Sovereign AI at the Front Door of Care: A Physically Unidirectional Architecture for Secure Clinical Intelligence

Vasu Srinivasan; Dhriti Vasu

cs.CRMar 26, 2026

Sovereign AI at the Front Door of Care: A Physically Unidirectional Architecture for Secure Clinical Intelligence

Authors: Vasu Srinivasan, Dhriti Vasu

Organizations: 6Hats AI Labs Inc. · University of California, Berkeley

Abstract

We present a Sovereign AI architecture for clinical triage in which all inference is performed on-device and inbound data is delivered via a physically unidirectional channel, implemented using receive-only broadcast infrastructure or certified hardware data diodes, with no return path to any external network. This design removes the network-mediated attack surface by construction, rather than attempting to secure it through software controls. The system performs conversational symptom intake, integrates device-captured vitals, and produces structured, triage-aligned clinical records at the point of care. We formalize the security properties of receiver-side unidirectionality and show that the architecture is transport-agnostic across broadcast and diode-enforced deployments. We further analyze threat models, enforcement mechanisms, and deployment configurations, demonstrating how physical one-way data flow enables high-assurance operation in both resource-constrained and high-risk environments. This work positions physically unidirectional channels as a foundational primitive for sovereign, on-device clinical intelligence at the front door of care.

Figures & tables

Configuration	Enforcement	Def. 4.1
Firewall rule	Software	No
Managed IP, outbound disabled	Kernel policy	Conditional
5G Broadcast (NR MBS)	Config, bidir platform	Conditional
Software data diode	Software/firmware	Conditional
Hardware data diode	Hardware	Yes
Satellite (DVB-S2/S2X)	Hardware + spectrum	Yes

Table 1: Inbound Channel Configurations and Unidirectionality Enforcement

Attack Class	Connected Terminal	Sovereign AI Arch.
Remote code execution	Possible via NIC	Eliminated ( $S_{r}=\emptyset$ )
Network scanning	Terminal visible	Eliminated ( $T\notin V$ )
Lateral movement	Possible via $G$	Eliminated ( $T\notin V$ )
Worm propagation	Possible	Eliminated (Thm. 6.4 )
Botnet enrollment	Possible	Eliminated (Cor. 6.5 )
Man-in-the-middle	Possible	Eliminated (no path)

Table 2: Eliminated attack classes vs. connected terminal

Attack Class	Mitigation
Optical $K_{\text{priv}}$ capture	Time-bounded $T_{\text{exp}}$ , physical security
Optical output capture	Physical security, display orientation
USB device injection	VID/PID/class whitelist + attestation
Chassis intrusion	Tamper detection, volatile wipe
RF injection near antenna	Physical security perimeter
Broadcast injection	Signature verification (Assumption 2.3 )

Table 3: Residual attack classes requiring

\mathcal{A}_{p}

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Property	Value
Unidirectionality enforcement	Hardware (transmit circuitry absent)
Definition 4.1 satisfied	Yes—unconditionally
Typical downlink throughput	20–100 Mbps (DVB-S2X ACM)
Coverage footprint	Continental (GEO) or global (LEO)
Terminal count scalability	Unlimited—broadcast is one-to-many
Network infrastructure at receiver	None—power and antenna feed only

Appendix

Table 4: Configuration 1 operational characteristics.

Property	Value
Unidirectionality enforcement	Hardware (certified data diode)
Definition 4.1 satisfied	Yes—unconditionally
Typical throughput	Up to 10 Gbps (device-dependent)
Coverage	Point-to-point or hub-and-spoke
Network infrastructure at receiver	Diode receive port only—no bidirectional NIC
Return channel for fleet management	None toward source network

Appendix

Table 5: Configuration 2 operational characteristics.

Property	Value
Unidirectionality enforcement	Kernel policy + perimeter firewall
Definition 4.1 satisfied	Conditional—absent under correct operation
Typical throughput	Standard Ethernet/IP rates
Coverage	Institutional LAN/WAN
Network infrastructure at receiver	Standard NIC—full hardware retained
Return channel if policy fails	Possible

Appendix

Table 6: Configuration 3 operational characteristics.

Property	Config 1: Broadcast	Config 2: Diode	Config 3: Managed IP
Def. 4.1 satisfied	Yes (unconditional)	Yes (unconditional)	Conditional
Unidirectionality basis	No TX circuitry	Certified HW diode	Kernel + firewall policy
SW subversion possible	No	No (at diode boundary)	Yes (if policy fails)
Coverage model	Broadcast 1:many	Point-to-point	IP 1:1 or 1:many
Return channel possible	No	No	Yes if misconfigured
Fleet scalability	Unlimited	One port per terminal	Standard IP scaling

Appendix

Table 7: Comparison of deployment configurations against key security properties.

AI Assurance

Artificial intelligence assurance develops evidence and controls to evaluate, govern, and certify AI systems across their lifecycle and deployment contexts.

See all 79 papers

[Emerging Ideas] Artificial Tripartite Intelligence: A Bio-Inspired, Sensor-First Architecture for Physical AI
Apr 15, 2026You Rim Choi, Subeom Park, Hyung-Sin KimAdaptive Sensing Embodied AI
Seoul National University, Seoul, South Korea
Caging the Agents: A Zero Trust Security Architecture for Autonomous AI in Healthcare
Mar 18, 2026Saikat MaitiAI Agent Security LLM Agent Security
VP of Trust, Commure · Founder & CEO, nFactor Technologies
Toward Zero-Egress Psychiatric AI: On-Device LLM Deployment for Privacy-Preserving Mental Health Decision Support
Apr 20, 2026Eranga Bandara, Asanga Gunaratna, Ross Gore +9On-Device Language Model Inference Privacy-Preserving Language Models
Old Dominion University, Norfolk, VA, USA · AI Motion Labs, Melbourne, Australia · Department of Psychiatry and Neurobehavioral Sciences, University of Virginia School of Medicine, Charlottesville, VA, USA +3

Apr 15, 2026J/K move · Enter open · S save

[Emerging Ideas] Artificial Tripartite Intelligence: A Bio-Inspired, Sensor-First Architecture for Physical AI

You Rim Choi, Subeom Park, Hyung-Sin Kim

Seoul National University, Seoul, South Korea

Adaptive Sensing Embodied AI Cognitive Architectures for AI Agents Active Perception Hardware-Software Co-Design Edge Inference

Open paper AskPDF arXiv

As AI moves from data centers to robots and wearables, scaling ever-larger models becomes insufficient. Physical AI operates under tight latency, energy, privacy, and reliability constraints, and its performance depends not only on model capacity but also on how signals are acquired through controllable sensors in dynamic environments. We present Artificial Tripartite Intelligence (ATI), a bio-inspired, sensor-first architectural contract for physical AI. ATI is tripartite at the systems level: a Brainstem (L1) provides reflexive safety and signal-integrity control, a Cerebellum (L2) performs continuous sensor calibration, and a Cerebral Inference Subsystem spanning L3/L4 supports routine skill selection and execution, coordination, and deep reasoning. This modular organization allows sensor control, adaptive sensing, edge-cloud execution, and foundation model reasoning to co-evolve within one closed-loop architecture, while keeping time-critical sensing and control on device and invoking higher-level inference only when needed. We instantiate ATI in a mobile camera prototype under dynamic lighting and motion. In our routed evaluation (L3-L4 split inference), compared to the default auto-exposure setting, ATI (L1/L2 adaptive sensing) improves end-to-end accuracy from 53.8% to 88% while reducing remote L4 invocations by 43.3%. These results show the value of co-designing sensing and inference for embodied AI.

Abstract

AI Assurance

Explore similar work

[Emerging Ideas] Artificial Tripartite Intelligence: A Bio-Inspired, Sensor-First Architecture for Physical AI

Caging the Agents: A Zero Trust Security Architecture for Autonomous AI in Healthcare

Toward Zero-Egress Psychiatric AI: On-Device LLM Deployment for Privacy-Preserving Mental Health Decision Support