arXiv: Towards Model-based Run-time Cybersecurity: On Control-Flow Anomaly Detection, Attack Identification, and Hardware Monitoring

This publication introduces a novel framework for run-time cybersecurity in AI systems, focusing on control-flow anomaly detection and hardware-level monitoring. It proposes a model-based approach that continuously verifies whether an AI system’s execution path deviates from expected behavior, enabling real-time attack identification. The paper is not a regulatory mandate but a technical contribution that informs how future AI safety standards might be implemented, particularly under the EU AI Act’s requirements for high-risk systems to have robust monitoring and incident response capabilities.

The primary audience is organizations deploying high-risk AI systems in critical sectors such as healthcare, transportation, energy, and finance, as well as cloud service providers and industrial control system operators. Any entity subject to Article 15 of the EU AI Act, which mandates accuracy, robustness, and cybersecurity, should pay attention. The framework suggests that hardware-based monitoring could become a compliance expectation for demonstrating continuous safety, especially for systems with limited human oversight.

Compliance teams should treat this as a signal to begin evaluating their current monitoring infrastructure against emerging technical benchmarks. Specifically, they should assess whether their AI systems can detect control-flow anomalies in real time, and if not, initiate a gap analysis. Engage with engineering teams to pilot hardware monitoring solutions, and document these efforts as part of your technical documentation for future conformity assessments. Also, monitor the European Commission’s harmonised standards for AI, as this research may influence their development. No immediate action is required, but proactive evaluation now will reduce future compliance burden.