Chiplets make a lot of the old trust assumptions wobble, because a lot of “the chip” securtiy work was really about one die, one clock tree, one boundary. Now you have package links and die-to-die fabric in the middle of the story, so the attack surface starts looking more like an SoC plus a little network you don’t fully control. For LLMs, the annoying part is less “AI magic” and more that model weights, prompt routing, and accelerator DMA all become places where you end up leaning on the same tired defenses, secure boot, IOMMUs, attestation, and hoping the vendor actually wired them through the package.

Are we just back to attestation, isolation, and boring supply-chain checks, except now the package boundary is the new trust boundary?