arXiv:2610.37147v1 Announce Type: new Abstract: Mobile Internet-of-Things (IoT) endpoints such as connected vehicles, wearables, and drones continuously cross heterogeneous network domains, creating handover-driven attack surfaces that static, cloud-anchored detectors cannot follow. However, three obstacles block real-time detection on such roaming endpoints: detection state is lost at every inter-domain handover; transmitting raw telemetry to a fixed detector exhausts the uplink and the device battery; and full-depth language model inference cannot meet millisecond latency budgets on constrained hardware. To tackle these challenges, we propose MAPLE-Sec, a mobility-aware partitioning framework that splits a compact, security-tuned language model across a roaming device and its nearest edge node. First, a trajectory-conditioned partition scheduler recomputes the split point from predicted handover timing, residual battery, and uplink quality. Second, a token-budgeted early-exit mechanism emits a verdict at the shallowest layer that meets a confidence threshold. Finally, a learned activation-compression codec migrates the intermediate inference state across edge nodes during handover without retransmitting raw telemetry. We formalize the partition-and-migration decision as an on-device constrained optimization solved in sub-millisecond time. Extensive experiments across the CIC-IoT and Edge-IIoTset corpora under both IID and non-IID roaming conditions demonstrate that MAPLE-Sec sustains detection across mobility events, improving the converged F1-score by up to 9.3\% relative to Cloud-only and by 2.9 percentage points over the strongest edge-collaborative baseline (EdgeShard), while reducing end-to-end latency by up to 2.5$\times$. Ablation confirms that the activation-compression codec reduces migration energy by 2.4$\times$ versus the raw-activation migration variant.