Air-Gapped AI Deployment, Explained

What an air gap actually is

Start with the definition, because the term gets used loosely. The NIST Computer Security Resource Center glossary, drawing on CNSSI 4009-2015, defines an air gap as "an interface between two systems at which (a) they are not connected physically and (b) any logical connection is not automated (i.e., data is transferred through the interface only manually, under human control)."

Two things in that sentence do a lot of work. First, there are two clauses, and most systems people call air-gapped satisfy only the first. A server with the Ethernet cable pulled but a nightly rsync over a management VLAN is not air-gapped; it is disconnected from one network. Second, an air gap is a property of an interface, not of a room. The question is never "is this machine offline" but "by what mechanism does data get in and out, and is a human in that loop every time."

That framing matters because the adjacent architectures are often what a program actually deploys. A unidirectional security gateway — a data diode — enforces one-way flow in hardware, and NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023) is the standard reference for that class of design. A diode is useful and it is not an air gap, because the flow is automated. If you need automated movement of data between security domains at all, that is a cross domain solution, governed for U.S. government systems by NSA's National Cross Domain Strategy and Management Office and its Raise the Bar requirements. NIST SP 800-53 Rev. 5 even has a control for it: AC-4(20), Approved Solutions.

Air-gapped is not the same as IL5 or IL6

This conflation shows up constantly, and it changes the design. The DoD Cloud Computing Security Requirements Guide, maintained by DISA and published on the DoD Cyber Exchange, defines impact levels by the sensitivity of the information involved: IL2 for information approved for public release and other non-CUI, IL4 for controlled unclassified information, IL5 for higher-sensitivity CUI and unclassified national security system information, and IL6 for classified information up to SECRET.

None of those is a statement about air gaps. Per Section 5.2.2.4 of the SRG, as summarized in Microsoft's published DoD IL6 compliance documentation, IL6 cloud infrastructure "is considered to be a Secret Internet Protocol Router Network (SIPRNet) enclave, and as such will be a closed self-contained environment for the cloud service offering processing, storage, and management planes connected only to SIPRNet." There is a network. It has no path to the public internet, and it is a network all the same, with the routing, service discovery, and update mechanics that implies.

So when someone says "IL6," they are telling you which accreditation boundary and which network their system lives on. When they say "air-gapped," they are telling you about the transfer interface. A system can be IL5-accredited and fully connected; a commercial system can be genuinely air-gapped and hold nothing classified at all, because a company simply refuses to put a proprietary corpus on any network. Ask which is meant before you design anything, because the answer determines whether you are building for an enclave with services or for a box that boots alone — and in the enclave case, whether each service in the stack is individually accredited at that impact level rather than merely present in a government region.

Why most AI tooling assumes a network

Nearly every convenience in the modern ML stack is a network call. Model weights are fetched lazily on first use, and the weights are not the only file: tokenizer, configuration, generation config, and chat template typically download separately. Hugging Face's own environment variable documentation notes that even when the latest version of a file is already cached, the download helper "still triggers a HTTP request to check that a new version is not available," and that setting HF_HUB_OFFLINE=1 skips that call. With that variable set, Hub API calls raise an explicit offline error instead of silently reaching out.

The same pattern repeats one layer down. Package installs resolve against a public index. Container images pull from a registry. Several libraries collect usage telemetry by default — the same documentation describes HF_HUB_DISABLE_TELEMETRY=1 (and the ecosystem-wide DO_NOT_TRACK) for turning it off, and HF_HUB_DISABLE_UPDATE_CHECK=1 for the CLI's startup check against PyPI. Underneath all of that sit DNS, NTP, TLS certificate revocation checks, and occasionally a license server.

Here is the part that surprises teams: on a machine with no route out, none of this fails cleanly. It hangs, then times out. Hugging Face's defaults for metadata and download timeouts are ten seconds each. Stack a few of those across a startup path and the bug report reads "the model is slow to load," which sends an engineer to profile inference when the real cause is a dependency on a network nobody documented. Disconnection is not a configuration you can assume — it is a state you have to test for deliberately.

The bundle is the deliverable

In a connected deployment, the artifact is a container image and a config. In an air-gapped deployment, the artifact is a bundle that crosses a boundary once, and everything about how you build it is a security decision.

File format is one of them. Prefer safetensors, which its documentation describes as "a new simple format for storing tensors safely (as opposed to pickle)." PyTorch's older .bin checkpoints are pickles, and unpickling executes code by design. Importing an arbitrary-code-execution format across a boundary you built specifically to control what enters is a poor trade, and the safer format costs nothing.

Dependencies are another. Pip supports pulling a full wheel set on a connected staging host and installing from that directory with no index, and its secure installs documentation describes hash-checking mode via --require-hashes, where hashes are embedded in the requirements file "to protect against remote tampering and network issues." Inside an enclave, that pinning is also your inventory: it is the answer to "what exactly is running in here," which an assessor will ask.

Finally, the media itself. Once you remove the network, removable media becomes the concentrated risk, and it is well-documented as such. NIST's National Cybersecurity Center of Excellence finalized NIST SP 1334, Reducing the Cybersecurity Risks of Portable Storage Media in OT Environments, on September 30, 2025. The control-language versions are in NIST SP 800-53 Rev. 5: MP-7 (Media Use), which restricts or prohibits specified media types and blocks portable storage with no identifiable owner, and SC-41 (Port and I/O Device Access), which covers disabling or removing USB, Thunderbolt, and optical drives outright.

A deployment checklist

1. Pin the model artifact exactly. Specific weights, tokenizer, config, and chat template, with hashes recorded. Prefer safetensors over pickle-based checkpoints.
2. Pin the runtime. Inference server version, accelerator driver and toolkit versions, kernel. Write down what you actually tested against, not what you assume works.
3. Vendor the dependency set. Download wheels on a staging host, install offline from that directory, and hash-pin the requirements file.
4. Export container images to files rather than assuming a reachable registry inside the enclave.
5. Turn off the callbacks explicitly. Offline flags, telemetry flags, update checks. Set them in the image, not in someone's shell profile.
6. Test with egress blocked, not merely absent. Run the full startup path on a staging host with outbound traffic denied at the firewall and watch for stalls. Anything that pauses is a hidden dependency.
7. Design the update path before day one. Air-gapped systems drift. Decide the cadence, the media, who signs a bundle, and who verifies it on the far side.
8. Log locally and keep it. Model version, prompt, retrieved records, output, timestamp. You cannot reconstruct an incident later from a system that had no reachback and no local log.
9. Put evaluation inside. You will not be exporting enclave data to score a model in a notebook somewhere. The eval harness and its fixtures have to run on the far side of the gap.
10. Write the reproduction procedure. Someone who is not you should be able to rebuild the enclave from the bundle and the document. If that is not true, you have a demo, not a deployment.

What an air gap does not buy you

It does not make the model correct. Accuracy, hallucination rate, and whether a cited passage actually supports the sentence attached to it are unchanged by network topology. A wrong answer produced offline is still a wrong answer, and it is now harder to catch because fewer people can see the system.

It does not stop malware; it relocates the attack surface to the transfer interface. That is precisely why NIST published SP 1334 and why the 800-53 media controls exist.

It does not remove the accreditation work. Controls are still assessed, the authorization boundary still has to be drawn and evidence assembled against every control, and an authorizing official still makes a risk decision about a specific system in a specific environment.

And it does not solve governance inside the enclave. If everything in the enclave sits at one classification, a retrieval system can read all of it, which makes the model an aggregation surface. Per-record access rules, source marking, and traceability from every generated sentence back to the record it came from matter more inside an air gap, not less.

Finally, it constrains model choice. Air-gapped deployment means open-weight models you can hold on disk and run yourself. Our guide on open-weight versus frontier API models covers that trade honestly, and the free course on running LLMs locally is a reasonable place to build the muscle memory before an enclave is involved.

Where the honest boundaries are

Precision Federal, the federal software and AI firm that publishes this site, builds small models that read through a body of records and produce a written conclusion, with every statement traced back to the exact record it came from — including the offline bundle, the local evaluation harness, and the reproduction document that makes such a system deployable inside a boundary. That is the work we do.

Here is what we do not do, stated plainly because it saves everyone time. We do not build or accredit cross domain solutions; that is NCDSMO baseline territory and belongs to vendors who specialize in it. We do not issue authorizations to operate, act as your assessor, or promise an accreditation outcome — we produce artifacts an assessor asks for, and the authorizing official decides. We do not describe a model as "IL5 authorized" or "IL6 authorized," because models are not authorized; systems are, in a named environment, by a named official. And where a project requires work performed inside a classified facility, that is a facility-and-clearance question answered before an engineering conversation, not during it.

If the honest answer to a problem is a smaller model, a deterministic pipeline, or no AI at all, that is what we will say. On the far side of an air gap, nobody is coming to patch an overreach for you.

Sources: NIST CSRC Glossary — air gap (CNSSI 4009-2015); DoD Cyber Exchange — Cloud Computing Security Requirements Guide; Microsoft Learn — DoD Impact Level 6 (quoting CC SRG §5.2.2.4); NIST SP 800-82 Rev. 3 — Guide to OT Security; NIST SP 1334 — Portable Storage Media in OT Environments; NIST SP 800-53 Rev. 5; NSA — National Cross Domain Strategy and Management Office; Hugging Face Hub — environment variables; safetensors documentation; pip — secure installs. Analysis and framing by Precision AI Academy.

Common questions

What is an air gap? The NIST glossary, citing CNSSI 4009-2015, defines it as an interface between two systems at which they are not connected physically and any logical connection is not automated — data crosses only manually, under human control. It describes an interface, not a room.

Is an air-gapped system the same as DoD Impact Level 6? No. The DoD Cloud Computing SRG describes IL6 infrastructure as a SIPRNet enclave: a closed, self-contained environment connected only to SIPRNet, with no path to the public internet. That is a network, just a classified one. Impact level describes data sensitivity and accreditation; air gap describes the transfer interface.

Why does AI tooling break when it is disconnected? Weights, tokenizers, and configuration files are fetched on demand; packages resolve against a public index; container images pull from registries; some libraries send telemetry. Hugging Face documents an offline mode precisely because a cached file still triggers a version check by default. With no route out, those calls hang until they time out rather than failing immediately.

Does an air gap make an AI system secure? It removes one class of risk and concentrates another at the transfer interface, which is why NIST published SP 1334 on portable storage media and why SP 800-53 Rev. 5 includes MP-7 and SC-41. It does nothing about model accuracy, aggregation risk inside the enclave, or the accreditation work itself.