Securing the Cognitive Layer: A Survey on Security Threats, Defenses, and Privacy-Preserving Architectures for LLM-IoT Integration

Abstract

The convergence of Large Language Models (LLMs) and Internet of Things (IoT) systems has created a new class of intelligent applications across healthcare, industrial automation, smart cities, and connected homes. However, this integration introduces a complex and largely underexplored security landscape. LLMs deployed in IoT contexts face threats spanning both the AI and embedded systems domains, including prompt injection through sensor-driven inputs, model extraction from edge devices, data poisoning of IoT data streams, and privacy leakage through LLM-generated responses grounded in personal data. Simultaneously, LLMs are proving to be powerful tools for IoT security, with LLM-based intrusion detection systems achieving 95–99% accuracy on standard IoT datasets and LLM-driven threat intelligence outperforming traditional machine learning by significant margins. We systematically review 88 papers from IEEE, ACM, MDPI, and arXiv (2020–2025), providing: (1) a structured taxonomy of security threats targeting LLM-IoT systems, (2) a review of LLMs as security enablers for IoT, (3) an evaluation of privacy-preserving architectures including federated learning, differential privacy, homomorphic encryption, and trusted execution environments, (4) domain-specific security analysis across healthcare, industrial, smart home, smart grid, and vehicular IoT, and (5) a literature-based comparative analysis of LLM-based security systems. A central finding is the accuracy–efficiency–privacy trilemma: the model compression techniques needed to deploy LLMs on resource-constrained IoT devices can degrade security and even introduce new vulnerabilities. Our analysis provides researchers and practitioners with a structured understanding of both the risks and opportunities at the frontier of LLM-IoT security.

1. Introduction

The Internet of Things (IoT) continues to expand at a remarkable pace. By 2023, the number of connected IoT devices worldwide exceeded 16 billion, with projections reaching 30 billion by 2030 [1]. In parallel, Large Language Models (LLMs) built on the transformer architecture [2] have demonstrated capabilities in natural language understanding, reasoning, and code generation that were difficult to imagine just a few years ago. Models such as OpenAI’s GPT-4, Meta’s LLaMA, and Google’s Gemini can interpret context, generate coherent multi-step plans, and process multimodal inputs, making them natural candidates for integration with IoT systems that generate continuous, heterogeneous data streams.

The appeal of this integration is straightforward. LLMs can serve as a “cognitive layer” for IoT ecosystems, translating raw sensor readings into actionable insights, enabling conversational interfaces for device management, and automating complex decision-making processes that previously required human intervention [3]. Early work has already demonstrated LLM-based smart home agents that interpret underspecified user commands [4,5], industrial IoT systems that combine LLM reasoning with reinforcement learning for process optimization [6], and multisensory models that condition language generation on streams of IoT sensor data [7]. The TENT framework showed that a frozen LLM can perform zero-shot human activity recognition by aligning IoT sensor signals with textual embeddings [8], pointing toward a future where LLMs bring human-like cognitive flexibility to sensor networks.

Yet this convergence introduces a security landscape that is both broad and insufficiently understood. The challenges are bidirectional. On one side, LLM-IoT systems inherit the traditional vulnerabilities of IoT, including constrained device resources, heterogeneous protocols, and large attack surfaces created by billions of connected endpoints [9]. On the other side, the LLM component introduces AI-specific threats such as prompt injection, model extraction, backdoor attacks, and training data memorization that have no direct analogue in conventional IoT security [10,11]. When these two threat domains intersect, novel risks emerge. A compromised sensor feeding manipulated data to an LLM-based controller could trigger cascading failures across an industrial floor. An adversary exploiting prompt injection in a healthcare IoT assistant could extract private patient information or generate harmful medical guidance. The stakes of getting security wrong in LLM-IoT systems are substantial.

A core tension that emerges throughout our analysis is the accuracy–efficiency–privacy trilemma facing LLM-IoT deployments. While individual trade-offs between pairs of these objectives (e.g., accuracy vs. efficiency, or privacy vs. utility) have been studied in isolation [12,13], we identify the three-way interaction as a defining challenge specific to LLM-IoT edge deployments, where all three constraints bind simultaneously. Resource-constrained IoT devices cannot run full-scale LLMs, necessitating model compression through quantization and pruning. However, these compression techniques can degrade security performance and even introduce new vulnerabilities: recent work demonstrates that models benign at full precision can become malicious after quantization [14]. Meanwhile, privacy-preserving techniques such as differential privacy and federated learning impose additional computational overhead that conflicts with efficiency requirements. Navigating this trilemma is a recurring challenge across all domains we examine, and it serves as one of the unifying themes of this survey.

Several survey papers have examined the LLM-IoT space from different angles. Sarhaddi et al. [15] provide a broad, comprehensive survey of LLMs and IoT with 332 references spanning applications, architectures, and challenges across all functional layers. Alwahedi et al. [16] bridge traditional machine learning IoT security with emerging LLM and generative AI approaches. Ferrag et al. [17] offer a dual-perspective review of LLM applications and vulnerabilities in cyber–physical systems. While these works provide valuable context, none offers a deep, security-first analysis of the LLM-IoT integration. Sarhaddi et al. cover security as one of many topics rather than the central focus. The LLM security surveys by Das et al. [10] and Yao et al. [11] address LLM vulnerabilities broadly but do not ground their analysis in IoT-specific deployment constraints and threat models.

This survey fills that gap. We organize the entire analysis around security dimensions rather than application categories, providing depth where existing work offers breadth. Specifically, our contributions are:

• A security-focused taxonomy of the LLM-IoT landscape, covering threats to LLM-IoT systems and applications of LLMs for IoT security.
• A detailed threat analysis of attack vectors specific to LLM-IoT integration, including prompt injection in sensor-driven contexts, model extraction from edge-deployed LLMs, data poisoning of IoT data streams, and privacy leakage through LLM responses.
• A systematic review of LLMs as security enablers, covering intrusion detection, threat intelligence, vulnerability assessment, and device fingerprinting, with reported performance metrics.
• An evaluation of privacy-preserving architectures for LLM-IoT, including federated learning, differential privacy, homomorphic encryption, secure multi-party computation, and trusted execution environments.
• Domain-specific security analysis across healthcare, industrial, smart home, smart grid, and vehicular IoT deployments.
• A literature-based comparative analysis of LLM-based IoT security systems, compiling accuracy, F1-score, and efficiency metrics from the recent literature.

The remainder of this paper is organized as follows. Section 2 describes our survey methodology and paper selection process. Section 3 provides background on LLM fundamentals, the IoT security landscape, and the expanded attack surface created by their integration. Section 4 surveys related work and positions our contribution. Section 5 presents our security taxonomy. Section 6 covers security threats to LLM-IoT systems. Section 7 examines LLMs applied for IoT security. Section 8 evaluates privacy-preserving architectures. Section 9 provides domain-specific security analysis. Section 10 discusses challenges and open problems. Section 11 outlines future research directions, and Section 12 concludes the paper.

2. Survey Methodology

This section describes the systematic process used to identify, select, and analyze the literature included in this survey.

2.1. Search Strategy

We conducted a comprehensive literature search across six major academic databases: IEEE Xplore, ACM Digital Library, Google Scholar, arXiv, MDPI, and Elsevier ScienceDirect. The search period covered publications from January 2020 through February 2025, capturing both the rapid growth of LLM research post-2022 and relevant foundational IoT security work from the preceding years.

Our primary search strings were:

• “large language model” AND “IoT” AND “security”
• “LLM” AND “intrusion detection” AND “IoT”
• “prompt injection” AND (“IoT” OR “embedded”)
• “federated learning” AND “LLM” AND “privacy”
• “adversarial attack” AND “LLM” AND “sensor”
• “differential privacy” AND “language model” AND “IoT”
• “model extraction” AND (“edge” OR “IoT”)

We supplemented these keyword searches with backward and forward citation tracking from key papers identified in the initial search, as well as manual review of recent proceedings from top-tier venues (IEEE S&P, USENIX Security, ACM CCS, NeurIPS, ICML, NDSS).

2.2. Selection Criteria

We applied the following inclusion and exclusion criteria:

Inclusion criteria:

• Peer-reviewed journal and conference papers directly addressing LLM-IoT security, privacy, or related attack/defense mechanisms.
• High-quality arXiv preprints with demonstrable impact (10+ citations or from established research groups), given the rapidly evolving nature of this field.
• Papers addressing LLM security or IoT security individually, where the findings are directly applicable to LLM-IoT integration.

Exclusion criteria:

• Papers on general machine learning for IoT without an LLM or transformer-based component.
• Publications before 2020, unless seminal (e.g., foundational transformer architecture work).
• Non-English publications.
• Papers with insufficient methodological detail or unverifiable results.

2.3. Paper Selection Process

Our selection followed a structured multi-stage process, illustrated in Figure 1. The initial database search yielded approximately 450 candidate papers. Title and abstract screening reduced this set to roughly 200 papers of potential relevance. Full-text review further narrowed the selection to 88 papers that met all inclusion criteria and provided substantive contributions to the LLM-IoT security landscape. These 88 papers form the analytical foundation of this survey.

Figure 1. PRISMA-style flow diagram of the paper selection process.

2.4. Analysis Framework

Selected papers were categorized along four primary dimensions that mirror the structure of this survey:

1.

Threats TO LLM-IoT systems: Papers identifying or demonstrating attack vectors targeting LLM-IoT integration (prompt injection, data poisoning, model extraction, backdoor attacks, privacy leakage, etc.).

2.

LLMs FOR IoT security: Papers proposing or evaluating LLM-based approaches to IoT security tasks (intrusion detection, threat intelligence, vulnerability assessment, device fingerprinting).

3.

Privacy-preserving approaches: Papers developing or analyzing techniques for protecting data privacy in LLM-IoT systems (federated learning, differential privacy, homomorphic encryption, TEEs, MPC).

4.

Domain-specific applications: Papers examining LLM-IoT security within a specific application domain (healthcare, smart home, industrial, smart grid, transportation, wearables).

Many papers span multiple categories; in such cases, the paper was assigned to the category of its primary contribution while being referenced across relevant sections. Where quantitative performance metrics were reported, we extracted accuracy, F1-score, latency, and throughput data for the literature-based comparative analysis in Section 7.

3. Background

3.1. Large Language Model Fundamentals

A Large Language Model is a neural network, typically built on the transformer architecture [2], trained on massive text corpora to understand and generate human language. The transformer relies on a self-attention mechanism that allows the model to weigh the relevance of different parts of an input sequence when producing an output, enabling it to capture long-range dependencies far more effectively than earlier recurrent architectures. Modern LLMs such as GPT-4, LLaMA, and Gemini contain billions of parameters and are trained using a combination of unsupervised pre-training on large text datasets followed by supervised fine-tuning and reinforcement learning from human feedback (RLHF) to align model behavior with human preferences [18].

Several capabilities of LLMs are particularly relevant to IoT integration. First, LLMs excel at natural language understanding, allowing users and systems to interact with IoT devices through conversational interfaces rather than rigid command structures. Second, LLMs demonstrate in-context learning, where the model adapts its behavior based on examples or instructions provided in the prompt without requiring retraining. This is valuable in IoT settings where new device types or data formats may appear frequently. Third, LLMs possess broad world knowledge acquired during pre-training, enabling them to reason about physical processes, device behaviors, and domain-specific concepts, as demonstrated by the “Penetrative AI” work showing that GPT-4 can interpret accelerometer and GPS readings with near-expert reasoning [19]. Fourth, recent work has extended LLMs to handle multimodal inputs, including sensor time series, images, and structured data, broadening their applicability to the diverse data types generated by IoT ecosystems [7].

For deployment in IoT contexts, model size and computational requirements are critical considerations. Full-scale LLMs with hundreds of billions of parameters require cloud-based inference infrastructure, while smaller models (often termed Small Language Models, or SLMs) with parameter counts ranging from hundreds of millions to a few billion can be deployed on edge devices through techniques such as quantization, pruning, and knowledge distillation [20]. This spectrum of model sizes creates a corresponding spectrum of security considerations, as we discuss in later sections.

3.2. IoT Security Landscape

The IoT ecosystem encompasses a wide range of devices, from simple sensors and actuators to more capable gateways and edge servers, connected through heterogeneous protocols and deployed across diverse environments. This heterogeneity, combined with the sheer scale of deployments, makes IoT security fundamentally challenging [9].

Traditional IoT security concerns include device-level vulnerabilities such as weak authentication, unencrypted firmware, and limited support for security updates; network-level threats including man-in-the-middle attacks, denial of service, and protocol exploits; and data-level risks such as unauthorized access to sensor streams and privacy violations from behavioral inference [21]. Many IoT devices operate under severe resource constraints, with limited processing power, memory, and energy budgets, that preclude the deployment of heavyweight security mechanisms [22]. The result is that IoT networks often present a large, distributed attack surface with numerous weakly protected endpoints.

Machine learning has emerged as a key tool for IoT security, particularly for intrusion detection and anomaly detection in network traffic. Classical approaches using random forests, gradient boosting, and deep neural networks have shown strong performance on IoT security datasets [9,23]. However, these systems typically require labeled training data, struggle with novel attack types, and offer limited interpretability, motivating the exploration of LLM-based alternatives that can leverage pre-trained knowledge and natural language reasoning.

3.3. The LLM-IoT Attack Surface

Integrating LLMs into IoT systems does not simply add the vulnerabilities of each component together; it creates an expanded attack surface with novel threat vectors that arise from the interaction between the two [17,24]. Figure 2 provides a layered view of this architecture, highlighting the attack vectors and defense mechanisms at each level.

Figure 2. Layered LLM-IoT security architecture. Each layer faces distinct attack vectors (left, red) and is protected by corresponding defense mechanisms (right, green). Dashed arrows indicate the mapping between each architectural layer and its associated threats and defenses.

At the data ingestion layer, IoT sensors continuously feed data to LLMs for interpretation, and this data pipeline is vulnerable to poisoning. Unlike traditional data poisoning where an attacker corrupts a training dataset, LLM-IoT poisoning can occur at inference time through manipulated sensor inputs or corrupted context windows [25]. At the model layer, LLMs deployed on edge devices are susceptible to model extraction through side-channel analysis, where an attacker can infer architectural details and parameters by monitoring power consumption or electromagnetic emissions during inference [26]. The model compression techniques (quantization, pruning) commonly used to fit LLMs onto resource-constrained IoT hardware can themselves introduce security vulnerabilities, as recent work has shown that benign models can become malicious after quantization through carefully crafted poisoning attacks [14]. At the communication layer, the data exchanged between IoT devices and LLM inference endpoints, whether local or cloud-based, is vulnerable to interception and manipulation. Research has demonstrated that even encrypted LLM inference traffic can be classified to reveal query content [27]. At the output layer, LLM responses may inadvertently leak private information learned from IoT data, and adversarial prompting techniques can be used to extract sensitive information or cause the model to generate harmful outputs, such as unsafe control commands for physical devices [28].

Understanding this layered attack surface is essential for developing security strategies that address the full scope of LLM-IoT risks. The following sections examine each dimension in detail.

4. Related Surveys and Our Positioning

The intersection of LLMs and IoT has attracted growing research attention, and several surveys have addressed various aspects of this space. Table 1 provides a structured comparison of existing surveys against our work.

Table 1. Comparison of Related Surveys on LLM, IoT, and Security.

Survey	Year	Refs	LLM	IoT	Sec.	Priv.	Threats	Domain	Metrics	Edge
Sarhaddi et al. [15]	2025	332	✓	✓	Low	Low	–	–	–	Low
Al-Garadi et al. [9]	2020	300+	–	✓	High	Med	✓	–	✓	–
Das et al. [10]	2025	200+	✓	–	High	Med	✓	–	–	–
Yao et al. [11]	2024	150+	✓	–	High	Med	✓	–	–	–
Alwahedi et al. [16]	2024	100+	Med	✓	Med	Low	–	–	–	Low
Ferrag et al. [17]	2025	150+	✓	Med	Med	Low	Med	–	–	Med
He et al. [24]	2025	100+	✓	–	High	Low	✓	–	–	–
Liu et al. [29]	2025	50+	✓	Med	Med	–	Med	–	–	–
This Survey	2025	88	✓	✓	High	High	✓	✓	✓	High

Bold indicates the current survey. ✓ = coverage provided; – = not covered; Low/Med/High = depth of treatment.

Sarhaddi et al. [15] provide the most comprehensive general-purpose survey of LLMs in IoT, covering applications across perception, network, processing, and application layers with 332 references. Their work is an excellent resource for understanding the breadth of LLM-IoT integration but treats security as one consideration among many rather than a central organizing principle. While Sarhaddi et al. provide a horizontal survey spanning LLM-IoT applications across all functional layers with breadth as the primary contribution, our work provides a vertical, deep-dive analysis focused specifically on security mechanisms, threat taxonomies, and privacy-preserving architectures. Their survey answers “What can LLMs do in IoT?”; our survey answers “How do we secure LLM-IoT integration, and what are the risks if we fail?”.

Al-Garadi et al. [9] offer a thorough survey of machine learning and deep learning methods for IoT security, covering authentication, access control, malware detection, and intrusion detection. Published in 2020, this work predates the LLM era and therefore does not address the unique security challenges and opportunities that LLMs bring to IoT environments.

On the LLM security side, Das et al. [10] present an authoritative ACM Computing Surveys paper covering jailbreaking, prompt injection, backdoor attacks, and privacy risks across the LLM lifecycle. Yao et al. [11] organize LLM security into “the good, the bad, and the ugly,” providing a useful framework for understanding LLMs as both security tools and attack targets. He et al. [24] focus specifically on the security of LLM-based autonomous agents, covering knowledge poisoning and tool manipulation, which is directly relevant to IoT agent deployments. While these surveys provide deep LLM security analysis, they do not ground their findings in the constraints and threat models specific to IoT, such as resource limitations, heterogeneous device populations, and physical-world consequences of security failures.

Alwahedi et al. [16] bridge the gap between traditional ML-based IoT security and emerging generative AI approaches, providing a roadmap for this transition. Ferrag et al. [17] examine LLM applications and vulnerabilities in cyber–physical systems, offering dual-perspective analysis relevant to IoT. Liu et al. [29] analyze the dual role of LLMs as both threat actors and security agents in network environments. These works provide partial coverage of the LLM-IoT security space but none offers the combination of threat depth, privacy architecture analysis, domain-specific security focus, and literature-based performance comparison that our survey provides.

In summary, our security-first organizational approach allows us to identify cross-cutting challenges, such as the accuracy–efficiency–privacy trilemma in edge deployments, that are not visible from broader survey perspectives.

5. Taxonomy of LLM-IoT Security

To structure our analysis, we present a taxonomy that organizes the security landscape of LLM-IoT integration into two primary branches: security threats to LLM-IoT systems, and applications of LLMs for IoT security. Figure 3 illustrates this taxonomy.

Figure 3. Taxonomy of LLM-IoT security. The left branch covers threats targeting LLM-IoT systems across four layers. The right branch covers beneficial applications of LLMs for IoT security across four functional areas. Orange nodes represent threat categories; green nodes represent security function categories. Thick arrows show hierarchical relationships; thin gray arrows connect categories to specific attack or defense types.

This taxonomy differs from traditional IoT security frameworks in two key ways. First, it incorporates LLM-specific attack vectors, including prompt injection, jailbreaking, and hallucination exploitation, that have no direct analogue in conventional IoT threat models. Second, it recognizes the dual nature of LLMs as both attack targets and defensive tools, organizing the security landscape into threats TO and applications FOR rather than the traditional confidentiality-integrity-availability (CIA) triad. This dual-branch structure reflects a fundamental insight of this survey: the same LLM capabilities that make them vulnerable to adversarial manipulation are precisely what make them effective as security tools.

The threats branch is organized by the layer of the LLM-IoT stack being targeted:

• Data and Input Attacks target the interface between IoT sensors and the LLM, including prompt injection crafted through sensor data manipulation, data poisoning of IoT streams, and adversarial examples designed to cause misclassification or unsafe outputs.
• Model-Level Attacks target the LLM itself, including model extraction (stealing model weights or functionality), backdoor attacks (inserting hidden triggers during training or fine-tuning), and membership inference (determining whether specific data was used in training).
• Communication and Infrastructure Attacks target the data pathways between IoT devices and LLM inference endpoints, including man-in-the-middle attacks, encrypted traffic analysis, and exploitation of API interfaces.
• Privacy Leakage covers scenarios where the LLM inadvertently reveals sensitive information derived from IoT data, either through direct extraction by adversaries or through inference of private behavioral patterns.

The LLMs-for-security branch is organized by the security function being performed:

• Intrusion Detection covers the use of LLM architectures and embeddings for detecting malicious activity in IoT network traffic and device behavior.
• Threat Intelligence covers the application of LLMs to security log analysis, automated threat hunting, and vulnerability database querying.
• Vulnerability Assessment covers LLM-assisted security auditing of IoT firmware and automated fuzzing of IoT device interfaces.
• Authentication and Fingerprinting covers the use of LLMs for device identification, asset discovery, and behavioral authentication in IoT networks.

Orthogonal to both branches, privacy-preserving architectures (federated learning, differential privacy, homomorphic encryption, secure multi-party computation, and trusted execution environments) apply to both defensive and offensive contexts and are treated in a dedicated section. The following sections elaborate on each component of this taxonomy.

6. Security Threats to LLM-IoT Systems

This section examines the attack vectors targeting systems that integrate LLMs with IoT infrastructure. We organize the discussion following the threat taxonomy presented in Section 5, covering data and input attacks, model-level attacks, communication and infrastructure attacks, and privacy leakage. Table 2 provides a summary of the threat landscape.

Table 2. Summary of Security Threats to LLM-IoT Systems.

Category	Attack Type	IoT-Specific Manifestation	Potential Mitigation
Data & Input	Prompt Inj.	Manipulated sensor data injecting instructions into LLM	Input validation, DP, blockchain
	Data Poison.	Corrupted training data or RAG knowledge bases	Pipeline anomaly detection, provenance
	Adversarial	Crafted sensor perturbations causing misclassification	Ensemble defenses, adversarial training
Model-Level	Extraction	Side-channel fingerprinting of edge LLMs	Obfuscation, rate limiting
	Backdoor	Hidden triggers in fine-tuned models	Weight analysis, clean fine-tuning
	Membership	Determining if specific device data was in training	DP training, output perturbation
Comms	Traffic Analysis	Classifying encrypted queries via side channels	Traffic padding, noise injection
	API Manip.	Compromising device APIs used by agents	Tool verification, sandboxing
Privacy	Extraction	Extracting training data via prompting	Output filtering, machine unlearning
	Inference	Reasoning revealing private patterns from data	Data minimization, context limits

6.1. Data and Input Attacks

6.1.1. Prompt Injection in IoT Contexts

Prompt injection is among the most discussed vulnerabilities of LLM systems, but its manifestation in IoT environments introduces unique challenges. In a conventional web application, prompt injection occurs when a user crafts input text that overrides the system prompt or causes unintended behavior. In IoT contexts, the attack surface expands because LLM inputs may include sensor data, device status reports, and automated messages that an adversary can manipulate without direct access to the text interface.

The broader survey literature on prompt injection [28,30] categorizes attacks into direct injection (where the attacker directly manipulates model input) and indirect injection (where malicious content is embedded in data the model retrieves), both of which are relevant to IoT. In a smart home scenario, for instance, indirect injection could occur through a compromised IoT device that injects malicious text into its status reports, which are then processed by a home management LLM.

The OWASP Top 10 for LLM Applications identifies prompt injection as the highest-priority risk [31], and the IoT context amplifies this risk because the physical consequences of manipulated LLM outputs, such as incorrect device control commands, can cause tangible harm.

6.1.2. Data Poisoning of IoT Streams

Data poisoning attacks in the LLM-IoT context differ from classical training data poisoning because they can target both the training phase (corrupting the data used to fine-tune an LLM for IoT tasks) and the inference phase (manipulating the sensor data presented to the LLM at runtime). Mithsara et al. [25] propose a framework specifically for detecting data poisoning in wearable IoT systems using LLMs, leveraging zero-shot and few-shot learning to identify corrupted human activity recognition data. Their approach uses the LLM itself as a detector, evaluating whether incoming sensor patterns are consistent with expected distributions.

At the training level, research from Anthropic’s collaboration with the UK AI Safety Institute [32] demonstrates that as few as 250 malicious documents can successfully backdoor LLMs ranging from 600 million to 13 billion parameters. This finding is particularly concerning for IoT scenarios where LLMs are fine-tuned on domain-specific data collected from sensor networks, as the data collection process across distributed IoT devices creates multiple opportunities for poisoning.

Ikbarieh et al. [33] demonstrate a transfer-learning-based data poisoning attack specifically targeting LLM-based IoT network intrusion detection systems that use Retrieval-Augmented Generation (RAG). Their attack introduces word-level perturbations into the RAG knowledge base, degrading the quality of attack analysis while preserving surface-level plausibility.

6.1.3. Adversarial Examples

Adversarial examples, carefully crafted inputs designed to cause machine learning models to produce incorrect outputs, represent a well-studied threat that takes on new dimensions in the LLM-IoT context. Almutairi et al. [34] provide a systematic literature review (2020–2024) of adversarial machine learning in IoT-enabled security systems, finding that the Fast Gradient Sign Method (FGSM) is the most commonly employed attack against IoT intrusion detection systems. Their work highlights that defenses effective against one attack type often fail against others, suggesting the need for ensemble defense strategies.

In the LLM domain, adversarial attacks extend beyond traditional perturbation-based approaches to include jailbreak attacks that use carefully constructed prompts to bypass safety alignment. Yi et al. [35] provide a comprehensive taxonomy of jailbreak attacks and defenses, while Su et al. [36] present a theoretical framework proving that jailbreaking is statistically inevitable for sufficiently capable models, an unsettling result for safety-critical IoT applications. They propose Enhanced RLHF (E-RLHF) as a partial mitigation, though the fundamental vulnerability remains.

For edge-deployed small language models used in IoT, Zhang et al. [37] conduct the first large-scale empirical study of jailbreak vulnerability, testing 63 SLMs from 15 model families. They find that 47.6% of tested models show high susceptibility with attack success rates exceeding 40%, raising concerns about the security of resource-constrained LLM deployments in IoT.

6.2. Model-Level Attacks

6.2.1. Model Extraction and Theft

Model extraction attacks aim to steal the functionality, architecture, or weights of a deployed LLM by observing its input-output behavior. Zhang et al. [38] provide a comprehensive taxonomy of LLM extraction attacks, categorizing them into functionality extraction (replicating model behavior), training data extraction (recovering data used to train the model), and prompt-targeted extraction (stealing proprietary system prompts). For IoT deployments, all three categories are relevant: a competitor could replicate a proprietary IoT security model, an adversary could recover sensitive IoT data used in fine-tuning, and a prompt-stealing attack could reveal the security rules governing an LLM-based IoT controller.

Edge deployment introduces additional extraction risks. Nazari et al. [26] demonstrate LLM-FIN, a fingerprinting methodology that reveals architectural details of edge-deployed LLMs through side-channel analysis. By monitoring physical characteristics of the device during inference, they can recover model architecture information that would be hidden in a cloud deployment. This vulnerability is particularly acute for IoT devices, which often lack the physical security controls available in data center environments.

6.2.2. Backdoor Attacks

Backdoor attacks insert hidden triggers into a model during training or fine-tuning, causing the model to behave normally on clean inputs but produce attacker-specified outputs when the trigger is present. Li et al. [39] introduce BackdoorLLM, the first comprehensive benchmark for backdoor attacks on LLMs, covering data poisoning, weight poisoning, and hidden state steering across 200+ experiments spanning 8 attack strategies and 6 model architectures.

Qu et al. [40] demonstrate a transferable and stealthy backdoor prompt attack achieving 91.4% attack success rate. In IoT contexts, backdoor attacks could be used to create hidden “kill switches” in LLM-based security systems, allowing an attacker to disable intrusion detection or manipulate industrial control outputs at will by presenting the trigger pattern through a compromised sensor.

6.2.3. Membership Inference Attacks

Membership inference attacks (MIAs) attempt to determine whether a specific data point was included in a model’s training set. For LLM-IoT systems fine-tuned on IoT device data, successful MIAs could reveal whether data from a specific user, device, or location was used in training, constituting a privacy breach. Duan et al. [41] conduct a large-scale evaluation of MIAs against LLMs ranging from 160M to 12B parameters, finding that most existing MIA techniques barely outperform random guessing against base LLMs. However, Fu et al. [42] show that fine-tuned LLMs are significantly more vulnerable, with their self-prompt calibration approach (SPV-MIA) raising MIA AUC from 0.7 to 0.9, a result directly relevant to IoT-specific fine-tuned models.

Carlini et al. [43] demonstrate a more fundamental risk: the ability to extract verbatim training data from LLMs, including personally identifiable information, through targeted prompting. Their divergence attack achieves a 150x higher extraction rate than baseline methods. For LLMs trained or fine-tuned on IoT data containing personal information, such as smart home activity patterns or health monitoring data, this extraction capability represents a serious privacy threat.

6.3. Communication and Infrastructure Attacks

The data pathway between IoT devices and LLM inference endpoints, whether cloud-based or edge-local, presents opportunities for interception and manipulation. Traditional man-in-the-middle attacks apply, but the LLM context introduces additional concerns. Wen et al. [27] demonstrate that LLM inference traffic can be classified even when encrypted, using network side-channel characteristics such as packet sizes and timing patterns. This means that an adversary monitoring network traffic between IoT devices and an LLM service could determine what types of queries are being made, even without decrypting the content.

API interfaces connecting IoT platforms to LLM services represent another attack vector. Many LLM-IoT systems rely on cloud APIs for inference, and weaknesses in API authentication, rate limiting, or input validation can be exploited. He et al. [24] discuss tool manipulation attacks where adversaries compromise the external tools (including IoT device APIs) that LLM agents use, causing the agent to take unintended actions through legitimate-looking tool calls.

6.4. Privacy Leakage

Privacy leakage in LLM-IoT systems occurs through multiple channels. At the most direct level, LLMs can be prompted to reveal information from their training data or context window, as discussed above with respect to extraction attacks. In IoT settings, this risk is amplified because the data flowing through LLMs often includes highly personal information: home occupancy patterns from smart home sensors, health metrics from wearable devices, location data from connected vehicles, and operational data from industrial sensors [44].

Li et al. [45] demonstrate multi-step jailbreaking privacy attacks on ChatGPT that bypass safety filters through sequential prompting, gradually escalating from benign to privacy-violating queries. When applied to LLM-IoT assistants that have access to personal sensor data, such attacks could extract detailed user behavioral profiles.

Jüttner et al. [46] examines whether ChatGPT can reconstruct private aspects of a user’s life from smart home data, finding that the model can make surprisingly detailed inferences about daily routines, occupancy patterns, and personal habits from raw sensor streams. This demonstrates that even without explicit prompting for private information, the reasoning capabilities of LLMs applied to IoT data can themselves constitute a privacy risk.

7. LLMs for IoT Security

While the previous section examined how LLM-IoT systems can be attacked, this section surveys the growing body of work applying LLMs as tools to strengthen IoT security. Table 3 provides a comparative summary of reported performance metrics. Across the surveyed systems, LLM-based approaches achieve 95–99% detection accuracy on standard IoT datasets, outperforming traditional ML methods by 5–15 percentage points in most configurations, though at 10–100x higher computational cost. These performance figures should be interpreted with caution, as they are derived from specific benchmark datasets and may not directly generalize to production IoT environments with different traffic distributions, attack profiles, and device populations. This trade-off between detection quality and resource requirements is a central consideration for IoT deployment.

Table 3. Performance Comparison of LLM-Based IoT Security Systems.

System	LLM/Model	Dataset	Acc/F1	Notable Feature
SecurityBERT	BERT (Light)	Edge-IIoTset	98.2%	Sub-150 ms inference
IDS-Agent	LLM Agent	ACI-IoT	0.97 F1	Explainable, zero-day adapt
EADL-IDS	LLM + RAG	NSL-KDD	>95%	Autoencoder hybrid
BARTPredict	BART+BERT	CICIoT23	98%	Predicts threats proactively
BERT Small	BERT Small	IoT-23	99.7%	High throughput
LogLLM	LLaMA	Sec Logs	0.92 F1	Beats XGBoost (0.55)
ChatIoT	RAG-LLM	Vuln DB	+10%	Domain-grounded RAG
Device FP	Transformers	Banners	N/A	Identifies unknown devices

7.1. Intrusion Detection Systems

The application of LLM architectures to IoT intrusion detection represents one of the most active research areas in this space. Table 3 summarizes the key systems and Figure 4 visualizes their comparative performance.

Figure 4. Performance comparison of LLM-based IoT intrusion detection systems. Systems are color-coded by deployment paradigm. The dashed line marks the 95% accuracy threshold exceeded by the majority of current approaches.

Unlike traditional ML-based IDS that require manual feature engineering, LLM-based approaches can leverage pre-trained representations and natural language understanding to detect both known and novel attack patterns.

Ferrag et al. [1] propose SecurityBERT, a privacy-preserving BERT-based lightweight model designed for IoT and IIoT devices. Trained on the Edge-IIoTset dataset, SecurityBERT achieves 98.2% accuracy with sub-150 ms inference time, making it suitable for deployment on resource-constrained edge devices. The model’s lightweight architecture represents a practical trade-off between detection capability and computational cost that is essential for IoT settings.

Li et al. [47] introduce IDS-Agent, the first AI agent powered by LLMs for IoT intrusion detection. IDS-Agent provides explainable detection results and supports customization for different network environments. Evaluated on the ACI-IoT and CIC-IoT benchmarks, it achieves F1-scores of 0.97 and 0.75, respectively. A key advantage is its use of memory retrieval for zero-day attack adaptation, allowing it to learn from new attack patterns encountered during deployment without full retraining.

Huang et al. [48] present EADL-IDS, which combines a Denoising Convolutional Autoencoder with LLMs through RAG for both binary anomaly detection and multi-class attack interpretation. The system achieves over 95% binary accuracy and over 85% multi-class accuracy on NSL-KDD, CIC-IoT-2023, and ACI-IoT-2023 datasets, demonstrating that the combination of specialized feature extraction with LLM-based reasoning can outperform either approach alone.

Diaf et al. [49] propose BARTPredict, which combines BART for sequence prediction with BERT for classification, achieving 98% accuracy in proactive threat prediction on the CICIoT2023 dataset. The proactive nature of this system, predicting threats before they fully manifest rather than simply detecting ongoing attacks, represents an important advancement over reactive IDS approaches.

For comparative context, recent comparison studies provide insight into how LLM-based approaches compare with traditional ML. A systematic comparison by researchers evaluating GPT-2, GPT-Neo-125M, and LLaMA-3.2-1B against traditional ML methods on the CIC IoT 2023 dataset [50] found that while LLMs achieve over 95% F1-score, classical methods like XGBoost and Random Forest still outperform LLMs in some configurations. Similarly, evaluation of fine-tuned LLMs (DeepSeek-R1, LLaMA 3.2, Qwen 2.5) on the Edge-IIoTset dataset [51] achieved perfect scores in binary classification and outperformed ML methods in multi-class settings, with zero-shot F1 of 0.45 improving to 0.93 with few-shot prompting. These results suggest that while LLMs show strong overall performance, the choice between LLM-based and traditional approaches should be guided by the specific deployment constraints and detection requirements of each IoT environment.

An LLM-based threat detection framework comparing BERT variants in Docker-based simulation [52] found that BERT Small achieves 99.72% accuracy at 287.82 requests per second on the IoT-23 and TON_IoT datasets, suggesting that smaller, task-specific transformer models may offer the best balance of accuracy and throughput for IoT deployment.

7.2. Threat Intelligence and Log Analysis

LLMs bring natural language understanding capabilities that are particularly valuable for security log analysis, where the volume and complexity of data often exceed human analyst capacity. Research evaluating LLMs (Qwen2.5, Gemma3, LLaMA3.2) for cybersecurity log classification with domain-specific prompt engineering [53] demonstrates F1-scores of 0.928, substantially outperforming XGBoost (0.555) and LightGBM (0.432) on the same log data. This significant gap suggests that the contextual understanding capabilities of LLMs are particularly well-suited to the semi-structured, semantically rich nature of security logs.

LogLLM [54] combines BERT for semantic vector extraction with LLaMA for log sequence classification, achieving the highest F1-scores using regular expression preprocessing across multiple datasets. Dong et al. [55] introduce ChatIoT, a RAG-augmented LLM designed specifically for IoT vulnerability analysis and threat intelligence. By grounding LLM responses in verified IoT vulnerability databases, ChatIoT achieves over 10% accuracy improvement compared to baseline LLMs, demonstrating the value of domain-specific knowledge augmentation.

7.3. Vulnerability Assessment

LLMs are increasingly being applied to discover vulnerabilities in IoT systems before they can be exploited. IoT firmware and embedded software often contain security weaknesses that are difficult to detect through conventional testing. LLM-augmented intelligent fuzzing (LLMIF) [56] uses LLM intelligence to guide fuzzing processes for more effective IoT vulnerability identification, generating more semantically meaningful test inputs than random fuzzing.

The SECURE benchmark [57] introduces standardized evaluation datasets for assessing LLM capabilities in cybersecurity advisory tasks, including MITRE ATT&CK extraction, CVE and CWE understanding, and CVSS scoring. Such benchmarks are essential for calibrating the reliability of LLMs as security tools in IoT contexts. Complementing vulnerability discovery, the ability to identify and authenticate the devices on a network is equally critical for maintaining IoT security.

7.4. Device Authentication and Fingerprinting

Device fingerprinting, the identification of devices based on their network behavior or characteristics, is a critical security function in IoT environments where millions of heterogeneous devices must be authenticated and monitored. Sarabi et al. [58] introduce an LLM-based framework for fingerprinting internet-connected devices using sentence transformers to generate embeddings from HTTP banners. Their approach identifies new IoT devices not captured by existing manual databases like Recog, demonstrating the ability of LLMs to generalize to previously unseen device types.

Building on this direction, recent work on instruction-tuned LLMs for semantic IoT device fingerprinting [59] achieves 98.25% top-1 accuracy and 90.73% macro accuracy across 2015 vendors, with adversarial robustness testing demonstrating resilience against evasion attempts. These results suggest that LLM-based fingerprinting could serve as a scalable and adaptive authentication mechanism for large IoT deployments.

8. Privacy-Preserving LLM-IoT Architectures

The privacy risks identified in Section 6 motivate the development of architectures that allow LLMs to operate on IoT data while minimizing exposure of sensitive information. This section surveys five major approaches: federated learning, differential privacy, homomorphic encryption, trusted execution environments, and secure multi-party computation. Table 4 compares these techniques, and Figure 5 provides a visual comparison of their trade-offs. The ratings in Figure 5 and Table 4 are qualitative assessments on a 0–10 scale derived from the evidence reported in the surveyed papers. Privacy guarantee scores reflect the strength of formal privacy properties (e.g., mathematical guarantees for DP vs. empirical protections for FL). Compute overhead scores are based on reported slowdown factors relative to plaintext computation. IoT compatibility scores reflect practical deployability on resource-constrained devices, considering memory, latency, and communication requirements documented in the reviewed literature.

Table 4. Comparison of Privacy-Preserving Techniques for LLM-IoT.

Technique	Protection	Overhead	IoT Feas.	Strengths	Limitations
Federated Learning	Moderate	Low-Med	High	Decentralized, scalable	Gradient leakage risk
Differential Privacy	Strong	Low	High	Formal guarantees	Utility degradation
Homomorphic Enc.	Very Strong	Very High	Low	No data exposure	Massive slowdown
Trusted Exec. Env.	Strong	Low	Medium	Hardware isolation	Hardware dependency
Secure MPC	Very Strong	High	Low-Med	No trusted party	Comms overhead

Figure 5. Visual comparison of privacy-preserving techniques for LLM-IoT. Each technique is evaluated on three dimensions: privacy guarantee strength, computational overhead, and compatibility with IoT constraints. No current technique achieves all three simultaneously, reflecting the accuracy–efficiency–privacy trilemma.

8.1. Federated Learning Approaches

Federated learning (FL) enables multiple IoT devices or edge nodes to collaboratively train or fine-tune an LLM without sharing raw data, instead exchanging only model updates. This paradigm is naturally suited to IoT, where data is generated at distributed endpoints and centralization raises privacy, bandwidth, and latency concerns.

Otoum et al. [60] propose an FL-LLM framework integrating generative IoT models with a Gradient Sensing Federated Strategy (GSFS) that adapts aggregation based on gradient quality. Evaluated on the IoT-23 dataset, their approach shows improved accuracy with reduced latency and enhanced energy efficiency.

Research on privacy-aware split federated learning [12] addresses the “accuracy–efficiency–privacy trilemma” inherent in distributed LLM fine-tuning for IoT. They introduce a privacy quantification metric based on Fisher information that identifies layer-wise privacy risks in split federated learning, enabling practitioners to make informed trade-offs between model utility and privacy guarantees.

The three-way synergy of IoT, LLMs, and federated learning is surveyed comprehensively by researchers in MDPI Applied Sciences [61], who review LoRA-based fine-tuning combined with split federated learning as a practical pathway for privacy-preserving LLM deployment in IoT. Federated black-box prompt tuning (FedBPT) [62] takes a different approach, enabling collaborative LLM customization across IoT deployments without sharing model internals or training data, treating the LLM as a black box and optimizing only the prompt.

Ferrag et al. [63] demonstrate the scalability of federated approaches with an FL-CNN intrusion detection system evaluated across 7 IoT datasets comprising 415 million records, achieving 97.31% accuracy. A two-stage hybrid federated learning approach for IoT anomaly detection [64] achieves 99.14% accuracy on the N-BaIoT dataset, the highest reported accuracy for federated IoT anomaly detection, while a privacy-preserving FL-based IDS for the Internet of Health Things [65] combines FL with differential privacy and homomorphic encryption for multi-layered privacy protection.

8.2. Differential Privacy for LLM-IoT

Differential privacy (DP) provides mathematical guarantees that the output of a computation does not reveal too much about any individual data point. For LLM-IoT systems, DP can be applied during training (through DP-SGD), during fine-tuning, or at inference time (through output perturbation).

Li et al. [13] demonstrate that large pre-trained models combined with parameter-efficient fine-tuning can achieve near non-private accuracy while satisfying formal DP guarantees, an encouraging result for IoT applications where both utility and privacy are essential. Shi et al. [66] propose Just Fine-tune Twice (JFT), a selective differential privacy framework that protects only sensitive tokens rather than applying uniform noise, preserving utility on non-sensitive content while protecting private IoT data elements.

Tang et al. [67] propose practical differential privacy mechanisms for LLM training and inference, addressing the challenge of balancing privacy guarantees with model quality. The privacy-preserving techniques survey by researchers in MDPI Information [68] provides a comprehensive review covering DP, FL, HE, SMPC, and emerging post-quantum cryptographic approaches, concluding that combining multiple techniques typically provides stronger privacy guarantees than any single method.

8.3. Homomorphic Encryption

Homomorphic encryption (HE) allows computations to be performed on encrypted data without decryption, enabling LLM inference on sensitive IoT data while keeping the data encrypted throughout the process. The primary challenge is computational overhead: fully homomorphic encryption introduces orders-of-magnitude slowdowns compared to plaintext computation.

Research on HE-friendly LLM architectures [69] proposes transformer modifications, including replacing softmax with Gaussian kernels and using LoRA fine-tuning, that achieve 6.94× speedup for fine-tuning and 2.3× speedup for inference under the CKKS encryption scheme. EncryptedLLM [70] demonstrates the first GPU-accelerated fully homomorphic encryption implementation for encrypted GPT-2 inference, achieving 200× speedup over CPU baselines. While still far from real-time performance for large models, this represents significant progress toward practical encrypted LLM inference.

A comprehensive survey of cryptographic privacy-preserving approaches across the LLM lifecycle [71] covers both FHE and MPC techniques, noting that current approaches are practical for small to medium models but require continued algorithmic and hardware advances for application to full-scale LLMs in latency-sensitive IoT scenarios.

8.4. Trusted Execution Environments

Trusted Execution Environments (TEEs) provide hardware-based isolation that protects code and data during execution, even from privileged software. For LLM-IoT systems, TEEs can protect model weights and inference data on both edge devices and cloud servers.

Yu et al. [72] propose the CMIF framework, combining client-side TEE (Intel SGX) with GPU servers and optimized Report-Noisy-Max for dual privacy protection during LLM inference. TEECHAT [73] demonstrates end-to-end encrypted LLM chat using NVIDIA H100 Confidential GPUs with hardware attestation, achieving less than 1% latency overhead for models with 10 billion or more parameters. This near-zero overhead for large models suggests that TEE-based protection may be practical for cloud-hosted LLM services accessed by IoT devices, though TEE support on the IoT devices themselves remains limited to higher-end hardware.

8.5. Secure Multi-Party Computation

Secure multi-party computation (MPC) allows multiple parties to jointly compute a function without revealing their individual inputs. In the LLM-IoT context, MPC can enable scenarios where IoT data holders and model operators jointly perform inference without either party seeing the other’s data or model.

Iron [74] presents an efficient hybrid HE/MPC framework with specialized protocols for matrix multiplication, Softmax, GELU, and LayerNorm operations, achieving 3–14x less communication and 3–11x faster runtime compared to prior work. SHAFT [75] proposes a two-party computation framework with stable constant-round private softmax and efficient GELU protocols that outperforms prior systems including BumbleBee and BOLT. These advances are narrowing the gap between secure and plaintext inference, though significant overhead remains for full transformer architectures.

9. Domain-Specific Security Analysis

The security challenges of LLM-IoT integration manifest differently across application domains due to varying regulatory requirements, threat models, and physical consequences of security failures. This section examines five major IoT application domains through a security lens.

The severity ratings in Figure 6 are qualitative assessments by the authors rated as High, Medium, or Low based on three criteria: (1) whether the surveyed literature documents the attack in that domain, (2) the severity of potential consequences given domain-specific constraints, and (3) the availability of domain-specific defenses. These ratings are derived from the evidence reviewed in Section 6 and Section 9.

Figure 6. Threat severity across IoT domains. Each cell indicates the relevance of a specific attack type to a given domain, derived from the domain-specific analysis in this section.

9.1. Healthcare IoT Security

Healthcare IoT systems process some of the most sensitive data in any IoT domain, and the consequences of security failures can directly affect patient safety. The integration of LLMs with medical IoT devices, such as wearable monitors, infusion pumps, and diagnostic equipment, amplifies both the utility and the risk.

Research on multi-agent collusion attacks in AI-based healthcare [76] presents the first systematic study of collusion risks when multiple LLM agents interact in healthcare IoT environments, evaluated on 50 clinical questions. The authors demonstrate that cooperating malicious agents can produce consensus-appearing but incorrect clinical recommendations that are difficult for human operators to detect.

Ye et al. [77] propose LLM-HAS, an LLM-guided healthcare alert system that uses generative diffusion models for privacy-preserving local data processing. This architecture keeps sensitive patient data on-device while leveraging cloud LLMs only for higher-level reasoning on anonymized summaries, representing a practical privacy-aware design pattern.

De Vito [78] evaluates the quality attributes of healthcare software integrating both IoT and LLM technologies, identifying reliability, security, and maintainability as the most critical concerns. Regulatory compliance, particularly with HIPAA in the United States and GDPR in the European Union, adds an additional layer of complexity for healthcare LLM-IoT deployments, as these regulations impose specific requirements on data handling, consent, and breach notification that must be satisfied throughout the system architecture.

A privacy-preserving FL-based IDS specifically for the Internet of Health Things [65] combines federated learning with differential privacy and homomorphic encryption, providing a multi-layered approach to protecting healthcare IoT data during collaborative intrusion detection model training.

9.2. Smart Home Security

Smart homes represent a domain where LLM-IoT integration is already commercially deployed through voice assistants and home automation platforms, making the security analysis particularly urgent. The intimate nature of smart home data, capturing daily routines, occupancy patterns, and personal preferences, makes privacy a primary concern.

Farina [79] analyzes the prospects and risks of ChatGPT integration in smart home systems, identifying phishing via AI-generated content as an emerging threat vector. The author notes that LLM-powered smart home assistants could be socially engineered to reveal sensitive information about household members or to execute unauthorized actions on connected devices.

Jüttner et al. [46] provides empirical evidence that ChatGPT can reconstruct detailed profiles of residents’ private lives from smart home sensor data, including sleep schedules, meal patterns, and occupancy habits. This finding underscores that even legitimate use of LLMs for smart home data analysis carries inherent privacy risks that require careful mitigation through data minimization, anonymization, or differential privacy.

On the defense side, systems like SAGE [5] and Sasha [4] demonstrate LLM-based smart home agents that interpret underspecified user commands and manage connected devices. While these systems focus on functionality, their architectures raise security questions about the authorization model for LLM-generated device commands and the potential for adversarial manipulation of the reasoning process that translates user intent into device actions.

9.3. Industrial IoT (IIoT) Security

Industrial IoT environments, including SCADA systems, manufacturing floors, and energy infrastructure, face the highest-consequence security threats due to the potential for physical damage and human safety impacts. Adversarial perturbations to sensor inputs are particularly dangerous in industrial settings, where even small manipulations of process control data could cause equipment damage or safety incidents. LLMs offer opportunities for improved monitoring and incident response, but also introduce risks to safety-critical systems.

Research on LLMs for the protection of industrial IoT critical infrastructure [80] examines how LLMs can support cybersecurity incident triage and contextual analysis in IIoT environments. Muhammad et al. [81] propose HyLLM-IDS, a hybrid intrusion detection system integrating LLM reasoning with RAG for industrial control systems and smart grids, designed to combine the pattern recognition capabilities of traditional ML with the contextual understanding of LLMs.

On the threat side, Zhang et al. [82] identify bad data injection and domain knowledge extraction attacks against LLMs deployed in smart grid systems. Their work demonstrates that adversaries can use targeted prompting to extract specialized knowledge about grid operations from LLMs fine-tuned on utility data, representing a form of intellectual property theft with potential operational security implications.

Ren et al. [6] combine LLM reasoning with reinforcement learning for IIoT process optimization, noting that the intelligence of the LLM component must be balanced against the need for deterministic, verifiable behavior in safety-critical control loops.

The domain security profiles in Figure 7 are scored on a 1–10 scale across six dimensions. Threat exposure reflects the breadth and severity of documented attacks in each domain. Privacy sensitivity reflects the personal nature of data processed. Real-time requirements reflect latency tolerance for security operations. Regulatory burden reflects compliance obligations (e.g., HIPAA for healthcare, NERC CIP for smart grid). Resource constraints reflect typical device computational limitations. LLM security adoption reflects the maturity of LLM-based security solutions documented in the surveyed literature. Scores are qualitative assessments by the authors, assigned based on the frequency and severity of threats documented in the surveyed literature for each domain, the stringency of applicable regulations, the typical hardware capabilities of devices in each domain, and the number of published LLM-based security solutions targeting that domain.

Figure 7. Security profiles of six IoT domains across six dimensions. No two domains share the same profile, highlighting that security solutions must be tailored to domain-specific constraints and priorities.

9.4. Smart Grid and Transportation Security

Smart grid systems and transportation networks represent infrastructure-scale IoT deployments where security failures can affect millions of people. Zaboli et al. [83] evaluate ChatGPT and other LLMs for cybersecurity of IEC 61850-based smart grid applications, finding that ChatGPT 4.0 outperforms other models for GOOSE and Sampled Values anomaly detection. They report comparative metrics including true positive rate, false positive rate, precision, and F1-score across different LLM configurations.

For autonomous vehicles, Cui et al. [84] provide a comprehensive review of security, privacy, and safety challenges with the LLM4AD benchmark. Yin et al. [85] propose a semi-centralized key agreement protocol using Physical Unclonable Functions (PUFs) and certificateless cryptography for CAN bus protection in LLM-based autonomous driving systems, addressing the unique communication security requirements of vehicular IoT.

Nguyen et al. [86] examines the role of LLMs in securing next-generation 6G communications, mapping LLM capabilities to the security challenges of massive IoT device management including distributed denial-of-service defense and anomaly detection at network scale.

9.5. Wearable and Personal Device Security

Wearable IoT devices present a particularly challenging security profile: they collect highly personal data (biometrics, location, activity patterns) on devices with severe computational constraints, and users often lack the technical sophistication to manage security settings.

Mithsara et al. [25] specifically address data poisoning threats in wearable IoT human activity recognition systems, proposing an LLM-based detection framework. Li et al. [87] propose LLM-QueryGuard, an on-device approach that uses a local LLM to generate indistinguishable false queries, protecting user privacy by making it impossible for network observers to distinguish real queries from decoys.

The compact model research by SEED [88] demonstrates fine-tuned BERT models reduced by approximately 90% for IoT deployment, achieving a 4MB compact model suitable for intrusion detection and anomaly detection on wearable devices. This level of compression makes on-device LLM-based security feasible even on highly constrained wearable platforms, though the security implications of such aggressive compression (as highlighted by the quantization poisoning work of Egashira et al. [14]) must be carefully evaluated.

10. Challenges and Open Problems

10.1. Technical Challenges

The accuracy–efficiency–privacy trilemma. Resource-constrained IoT devices cannot run full-scale LLMs, necessitating model compression through quantization, pruning, and distillation. However, these compression techniques can degrade security performance and even introduce new vulnerabilities. Egashira et al. [14] demonstrate a three-stage attack where models that are benign at full precision become malicious after quantization. This means that the very techniques used to make LLMs deployable on IoT edge devices can be weaponized. Balancing model accuracy, computational efficiency, and privacy protection on resource-constrained hardware remains an open problem that current approaches address only partially.

Latency versus security trade-offs. Security mechanisms such as encryption, authentication, and anomaly detection add latency to LLM-IoT interactions. For time-critical IoT applications, including industrial process control and autonomous vehicle decision-making, this added latency may be unacceptable. TEE-based approaches show promise with less than 1% overhead for large models [73], but equivalent low-overhead solutions for edge-deployed small models remain elusive.

Reliability and hallucination. LLMs can generate plausible but factually incorrect outputs (hallucinations) [18], and in IoT contexts where LLM outputs may control physical actuators, the consequences of hallucination extend beyond informational errors to potential physical harm. Current hallucination mitigation techniques (retrieval augmentation, output validation, uncertainty quantification) add complexity and latency that compound the challenges already described.

Heterogeneity and interoperability. IoT ecosystems involve devices from many manufacturers using diverse protocols and data formats. Developing security solutions that work across this heterogeneous landscape, rather than only within controlled testbed environments, remains a significant challenge.

10.2. Deployment Challenges

Scalability. Current LLM-IoT security research is primarily evaluated on benchmark datasets with limited device populations. Scaling these approaches to networks with millions or billions of devices introduces challenges in model management, update distribution, and coordinated threat response that are not yet addressed in the literature.

Real-world validation. Most published results come from controlled experimental settings using standard datasets. Long-term, real-world deployments that capture the complexity of actual IoT environments, including device churn, concept drift, and evolving attack patterns, are largely absent from the current literature.

10.3. Regulatory and Ethical Challenges

LLM-IoT systems that process personal data must comply with an evolving regulatory landscape including GDPR, HIPAA, the EU AI Act, and sector-specific regulations. The “black box” nature of LLM decision-making creates tension with regulatory requirements for explainability and accountability. Furthermore, the dual-use nature of LLMs, as both security tools and potential attack instruments [29], raises ethical questions about responsible development and deployment practices. Additionally, implementing zero-trust security architectures on resource-constrained edge devices remains an open challenge, as continuous verification and microsegmentation impose computational overhead that conflicts with IoT device limitations.

11. Future Research Directions

Based on our analysis, we identify the following priority directions for future research:

Security-aware model compression. Research is needed on compression techniques that preserve or enhance security properties. This includes developing quantization and pruning methods that are resistant to the quantization poisoning attacks demonstrated by Egashira et al. [14], as well as compression approaches that maintain the effectiveness of safety alignment.

Standardized LLM-IoT security benchmarks. The field lacks standardized benchmarks that evaluate LLM-based security systems under realistic IoT conditions. Building on initial efforts like the SECURE benchmark [57], future work should develop evaluation frameworks that capture the unique characteristics of IoT environments, including resource constraints, real-time requirements, and heterogeneous device populations.

Explainable security decisions. As LLMs take on more security-critical roles in IoT, the ability to explain security decisions becomes essential for operator trust and regulatory compliance. Initial work on explainable LLM-based IDS [47] should be extended to cover the full range of LLM security functions in IoT.

Zero-trust architectures for LLM-IoT. The integration of LLMs with IoT calls for security architectures that assume no component is inherently trustworthy. Future work should develop zero-trust frameworks specifically designed for LLM-IoT ecosystems, incorporating continuous verification, least-privilege access, and microsegmentation adapted to the constraints of IoT deployments.

Lightweight privacy-preserving inference. While TEEs show promise for cloud-hosted LLMs with near-zero overhead, privacy-preserving inference for edge-deployed models remains computationally expensive. Research combining hardware acceleration (e.g., specialized cryptographic accelerators), algorithmic improvements (e.g., HE-friendly model architectures [69]), and protocol optimizations (e.g., reduced-round MPC [75]) could enable practical private inference on IoT edge devices.

Resilience to adversarial attacks. Given the theoretical result that jailbreaking is statistically inevitable [36], research should shift from attempting to make LLMs invulnerable to adversarial input toward designing systems that are resilient to adversarial success. This includes developing defense-in-depth strategies, output validation mechanisms, and fail-safe behaviors for IoT systems when adversarial manipulation is detected.

Cross-domain security frameworks. Security solutions developed for one IoT domain (e.g., healthcare) may not transfer directly to another (e.g., industrial). Research on domain-agnostic security frameworks that can be efficiently adapted to specific IoT verticals would reduce duplication of effort and accelerate deployment.

12. Conclusions

The integration of Large Language Models with Internet of Things systems is creating a new generation of intelligent, autonomous applications across healthcare, industry, smart homes, energy infrastructure, and transportation. This survey has examined this convergence through a security-focused lens, providing a structured analysis of both the threats that LLM-IoT integration introduces and the security capabilities that LLMs enable.

Our analysis reveals a field of considerable promise and significant risk. On the defensive side, LLM-based intrusion detection systems achieve 95–99% accuracy on standard IoT datasets, LLM-driven threat intelligence outperforms traditional ML on security log analysis, and LLM-based device fingerprinting can identify previously unknown IoT devices. On the offensive side, LLM-IoT systems face a broad threat landscape including prompt injection through manipulated sensor data, model extraction from edge devices, backdoor attacks on fine-tuned models, and privacy leakage through LLM reasoning over personal IoT data.

Privacy-preserving architectures offer pathways to mitigate these risks, with federated learning providing the most IoT-compatible approach, differential privacy offering formal guarantees, and hardware-based TEEs approaching practical overhead levels. However, the accuracy–efficiency–privacy trilemma remains a fundamental challenge for edge deployments, and the discovery that model compression techniques can themselves introduce vulnerabilities adds an unsettling dimension to the security landscape.

Looking ahead, the field requires standardized security benchmarks, security-aware compression techniques, explainable security decision-making, and zero-trust architectures designed for the unique constraints of LLM-IoT ecosystems. The dual-use nature of LLMs, as both powerful security tools and potential attack instruments, demands continued research attention and responsible development practices.

Cross-disciplinary collaboration spanning AI security, IoT engineering, cryptography, and domain-specific expertise remains essential. The transformative potential of LLM-IoT integration can only be fully realized if the security challenges identified in this survey are addressed through sustained, coordinated research effort.