Proposing a five-layer taxonomy for physical AI security

Summary

The authors propose a five-layer taxonomy supported by a PRISMA-guided review of 312 articles, 28 standards, and 12 incident reports covering the period 2015–2025. This taxonomy (hardware trust, pre-deployment validation, runtime assurance, domain semantics, and information feedback) aims to unify the fragmented Physical AI Security literature.

Why it matters

As AI models increasingly direct physical actuators in factories, warehouses, and critical infrastructure, security research remains scattered across hardware, AI, robotics, and OT communities. A common terminology is nearly nonexistent. A shared structural framework can help researchers and regulators see cross-layer dependencies. For example, scenarios where a compromised sensor feeds a malicious controller, which in turn activates a robot near a human. This framework also allows focusing on areas where Physical AI differs most from classic ICS and where coverage is weakest (model provenance, learning controller validation, HRI safety).

Highlights

• Five-layer taxonomy: hardware-based trust → pre-deployment validation → runtime assurance → domain semantics → information feedback
• PRISMA-guided review: 312 articles + 28 standards + 14 regulatory frameworks + 12 incident reports (2015–2025)
• Identified gaps focused on model provenance, learning controller validation, and human-robot interaction safety; proposed 10 prioritized research challenges

Critical take

This article is a non-peer-reviewed preprint. Its main output is a conceptual taxonomy and literature review. The 'reference architecture' is not explicitly evaluated. While the ten research challenges are useful as a reading list, they contain no empirical validation or refutation beyond the stated criteria. The taxonomy is merely a reorganization of known security domains and offers no new technical contribution. Therefore, the work's real value depends on whether the community actually adopts this framework.