What air-gapped AI actually means
Air-gapped AI is not a different algorithm. It is a different delivery model. The model weights, the training data, the prompt logs, the gradient updates, the evaluation harness, the CI runner, the observability stack, and the human in the loop all live inside a closed network. There is no outbound internet. There is no pip install at runtime. There is no hosted LLM API. Every dependency must be brought in through an approved transfer path, scanned for malware, and approved by the information system security manager. This changes how you build, test, deploy, and monitor an AI system in ways that only show up after you try it.
Precision Federal builds AI for disconnected and export-controlled environments the way mission owners consume it: open-weight large language models on customer-accredited GPU clusters, retrieval systems that honor data labels, inference stacks that emit audit logs to the enclave SIEM, and documentation that supports your own authorization. The firm holds an approved DD Form 2345 (Joint Certification Program), which makes it an eligible recipient of export-controlled technical data, and the founder brings deep experience with FedRAMP High and DoD IL5 patterns.
Why this matters federally: many agencies with valuable AI use cases work on disconnected networks or with export-controlled technical data, and they cannot send that data to a commercial SaaS LLM. They need the same modern AI stack running offline, built by people who understand that a missing sanitization step is a spillage, not a bug.
The air-gapped AI stack we use
Every component below was selected because it runs inside a closed enclave without phoning home, supports offline license activation, and produces auditable artifacts.
- Open-weight LLMs: Llama 3.1 (8B/70B/405B), Mistral Large, Mixtral 8x22B, Qwen 2.5, DeepSeek-V3, Phi-4. Weights imported through the customer's approved one-way transfer, SHA-256 verified, scanned, and registered in an offline model registry.
- Inference runtimes: vLLM, TensorRT-LLM, llama.cpp, Text Generation Inference — all usable fully offline. NVIDIA Triton for serving when GPU utilization matters more than throughput.
- Fine-tuning: LoRA and QLoRA via PEFT, full-parameter SFT on DGX-class hardware, DPO/KTO for preference alignment. Training logs stay inside the enclave; no W&B cloud.
- Retrieval and RAG: self-hosted vector stores (Qdrant, Milvus, Weaviate, pgvector). Data labels (CUI category, export-control notice, need-to-know group) attached at the chunk level; the retrieval filter enforces label-based access before the LLM ever sees a document.
- Offline MLOps: MLflow self-hosted, DVC on on-prem S3-compatible storage, Airflow or Argo Workflows for orchestration. See our MLOps page for the connected baseline.
- Red team and eval: Garak, PyRIT, lm-evaluation-harness, custom mission-specific evals. Adversarial probes stored in the enclave; findings routed to the ISSM.
- GPU platforms: NVIDIA DGX, HPE Cray, Supermicro GPU nodes, on the customer's own accredited hosting or on-prem racks. Kubernetes via OpenShift or vanilla with STIG-hardened control plane.
- Guardrails: NVIDIA NeMo Guardrails, Llama Guard, marking-aware output filters built to the agency's own marking standard (CUI, export-control notices).
Multi-level security (MLS) design
When users with different access rights share an AI system, leakage is the first failure mode. We design retrieval, prompting, and logging so a user never sees content above their access and every answer carries the right markings. Controls include per-document labels, user-attribute filtering on the retriever, mandatory access control in the application layer, output markings that default to the most restrictive input, and a marking banner on every response. Where data must cross between networks, the software is built to pass through the customer's accredited cross-domain solution (Forcepoint, Owl, Arbit) rather than a guard of our own.
Federal deployment considerations
Air-gapped AI engagements almost never start as greenfield. The accrediting authority already has opinions about where the enclave lives, who can touch it, and what an acceptable change management process looks like. Our delivery pattern:
- Boundary first: the authorization boundary is drawn before the first line of code. Every LLM, retriever, ingestion pipeline, and logging component is mapped to it.
- Control of weights: a fine-tune carries the markings of the data it was trained on, so a model tuned on export-controlled data is handled as export-controlled. The model registry enforces this.
- ATO support: we write the documentation your authorizing official needs (system security plan inputs, control mappings, component inventory) and reuse control inheritance from the hosting environment wherever possible. See ATO engineering.
- ITAR and EAR: training data and model artifacts that touch defense articles or dual-use technologies are treated as controlled. Export control officers review before any cross-boundary transfer.
- Transfer-ready delivery: we build and test with synthetic data of the same structure, and hand over signed, scanned, versioned artifacts that move into the enclave through the customer's own approved transfer path.
Where this fits in Precision Federal engagements
Air-gapped AI sits at the top of the sensitivity pyramid for our federal work. It layers on top of generative AI, RAG systems, and MLOps, and inherits authorization patterns from ATO engineering and cybersecurity. Typical engagements: stand up a sanitized open-weight LLM in an air-gapped environment, harden a retrieval pipeline against spillage, or deliver an ATO package for a disconnected AI application.