Secure Edge-AI Sensing on an FPGA SoC: Lightweight ASCON Authentication of Model Updates and Interface-Bound Inference for Bearing-Fault Detection

Vibration monitoring increasingly classifies on the sensing node. We ask where the cost of running and securely updating a small classifier on an FPGA system-on-chip node lies. One Q4.12 multilayer perceptron for bearing-fault detection, trained on 40 CWRU recordings over four loads and three severities, is deployed bit-exactly on an ESP32-S3, a Cortex-A53 and a custom AXI4-Lite accelerator of the same Zynq UltraScale+ device (Kria KV260), checked on all 2132 windows. The fabric computes one inference in 36 cycles (0.36 µs), yet the latency under the PYNQ driver is 133.2 µs; a native-C driver reduces it to 3.59 µs, placing 95–97% of the per-transaction cost in the host software stack. Moving the update decision into the fabric, with the ASCON-AEAD128 tag check, version freshness and staging enforced in hardware, rejects every tested forgery, replay and direct write, and cuts a 608-byte authenticated update from 148.7 to 66.0 µs in native C. The full chain runs in real time, with no deadline miss over 552 windows (worst case 1.8% of the 171 ms window), and feature extraction dominates its cost. The model reaches 98.2% on unseen segments but generalizes poorly to unseen fault severities and to real damage of unseen Paderborn bearings, which makes field updates a requirement.