An electrophysiology lab with an edge AI device, made by me and Grok. Imagine a janitor at Walter Reed reading off a US President’s data in the procedure from the hallway.
Intro
This week we attack data security in edge AI-enabled medical devices.
I was a technician in a communications battalion in the Israeli Army. We provided communications infrastructure for an armored division. Two of us handled encryption of trunk communications. Our equipment sat in an armored van and the lines in and out were physical cabling.
I was trained as a physicist. Sitting in the van - I often wondered how much of the radiation leaking from those cables could be remotely detected, and at what distances.
We revisit this old question in this weeks note.
Physical Side-Channel Attacks on Edge LLMs
In a side-channel attack an attacker steals secret information from a device without breaking into the device, but by watching the device by measuring temperature change, timing operations or measuring electromagnetic emissions.
Researchers at University of Amsterdam recently demonstrated a proof of concept attack extracting output tokens and user prompts via electromagnetic emissions.
See this article on Arxiv published Oct 9, 2026.
The deployment of large language models (LLMs) on edge devices is largely motivated by privacy concerns over sharing sensitive user data with cloud servers.
The authors demonstrate that keeping inference local does not eliminate privacy risks
They put a near-field probe next to the processor and measured what the chip radiated while it was computing.
No OS access. No memory access. No network. Just physics.
The proof of concept was not a hospital-scale attack. The researchers used a fixed CPU frequency, a high-bandwidth scope, and a probe sitting close to the silicon.
In real life, in real clinics and with real medical devices, these attacks will be much harder - but the proof of concept is useful because edge inference is a growth market.
Edge inference is good for clinical AI. Patient data stays on the device. Latency drops. You don’t pay for tokens.
A second paper, due to be released October 13, shows the hardware direction: a quantized 27-billion-parameter model running entirely in system RAM on ordinary machines after the GPUs ran out of memory. Slow (0.6–2.4 tokens/s), fine for overnight work, and federated fine-tuning only moves a 22 MB adapter instead of the full weights.
As hardware gets better and small local models improve - the economics favor cheap hardware and local LLMs.
That’s a bet I think a lot of AI medical device developers will make.
And you can sell robust privacy, predictable performance, and offline operation.
The paper profiles 50 medical and privacy-sensitive words (cancer, HIV, depression, etc.). Closed-set classification hit 97.2% on the profiled set. When they went after the full vocabulary and looked for words the classifier had never seen, the right token still landed in the top 100 candidates 67% of the time.
They recovered enough of the hidden state to reconstruct the semantic intent of the prompt.
So how much of this is a Netflix episode?
The attack requires physical proximity and controlled conditions.
With the right equipment - and a valuable enough target - you could justify a driveby attack from a cart pushed by a person impersonating a hospital orderly.
Edge devices go into clinics, labs, homes, and other places where you do not control who stands near the box or for how long.
A standardized AI medical device with the same hardware, same runtime, same model and standard deployment is good for device vendors and attackers.
Standardized configurations is good for attackers.
Profile one unit, rinse and repeat the attack.
Attackers can infer sensitive prompts or outputs without touching the network or the stored records. Diagnosis, mental-health interaction, treatment recommendation, proprietary workflow logic — any of it can leak while the processor is using it.
Encryption at rest and TLS do not mitigate this. The data is in motion inside the chip.
Security countermeasures like shielding, execution randomization, masking the LM head and hidden states can be implemented, but it’s a question of cost-effectiveness for your product.
You need to evaluate cost-effectiveness, performance hit, and effectiveness on real medical-device hardware.
Since the privacy, latency, and deployment advantages can easily justify the extra exposure - edge inference should turn into an economic decision.
But “on-device” is definitely not the end of the threat analysis.
And it’s not a Netflix screenplay.
It’s the beginning.
OpenCRO analyzes plausible cyber, privacy, and patient-safety events that could affect your revenue, regulatory status, and reputation. We estimate the financial exposure and prioritize cost-effective countermeasures for AI-enabled devices.
Tasks for threat analysis of edge inference in medical devices.
As always in a threat analysis - you start by asking questions:
Can you model the operating environment in the hospital or clinic?
Who can touch the enclosure?
How close can they get?
For how long?
Is the vendor using standard hardware, software and open source weights?
How sensitive are the prompts and outputs?
What does physical shielding actually cost?
Is it economically feasible to do EM leak testing for your device?
FDA’s February 2026 cybersecurity guidance expects controls that address the device and its operating environment, with evidence tied back to the risks you identified. “The data never leaves the device” is a claim. It is not that evidence.
Local AI reduces one set of exposures.
It does not repeal physics.
Worth reading
Alhalawani et al., Physical Side-Channel Attacks on Edge LLMs, arXiv 9 Oct 2026
Yune et al., Capacity over TFLOPS: Memory-Centric Deployment of Large Clinical Language Models on Consumer CPUs, arXiv 13 Oct 2026
FDA, Cybersecurity in Medical Devices, February 2026