Air-Gapped AI Infrastructure for Government Missions
Air-gapped AI is an AI environment whose security boundary prevents routine network connectivity to external systems. That can support classified, disconnected, tactical, laboratory or critical-infrastructure missions, but unplugging an internet cable is not the design. Models, packages, security updates, datasets, licenses, logs and replacement parts still cross the boundary through controlled processes.
By Uniqcli Team · · 6 min read
Key takeaways
- Define the exact boundary; “air gapped” may still contain multiple internal zones and management networks.
- Build an approved content-transfer path with quarantine, scanning, signing, authorization and audit.
- Mirror models, packages, containers, documentation and licenses inside the boundary.
- Design identity, time, DNS, logging, backup and monitoring to operate without external services.
- Test updates and recovery in a representative staging environment before importing them.
- Isolation reduces some remote paths but can increase patch delay, insider and removable-media risk.
On this page
A successful air-gapped environment treats transfer, provenance, offline operations and recovery as first-class system functions. Otherwise isolation becomes technical debt: stale software, unknown artifacts, weak observability and emergency workarounds.
Define the air gap
Draw the boundary and name what sits inside it. Include users, GPU compute, storage, network fabric, management nodes, administrator workstations, identity services, logging, backup, time source, DNS, software repositories, model registry and transfer stations. Then show every physical or logical interface.
Some environments are permanently disconnected. Others use a scheduled cross-domain transfer, a unidirectional gateway or an intermittently connected maintenance window. Do not use “air gap” to hide those differences. Each pattern has a different authorization, threat and operating model.
Separate internal zones. Training data, production inference, development, management and backup may need different access even when all are disconnected from the public internet. Apply zero-trust architecture principles inside the boundary: authenticate users and workloads, minimize privilege, segment management and record activity.
Define failure behavior. If a node loses its local license, identity service or time source, does inference stop? If a model artifact is corrupt, can operations return to the last known-good version? The boundary diagram should include recovery paths, not only normal flows.
Map every required flow
List what must enter:
- Base operating-system and firmware updates.
- GPU drivers, CUDA components and container images.
- Python/system packages and dependency metadata.
- Model weights, adapters, tokenizers and evaluation suites.
- Mission datasets and retrieval documents.
- Vulnerability signatures and trust roots.
- Licenses and entitlement files.
- Hardware replacement images and recovery media.
List what may leave: security logs, aggregate metrics, approved outputs, incident artifacts, model evaluations and media marked for destruction or reuse. Define classification, owner, direction, frequency, format, maximum size, allowed media and approval for each flow.
Large models change transfer engineering. Hundreds of gigabytes or terabytes cannot be handled like a small patch. Estimate transfer, scanning, hashing and import time. Validate media capacity, interface speed, encryption, error detection and physical handling. Keep enough working space in quarantine and target repositories for both the incoming artifact and rollback copy.
Build a controlled transfer pipeline
A defensible inbound process has distinct stages:
- Acquire from an approved source in a connected zone.
- Record source, version, hash, license and requested owner.
- Quarantine and scan with multiple appropriate controls.
- Test the artifact in a representative staging environment.
- Approve the transfer under the site's authority and two-person rules where required.
- Write to controlled media or an approved transfer mechanism.
- Verify tamper evidence, custody and hash at the receiving boundary.
- Import into an internal quarantine repository.
- Re-scan, validate signature/hash and promote to the approved repository.
- Retain or destroy transfer media under policy and close the audit record.
Outbound processing needs comparable controls to prevent data leakage. Scan content, enforce classification/release approval, record custody and validate that the media does not carry residual data from prior use.
Automation can reduce transcription error, but automated transfer must not erase accountability. Produce a machine-readable manifest and a human approval record. If a tool transforms or repackages the artifact, retain both source and derived hashes and record the transformation.
Operate the AI software supply chain offline
Create internal mirrors for operating packages, containers, drivers, models and documentation. Pin versions. Resolve dependencies in the connected staging environment so an offline installation does not discover that it needs an external package index.
Maintain a model registry with provenance, license, source, hash, evaluation, approval, deployment and retirement status. Treat adapters and system prompts as versioned artifacts. If a model is quantized or converted, record the toolchain and evaluate the derived artifact; it is not identical to the source weights.
Use signed containers and an internal trust root appropriate to the environment. Keep vulnerability data current enough to scan imported artifacts, but recognize that signature updates themselves require transfer. Establish a cadence and an emergency path for critical issues.
Licensing is a frequent hidden dependency. Verify that operating software, management tools and model licenses can function for the required disconnected period. Document offline activation, grace periods, renewal process and behavior when an entitlement expires. Do not discover a cloud-only license check during a mission.
NIST SP 800-161 Rev. 1 provides a lifecycle approach to supply-chain risk. Apply it to software/model sources and to the hardware BOM, integrator and logistics path.
Design resilient platform services
An air-gapped AI cluster needs local identity, name resolution, time, certificate services, orchestration, scheduler, secrets, observability and backup. Deploy them with redundancy proportional to mission needs. A highly available GPU pool is not available if a single identity or registry node fails.
Logging must stay useful inside the zone. Size retention for security, model and platform telemetry. Protect logs from unauthorized alteration and export approved summaries through the outbound path when needed. Define who monitors alerts without an external managed service.
Storage design should separate active datasets, model registry, scratch/checkpoints, retrieval indexes, user workspaces and recovery. The AI storage architecture guide maps the tiers. Maintain an immutable or isolated recovery copy and test restoration without external repositories.
Plan hardware service. Keep approved firmware and diagnostic tools available offline. Define how vendor engineers, tools and replacement media enter the zone. Hold critical spares if mission downtime cannot wait for a screened replacement path.
Test security and mission recovery
Factory acceptance should prove the hardware, fabric and storage under load. Site acceptance should also test the disconnected operating model:
- Install a node from internal repositories.
- Import and deploy a signed model artifact.
- Revoke an administrator and rotate a key.
- Apply and roll back a driver or firmware update.
- Restore the scheduler, model registry and a representative dataset.
- Operate through loss of an internal service and a power feed.
- Reconcile every transferred artifact against the manifest.
- Export an approved log package without unauthorized data.
Exercise the emergency update path. A process designed only for quarterly releases may fail during an actively exploited vulnerability. Define who can authorize expedited transfer, what testing may be abbreviated and what compensating controls apply.
Review isolation controls for insiders and removable media. CISA's secure AI system development guidance stresses secure design through operation. Physical isolation does not eliminate malicious artifacts, misconfiguration or unsafe model behavior.
Procurement checklist
Include these deliverables in the requirement:
- Boundary and data-flow diagrams.
- Offline dependency and license report.
- Internal repository and model-registry build.
- Transfer-station hardware/software and operating procedure.
- Artifact manifest, hashing and signature method.
- Local platform-service architecture and capacity.
- Security configuration and logging integration.
- Backup, recovery and last-known-good model process.
- Staging environment and update test plan.
- Spares, firmware, diagnostic and vendor-access procedure.
- Factory/site acceptance tests and operator training.
- As-built BOM, firmware/software manifest and change-control baseline.
Specify who provides each item. A compute supplier may not own cross-domain policy; the agency may not expect to build the internal container repository. Assign the interfaces so they do not become post-award gaps.
Can an air-gapped AI system still receive updates?
Yes. Air-gapped does not mean permanently frozen; it means updates cross the boundary through an authorized process instead of a routine external network connection. The program should define normal and emergency cadences, staging tests, artifact signatures/hashes, media control, approval, rollback and audit. If a vendor product supports only automatic cloud update, either obtain a supported offline method or select a different component. Delayed patching is a risk that must be measured and managed, not an unavoidable excuse.
How Uniqcli can support deployment
Uniqcli can support the physical and integration layers of an air-gapped environment: security and continuity, AI infrastructure, rack integration, staging, firmware/software baselining, offline documentation and acceptance planning. Request an offline operations and transfer-path workshop.
Bring the boundary, classification/handling owners, transfer policy, model sizes, update cadence, recovery target and facility limits. The result should identify what Uniqcli can integrate, what the agency must authorize and what external software dependencies need redesign.
Security note: An air gap is not a certification or complete control set. Apply the agency's authorization, cross-domain, media, classification and risk-management requirements.