Local AI and cyber security. How Switzerland can use edge AI securely and reliably

Developments in the field of artificial intelligence are currently dominated by the massive expansion of cloud infrastructure. This is causing a second, equally significant development to take a back seat: AI models are increasingly running directly on end devices – on smartphones, sensors, industrial robots or in vehicles. This so-called edge AI processes data where it is generated, rather than transmitting it to remote data centres.

This has far-reaching consequences, particularly for cyber security. Because sensitive data remains local, edge AI strengthens data protection and digital sovereignty on the one hand. On the other hand, however, the proximity of data, AI models and hardware increases the attack surface and shifts responsibility for cybersecurity from the cloud to the operators of the end devices.

To ensure that Switzerland does not miss out on this development and can deploy edge AI securely and reliably in future, the SATW’s Cybersecurity thematic platform outlines specific courses of action:

• Zero-trust architecture (in accordance with NIST SP 800-207): Based on the principle of ‘never trust, always verify’, a separate access credential is created for every instance of access to every resource, which can be revoked at any time should the security situation change.
• International industrial standards (IEC 62443): Defining security-relevant zones and communication channels makes it possible to reflect the distributed nature of edge AI applications and to operate them in isolated zones.
• Security standards for AI models: New standards and mandatory red-team testing prior to deployment address risks such as data poisoning, model poisoning and hostile attacks – threats that are exacerbated in edge AI due to the proximity of hardware and software.
• Mandatory cybersecurity framework for high-risk AI systems: Edge AI systems used, for example, in critical infrastructure (such as transport or electricity and water networks), in biometric identification or in educational assessment, should be required to adhere to the principle of ‘Security by Design’. ‘Security by Design’ requires that the accuracy, robustness and cybersecurity of the systems be embedded throughout the entire architectural and development process.
• Trusted Execution Environments (TEs) to protect hardware components: As edge AI models process data and execute code locally, providers should increasingly rely on TEs. These TEE involve a hardware-based separation of the areas where data is processed and where the code of the edge AI model is executed.

Rapid developments in the field of AI are increasingly taking place at the local level. To ensure that Switzerland can utilise edge AI in a secure and trustworthy manner, the courses of action discussed here should be implemented.