SecTor 2025 | Threat Architecture, Attack Surfaces & Real-World Risk

Agentic Edge AI: Threat Architecture, Attack Surfaces & Real-World Risk.

Overview

In this presentation, Numaan Huq, a Senior Threat Researcher at Trend Micro, explores the rapidly approaching future of Agentic Edge AI—autonomous AI systems deployed on physical devices rather than relying solely on the cloud. Huq outlines what these systems are, how they operate, and critically, the new and complex cybersecurity threats they will introduce over the next 3 to 5 years as they integrate into homes, workplaces, and public infrastructure.

What is Agentic Edge AI?

Huq begins by defining the core concepts:

• Agentic AI: An AI system that uses an “orchestrator” to break down complex, high-level goals into smaller tasks, assigning them to specialized AI agents to solve autonomously.
• Agentic Edge AI: This is Agentic AI moved to local hardware (the “edge”). Instead of relying on massive cloud-based Large Language Models (LLMs), these devices use Small Language Models (SLMs). This allows the device to process data, reason, and act in real-time, even offline.

These systems are defined by low latency, enhanced privacy (data stays on the device), and real-time decision-making. Examples include autonomous vehicles (like Waymo), advanced wearables, smart home robots (like Samsung Ballie), and industrial robots.

The 5-Layer Architecture:
To understand the vulnerabilities, Huq breaks down the architecture of these devices into five layers:

1. Perception/Sensing Layer: Gathers real-time data using cameras, LiDAR, and audio sensors.
2. Edge Cognition Layer: Local processors (CPUs, GPUs, NPUs) interpret the data and make decisions.
3. Cloud Cognition Layer (Optional): Used only for heavy, complex analytics or edge cases the local device cannot handle.
4. Learning/Adaptation Layer: The device learns from its environment over time, often sharing this learning with other devices via “Federated Learning.”
5. Action/Actuation Layer: The physical response—moving a robotic arm, applying brakes, or unlocking a door.

The Expanding Threat Landscape

Because Agentic Edge AI interacts with the physical world, the attack surface is massive. Huq notes that the complex development pipeline of these models—which involves virtual environments, synthetic data generation, and simulations—creates numerous opportunities for “supply chain” style attacks before the device is even built.

Once deployed, the devices face threats across all five layers:

• Perception Attacks: “Blinding” cameras with lasers, audio spoofing (using deepfakes to mimic a user’s voice to issue commands), and sensor spoofing.
• Cognition Attacks: Model poisoning and prompt injection via physical sensors.
• Learning Attacks: Poisoning the continuous learning process to slowly degrade the model’s accuracy.
• Action Attacks: Denial of Service (DoS) attacks that freeze the physical operation of the device.

Real-World Attack Scenarios

Huq provides three concrete examples of how these attacks might play out in the real world:

1. Sensor-Side Prompt Injection (The Fire Alarm Hack): A smart home security robot uses a vision model to monitor the house. An attacker flashes a cheap orange LED strobe light from outside. The robot’s limited edge-vision model misinterprets the strobe as a “burning sofa.” Consequently, the robot autonomously triggers the home’s sprinklers or calls 911, causing physical and logistical damage.
2. Adversarial Vision Patching (The Smart Lock Hack): An attacker targets an AI-powered smart door lock. By wearing a specifically designed mask or sticker (an adversarial patch) that confuses the facial recognition algorithm, the attacker tricks the AI into thinking they are an authorized user, causing the lock to actuate and open the door.
3. Federated Learning Poisoning: A fleet of devices (like smart vacuums or wearables) share their local learning updates with a central cloud to improve the “global” AI model. An attacker hacks a single edge device and uses it to send malicious, corrupted updates to the cloud. Over time, this poisons the global model, dropping the accuracy and reliability of the entire fleet of devices.

Mitigation and Conclusion

Traditional cybersecurity (like secure boot and encryption) is necessary but insufficient for Agentic Edge AI. Huq highlights several advanced mitigation strategies:

• Multi-Sensor Fusion: Devices must not rely on a single sensor. If a camera sees a fire, the device should cross-reference this with a thermal or carbon monoxide sensor before taking action.
• Human-in-the-Loop: For critical or emergency actions (like calling 911 or firing weapons), a human must verify the AI’s decision.
• Adversarial-Robust ML Practices: Developers must actively try to break their own models during the training phase using adversarial data.

The takeaway: As AI evolves from chat windows on our screens to autonomous physical entities in our living rooms and streets, the cybersecurity paradigm must urgently adapt to protect not just our data, but our physical safety and infrastructure.