Edge AI: Security Risks of AI on IoT Devices

How edge AI works

A model is trained centrally. Then it is tuned for the target hardware, for example through quantization or pruning, and deployed to the device. There, a microcontroller, GPU or dedicated AI accelerator runs the model (inference). Typical uses include:

• camera-based quality control on the production line
• predictive maintenance based on vibration data
• access control
• voice control
• anomaly detection in network traffic

The benefits are low latency, no need for an internet link and better privacy, since raw data does not have to leave the device. For security, though, the attack surface moves. It shifts from one well-protected data center to thousands of devices spread out in the field.

Specific security risks

• Model theft and reverse engineering: If the model sits unencrypted in flash memory or inside an app package, an attacker with physical access or a firmware dump can copy it. You lose intellectual property and what you spent on training. With the model in hand, attackers can also plan targeted evasion attacks.
• Adversarial examples in the real world: Special stickers, patterns or sounds can trick an image or audio model into wrong outputs. For edge systems, the input is the real world around them. An attacker can sometimes change it directly.
• Tampering with sensor data: If someone tampers with a sensor or its wiring, every AI decision rests on bad data.
• Insecure update channels: Models and firmware are updated over the network. Without signature checks and integrity protection, an attacker can push a tampered model, for example one with a built-in backdoor.
• Side-channel attacks: With physical access, power use, timing or electromagnetic emissions can leak details about model parameters or the data being processed.
• Classic IoT weak spots: Default passwords, open debug ports such as JTAG or UART, old operating systems and missing network segmentation hit edge AI devices just like any other IoT device.
• Lack of monitoring: Unlike in the cloud, central logs are often missing. Slow tampering or a model that gets worse over time (model drift) is noticed late.

Why it matters for industry and mid-sized firms

Manufacturers in particular use edge AI in production. It is often built into machines from suppliers. A tampered quality check can let faulty parts through. A fooled access control system can let the wrong people in. Edge devices also often link operational technology (OT) and office IT. That makes them a possible way into the company network.

Safeguards

1. Inventory and ownership: Record all devices with AI functions, their model versions and makers, and who is in charge of updates.
2. Trusted boot: Secure boot makes sure only signed firmware runs. A hardware root of trust such as a TPM or secure element protects the keys.
3. Protect the model: Store models in encrypted form. Where you can, decrypt and run them only inside a trusted execution environment such as ARM TrustZone.
4. Signed updates: Sign firmware and model updates with cryptography, check the signature on the device and add rollback protection.
5. Harden the hardware: Turn off debug ports in production units, make housings tamper-proof and remove default accounts.
6. Stress-test the models: Before rollout, test models against real-world noise and adversarial examples. Add sanity checks with extra sensors.
7. Segment the network: Put edge devices in their own network segments and allow only the traffic they need.
8. Use telemetry: Collect integrity status, model version and anomalies in one place, for example in a SOC.

Regulatory context

For makers of products with digital elements, the Cyber Resilience Act (Regulation (EU) 2024/2847) is key. Its duty to report actively exploited vulnerabilities applies from September 2026. The other rules apply from December 2027.

If the AI function is a safety part of a regulated product, it may count as high-risk AI under Annex I of the EU AI Act. After the change made by the Digital Omnibus (in force since 27 July 2026), those duties apply from 2 August 2028. In industrial automation, the IEC 62443 series is an established framework.

Conclusion

Edge AI moves AI security down to the level of hardware and the supply chain. Three steps cut the risk a lot:

• keep an inventory of devices
• protect models and updates with cryptography
• keep edge devices apart from the rest of the network

SecTepe supports risk analysis and security testing of IoT and OT environments.

Frequently asked questions

Is edge AI more secure than cloud AI?

For privacy, often yes, since raw data stays local. For physical tampering and upkeep, usually not. Which approach fits better depends on the use case.

What should we look for when buying devices?

Ask about secure boot, signed updates, how long security updates will be provided and how to report vulnerabilities.