Where the model is deployed on the user's device, the provider must activate the service through official channels on first use and push security policy updates when the device is online; must include an on-device security module that reviews generated content using a keyword library and similar techniques, collects and retains security logs and supports uploading them when online or exporting them locally, and periodically updates the keyword library and security configuration when online; and must have a model update mechanism that fixes security vulnerabilities promptly, for example by pushing patches to devices, and gives repeated reminders and warnings to users whose devices have not been updated for a long time after a major model update.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.