How Far Can You Trust a Local Generative AI Where There Is No Signal? ── A preprint that organizes trust mechanisms by connectivity level and tests them, down to signed knowledge packs, with fully local RAG on a Raspberry Pi 5

1. What problem does the paper address?

Generative AI and large language models (LLMs) are moving into Internet of Things devices. Yet most deployments assume a cloud connection, while many IoT settings have intermittent, restricted, or no connectivity at all. The abstract starts from this mismatch^[1].

Without a connection, two problems arrive together. First, the device cannot check a model's answer against an outside service. Second, there are few ways to update what the device knows. When a bundle of new knowledge arrives, the device itself has to decide whether it is genuine and whether anyone altered it on the way. Safeguards that assume the cloud mostly stop working the moment the link drops.

This paper is a preprint posted to arXiv and has not been peer reviewed. Everything below about methods and results should be read as the authors' claims.

2. What does it propose?

The core idea is to rebuild trust mechanisms around the state of connectivity. The authors define a connectivity-regime framework with levels C0 to C4, sort inference-time trust mechanisms into a taxonomy, and propose signed, versioned "knowledge packs" as the channel for updating knowledge when the device is disconnected^[1].

The test bed is a Raspberry Pi 5, a small single-board computer. Isolated from the network, it runs retrieval-augmented generation (RAG) fully on the device. RAG first retrieves documents related to a question and then has the model write an answer grounded in them^[5]. The authors used three sizes of Qwen2.5, three context sizes, and 300 questions from SQuAD 2.0. SQuAD 2.0 is a reading-comprehension dataset that mixes in questions whose answers are not in the passage, so it tests whether a model can hold back^[3].

Four kinds of mechanism are evaluated: a retrieval-score gate that refuses when retrieval looks weak; a deterministic output validator that turns malformed output into an explicit abstention; an NLI-based verifier that checks whether the answer is supported by the evidence; and signature and hash checks on knowledge packs.

3. What did it show? (Only what the abstract states)

• An empirically calibrated retrieval-score gate detects knowledge gaps almost perfectly (AUROC 0.97) but detects in-topic unanswerable questions poorly (0.68).
• The deterministic output validator converts malformed outputs into explicit abstentions with no observed loss of correct answers. The NLI-based verifier the authors tested adds little.
• For the 7B model, 96% of substantive answers to unanswerable-labelled questions match normalized spans of the retrieved passages.
• A 3B model reaches the same gold-answer containment rate as the 7B model at less than half the latency and estimated energy, although the 7B model far more often exceeds a token-F1 threshold of 0.5. Retrieving five passages instead of three lowers correctness from 75% to 52%.
• Verifying a signed pack takes about 4.5 ms, against about 29 min to embed its passages on the device. Signature and hash checks alone accept six of nine tested update attacks that layered verification rejects.
• Yet a validly signed poisoned pack passes every pack check. On 30 previously correct questions, correct answers drop to zero and 14 return the injected answer.

The authors close the abstract by stating that none of the mechanisms they evaluated establishes the truth of the evidence. A signature tells you who issued a pack and that it was not changed in transit. It says nothing about whether the content is right. That sentence is, in effect, the paper's conclusion^[1].

Much is left open. Who writes and signs the packs, and under what procedure? Does the 96% match on supposedly unanswerable questions point to a labelling issue in the data or to a model error? The abstract does not say.

4. A concrete example

Take a clinical trial site where a terminal sits in an area with restricted network access. Staff use it to ask questions about the protocol and site procedures. The terminal holds a knowledge pack built from distributed documents and a small language model. When the protocol is amended, a new pack arrives.

Under the second approach, a conversation might go like this.

5. What is not new, and where are the limits?

Most of the parts already exist. RAG has been widely used as a way to combine retrieval with generation^[5]. Evaluating with unanswerable questions mixed in was the point of SQuAD 2.0^[3]. Attacks that plant crafted text in a RAG knowledge source to trigger a chosen wrong answer were reported earlier as PoisonedRAG^[4]. What this paper adds is arranging these pieces along the axis of connectivity and measuring them end to end, including the update channel, on a small device cut off from the network. It is an organizing framework plus measurement for deployment design, not the discovery of a new phenomenon.

Limits worth keeping in mind:

• Type of question. The 300 SQuAD 2.0 questions are general reading-comprehension items. Whether the same patterns hold for technical documents or long procedures is unknown.
• One device. Latency and energy comparisons come from a Raspberry Pi 5. How they change on other hardware is not shown.
• Scope of the poisoning test. The test is limited to 30 previously correct questions, and the abstract does not show how results vary with the way the attack is built.
• A gap in the gate. Detection of in-topic unanswerable questions stays at 0.68, so the retrieval-score gate alone leaves wrong answers through.
• Upstream procedure. How packs are written, approved, and signed is outside what the abstract covers.

6. Why is this topic clustering now?

Strictly speaking, it is not clustering. At collection time no other paper asking the same question was found, so the cluster size was 1. The signal came from readers of HF Daily Papers: 8 upvotes, 8 comments, and 0 GitHub stars. Under the selection rules the comment count met the threshold, but that only shows the paper caught some researchers' attention. It says nothing about whether the claims are correct, or whether a topic is forming. Attention and correctness are measured on different scales.

The keywords still show where interest is pointing: "connectivity-regime framework," "signed versioned knowledge packs," "retrieval-score gate," "deterministic output validator." The focus is not on a stronger model but on the checks placed around a model and on how its knowledge gets updated. This site has covered papers on agent execution layers and verifier roles; this one carries the same question into places with no connection.

The authors have released their code and data^[2]. Whether a cluster grows depends on other groups trying the same measurements on other devices and documents and reproducing the pattern. For now, it is best treated as one paper's claims.

7. Where does this connect to pharma and regulatory work?

Pharmaceutical work has many places with no network, or with access deliberately restricted: terminals in manufacturing areas, closed networks at trial sites, devices in transit, sites during a disaster. If generative AI is placed there, the paper's framing suggests deciding in advance which checks remain available at each level of connectivity and which do not.

The most direct link is between signed knowledge packs and document control. In a pharmaceutical company, only approved versions are distributed, old versions are withdrawn, and the record shows who approved what and when. Signatures and version numbers correspond to confirming that "the approved version arrived." But in the authors' experiment, a validly signed poisoned pack passed every check on the device. A signature guarantees origin and integrity; the correctness of the content rests on the approval procedure before distribution. Technology on the device cannot replace that upstream approval.

Three practical points follow. First, put knowledge packs for devices under the same approval and version control as other controlled documents. Second, treat "no answer" as a legitimate output on the device, and abstain on malformed output and weak retrieval. Third, when choosing a model size, look beyond whether the gold answer is contained: compare latency, energy, and a separate measure of answer quality side by side. Within this paper, the results apply to the device and dataset tested; it does not show how to meet regulatory requirements.

A signature tells you who sent something. It does not tell you whether it is right. Whether that distinction can be written into operating procedures is the first question when placing generative AI where there is no connection.