On the Security and Privacy of LLMs in Mobility

A survey of LLM applications in intelligent transportation reveals a critical gap between optimization performance and AI Act compliance, with security, privacy, and reliability largely neglected.

Mauro Conti; Lorenzo Perinello; Umberto Salviati· arXiv· 2026· DOI 10.48550/arXiv.2609.26295

The core problem

The mobility sector is undergoing a paradigm shift driven by advances in Generative Artificial Intelligence. With a global market valued at approximately 2.9 trillion dollars annually, considering only cars, the integration of these technologies has the potential to impact more than 1.5 billion vehicles worldwide. As Large Language Models (LLMs) are increasingly adopted in mobility, concerns about cybersecurity, privacy, and reliability emerge. Accordingly, this paper surveys current applications and assesses these challenges. Since the European AI Act classifies transportation AI as high risk, the authors derive nine technical classes from its requirements to assess current research and future deployments. The study aims to map the landscape of LLM applications in mobility, evaluate the extent to which security and privacy are addressed, and identify gaps in regulatory compliance. The central research question is: to what extent does current research on LLMs in mobility address the high-risk requirements set forth by the European AI Act, particularly in terms of security, privacy, and reliability?

The findings show that research mainly studies GPT and Llama models (over 50% of reviewed works) and traffic applications while largely neglecting security, privacy, and reliability. This gap extends to AI Act compliance: among 35 reviewed works, only one includes a partial vulnerability assessment and one a partial risk management system. The results indicate a clear gap between strong optimization performance and regulatory adherence. Most works focus on improving efficiency, accuracy, or user experience, but few address the high-risk requirements mandated by the AI Act. The distribution of models and applications suggests a concentration on popular, general-purpose LLMs rather than domain-specific or safety-critical solutions. The lack of comprehensive security and privacy assessments raises concerns about the deployment of LLMs in real-world mobility systems, where failures could have severe consequences.

The mobility sector is undergoing a paradigm shift driven by advances in Generative Artificial Intelligence. With a global market valued at approximately 2.9 trillion dollars annually, considering only cars, the integration of these technologies has the potential to impact more than 1.5 billion vehicles worldwide. As Large Language Models (LLMs) are increasingly adopted in mobility, concerns about cybersecurity, privacy, and reliability emerge. Accordingly, this paper surveys current applications and assesses these challenges. Since the European AI Act classifies transportation AI as high risk, the authors derive nine technical classes from its requirements to assess current research and future deployments. The study aims to map the landscape of LLM applications in mobility, evaluate the extent to which security and privacy are addressed, and identify gaps in regulatory compliance. The central research question is: to what extent does current research on LLMs in mobility address the high-risk requirements set forth by the European AI Act, particularly in terms of security, privacy, and reliability?

The authors conducted a systematic survey of existing literature on LLM applications in the mobility sector. They reviewed 35 works, extracting information on the models used, application domains, and the coverage of security, privacy, and reliability aspects. To structure their assessment, they derived nine technical classes from the European AI Act's requirements for high-risk AI systems. These classes likely include: risk management system, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness, and cybersecurity. Each reviewed work was evaluated against these classes to determine the level of compliance. The survey also analyzed the distribution of LLM models (e.g., GPT, Llama) and application areas (e.g., traffic, autonomous driving). The methodology emphasizes a gap analysis between optimization performance and regulatory adherence, highlighting the need for security-by-design in safety-critical intelligent transportation systems.

The authors identify a clear gap between strong optimization performance and regulatory adherence, suggesting compliance is limited less by technology than by a focus on static performance over lifecycle safety. This underscores an urgent need for security-by-design in safety-critical intelligent transportation systems. The discussion highlights that the European AI Act's high-risk classification for transportation AI imposes stringent requirements, yet current research largely ignores them. The authors argue that the mobility sector's adoption of LLMs must prioritize security, privacy, and reliability from the outset, rather than as an afterthought. They call for a shift in research priorities towards lifecycle safety, including vulnerability assessments, risk management, and continuous monitoring. The paper also notes the potential impact of LLMs on 1.5 billion vehicles worldwide, emphasizing the scale of the challenge. The analysis suggests that without regulatory adherence, the benefits of LLMs in mobility may be undermined by security and privacy risks.

CS practitioners and researchers

Opening member content…