Trust Mechanisms for Offline Generative AI at the Edge: A Connectivity-Regime Framework and an Empirical Study on a Raspberry Pi 5

Trust Mechanisms for Offline Generative AI at the Edge. A Connectivity-Regime Framework and an Empirical Study on a Raspberry Pi 5. By Georgios Feretzakis and one other, from Securagen AI. Published on the twenty-fourth of October. Its code repository is public and real: about forty source files.

Generative AI and large language models are moving into the Internet of Things, and most deployments assume a connection to the cloud. Many IoT settings have intermittent, restricted, or no connectivity at all. The paper proposes three things for that world: a connectivity-regime framework running from C0 to C4, a taxonomy of trust mechanisms applied at inference time, and signed, versioned knowledge packs as the update channel when a device is disconnected. Its central finding is a sobering one, stated plainly by the authors: none of the mechanisms they evaluated establishes that the evidence is true.

The test bed is a Raspberry Pi 5 running fully local retrieval-augmented generation under network isolation. It uses three Qwen2.5 model sizes, three context sizes, and three hundred questions from SQuAD 2.0.

An empirically calibrated gate on retrieval scores detects knowledge gaps almost perfectly, with an AUROC of zero point nine seven. It is poor at in-topic questions that cannot be answered, scoring zero point six eight. A deterministic output validator turns malformed outputs into explicit abstentions, with no observed loss of correct answers. The NLI-based verifier the authors tested adds little. For the seven billion parameter model, ninety-six percent of substantive answers to questions labelled unanswerable match normalised spans of the retrieved passages.

On model size, a three billion parameter model reaches the same gold-answer containment rate as the seven billion model, at less than half the latency and less than half the estimated energy. The larger model, though, far more often clears a token F1 threshold of zero point five. Retrieving five passages instead of three lowers correctness from seventy-five percent to fifty-two percent.

On updates, verifying a signed pack takes about four point five milliseconds, against about twenty-nine minutes to embed its passages on the device. Signature and hash checks on their own accept six of the nine update attacks tested, all of which layered verification rejects. But a poisoned pack that is validly signed passes every pack check. On thirty questions the system had previously answered correctly, correct answers fall to zero, and fourteen of them return the injected answer.

These results come from one device, one question set, and one model family at three sizes, under the specific mechanisms the authors built and tested. The verifier that added little is described as the one they tested, not as every possible verifier. And the poisoning result marks a boundary of the whole approach: signatures establish where a pack came from and that it arrived intact, not whether what it says is correct.

Offline trust, on this evidence, can be layered and partly measured. Gates catch missing knowledge, validators catch broken outputs, and layered checks stop most tampering in transit. What none of them does is vouch for the content of a properly signed source. The code and data are released.