We present a Sovereign AI architecture for clinical triage in which all inference is performed on-device and inbound data is delivered via a physically unidirectional channel, implemented using receive-only broadcast infrastructure or certified hardware data diodes, with no return path to any external network. This design removes the network-mediated attack surface by construction, rather than attempting to secure it through software controls. The system performs conversational symptom intake, integrates device-captured vitals, and produces structured, triage-aligned clinical records at the point of care. We formalize the security properties of receiver-side unidirectionality and show that the architecture is transport-agnostic across broadcast and diode-enforced deployments. We further analyze threat models, enforcement mechanisms, and deployment configurations, demonstrating how physical one-way data flow enables high-assurance operation in both resource-constrained and high-risk environments. This work positions physically unidirectional channels as a foundational primitive for sovereign, on-device clinical intelligence at the front door of care.

翻译：我们提出了一种用于临床分诊的自主式人工智能架构，该架构在设备端执行所有推理，并通过物理单向信道（采用仅接收广播基础设施或经过认证的硬件数据二极管实现，无返回路径至任何外部网络）传输入站数据。该设计从架构上消除了网络中介的攻击面，而非通过软件控制加以防护。系统在护理现场执行对话式症状收集、整合设备测量的生命体征数据，并生成结构化、符合分诊要求的临床记录。我们形式化了接收端单向性的安全属性，并证明该架构在广播和二极管强制部署场景下具有传输无关性。进一步，我们分析了威胁模型、强制机制和部署配置，展示了物理单向数据流如何在高保障性条件下运行于资源受限和高风险环境中。本研究将物理单向信道定位为护理前沿自主式、设备端临床智能的基础原语。