An on-device model is an AI model stored and executed locally on a user’s machine instead of being sent only to a cloud service. The device downloads the model files, keeps them on disk, and uses local compute to run inference. This can improve speed, offline use, and privacy, but it also turns the model into endpoint software that must be managed, updated, and removed like any other local component.
In cyber security, on-device models matter because they expand the attack surface of the endpoint. Attackers may try to tamper with model files, disable policy controls, force unwanted re-downloads, or abuse local model data to persist features or bypass restrictions. Defenders, meanwhile, must verify integrity, control permissions, and monitor storage and configuration changes. In real deployments, the key question is not just what the model can do, but who controls its lifecycle on the machine.