Trust Mechanisms for Offline Generative AI at the Edge: A Connectivity-Regime Framework and an Empirical Study on a Raspberry Pi 5

AI summary

Overview

Research area: Trustworthy and secure edge AI — specifically offline retrieval-augmented generation (RAG) on constrained hardware, with a security emphasis (arXiv category cs.CR).

Technical level: Advanced. The paper assumes familiarity with retrieval-augmented generation, quantization, conformal prediction, digital signatures, and supply-chain threat models such as TUF and the IETF IoT update manifest.

Scope: The paper proposes a five-level connectivity-regime framework (C0–C4) for edge AI deployments and reports a proof-of-concept measurement of inference-time trust mechanisms, latency, energy, and signed knowledge-pack verification on a single Raspberry Pi 5 under network isolation.

What This Paper Is About

Most generative AI deployments assume cloud connectivity, but many IoT settings — maritime, remote infrastructure, disaster response, industrial, and defense — have intermittent, restricted, or no connectivity. The authors ask how to make a local generative assistant trustworthy when it is disconnected, and what those trust mechanisms cost in latency, energy, and lost correct answers on CPU-only edge hardware. They pair an architectural framework with an empirical study on a Raspberry Pi 5 running fully local RAG, including tests of how the system resists — and fails to resist — tampered and poisoned knowledge updates.

Key Contributions

1. A connectivity-regime framework (C0–C4) that treats disconnection as a design dimension spanning cloud-connected (C0), edge-assisted (C1), offline-capable (C2), disconnected with controlled updates (C3), and air-gapped (C4) operation, tracing consequences for inference, updates, federation, threats, and governance evidence.

2. A taxonomy of inference-time trust mechanisms organized by locus and dependence on the generator, plus a comparison of federation units (full weights, gradients, PEFT adapters, knowledge packs, knowledge-graph updates, prompt/policy bundles) that motivates signed, versioned knowledge packs as the update channel for disconnected regimes.

3. An empirical evaluation on a Raspberry Pi 5 under network isolation — five configurations, three Qwen2.5-Instruct model sizes (1.5B, 3B, 7B), three context sizes (k = 1, 3, 5), 1,500 generations over 300 SQuAD 2.0 questions, 30 generations against a poisoned pack, and 11 packs in update-security tests.

4. Design guidelines for trustworthy generative edge systems and an open release of code and data.

Main Findings

• The retrieval-score gate detects missing knowledge, not missing answers. It separated answerable from out-of-corpus queries almost perfectly (AUROC 0.97 [0.94, 0.99]) but separated answerable from in-topic unanswerable questions poorly (AUROC 0.68 [0.60, 0.76]). Mean top-1 scores were 0.60 (SD 0.07) for answerable, 0.56 (0.08) for in-topic unanswerable, and 0.44 (0.05) for out-of-corpus queries.

• Small models fail by emitting empty outputs, and a deterministic validator converts these into abstentions at no observed cost. The 1.5B model returned a citation marker with no answer text for 30% of all queries. Treating those as abstentions lowered risk among answered queries from 0.81 to 0.46 for the 1.5B model (paired 95% interval −0.46 to −0.25) and from 0.36 to 0.29 for the 7B model (−0.13 to −0.04), with no observed loss of correct answers. Over all 300 queries, the 1.5B model produced 27 correct and 23 incorrect substantive answers, 160 explicit abstentions, and 90 empty outputs; the 7B model produced 75 correct, 30 incorrect, 182 abstentions, and 13 empty outputs.

• Self-abstention handles knowledge gaps far better than in-topic unanswerable questions. Models declined 91–99% of out-of-corpus questions but only 47%, 66%, and 71% of in-topic unanswerable ones (1.5B, 3B, 7B).

• The score gate adds a modest, costly increment. Adding it on top of self-abstention and the validator raised abstention on in-topic unanswerable questions by 3–7 percentage points (3B: +6, interval +2 to +11; 7B: +7, +3 to +13) and pushed out-of-corpus abstention to 99–100%, but removed 2–8 percentage points of correct answers (3B: −8, −14 to −3; 7B: −7, −13 to −2). Risk for the 7B model fell from 0.29 to 0.24. Even the strongest layered policy declined only 84% of in-topic unanswerable questions.

• The NLI entailment verifier adds little. It separated correct from incorrect answers with AUROC between 0.50 and 0.64 across configurations, cost a median 2.1–2.4 s per answer at k = 3, and removed 3–7 percentage points of correct answers while raising unanswerable abstention by 0–5 points. For the 7B model, 96% of substantive answers to in-topic unanswerable questions (22 of 23) matched a normalized span of a retrieved passage — the same rate as its correct answers — showing that lexical support checks cannot catch this failure.

• The 3B model matches the 7B model on lenient correctness but not strict correctness. Both achieve a 75% gold-answer containment rate, but the 3B model does so at 22 s and 174 J versus 50 s and 399 J for the 7B model. The 7B model far more often exceeds a token-F1 threshold of 0.5 (74% versus 31%) and has lower risk (0.24 versus 0.37 for the strongest layered policy).

• More retrieved context can hurt. For the 3B model, k = 5 lowered correctness from 75% to 52% compared with k = 3.

• Verifying a pack is cheap; building one on-device is expensive. Verification took about 4.5 ms (4.4 ms median of 20), loading took 2.7 s, and embedding the pack's passages took 28.8 min on the device.

• Signature-and-hash checks alone are insufficient. They accepted six of nine tested update attacks; the layered verifier — binding signature verification to the declared key, enforcing a strictly increasing sequence number, expiry, revocation, and embedding-model compatibility — rejects them. The authors also report finding and correcting a flaw in their own initial implementation that accepted a manifest signed with a revoked key declaring the current key's identifier.

• A validly signed poisoned pack defeats every pack check. On 30 questions the 3B model had previously answered correctly, correct answers dropped to zero and 14 returned the injected answer; 13 of those 14 passed gating, span, and entailment checks.

• No evaluated mechanism establishes the truth of the evidence. The authors state this limitation explicitly.

• Supporting measurements: retrieval recall@1/3/5 = 0.83/0.98/0.98; split-conformal thresholds (α = 0.1, 2,000 splits, mean threshold 0.50, SD 0.02) retained on average 91% of answerable queries on held-out halves and rejected 88% of out-of-corpus but only 28% of in-topic unanswerable queries; the full run took about 11.5 h with no thermal throttling.

Methodology in Plain English

The researchers built a small question-answering assistant that runs entirely on a Raspberry Pi 5 (Broadcom BCM2712, four Cortex-A76 cores, 16 GB RAM) with no network access: retrieval, the model server, and the benchmark all ran inside a Linux network namespace containing only a loopback interface.

The knowledge base was 950 passages drawn from 28 of the 35 articles in the SQuAD 2.0 development set; the other 7 articles were held out to create deliberate knowledge gaps. Passages and queries were embedded with BGE-M3 and indexed with HNSW. Three quantized Qwen2.5-Instruct models (4-bit Q4_K_M, served by llama.cpp, temperature 0, at most 64 output tokens) answered prompts instructing them to use only numbered passages, cite a passage, or reply "UNANSWERABLE".

They sampled 300 questions with a fixed seed, 100 per condition: answerable, adversarially unanswerable (in-topic), and out-of-corpus. They compared layered policies: the model's own self-abstention, a deterministic output validator that treats citation-only responses as abstentions, a retrieval-score gate calibrated with split conformal prediction to retain at least 90% of answerable queries, and a post-hoc NLI entailment verifier with a span check. Correctness was measured leniently (contains a normalized gold answer) and strictly (token-F1 ≥ 0.5), with paired bootstrap intervals over 4,000 resamples.

For updates, they packaged the corpus and index with a SHA-256 manifest signed with Ed25519, then extended it with a pack identifier, monotonic sequence number, expiry, embedding-model metadata, and signing-key identifier. They tested a signature-and-hash baseline against a layered verifier on 11 packs. For poisoning, following PoisonedRAG, they added 150 short passages (five per question) asserting wrong answers to 30 questions the 3B model had answered correctly, signed the new pack validly, and re-ran retrieval and generation.

Latency combines query embedding, retrieval, and generation; energy is estimated from board power sampled every 0.5 s from the Raspberry Pi 5 power-management IC, multiplied by latency. The authors describe these as estimates, and the study as an illustration on one device and one dataset rather than a benchmark.

Why This Matters

Impact on research. The paper shifts connectivity from background assumption to explicit design variable and measures trust mechanisms jointly — rather than one at a time — on CPU-only edge hardware under isolation. Its negative results are consequential: a retrieval gate that looks excellent against out-of-corpus questions collapses on in-topic unanswerable ones, an NLI verifier barely separates correct from incorrect answers, and cryptographic signing provides no protection against a maliciously curated but validly signed pack. It also documents the interaction between model size and context size, showing that more retrieved passages can reduce correctness.

Real-world applications:

• Maritime, remote-infrastructure, and industrial maintenance assistants that must answer from local manuals without connectivity.
• Disaster-response and defense decision support where networks are absent or untrusted.
• Clinical document tools that must keep inference inside the operator's perimeter for data-protection reasons.
• Auditable local knowledge distribution in regulated environments, where pack versions, retrieval scores, and routing decisions serve as governance evidence.

Industry relevance. The logging design maps onto obligations from the GDPR, the EU AI Act as amended by the Digital Omnibus on AI, the Cyber Resilience Act, the NIST AI RMF and its Generative AI Profile, and ISO/IEC 42001 — though the authors note observability does not by itself establish legal compliance. The layered verifier design is directly actionable for anyone shipping signed artifact updates to disconnected devices.

Future Directions

• Content trust for signed packs. A validly signed poisoned pack passes every check and drives correct answers to zero on its targets; the paper leaves open how curation, adversarial testing, and post-generation verification should be structured to catch this.
• Detecting in-topic unanswerable questions. AUROC of 0.68 and a best-case abstention of 84% show this is the dominant remaining failure mode for score-based gating; better signals or instance-adaptive policies are needed.
• Replacing or repairing the verifier. The NLI cross-encoder was weak, with rule-based question-to

Authors’ abstract

Generative AI and large language models (LLMs) are moving into the Internet of Things, yet most deployments assume cloud connectivity, and many IoT settings have intermittent, restricted, or no connectivity. We propose a connectivity-regime framework (C0-C4), a taxonomy of inference-time trust mechanisms, and signed, versioned knowledge packs as the update channel for disconnected regimes, and evaluate them on a Raspberry Pi 5 running fully local retrieval-augmented generation under network isolation, with three Qwen2.5 model sizes, three context sizes, and 300 SQuAD 2.0 questions. An empirically calibrated retrieval-score gate detects knowledge gaps almost perfectly (AUROC 0.97) but in-topic unanswerable questions poorly (0.68). A deterministic output validator converts malformed outputs into explicit abstentions with no observed loss of correct answers, while the NLI-based verifier we tested adds little; for the 7B model, 96% of substantive answers to unanswerable-labelled questions match normalized spans of the retrieved passages. A 3B model achieves the same gold-answer containment rate as a 7B model at less than half the latency and estimated energy, although the 7B model far more often exceeds a token-F1 threshold of 0.5; five retrieved passages lower correctness from 75% to 52% compared with three. Verifying a signed pack takes about 4.5 ms versus about 29 min for embedding its passages on the device; signature and hash checks alone accept six of nine tested update attacks that layered verification rejects. Yet a validly signed poisoned pack passes every pack check: on 30 previously correct questions, correct answers drop to zero and 14 return the injected answer. None of the mechanisms we evaluated establishes the truth of the evidence. We release code and data.