Your AI Is on the Street Now: Adversarial Threats to Edge AI Systems in Physical Environments

AI assistants are rapidly moving from controlled cloud environments into your personal life — embedded in phones, laptops, and AI PCs, reading your screen, files, inbox, camera, and microphone. Once deployed on a personal device, they're no longer protected by cloud perimeters or centralized monitoring
This talk examines adversarial attacks against on-device AI assistants in real-world personal environments. We explore how attackers exploit the assistant's inability to distinguish content it reads from commands it should obey — through poisoned documents and email, inaudible ultrasonic voice commands, and instructions hidden in images. We then look at what happens when a hijacked assistant can act: silent exfiltration through its own legitimate tools, memory poisoning, and privilege pivot. Unlike prompt attacks on chatbots, these arrive through vision, audio, and ordinary content the assistant was designed to process.
From a red-team perspective, we analyze why common safeguards fail. Secure boot and encrypted storage don't help when the vulnerability is the feature, not a flaw. Input sanitization is blind to instructions living in pixels and near-ultrasound. And the frontier labs now concede what practitioners already knew: prompt injection cannot be fully solved within today's architectures.
So we shift from prevention to containment: separating content from command, enforcing least privilege to break the "lethal trifecta" of private data, untrusted content, and an exfiltration channel, and gating releases on continuous adversarial testing. Attendees will leave with a practical threat model for adversarial AI on personal devices — and guidance for securing assistants before they're deployed "on the street."