Unbuildable offline
A dependency resolves fine in CI and cannot be fetched inside the enclave. Discovered at the worst possible moment.
Air-Gapped Deployment
How models, dependencies, and updates cross an air gap — the part that determines whether an isolated deployment is maintainable or merely possible.
Standing up a model inside a disconnected enclave is not the hard part. Keeping it current for three years is.
Every routine operation that assumes a network — pulling a package, downloading weights, phoning home with telemetry, checking a licence — becomes a logistics process with change control attached. These must be designed for at the start. Retrofitting them onto a connected pilot is where air-gapped projects fail.
Components
Process walkthrough
Staging zone
A connected environment that assembles and verifies everything before it crosses. Treat it as part of the security boundary, because a compromise here is a compromise inside.
Integrity verification
Checksums, signatures, and provenance for weights and every dependency. Model supply chain is a real attack surface and largely unaddressed in most deployments.
Signed bundle
One artifact, versioned, with a manifest. Transferring loose files invites partial or mismatched updates that are painful to diagnose later.
Import & verify
Signatures re-checked inside the enclave. Verification on the sending side alone is not a control.
Validate against evaluation set
The new model runs against your maintained test set before promotion. A model that regresses is rejected inside the enclave, not discovered by users.
Internal mirror
Packages, base images, and CUDA components mirrored internally and version-pinned. This is the step most projects discover far too late.
Internal observability
Metrics, traces, and evaluation dashboards run inside. Most vendor tooling assumes outbound connectivity and simply cannot be used.
Rationale
Decisions and trade-offs
| Decision | What we do, and why |
|---|---|
| Bundle, do not stream | One signed artifact per update. Reproducible, auditable, and diagnosable — unlike a set of loose transfers. |
| Validate inside, not outside | The evaluation set lives in the enclave with the real data. Validating against sample data outside proves very little. |
| Mirror everything, pin everything | Assume no registry is reachable, ever. Unpinned transitive dependencies are the most common cause of a failed offline build. |
| Accept the slower cycle | Expect the longest change cycle of any deployment model. Plan the roadmap around it instead of fighting it. |
| Build observability first | Without external telemetry you are blind by default. Internal dashboards are foundational here, not a later refinement. |
Failure modes
Failure modes this addresses
Unverified model provenance
Weights of uncertain origin promoted into a classified environment with no integrity chain.
Silent regression on update
A newer model performs worse on your specific task and nobody measured before promoting.
Blind operation
No telemetry, no dashboards, no way to answer whether the system is still working as intended.
Related
On-Premise AI
On-Premise AIAI for Defense
AI for DefenseWant this sized for your environment?
The assessment produces a reference architecture scoped to your data, infrastructure, and regulatory position — not a generic diagram.
Vendor-neutral. We hold no reseller agreements and take no vendor commissions.