Trust at the Intelligent Edge Rethinking Security for Edge AI

As edge AI systems become increasingly autonomous, security becomes a prerequisite for safety. End-to-end chains of trust are necessary to efficiently protect models, data, and runtime environments.

Artificial intelligence is increasingly shifting from centralized data centers to edge devices, where processing takes place directly on local hardware rather than on remote servers. These “edge-first” AI systems—such as processors (CPUs) in vehicles and electric cars, or neural processors (NPUs) in IP cameras and drones—are being used more and more frequently to execute real-time, safety-critical decisions and actions during operation.

Whether on a factory floor, in a vehicle, or in an operating room: AI security is crucial for ensuring the integrity and resilience of the decisions made by these automated systems. As edge AI systems become increasingly autonomous, it is becoming clear that security is a prerequisite for safety: a system cannot be considered safe unless it is also protected against attacks. Otherwise, an AI agent with the ability to take real-world actions could become a dangerous and uncontrollable adversary.

At the same time, a tension is emerging between the rapid proliferation of AI and the maturity of available security solutions. AI is already becoming ubiquitous, even in highly resource-constrained embedded systems such as hearing aids. Nevertheless, many of these AI applications are not developed according to “secure by design” principles. This challenge is exacerbated by the rise of AI agents and physical AI systems that operate with increasing autonomy, speed, and scale.

If security, safety, and data protection do not keep pace now, there is a risk that insecure implementations will become permanently entrenched in society. This will create a legacy problem that will be difficult—if not impossible—to resolve in the future.

A Rapidly Changing Threat Landscape

Edge AI enables inference and data processing close to the data source and the end user. This shortens response times, enables real-time decision-making, and reduces dependence on central data centers. At the same time, this improves data privacy, as sensitive data remains on the device and does not need to be transferred to the cloud—or only to a limited extent. However, this also gives rise to new security risks.

Traditional cybersecurity focuses primarily on protecting data on networks and servers. With AI, attackers are now also targeting the models themselves, the execution environment, embedded devices, and the data.

As a result, the threat landscape extends well beyond traditional IT risks.

With edge AI, the situation changes once again. Devices are physically accessible to attackers and are therefore more vulnerable to tampering. At the same time, they are more tightly encapsulated. While cloud-based AI applications centrally manage training, storage, and access to large amounts of data—thereby creating particularly attractive targets for attacks—edge systems operate differently.

Simply put, attacks on individual edge systems usually have a more limited scope, while successful cloud attacks can cause significantly greater overall damage. For security reasons, therefore, a locally operated edge AI infrastructure that is consistently isolated from external networks—or an architecture with strictly controlled gateways—remains an attractive option. Nevertheless, risks still exist.

Security threats to AI systems can be divided into two broad categories. First, there are traditional IT attacks that target valuable data (such as the AI model) or aim to cripple a service. These threats are generally well understood. Second, there are AI-specific attacks, including prompt injection, model distillation, model inversion, membership inference, backdoors in the training data, and manipulated input data that can force misclassifications or incorrect decisions. These attacks exploit specific characteristics of AI systems and require new, specialized protective measures.

Since proprietary AI models often embody training data and expertise worth millions, successful attacks can destroy competitive advantages, compromise security, and undermine trust in the system. The situation becomes particularly critical when attackers can deliberately alter a model’s behavior in the field. That is why it is essential for AI systems to follow the “security by design” principle and integrate appropriate protective mechanisms from the very beginning.

This includes measures to safeguard device integrity, such as ensuring that only authorized software or authorized AI models are executed, that updates are trustworthy, and that AI systems comply with regulatory requirements such as the EU AI Act or the Cyber Resilience Act (CRA).

Equally important is the protection of data access. Legitimate access for AI applications must be enabled without creating new vulnerabilities. A secure implementation begins with an end-to-end chain of trust consisting of secure boot code, verified firmware, and runtime isolation. Furthermore, post-quantum cryptography (PQC) is increasingly becoming a central element of modern cybersecurity, as we must prepare today for a future in which quantum computers will be able to break traditional public-key methods.

Building Blocks for an End-to-End Chain of Trust

A robust defense architecture implements protective mechanisms at all levels of the system—that is, in hardware, firmware, and software—and begins with secure provisioning and storage. The AI model remains encrypted during storage and is decrypted only when it needs to be executed. Real-time memory encryption mechanisms protect the system memory during this process.

Equally important is isolation during runtime. Resource Domain Controllers, TrustZone partitions, and secure subsystems isolate processing areas from one another, preventing malware from spying on internal activations or manipulating computations. Together, these mechanisms ensure that the correct model runs on authentic hardware and that the results remain unaltered.

However, model integrity is only part of the overall challenge. Edge AI often processes personal and highly sensitive data, including medical information or confidential corporate and government data. Technologies such as Fully Homomorphic Encryption (FHE) and Secure Multi-Party Computation (MPC) make it possible to offload AI processing to external infrastructures, such as the cloud, without exposing the underlying data. This allows models to be trained and deployed on significantly larger sets of privacy-sensitive information, which both improves model quality and opens up new use cases.

High-Quality AI without Compromising on Security

Edge AI must operate locally under strict resource constraints, ranging from wearables and sensors to robots and vehicles. Computing power, memory, and connectivity are often limited in these scenarios.

With the increasing prevalence of neural processing units (NPUs), these edge nodes also require specialized security measures. Here, experience gained from securing cryptographic accelerators can be leveraged, for example through randomized execution or integrity checks of SRAM memory.

This approach is consistent with regulatory and industry frameworks such as the EU AI Act, the NIST AI Risk Management Framework (AI RMF), and guidelines from the medical and automotive sectors. Systems with potentially safety-critical implications must be demonstrably secure and resilient, especially when they process sensitive data.

To achieve this goal more quickly, semiconductor manufacturers, tool providers, model developers, regulatory agencies, and system integrators should develop shared best practices, reference architectures, and certification profiles. A similar collaborative approach has already accelerated functional safety in the automotive sector, reduced audit efforts, and sped up the time to market for new products. For edge AI products, “time-to-solution” is a critical success factor. Therefore, “security by design” must keep pace with the speed of AI development, from the first demonstrator to large-scale deployment.

The Goal: Robust, Safe, and High-Performance Autonomy

Local data processing via edge AI inference reduces latency, bandwidth costs, and potential points of vulnerability. In fact, local processing may be the only way to handle the enormous volume of data in the future: By 2028, edge systems are projected to generate approximately 394 zettabytes of data per year. A single zettabyte is roughly equivalent to one billion hard drives, each with 1 terabyte of storage capacity.

Edge AI represents the biggest architectural shift since the advent of cloud computing. However, trust is not an option here—it is a prerequisite for success. From secure boot ROMs to encrypted and securely provisioned models to post-quantum keys, the necessary technologies are already available today to protect models, code, and data end-to-end—whether they involve vision AI, speech AI, large language models, or autonomous agents.

The challenge now lies in widespread implementation: Edge systems must be designed with security, data protection, and safety in mind from the very beginning. At the same time, there is a need for common standards and an ecosystem in which every stakeholder can verify that all components are functioning as intended. 

*Joppe Bos is a cryptographer and Technical Director at NXP Semiconductors
*Davis Sawyer is the AI Product Marketing Manager at NXP Semiconductors