Kinetic Risk: Securing and Governing Physical AI in the Wild

Kinetic Risk: Securing and Governing Physical AI in the Wild

Speaker: Padma Apparao, Senior Principal Engineer — AI Systems, Solutions and Performance Architect, Intel

Conference: [un]prompted 2026 — The AI Security Practitioner Conference

Date: March 3–4, 2026, San Francisco

Watch on YouTube: https://www.youtube.com/watch?v=YzP3Fif_DHU

Reading time: ~9 minutes

TL;DR

When AI moves from screens to the physical world, errors stop being recoverable — they become kinetic events measured in force, speed, and mass. Padma Apparao of Intel argues that physical AI requires an entirely different security and governance model, where latency is a safety KPI, human-in-the-loop is architecturally impossible, and governance must be embedded inside the system rather than written in external policy documents.

Introduction

In the digital world, an AI mistake means a wrong answer, a bizarre hallucination, or a failed task. You hit Ctrl+Z, reboot, try again. In the physical world, a robot arm that misjudges grip force doesn't produce a log entry — it breaks the cup. A drone that misidentifies a target doesn't get rolled back — it creates casualties. An autonomous vehicle that misreads a pedestrian crossing doesn't prompt a retry — it hits someone.

Padma Apparao, a Senior Principal Engineer at Intel with nearly three decades of experience spanning database benchmarks, AI performance engineering, and hardware architecture, calls this gap "kinetic risk." Her talk at [un]prompted 2026 made the case that the physical AI transition — driven by converging advances in sensors, frontier models, and edge compute — is happening now, and the security and governance frameworks the industry relies on are not ready for it.

According to Deloitte 2026 data cited in her slides, 58% of companies are already using some form of physical AI, with that figure expected to reach 80% within two years. The "ChatGPT moment" for physical AI — the point where autonomous machines become a must-have operational necessity rather than a nice-to-have experiment — has arrived.

▶ Watch: Introduction and the Physical AI Transition (00:00)

What Makes Physical AI Different

The conceptual difference between digital and physical AI is stark. Digital AI acts on information; errors are reversible; compute can be elastic; failures are tolerable. Physical AI acts on matter; errors transfer energy as force, speed, or momentum; compute is constrained by hardware; failures have real-world consequences.

Apparao described three converging technologies that have made physical AI deployable at scale today:

1. Sensors — High-fidelity LiDAR, cameras, IMUs, and tactile sensors that have matured dramatically in recent years.
2. Foundation models — Frontier models that are now stable enough for perception and reasoning tasks with acceptable hallucination rates.
3. Edge compute — Low-latency processors capable of running inference in real-time at the point of action.

Together, these enable the autonomous economy that industries including smart factories, warehouses, healthcare, autonomous vehicles, and drones all require.

▶ Watch: Why Physical AI Is Here Now (02:00)

The Physical AI Stack: Five Layers

Apparao laid out physical AI as a five-layer loop, from sensing to action, with specific model types at each layer:

| Layer | Function | Example Models |

|---|---|---|

| Sense | Acquire raw data from environment | Cameras, LiDAR, IMU, tactile sensors |

| Perceive | Extract structured information | VLMs (CLIP, DINOv2, BLIP-2) |

| Think (World Model) | Model the world; predict outcomes | DreamerV3, latent dynamics models |

| Reason & Plan | Decide what to do | LLMs (GPT-4, PaLM-E) |

| Control / Act | Execute actions | VLAs (OpenVLA, RT-2, π₀, TinyVLA) |

The key insight from this architecture: LLMs and VLMs are optional accelerators in this stack. World models are mandatory. The world model is the layer that takes system state as input and predicts the next state — answering the question "what will happen if I take this action?" before the action is issued.

Apparao illustrated this with a deceptively simple example: picking up a coffee cup. The world model must determine whether the cup is fragile or not, whether the surface is rigid or soft, whether the cup has a handle, and calculate the appropriate grip force. If it gets any of these wrong, the result is spilled coffee. In a warehouse or surgical context, equivalent misjudgments can destroy property or harm people.

▶ Watch: The Physical AI Five-Layer Stack (04:00)

Latency Is a Safety KPI, Not a Performance KPI

One of the most striking claims in the talk concerned latency. In digital AI, everyone optimizes for tokens per second or time-to-first-token — latency is a quality-of-experience metric. In physical AI, latency is a safety parameter.

The numbers Apparao presented make this visceral:

• A large LLM (7B–70B parameters) has inference latency in the range of 200ms to several seconds — too slow and too nondeterministic for physical control.
• A Vision Language Action (VLA) core (1B–7B parameters) targets 20–100ms latency.
• The control policy / planner layer must operate at under 1–5ms, with deterministic, timing-guaranteed execution.
• Safety / runtime monitors must operate at under 1ms — their job is to preempt motion, not explain it.

The entire sensing-to-action loop must complete within 100–200ms. A pedestrian stepping in front of a vehicle doesn't give the system several seconds to deliberate. "You can be perfectly right," Apparao said, "but if your reaction time is a few milliseconds slow, you actually hit the pedestrian."

This latency constraint also fundamentally breaks the human-in-the-loop model. Humans cannot make decisions in sub-millisecond timeframes. "The human is not in the loop anymore, or it cannot be in the loop," she stated plainly. What humans can do is set the strategic boundaries, design the architecture, and define the intent before execution begins. The execution itself must be entirely autonomous.

▶ Watch: Latency as a Safety Parameter (10:00)

Fail-Safe Architecture and the Point of No Return

Apparao identified a critical point-of-no-return in the physical AI control loop. Up until the Vision Language Action model issues commands to actuators, errors can still be caught and corrected — the world model's prediction was wrong, the plan is still in software. Once the VLA has issued motion commands to the physical system, intervention is no longer possible in real time.

"It's too late. You cannot reverse back," she said. This is not a theoretical concern — it is the architectural reason why governance must be embedded in the system rather than administered externally.

A fail-safe architecture addresses this through multiple mechanisms:

• Physical kill paths and override buttons — hardware-level emergency stops
• Graceful degradation — systems that fail safely rather than abruptly
• Deterministic control paths with bounded latency guarantees
• Sensor authentication — preventing spoofed sensor data from driving decisions
• Model signing and attestation — ensuring the running model is the expected model
• Secure control channels — protecting the communication between reasoning layers and actuators

▶ Watch: Fail-Safe Architecture and Governance Primitives (14:01)

Governance Must Be Embedded, Not External

The most pointed critique in Apparao's talk was aimed at existing governance frameworks. Both NIST AI RMF and the EU AI Act, she argued, are fundamentally inadequate for physical AI.

"The NIST AI framework does not talk about anything about physical AI at all," she said. "It's all about model attestation, model accuracy, data purity — but nothing related to the physical world." It also misses real-time monitoring requirements and lacks specifications for physical-world controls.

The EU AI Act is arguably worse on this front: it explicitly excludes physical AI systems from its highest-risk categories in many cases, treating them as a problem for other regulatory domains.

"Governance should be inside the system and be setting the boundaries," Apparao argued. Governance documents that exist only on paper have no mechanism to actually constrain a robot arm moving at speed.

The governance primitives she articulated include:

• Timing and latency — hard bounds on how long any layer may take
• Scope — physical boundaries within which the system is permitted to operate (geo-fencing)
• Override protocols — when and how to escalate or halt, and what "safer state" transitions look like
• Accountability and traceability — continuous runtime monitoring, not one-time model certification, with the ability to reconstruct incidents

On accountability, she drew a pointed analogy to aviation: black box flight recorders didn't exist until the regulatory community recognized they needed to recreate accidents. Air traffic control didn't exist until crashes made it necessary. Physical AI is at the pre-crash stage of that regulatory arc today.

▶ Watch: Governance Frameworks and Their Gaps (18:02)

Liability Flows Up the Stack

When a physical AI system causes harm, who is responsible? Apparao proposed a clear principle: liability flows up the stack to the last layer that could have prevented the action.

Sensors have minimal responsibility — they collect and pass data. The world model has partial responsibility — it can only act on what it perceives. The VLA and control layer, as the final actor capable of stopping an irreversible action, bears the greatest responsibility.

Since humans cannot be in the real-time execution loop, this creates an imperative for system-level certification. "Not a model certification from OpenAI or Google or Anthropic," she emphasized, "but entire system-level certifications" covering the integrated stack from sensor to actuator.

"Zero risk is impossible," she concluded. "It's about damage control, not damage prevention."

▶ Watch: Accountability and Liability (20:02)

Notable Quotes

"When AI's mistakes start moving into the real world, that's kinetic risk."

"Latency is not a Performance KPI anymore — it's a safety KPI."

"Zero risk is impossible. It's about damage control, not damage prevention."

"Governance should be embedded into the architecture. NIST, the EU AI Act — they are all on paper, and they have no way of controlling the system. That's the gap."

"The human is not in the loop anymore, or it cannot be in the loop, because humans cannot think in milliseconds."

Key Takeaways

• Physical AI errors are irreversible. A wrong answer in software can be corrected; a wrong action in the physical world transfers kinetic energy with consequences that cannot be undone.
• Latency is a safety parameter. VLA systems must complete the full sensing-to-action loop within 100–200ms. Control policies must be deterministic at under 5ms. LLMs are too slow for direct physical control.
• Human-in-the-loop is architecturally impossible at millisecond timescales. Humans set strategic intent and boundaries; machines execute autonomously within those bounds.
• Governance must be embedded in the system, not written in external policy documents. NIST AI RMF and the EU AI Act both fail to address physical AI's real-time control requirements.
• Liability belongs to the last layer that could have prevented the harmful action — which means system-level certification is required, not just model-level attestation.

Slides Reference

Slides available: 2026-04-04-D1-S2-16-03-Kinetic-Risk-Securing-and-Governing-Ph.pdf

Key slide topics include: Digital vs. physical AI comparison table (reversible vs. irreversible, information vs. matter); the five-layer physical AI loop (Sense → Perceive → Think → Reason & Plan → Control/Act); LLM → VLM → VLA → World Model evolution diagram; the coffee cup example as a worked walkthrough; component latency targets table (Vision Encoder: 5–20ms, World Model: 10–40ms, VLA Core: 20–100ms, Control Policy: <1–5ms, Safety Monitor: <1ms); the fail-safe architecture diagram; and the governance gap analysis comparing NIST AI RMF, EU AI Act, and physical AI requirements.