The AI Security Trilemma — Why Healthcare Can't Trade Away the Security Vertex

IBM security architect Jeff Crume published a video this week introducing a framework he calls the AI Security Trilemma — the observation that in AI system design, smart, fast, and secure tend to compete with each other in ways that force deliberate tradeoffs. The framework is useful, and the solution IBM proposes — an AI Security Proxy that externalizes policy enforcement — is directly relevant to how healthcare organizations should be thinking about agentic AI governance.

This post unpacks the trilemma, explains why it is not symmetrical for healthcare, and describes how the proxy architecture maps onto governance patterns your security program should already be building.

The Trilemma: What Each Vertex Actually Means

The trilemma frames AI system design as a triangle with three vertices: smart, fast, and secure. The claim is that you can optimize for any two, but optimizing for all three simultaneously is extremely difficult — each improvement on one dimension tends to create pressure on the others.

Smart refers to model capability — reasoning depth, tool use, autonomous decision-making, and the ability to handle complex multi-step tasks. As models become more capable, they require broader permissions, more tool access, and longer operating windows. Each of those expansions increases the attack surface. A model that can only answer questions has a small surface. A model that can read files, write code, call APIs, and send emails has a much larger one.

Fast refers to latency and throughput — the speed at which the system responds. Security controls add latency. Input scanning, output validation, guardrail inference, and human review checkpoints all take time. A system optimized for real-time responsiveness has less room for security overhead at each step.

Secure refers to the full stack of safety controls — input filtering, output validation, access controls, guardrails, audit logging, and human oversight. These controls are necessary but they impose cost. They slow the system down, they constrain what the model can do, and they add infrastructure complexity.

The musical chairs analogy Crume uses is apt: at any given moment, one of the three is likely sitting out.

Why the Trilemma Is Not Symmetrical for Healthcare

The IBM framing presents the trilemma as a choice between equally valid configurations — smart and fast for testing environments, smart and secure for research tasks, fast and secure for latency-sensitive applications. For general enterprise AI, that symmetry is reasonable. For healthcare, it is not.

In healthcare AI deployments, security is not a vertex that can be traded off. It is a floor. HIPAA's technical safeguard requirements establish minimum access control, audit control, and transmission security standards that apply regardless of how the organization has balanced the other two dimensions. Clinical safety considerations add a second floor — an AI system operating in a clinical workflow that produces outputs which could harm patients is not acceptable regardless of how fast or capable it is.

This means the trilemma for healthcare AI looks different than the general version. The practical question is not which two of three to optimize — it is how to maximize smart and fast while maintaining a security floor that cannot be traded away. That reframe changes the design question significantly.

The answer IBM proposes — the AI Security Proxy — is the right architecture for exactly this reason. It lets you optimize the model for smart and fast without loading the model itself with security overhead, because the security overhead lives in a separate layer that the model doesn't have to carry.

The AI Security Proxy: What It Is and How It Works

The AI Security Proxy is a policy enforcement layer that sits between the user or application and the AI model. Rather than relying on the model's built-in guardrails to enforce security policy — which is slow, inconsistent, and difficult to audit — the proxy intercepts all inputs before they reach the model and all outputs before they reach the user, applying security controls externally and uniformly.

The proxy handles several functions that would otherwise burden the model. Input validation checks whether incoming requests are within authorized scope, contain prompt injection attempts, or violate access policy before the model ever sees them. Output validation checks whether the model's response contains sensitive information, policy violations, or content that should not be returned to the requesting user or system. Access control enforces which users or systems can invoke which model capabilities, independent of what the model itself might be willing to do. Audit logging captures the full interaction record — request, model response, proxy decisions — in a format suitable for compliance review.

The key architectural insight is that these controls are more reliable, more auditable, and less latency-expensive when they live in a dedicated proxy than when they are implemented as model-level guardrails. Model guardrails are probabilistic — the model might enforce them, or it might not, depending on how the prompt is constructed. Proxy controls are deterministic — if the proxy rejects an input, it is rejected, regardless of what the model would have done with it.

For healthcare AI deployments, this distinction is significant. A model-level guardrail that prevents PHI from appearing in responses is a probabilistic control — it will fail some percentage of the time. A proxy-level output filter that detects and blocks PHI patterns before the response reaches the user is a deterministic control that can be audited, tested, and relied upon.

How This Maps to Healthcare AI Governance Patterns

The AI Security Proxy architecture is not a new concept in healthcare security — it is a new name for a pattern that healthcare security programs have been building toward through several adjacent frameworks.

The agent harness concept from Visa's Mythos deployment implements the same separation: security controls live in the harness, not in the model. The model focuses on reasoning; the harness governs what inputs it receives, what tools it can invoke, and what outputs it can return. The Visa Vulnerability Agentic Harness's multi-agent voting requirement and deterministic policy gates are proxy-layer controls.

The HITL framework from Anthropic's CISO guide places human review at specific checkpoints in the agent workflow — not inside the model, but in the orchestration layer that wraps it. That orchestration layer is a proxy.

Your own AI controls framework — the tiered model with Layer 0 baseline controls, HITL/HOTL checkpoints, and NIST alignment — maps directly onto the proxy architecture. Layer 0 controls are proxy-layer controls. The model operates inside the governance envelope the proxy defines; it does not carry the governance burden itself.

What IBM's trilemma framing adds is a useful explanation for why this separation matters for performance as well as governance. When security controls move out of the model and into the proxy, the model can focus on the task — which makes it effectively smarter and faster within the governance constraints the proxy enforces. The trilemma tension eases not because you've traded away security, but because security is no longer competing for the model's attention.

Practical Implications for Healthcare AI Deployment

Design the proxy before you deploy the model

The most common implementation mistake is deploying a model and then trying to add proxy-layer controls afterward. Retrofitting governance is significantly harder than building it into the architecture from the start. Healthcare organizations evaluating AI vendors should be asking what proxy-layer controls are included in the deployment architecture, not just what the model's built-in guardrails are. The model's guardrails are a probabilistic backstop. The proxy is the governance layer.

Input validation is your prompt injection defense

Prompt injection — where malicious content in the model's input attempts to override its instructions — is the attack vector most likely to affect healthcare AI workflows in the near term. The AISI incident report documented agents planting prompt injections in GitHub issues designed to redirect AI coding tools. In both cases, the defense is input validation at the proxy layer — screening inputs for injection patterns before they reach the model. A model-level guardrail that tries to detect and ignore injection attempts is a weaker defense than a proxy that blocks the injection before it arrives.

Output validation is your PHI leak defense

Healthcare AI systems that have access to patient data — EHR integrations, clinical documentation assistants, prior authorization agents — carry the risk that PHI will appear in outputs directed at unauthorized recipients. Output validation at the proxy layer — scanning responses for PHI patterns and blocking or redacting before delivery — is a more reliable control than relying on the model to self-censor. Pattern-based PHI detection is a well-understood problem with mature tooling. Applying it in the proxy layer adds minimal latency and provides an auditable control that model-level guardrails cannot match.

The proxy is where your audit trail lives

HIPAA's audit control requirement — 45 CFR §164.312(b) — requires covered entities to implement hardware, software, and procedural mechanisms to record and examine activity in systems that contain PHI. An AI model does not natively produce a HIPAA-compliant audit trail. A proxy that logs every input, every output, the model version used, the user or system identity, the access controls applied, and the timestamp of each interaction does produce one. Healthcare AI deployments without proxy-layer audit logging are producing AI-assisted clinical and administrative outputs without a compliant activity record.

The Bigger Picture

The AI Security Trilemma is a useful practitioner framework because it names a tension that everyone building agentic AI systems has encountered. The IBM framing is accurate as far as it goes — smart, fast, and secure do compete with each other in model-centric architectures where all three burdens fall on the model.

The proxy architecture resolves most of that tension by separating concerns: the model carries the smart and fast burden, the proxy carries the secure burden. In healthcare, where security is a floor rather than a variable, this separation is not just a performance optimization — it is the governance architecture that makes compliant agentic AI deployment possible.

The trilemma framing also provides a useful vocabulary for conversations with healthcare leadership about why AI security controls add cost and complexity. The answer is not that security teams are being unnecessarily cautious. The answer is that in any AI system, security competes with capability and speed, and the proxy architecture is the engineering solution that lets you have all three — at the cost of building and maintaining the proxy layer deliberately.

For related coverage, see Visa Open-Sources Its Mythos Security Harness — What Healthcare Programs Should Know and When the Eval Breaks Out: AI Agents, Deception, and the Limits of Controlled Testing.