device security teams

Abstract: Deploying AI at the edge increases the need for security features on existing devices. When physical access to the device is available, storing secret keys in non-volatile memory is vulnerable. Physical unclonable functions (PUFs) address this by exploiting the unique yet repeatable characteristics of each device, but conventional implementations require design-stage modifications, making them inapplicable to a vast number of existing devices already manufactured. Recently, software PUFs have emerged as an alternative approach, leveraging analog characteristics exposed through software-only interfaces to derive unique responses, without post-fabrication changes. Since edge AI hardware is bound to long operational lifespans, this offers clear economic and engineering value. Existing research on software PUFs remains fragmented. It lacks a holistic review of the trade-offs among choices of components used as entropy sources and software methods to expose analog characteristics. This gap hinders assessing feasibility, comparing approaches, and identifying open challenges towards a hardware root of trust in existing devices. This paper surveys 37 existing software PUF works and compares them against the requirements of on-device model protection: boot-time versus runtime key derivation, and response latency. It analyzes trade-offs, outlines four key challenges that current software PUFs face for edge AI deployment, and highlights promising directions for overcoming barriers to real-world adoption.

Abstract: The rapid integration of AI into human-centred systems such as Brain-Computer Interfaces (BCIs) has created a poorly understood attack surface linking neural signals to physical systems. Exploits in this domain threaten cognitive autonomy, mental privacy, and physical safety, from neural data exfiltration to malicious control of BCI-tethered devices. We introduce the NERVE Attacks class, a systematic characterisation of five orthogonal attack dimensions that together span the complete BCI stack: Neuro-mimetic Forgery (N), Evasion via Desynchronization (E), Replay-based Hijacking (R), Vein Tapping (V), and Embedded Backdoors (E). To evaluate this class, we present EEGle, an AI-assisted extensible framework for systematic BCI security analysis. Our evaluation uncovers 17 novel neuro-specific attack instances and reveals a stealth-effectiveness spectrum unique to BCI backdoor design. We also show that generative AI lowers the barrier to entry for non-expert attackers and provide EEGle to the community for building and verifying the security of these deeply personal devices.