From Device to Cloud: Routing AI for Trustworthy Digital Journeys

F-Secure and AMD Silo AI explore adaptive AI routing across local, private and cloud infrastructure to keep your data secure as AI agents work for you.

Agentic browsing creates a new class of security and reliability problems. An AI agent may browse pages, read reviews, compare options, and summarize claims, all of which is useful only if the agent can use the web without being quietly manipulated by it.

A retailer page may be legitimate while a review, comment, or third-party snippet on that page is not. A user-generated review can be low-quality, overly promotional, misleading, or intentionally written to influence the agent rather than inform the user. In more adversarial cases, it may contain instruction-like text or indirect prompt injection designed to redirect an agent’s behavior.

In some cases, reviews or third-party content can be ignored, however, in many digital journeys like agentic shopping, that content should often influence the agent’s recommendation. The challenge is to treat each individual piece of content according to its provenance, risk signals, and journey context rather than granting blanket trust to an entire domain.

Digital Journeys Need Event-Level Handling

A digital journey is not one uniform risk category. Discovery, comparison, commitment, payment, delivery, cancellation and return handling all have different privacy and security implications. The right decision also depends on the user’s preferences, the financial exposure, the sensitivity of the product or service, and the available device resources.

During each stage of a digital journey, we need to evaluate these aspects with the right context, for example:

journey stage
+ user intent
+ user preferences
+ financial exposure
+ site and content classification
+ safety signals
+ user privacy preference
+ latency, battery and compute constraints
= routing decision

“The core principle of safe digital journeys is that trust is granted per event, not per domain. A known site can still carry an untrusted segment, and a low-risk browsing step can become sensitive when the agent moves toward login, payment, health, finance, or high-value commitment,” says Khalid Alnajjar, Lead AI & Data Scientist, F-Secure.

This makes routing decisions contextual rather than static. A strict privacy setting may keep processing local or private. A balanced setting may allow a stronger private model for sensitive or high-value decisions while keeping routine discovery local. A more open setting may permit external services only for explicitly allowed non-sensitive cases. The policy needs to respect the user’s choice and record how that choice was enforced.

Dynamic AI Routing from Device to Cloud: Privacy, Cost-Efficiency and Safety

AMD Silo AI has developed routing solutions that can be used to power safe digital journey applications like TrustPath. Routing policy decides whether a journey event should be resolved by deterministic policy, a local model, a stronger private model, or an explicitly allowed external path. In practice, this can mean execution on a local laptop for simple tasks, on a private cloud for moderate tasks and using frontier APIs for the most complex ones.

“The goal is not to send more events to the largest models. The goal is to handle each event as close to the user as possible, to keep it safe, private and efficient.”
- Jaakko Vainio, senior director, AMD Silo AI

On the device, AMD Ryzen™ AI platforms bring local AI capability through CPU, NPU, and graphics resources, depending on the system. AMD Radeon™ integrated and discrete graphics can add local acceleration for models and multimodal workloads. This matters for sensitive digital journeys because many events are frequent, latency-sensitive, and privacy-sensitive enough that they should stay close to the user whenever possible.

In private or cloud infrastructure, AMD EPYC™ server CPUs and AMD Instinct™ GPUs provide the larger compute target for stronger models, higher throughput, longer context, centralized governance, and controlled enterprise deployment. This matters when the event is sensitive, ambiguous, high-value, or requires more capable analysis than the local path can provide.

For developers, the important pattern is consistency across tiers. A privacy-aware application should not need a new integration every time a workload moves from local inference to private infrastructure. It should target a model class and endpoint contract, while routing policy decides which execution tier is appropriate for the current event.

The separation between logical route and physical endpoint is essential. The logical route says what the policy decided: local only, private cloud, or external handling (e.g. frontier API). As models, threats, devices, and enterprise policies change, the needs for applications change. The separation lets teams update policies, model classes, and infrastructure independently, avoiding hardcoding.

Serving AI Locally with Lemonade

Lemonade is an AMD open-source local AI serving layer that gives developers a practical way to expose local models through a familiar API and use available AMD client hardware rather than sending every request to a remote service.

Built on AMD products, Lemonade helps turn the device-to-cloud concept into an implementation path. A low-risk local route can run through a Lemonade endpoint on AMD client systems, using AMD Ryzen AI CPU/NPU resources and Radeon graphics where available. A higher-risk private route can use an endpoint backed by AMD EPYC and AMD Instinct infrastructure. The application logic can stay focused on routing policy, while the endpoint abstraction handles where inference actually runs.

One Journey, Multiple Routing Decisions: Agentic Shopping Example

The security lesson is straightforward: A safe domain does not automatically make every content segment safe, and a capable AI agent should not be allowed to treat every piece of text it reads as an instruction. The routing layer gives the application a place to enforce that distinction.

Beyond Shopping: Digital Journeys have Different Trust Curves

Routing Implications for Enterprise Developers

Large enterprises adopting agentic AI face a practical architecture question: How can they use agents across digital workflows while maintaining control over privacy, cost, latency, auditability and infrastructure choice?

• Privacy control: Sensitive data can be withheld, redacted, kept local, or routed only to approved private infrastructure.
• Cost control: Frequent low-risk events can run locally while expensive remote inference is reserved for cases that justify it.
• Latency control: Simple local decisions remain fast, while high-risk decisions can tolerate more latency for stronger analysis.
• Model portability: Applications can target model classes and compatible endpoints instead of hardcoding one provider.
• Auditability: Every route, reason code, privacy action, and endpoint can be recorded for replay, dashboards, and policy testing.
• Governance: Security teams can update routing policy as threats, regulations, models, and infrastructure evolve.

The result is a more controlled architecture for the agentic era: local when the event can stay on the device, private when the decision deserves stronger controlled compute, and externally connected only when policy and user consent allow it.

Enabling Trustworthy AI Journeys: AMD & F‑Secure’s Collaborative AI Architecture

The agentic era will not be secured by one larger model or one universal cloud endpoint. Trustworthy digital journeys need systems that can evaluate context, respect privacy preferences, choose the right model class, route inference to the right compute tier and leave a traceable audit trail.

For F-Secure and AMD, the shared opportunity is to make that architecture practical: F-Secure brings the digital trust model around the user journey while AMD provides the device-to-cloud AI compute and open-source tooling that can help developers run AI where it makes sense.