A hardware-level behavior monitoring and control method and system for edge AI agents

Abstract

This invention discloses a hardware-level behavior monitoring and control method and system for edge AI agents, belonging to the field of edge AI security technology. This invention confines the critical execution logic of the edge AI agent to a protected execution environment with hardware root of trust protection and pure hardware circuit physical isolation. A dedicated hardware independent monitoring unit deployed on the core data path monitors its operation behavior in real time. This unit is independently powered by a backup power supply and can operate for at least 72 hours after the main power supply fails. High-risk operations such as payment, contact list reading, and root permission requests are forcibly intercepted through an independent hardware channel, confirmed by a trusted UI push within the protected environment, and executed only after user verification. In offline mode, independent monitoring logs are stored, and synchronized via hardware root of trust encryption and signature after network recovery. This invention effectively solves the security supervision vacuum problem caused by the local execution of edge AI agents.

Description

Technical Field

[0001] This invention relates to the field of edge AI security management technology, specifically to a method and system for hardware-level behavior monitoring and management of edge AI agents running on user terminal devices. Background Technology

[0002] With the continuous improvement of computing power in edge AI chips, edge AI agents have been widely deployed on terminal devices such as smartphones, personal computers, and smart car cockpits. Apple Intelligence uses differential privacy and synthetic data technology to protect user privacy during all model training, while Google and Nvidia continue to increase their R&D investment in the field of AI agents. Edge AI agents can directly read and write local files, send messages, and perform payment operations; their behavior control needs are just as urgent as those of cloud-based agents. However, the core characteristic of edge AI agents—local execution—exactly bypasses the "cloud request, user verification" network structure upon which cloud-based agent management systems rely. Existing edge security solutions primarily rely on operating system-level permission management and application sandbox mechanisms, lacking an independent monitoring channel at the hardware root of trust level. Android permission management systems and iOS privacy reports can only record behavior and cannot intercept unauthorized operations in real time. Open-source solutions such as ClawAegis can still be disabled with root privileges, presenting a fatal security flaw. Goodix Technology's related solutions only encrypt communication links and cannot defend against local file tampering. Software solutions such as ClawKeeper rely on network connections for security auditing and cannot cover offline scenarios. GPUBreach attacks have demonstrated that attackers can escalate privileges from the GPU side to the entire host system using RowHammer techniques, bypassing IOMMU protection to gain root access. A 2025 study published by the University of Toronto confirmed the feasibility of RowHammer attacks on GPUs. OneFlip attacks only require flipping a single bit in the AI ​​model's memory to successfully implant a backdoor and manipulate the model's output. Existing solutions lack effective detection and defense capabilities against low-level memory attacks during the runtime of edge AI devices. Virtualized TEE solutions are vulnerable to side-channel attacks such as Spectre and Meltdown, and have been proven unsuitable for high-security scenarios. Summary of the Invention

[0003] The purpose of this invention is to provide a hardware-level behavior monitoring and control method and system for edge AI agents, effectively solving the security supervision vacuum problem caused by edge AI agents bypassing the cloud control system due to their local execution characteristics. The core improvement of this invention lies in: First, the critical execution logic of the edge AI Agent is confined to a protected execution environment protected by a hardware root of trust. This environment employs physical isolation implemented entirely by hardware circuitry, without relying on any virtualization technology or operating system kernel. Compared to virtualized TEE solutions, this significantly reduces performance overhead and completely eliminates the side-channel attack surface. Continuous real-time monitoring of all local operations of the AI ​​Agent is achieved through independent monitoring units deployed on core data paths such as the system bus, memory bus, and peripheral interconnect bus. In one specific embodiment, the independent monitoring unit is connected in parallel to the physical copper trace between the SoC system bus and the memory controller via a differential signal detection circuit for full-traffic real-time mirroring. This independent monitoring unit is a dedicated hardware circuit that does not run any general-purpose operating system, possesses hardware-level execution privileges, and cannot be shut down, downgraded, or bypassed by the edge AI Agent or its upper-layer software, effectively overcoming the long-standing technical challenge of software-level solutions being disabled by root privileges. The independent monitoring unit is independently powered by the terminal device's backup power supply, ensuring that normal operation is not immediately interrupted after the main power is disconnected, thus guaranteeing the integrity and traceability of monitoring records. In one specific embodiment, the backup battery capacity can meet the requirement of continuous operation for at least 72 hours after the main power supply fails; Second, high-risk operations are forcibly intercepted through a hardware-based judgment channel independent of the Agent execution environment. High-risk operation types are explicitly defined as payment instructions, contact list reading, device root access requests, password changes, encryption key access, sensitive file reading, and application installation. Confirmation requests are presented through a trusted user interface running within a protected execution environment. High-risk operations are only authorized to execute after the user completes confirmation through at least one of biometric or password verification methods. Third, the monitoring unit continues to operate independently in offline mode, storing all monitoring logs and interception records within the protected execution environment. When the device regains network connectivity, the monitoring data collected during the offline period is encrypted using a session key generated by the hardware root of trust and synchronized to the global dynamic monitoring network. All synchronized data is digitally signed by the hardware root of trust, and the global dynamic monitoring network verifies the signature before receiving the synchronized data, ensuring the integrity and unforgeability of offline data during the synchronization process. In one specific embodiment, the average time for encrypted synchronization of 12 hours of offline data is only 2.3 seconds, completely imperceptible to the user. Fourth, it possesses runtime memory integrity measurement capabilities, which can defend against RowHammer-type attacks. The measurement frequency is dynamically adjusted according to the AI ​​Agent's running status, automatically increasing the measurement frequency under high load to ensure timely detection. In one specific embodiment, when the Agent's memory utilization exceeds 85%, the integrity measurement frequency automatically increases to once every 50 milliseconds. When a memory bit flip or abnormal data change caused by a RowHammer attack is detected, an alarm is automatically triggered, only the affected memory pages are isolated, the AI ​​Agent is migrated to a safe memory area, and the behavior permissions of the affected edge AI Agent are restricted to read-only mode, avoiding the risk of system crashes that might result from marking an entire row of memory as unavailable. Attached Figure Description

[0004] Figure 1 This is a schematic diagram of the hardware-level behavior monitoring system architecture of the edge AI Agent of the present invention; Figure 2 Flowchart for real-time monitoring of edge behavior and interception of high-risk operations; Figure 3 Flowchart for offline autonomous monitoring and encrypted synchronization; Figure 4 A flowchart for runtime memory integrity measurement and RowHammer defense. Detailed Implementation

[0005] The present invention will now be described in detail with reference to the accompanying drawings and embodiments: Example 1: Monitoring and Interception of High-Risk Operations by AI Agent on Smartphone Side A smartphone equipped with an edge AI Agent. When the Agent is first activated, the hardware root of trust generates a unique 128-bit root identity primitive for it and irreversibly binds it to the SHA-256 hash value of the phone's Secure Enclave UID and device serial number. This root identity primitive is stored in a protected execution environment and cannot be accessed by the main operating system or any application. The edge-side real-time behavior monitoring unit continuously monitors all local operations of the Agent. When the Agent attempts to execute a payment operation, the operation is classified as a pre-defined high-risk operation. The high-risk operation local interception unit forcibly intercepts the payment operation through a hardware judgment channel independent of the Agent's execution environment. The interception unit pushes a confirmation prompt to the user through the device's built-in trusted user interface. This trusted user interface runs within a protected execution environment and cannot be tampered with or overwritten by any process of the edge-side AI Agent or the main operating system. The payment operation is only authorized after the user passes Touch ID biometric verification. The entire interception, confirmation, and authorization process is time-stamped and hash-based for evidence storage by the hardware root of trust. Example 2: Offline Autonomous Monitoring and Encrypted Synchronization The user's mobile phone is offline during the flight. The edge AI Agent continues to process the user's local documents. The edge behavior real-time monitoring unit operates independently, storing all monitoring logs and intercept records (the Agent performed 15 file reads, 3 photo album accesses, and 0 high-risk operations) in the internal NAND Flash of the protected execution environment. After the plane lands, the mobile phone regains network connection, and the offline autonomous monitoring unit encrypts the monitoring data from the past 12 hours of offline activity using a session key generated by the hardware root of trust, and then synchronizes it to the global dynamic monitoring network. All synchronized data is digitally signed by the hardware root of trust, and the monitoring network can only receive it after verifying the signature. The average time for encrypting and synchronizing the 12 hours of offline data is 2.3 seconds, which is completely imperceptible to the user. After synchronization is complete, local storage is cleared to free up space. After receiving the data, the monitoring network verifies the integrity of the causal chain, confirms that there are no broken chain events, and includes the behavior during the offline period in the user's overall behavior profile. Example 3: RowHammer Defense for Runtime Memory Integrity Measurement During operation, the runtime memory integrity measurement unit periodically scans the LPDDR5 memory region upon which the Agent relies for operation. The scanning algorithm uses a BLAKE3-based hash checksum, comparing the hash value of the current memory page with a baseline value stored in the OTP memory within the hardware trust root. The measurement frequency is dynamically adjusted based on the Agent's operating status. When the Agent is running under high load and memory utilization exceeds 85%, the measurement frequency automatically increases to once every 50 milliseconds to ensure timely detection. When a bit flip is detected in a memory page, the system determines that there is a risk of a RowHammer attack, automatically sends an alarm interrupt signal to the main processor, isolates only the affected memory page, migrates the Agent to a safe memory region, restricts the behavior permissions of the affected edge AI Agent to read-only mode, and pushes a security alert to the user. In another embodiment, the independent monitoring unit is powered independently by a backup power supply from the terminal device. This backup power supply is a backup battery independent of the main power supply, which can continuously power the independent monitoring unit after the main power supply is completely disconnected, ensuring that the monitoring unit's normal operation capability is not immediately interrupted due to power failure, thereby ensuring the integrity and traceability of monitoring records. As an exemplary configuration, the backup battery capacity can meet the requirement of continuous operation for at least 72 hours after the main power supply is disconnected, satisfying the requirements for judicial evidence preservation.

Claims

1. A hardware-level behavior monitoring and control method for edge AI Agents, applied to AI Agents deployed on user terminal devices that possess local autonomous decision-making and execution capabilities, characterized in that... Includes the following steps: Hardware-level execution environment isolation steps: The critical execution logic of the edge AI Agent is confined to run within a protected execution environment protected by a hardware root of trust. The protected execution environment is independent of the main operating system of the terminal device. Its storage space and computing resources are physically isolated from the main operating system by hardware circuitry. This physical isolation does not depend on any virtualization technology or operating system kernel. Real-time monitoring steps for edge-side behavior: Through an independent monitoring unit deployed on the core data path of the terminal device, continuous and uninterrupted real-time monitoring is performed on all local operational behaviors of the edge-side AI Agent—including file read / write operations, API call operations, process creation operations, network access operations, and inter-application data transfer operations; the core data path includes all physical paths for data transmission, such as the system bus, memory bus, and peripheral interconnect bus; the independent monitoring unit is a dedicated hardware circuit that does not run any general operating system, has hardware-level execution permissions, and cannot be shut down, downgraded, or bypassed by the edge-side AI Agent or its upper-layer software; High-risk operation local interception steps: When the operation behavior of the edge AI Agent is detected to belong to a preset high-risk operation type—including at least one of payment instructions, contact book reading, device root permission request, password modification, encryption key access, sensitive file reading, and application installation—the system forcibly intercepts the operation through a hardware judgment channel independent of the edge AI Agent's execution environment and pushes a confirmation request to the user. The confirmation request is presented through a trusted user interface built into the terminal device. This trusted user interface runs in a protected execution environment and cannot be tampered with or overwritten by any process of the edge AI Agent or the main operating system. Only after the user completes confirmation through at least one of biometric verification or password verification is the high-risk operation authorized to be executed. Offline autonomous monitoring and synchronization steps: When the terminal device is offline or disconnected from the network, the end-side behavior real-time monitoring unit continues to operate independently, storing all monitoring logs and interception records within the protected execution environment; when the device restores network connection, the monitoring data during the offline period is encrypted using the session key generated by the hardware trust root and synchronized to the global dynamic monitoring network; all synchronized data is digitally signed by the hardware trust root, and the global dynamic monitoring network can only receive the synchronized data after verifying the signature.

2. The method according to claim 1, characterized in that, It also includes a hardware trust root identity binding step: when the edge AI Agent is activated for the first time, the hardware trust root of the terminal device generates a unique root identity primitive for it, and irreversibly binds the root identity primitive to the hardware fingerprint of the device; the root identity primitive serves as an unforgeable identity identifier for auditing all operations of the edge AI Agent both locally and remotely.

3. The method according to claim 1, characterized in that, It also includes a runtime memory integrity measurement step: periodically measuring the GPU memory and system memory on which the edge AI Agent depends for operation; the frequency of the integrity measurement is dynamically adjusted according to the running status of the AI ​​Agent. When the AI ​​Agent is running under high load, the measurement frequency is automatically increased to ensure timely detection; when a memory bit flip or abnormal data change caused by a RowHammer attack is detected, an alarm is automatically triggered, only the affected memory pages are isolated, the AI ​​Agent is migrated to a safe memory area, and the behavior permissions of the affected edge AI Agent are restricted to read-only mode; the runtime integrity measurement runs independently of the edge AI Agent execution environment, and its measurement benchmark value is permanently stored in a one-time programmable storage medium inside the hardware root of trust.

4. The method according to claim 1, characterized in that, It also includes a step for synchronous upgrade of edge encryption agility: when the global dynamic monitoring network detects new cryptographic threats or a decrease in the security level of encryption algorithms, it pushes an encryption algorithm update package to the terminal device through a secure channel; after receiving the update package, the protected execution environment of the edge AI Agent uses a double-buffered hot-swap method to complete the dynamic replacement and upgrade of the encryption algorithm without interrupting the local behavior monitoring service during the upgrade process.

5. The method according to claim 1, characterized in that, The independent monitoring unit is powered independently by the backup power supply of the terminal device. When the main power supply of the terminal device is disconnected, the independent monitoring unit will not immediately interrupt its normal operation due to the power failure, so as to ensure the integrity and traceability of the monitoring records.

6. A hardware-level behavior monitoring and control system for edge AI agents, characterized in that, The method for implementing any one of claims 1 to 5 comprises at least: The system includes a hardware trust root module, a protected execution environment, an independent monitoring unit, a high-risk operation local interception unit, an offline autonomous monitoring unit, a runtime memory integrity measurement unit, and an edge-side encryption agility synchronous upgrade unit.

Images