 28.79% drift against 0.92% for ours.
Trust has to live outside the estimator
Here is the design choice the whole system turns on. The component that decides whether a position is trustworthy is separate code from the component that produces the position. It has to be. You would not let a witness certify their own testimony, and you cannot ask the machinery that generated an estimate to also rule on whether that estimate is any good.
So the Navigation Integrity Monitor sits outside the estimator and watches three signals the estimator cannot flatter: the count of usable static features, the position covariance (1-sigma), and the vision NIS, a chi-square check on whether the filter's own innovations are statistically consistent. It fuses them into one state. GREEN means fly (features at or above 8, sigma under 0.6 m, NIS under 7.0). RED means the position is not trustworthy (features below 1, sigma above 1.5 m, or NIS above 30.0). Because those thresholds are read from outside, they keep working no matter how good the VIO underneath gets.
Trust must not depend on the thing being trusted. In an autonomy stack, the most valuable line of code is the one that refuses to fly.
What honest abstention looks like when the scene goes dark
The sharpest moment in the mission is the one where the system does less, not more. Around t=52 s the flight enters a dark tunnel and usable visual features collapse toward zero. No estimator can manufacture a trustworthy position from a scene it cannot see. A stock pipeline coasts on inertial dead-reckoning and quietly keeps drawing a confident line. Lodestar does the opposite.
Feature count drops under the RED floor of one usable feature. The monitor holds RED for a sustained 0.5 s dwell, long enough to reject a momentary flicker, then latches the failsafe and commands return-to-home at t=52.5 s. It does not bluff a position. On this mission it flagged the genuinely-unobservable tunnel 100% of the time and false-alarmed on 0.1% of the healthy GPS-denied leg, so the abstention is both honest and not trigger-happy.
In the tunnel usable features hit 0 and the monitor flips RED, "position NOT trustworthy," latching return-to-home at 52.5 s rather than coasting on a confident-but-wrong fix.
That RED state is the product. Everything upstream is a race anyone can enter. A system that knows when it is blind is the rarer thing.
Why a better model doesn't retire this
It is tempting to treat integrity as a stopgap that a future, better estimator makes unnecessary. It is the reverse. A better VIO widens the GREEN band, recovers more scenes, drifts less. It never reaches the scene with no information in it, the pitch-black tunnel, the fully jammed and featureless leg, because that limit is physical, not algorithmic. As long as drones fly into places where the world stops being observable, something has to notice and abstain. That capability does not age out as models improve, which is exactly what makes it a moat rather than a feature.
There is an honest trade sitting next to this, and we show it rather than hide it. Toggle the simulated LiDAR fusion on and the same tunnel becomes observable again: integrity holds, no failsafe fires, and drift on this run falls to 0.01%. That recovery costs 250 to 400 g of payload and 8 to 12 W of power, a real SWaP-C trade the report states plainly instead of burying.
The receipt
Every run exports a Flight Integrity Report, JSON and printable HTML, in one click: the scoreboard against independently-generated ground truth, the abstention verdict, the failsafe time, the event timeline, and an explicit scope disclosure of what is stubbed versus deferred. That last section matters more than the metrics. It names, in writing, that the visual front-end and the LiDAR factor are simulated stand-ins, that the Jetson Orin NX throughput is a target-hardware spec rather than a measured figure, and that these numbers come from one seeded synthetic mission, not a flight test. For anyone running an SBIR or AFWERX-style technical review, a system honest about its own scope is easier to trust than one that isn't.
The one-click Flight Integrity Report, shown here for the LiDAR-fusion-engaged run (0.01% drift, 78.9% of the flight at GREEN), carries the scoreboard against independent ground truth, the event timeline, and a scope disclosure of what is stubbed versus deferred.
A note on what this is. Everything above is one physics-faithful, deterministic simulation, seeded for byte-for-byte reproducibility. There is no real drone, flight log, or EW emitter here; the R-330Zh is a named scenario, not a sensed signal. What it proves is the mechanism, drift control plus honest abstention plus a latched failsafe, and the architecture that makes the mechanism durable. You can run the whole thing offline at veriprajna.com/demos/gps-denied-drone-autonomy.
We keep coming back to one question for anyone building GPS-denied autonomy. When your stack loses the scene entirely, features gone, covariance blown out, does anything outside the estimator have the authority to declare the position untrustworthy and bring the aircraft home, or does the estimator get to grade its own work?