Air-Gapped AI: What Still Works With No Internet At All

An air-gapped AI system keeps the model weights, the inference server, the retrieval index, the application and its database inside an environment with no network path to anything outside it. Most of what an organization actually does with AI survives that disconnection. A smaller set of functions keeps working but acquires a manual process around it, and a specific list of dependencies stops working entirely. Sorting your system into those groups before you sign anything is the difference between a deployment that goes live and one that stalls in integration testing over a firewall rule that will never be approved.

This is the disconnected end of on-premises AI, which lays out the spectrum from pinning a cloud tenant to a region through to full isolation. Air-gap is the last rung on that ladder and the only one where the constraint is absolute rather than negotiated. On every other rung an exception can be requested. Here there is nothing to request an exception from.

An air gap is not a strict firewall

The two get used interchangeably in requirements documents, and the difference decides what is buildable.

An isolated or firewalled network has a physical route to the outside governed by policy. Egress is denied by default, an allowlist names permitted destinations, and a proxy inspects what passes. The route exists, so a licence check or a model download can be enabled by adding a rule, and the argument is about whether the exception is acceptable rather than whether it is possible.

An air gap removes the route itself, which leaves nothing for a rule to be written against. No cable, no interface, no tunnel and no route table entry connects the enclave to any external network. Data crosses only on controlled physical media or through a one-way transfer device that permits flow in a single direction and returns nothing. Because the return path does not exist, software that expects an answer from outside gets neither a reply nor a refusal, so it hangs until a timeout fires or it throws an error into whatever called it.

Which side of that distinction you are on is usually settled by the classification of the material rather than by anyone's architecture preference. The DoD Cloud Service Provider SRG permits information classified up to SECRET only at Impact Level 6, states that access is "via one or more private SIPRNet connections or approved CNSSP-11 circuits", and requires the entire infrastructure to be dedicated and separate, with the result that an IL6 offering "is not considered 'commercially available'". A programme operating there has not chosen isolation as a posture, because it is buying inside a boundary that already exists and that it has no authority to widen.

A vendor saying "we support on-premises" is therefore making a weaker claim than "we run with no egress at all", and every capability has to be inside the enclave at install time, because nothing missing can be fetched later. Test the stronger claim directly. Ask for a deployment on a lab network where egress is blocked at the switch rather than by policy, then run the workflow end to end, including install, first boot, model load, document ingestion, a chatbot query with citations, and a restore from backup. Software demonstrated only with a proxy in the path will fail somewhere in that sequence, and it is cheaper to find out during evaluation.

What genuinely runs disconnected

Most AI capability survives isolation because inference is a local computation over a local file. A trained model is a set of weights on disk, and serving it is a process that loads those weights into GPU memory and answers requests over a local socket. Nothing in that loop needs the internet. Network dependency enters through the delivery model, not through the mathematics.

The table below groups the surviving capabilities by the reason they survive, with the quality cost of the offline version stated honestly.

The quantization line in that table deserves a number rather than a warning, because the practice sounds far lossier than it measures. Quantizing a model means storing its numbers at lower precision so the whole thing fits into the memory your GPUs actually have, and fixed hardware means you will be doing it. GPTQ reported four-bit quantization costing 0.25 perplexity or less against full precision on 175-billion-parameter models, and 0.3 to 0.6 points at three bits, where perplexity measures how well a model predicts ordinary text and a lower score is a better one. What collapses is the naive method of simply rounding every number to the nearest available value, which took one 176-billion-parameter model from 8.11 perplexity to 571 at three bits. The method matters more than the bit width, and the numbers above are perplexity on general text rather than accuracy on your work, which is why the evaluation set is not optional.

That set of locally running capabilities is the design point for VIDIZMO's air-gapped deployment model, a completely isolated environment with no external network access, built for classified and other high-security networks in defense and intelligence. All AI processing runs locally and no data leaves the environment. Cloud LLM APIs are prohibited in air-gapped environments, including SIPR and JWICS, and that prohibition is what the deployment model exists to satisfy.

What separates a real disconnected deployment from a marketed one is that local processing covers every model class, not just the language model. Generation runs on self-hosted models the customer chooses, with a model-agnostic design so several can operate concurrently and be matched to different tasks. Speech to text runs inside the environment, with voice activity detection and speaker diarization, fully offline. OCR runs locally with model choice per deployment, including a Perso-Arabic path. Entity and PII detection runs locally across eleven language variants. Object and face detection, landmark detection and tracking run on local GPUs. Translation runs on self-hosted models quantized for on-premises hardware. Embeddings are generated locally, and retrieval combines vector and keyword search with hierarchical indexing against a local index.

That list is worth reading as a checklist rather than a feature summary, because the failure it guards against is specific. A vendor can serve a language model on your hardware and still POST an audio file to a cloud transcription endpoint, or an image to a cloud OCR endpoint, and the deployment will pass a demo and fail the moment egress is genuinely blocked. Worse, in a network that permits egress by exception rather than by architecture, it will pass quietly while exporting the most sensitive artefact in the pipeline. Ask which stages make a network call and get the answer as a list, one line per model class.

That coverage comes from the default posture rather than from a special build. Everything ships self-hosted, and external APIs are tenant-configurable alternatives rather than defaults, which makes the disconnected build a subtraction from the standard one rather than a separate product. Sizing the GPU pool that carries all of this, and measuring what quantization costs on your own data, is covered in running LLMs on-premises.

What changes shape rather than breaking

The functions in this section all keep working once the enclave is sealed, and what changes is who has to do the work that used to happen by itself. A background task becomes a staffed process with a named owner, and the cadence of that process becomes a risk you accept deliberately rather than one the software absorbs on your behalf.

Model updates turn into a supply chain, and the control catalogue already names every step of it. NIST SP 800-53 Rev. 5 requires under SI-2 that you "identify, report, and correct system flaws" and "install security-relevant software and firmware updates" within a period your organization defines, under CM-3 that you review each configuration-controlled change "with explicit consideration for security and privacy impact analyses", under SI-7 that you "employ integrity verification tools to detect unauthorized changes" to software, firmware and information, and under SR-4 that you "document, monitor, and maintain valid provenance" of components and associated data. A set of model weights is a component with a provenance, a hash and a change record, and an enclave is where that stops being paperwork.

Those four controls, read together, describe a process that an enclave has to run by hand rather than receive as an automatic update. On the connected side someone assembles the artefact, whether a container image or a weights file, and produces a manifest of hashes alongside it. It moves on physical media or through a one-way device, and on arrival it is verified against the manifest, scanned, staged in an environment that mirrors production, exercised against a regression set, approved, and only then promoted. VIDIZMO's file assessment layer covers part of that verification, with magic-byte file signature analysis, MIME detection, SHA-384 checksum integrity verification and malware detection at ingestion, though ingestion malware scanning is enabled by tenant configuration rather than on by default, so confirm it is switched on. Container-based deployment using Docker and Kubernetes helps separately, because the artefact crossing the boundary has the same shape as the one tested outside it.

Threat intelligence and malware signatures run the same pipeline at higher frequency, which makes cadence a concrete question. A weekly transfer is defensible. An intention to transfer weekly with nobody rostered to do it is how enclaves end up months behind.

Licensing and entitlement need an offline mechanism, and this belongs in writing. Ask how entitlement is validated with no licence server reachable, what artefact carries it, and what the system does when validation cannot run. A platform that fails closed on an unreachable licence check will take your enclave down on a date nobody has in a calendar.

Monitoring and alerting have to terminate inside the boundary, so your metrics collector, your log store, your alert rules and the people who answer a page all sit on the same side of the wall. Event logs can be streamed to an external customer-controlled system via webhook, which here means another system inside the boundary rather than a vendor endpoint. Decide early whether operational telemetry ever leaves, because if it never does, dashboards and capacity trending are yours to build and staff.

Support has to run as a written procedure rather than a screen share, and the procedure has to work with nobody from the vendor able to log in. VIDIZMO staff hold no standing access to customer environments under any deployment model, with break-glass access only, time-bound, MFA-enforced and logged, and in an enclave there is no remote path at all, so every intervention is performed by cleared local staff or escorted on site. The practical consequence lands on the log bundle, because diagnostics that would ordinarily be uploaded to the vendor now need a review and sanitization path, designed while the system is healthy rather than during an outage.

Clocks and certificates both become your own responsibility, because the public services that normally keep them correct are unreachable. Without public time sources you need an internal reference clock, commonly a GPS-disciplined appliance, because drift breaks authentication tokens, log correlation, scheduled jobs and anything validating a certificate window. Certificates need an internal certificate authority with revocation checking that resolves inside the enclave rather than reaching a public responder that will never answer. Expired certificates are among the most common self-inflicted outages in these environments because nothing renews automatically, so keep an inventory with expiry dates and a named owner. Transport posture is TLS 1.2 minimum with 1.3 supported and AES-256 at rest, but the trust chain behind it is yours to operate.

What simply breaks

Each item below works in every test environment that has internet access, and each fails the day the enclave is sealed. This list is why air-gapped projects fail late rather than early.

• Anything calling a hosted model API, and that means every model class rather than the language model alone. Hosted generation, hosted transcription, hosted OCR, hosted translation and hosted detection are all configuration options in connected deployments and have no route in a disconnected one.
• Licence servers and activation callbacks, including the quiet ones where a component checks entitlement at start-up and blocks until it gets an answer.
• Outbound telemetry of any kind, covering usage analytics, crash reporting, error aggregation services and automatic update checks, some of which fail loudly and some of which retry silently while consuming a thread pool.
• Package registries at install and at runtime, meaning pip, npm, apt, NuGet and public container registries. More dangerous are the lazy first-run downloads many machine learning libraries perform, pulling a tokenizer or a weights file from a public hub the first time a code path executes.
• Assets served from a CDN, including web fonts, JavaScript libraries, icon sets and map tiles. These hang or render broken rather than failing cleanly, which makes them slow to diagnose.
• Cloud identity providers, cloud-hosted MFA services, cloud SMTP relays and SMS notification gateways. Directory integration has to resolve to something inside the enclave.
• Outbound webhooks and callbacks, including any integration where a partner platform expects to receive an event.
• Container images referencing a floating tag, which resolve to whatever a registry decides today and resolve to nothing at all here.

Web search as a tool inside an agent workflow belongs on that list, and it is the capability teams most often assume will survive. There is no index to query and no route to one, so anything an agent needs has to already be in the enclave, either as content in the retrieval index or as an internal system it can reach. What an agent needs beyond the model itself is a harness, the scaffolding that supplies its tools, its memory, its control flow and the loop it runs in, and everything in that harness apart from the outward-facing tools carries on working exactly as it did. VIDIZMO's graph-based workflow designer operates identically in air-gapped environments with no dependency on external APIs, and HTTP request and MCP nodes still work against internal endpoints. Design workflows with the substitution already made, so the version tested connected is the version that runs in the enclave. What else changes when a whole agent graph moves inside your boundary is in agentic AI workflows on infrastructure you control.

Disciplines to have in place before switch-on

An air-gapped AI deployment is an operating model as much as an architecture, and the operating model has to exist before the system carries real work.

Start with artefact intake. Write down what may cross the boundary, on what media, who prepares it, who verifies it, who approves promotion into production, and where that record lives. Approval should sit with a named role rather than a team. An assessor will ask to see it alongside the boundary description, and how control requirements become that documentation is covered in the sovereign AI compliance architecture guide.

Mirror your dependencies before you need them. An internal package repository, a container registry, a model store and a manifest of their contents, populated and tested while you still have connectivity, prevent the most common late failure, which is discovering during install that a component wants a public registry.

Model versions need managing as configuration, which means recording alongside each output which model, which quantization, which revision and which prompt template produced it, rather than trying to reconstruct that from memory months afterwards. That record is how you diagnose a regression after an update, and it is what an output relied on in a proceeding needs behind it.

Rehearse a restore rather than only a backup, because a backup nobody has ever restored from is an assumption rather than a copy. A botched recovery is survivable when the missing pieces can be downloaded, and in an enclave anything not in the backup or sitting on a shelf does not exist. Restore into a clean environment on a schedule, time it, and confirm the model artefacts and the index come back.

Plan capacity for the peak, because bursting is not available. Fixed hardware makes queue depth your pressure valve, so decide in advance how the system behaves when demand exceeds supply and make that visible rather than silent. Model it from measured throughput on your own hardware. VIDIZMO's live analytics server handles 32 or more concurrent camera streams per GPU, validated on an NVIDIA RTX 5090 sampling every fourth frame by default, with real capacity varying by GPU model and by the sampling rate and frame rate of the streams. Servers can carry multiple GPUs and scale horizontally by adding nodes, but in an enclave that is a purchase order and a delivery window rather than an API call.

The honest costs

Patching is slower, and that is a security cost rather than an inconvenience. SI-2 makes you name the period in which security-relevant updates get installed, which means the exposure window in an enclave is not an accident you discover later but a number you wrote down and will be assessed against. VIDIZMO's own commitment is to apply security patches within 5 business days of vendor release with emergency hotfixes applied immediately, and in a disconnected environment the clock that actually governs is your transfer and approval cycle. If that cycle is monthly, your exposure window is monthly no matter what the vendor's number says. Shorten the cycle or accept the number explicitly, in writing, because an assessor will ask which one it is.

You will run behind the model frontier. By the time a new open-weight model has been evaluated, packaged, transferred, tested and approved, a connected competitor has been using it for weeks. For transcription, extraction, classification, summarisation and retrieval-grounded answering that gap rarely changes an outcome. For work depending on the strongest available reasoning, it sometimes does.

Staff time is the cost most often left out of the business case. Someone owns the transfer schedule, someone owns the internal certificate authority, someone owns GPU drivers and capacity, someone owns the evaluation set that decides whether a new model is an upgrade. Under a self-hosted deployment, operational responsibility shifts entirely to the customer, with the platform providing encryption, single sign-on and MFA, role-based access control and audit logging to support you rather than performing the operations for you.

Hiring is harder because the job asks for two skill sets that rarely sit in one person. You need people who can run GPU infrastructure and work within the constraints of a secure facility, and in many programmes clearance is required as well. That intersection is small, the recruitment cycle is long, and losing one person can stall a programme.

Some organizations should not do this. If your AI work involves material you would publish anyway, or drafting that carries no legal or safety consequence, an air gap adds cost and operational load without buying protection. The same holds if you have no legal or mission requirement for isolation and are choosing it on principle. Air-gap is a control for material where exposure has consequences measured in lives or in national security, and the organizations that regret it are the ones who chose it without such a requirement.

A pre-flight checklist

Work through this before the enclave is sealed rather than after.

1. Confirm the vendor has run the full workflow with egress blocked at the switch, and ask what was disabled to make it pass.
2. Inventory in writing every outbound call the software makes at install, at first boot and in steady state.
3. Establish how entitlement is validated offline and what happens when validation cannot run.
4. Populate an internal package repository, container registry, model store and manifest, then install from them with no external route present.
5. Define the artefact intake path end to end, including media, hash verification, scanning, staging, approval authority and the retained record, and map it explicitly to SI-2, CM-3, SI-7 and SR-4 so the assessment conversation is short.
6. Roster a transfer cadence for model updates, patches, signatures and configuration changes, and write down the exposure window it implies.
7. Stand up an internal certificate authority and a local time reference, with a certificate inventory carrying expiry dates and named owners.
8. Terminate monitoring, logging, alerting and paging inside the boundary, and decide whether any operational data leaves.
9. Agree the support procedure, and design the log sanitization and export path before an incident needs it.
10. Replace every external tool call in your agent harness, web search first, with an internal equivalent or a documented gap.
11. Rehearse a full restore into a clean environment, including model artefacts and the index, and record how long it takes.
12. Size capacity for peak demand on measured throughput, and define what users see when the system saturates.
13. Name the owner of the model evaluation set and schedule its first review before go-live.

An air gap leaves most AI capability intact and takes the convenience away instead. It replaces several background tasks with staffed processes, and it demands that the software was built to run without its vendor. Test that last property hardest, because it is the one that cannot be added later.