# Air-gapped AI CURRENT_STATUS: UNKNOWN OBSERVATION: SPEC_ONLY FRESHNESS: UNKNOWN PAGE_TYPE: reference CANONICAL_URL: /tools/ea-090-air-gapped-ai CLAIM_IDS: none EVIDENCE_IDS: EVD-EA-090-URL-57C3247CCB94, EVD-EA-090-URL-272149FACE44, EVD-EA-090-URL-A18F0A72C8B7, EVD-EA-090-URL-7591E2070CAB, EVD-EA-090-URL-6B878F018210, EVD-EA-090-URL-98C9ED2E4EC6, EA-090-R11-RESEARCH, EA-090-R11-WEB-READBACK UNKNOWN_IDS: EA-090-UNKNOWN-01, EA-090-UNKNOWN-CURRENTNESS OPS_IDS: none ## Summary 「Air-gapped AIは、モデルを一度持ち込んでネットワークを切れば完成するものではない。閉域内で推論・RAGを実行できることに加え、モデル、コンテナ、依存package、データ、脆弱性情報を検証付きで持ち込み、内部repositoryから更新・rollback・監査できる供給線が必要である。物理mediaは更新経路であると同時にattack surfaceでもある。」 ## Current judgment - Air-gapped AIの本体はoffline inferenceではなく `controlled import → verify → quarantine/stage → approve → internal registry/repository → deploy → audit → rollback` の更新supply chain。 - Red Hat OpenShift 4.20はfully disconnected環境でmirror-to-disk、physical transfer、disk-to-mirrorという更新経路を公式に実装している。AI専用機能ではないが、container/runtime/operator供給線の実装根拠になる。 - Hugging Face Transformersはpre-downloaded artifact、HF_HUB_OFFLINE、local_files_onlyでoffline executionを明示的にsupportする。これは「モデルをofflineでloadできる」証拠であり、安全なair-gap更新手順の証明ではない。 - physical mediaはair gapを越える更新channelになるため、air gapは攻撃面をゼロにしない。NISTはremovable mediaのowner、use restriction、procedural/physical/technical controlsを要求・推奨している。 - model weightsだけでなく tokenizer, config, code, Python wheels, container images, CUDA/driver/runtime, vector DB, embedding/reranker, RAG corpus, vulnerability/advisory metadata, license/SBOMを同じartifact governanceへ入れる必要がある。 ## Scope Enterprise AI Core / infrastructure / governance / security / privacy / audit / implementation / non-LLM component / organization overlay ## Confirmed - Air-gapped AIの本体はoffline inferenceではなく `controlled import → verify → quarantine/stage → approve → internal registry/repository → deploy → audit → rollback` の更新supply chain。 - Red Hat OpenShift 4.20はfully disconnected環境でmirror-to-disk、physical transfer、disk-to-mirrorという更新経路を公式に実装している。AI専用機能ではないが、container/runtime/operator供給線の実装根拠になる。 - Hugging Face Transformersはpre-downloaded artifact、HF_HUB_OFFLINE、local_files_onlyでoffline executionを明示的にsupportする。これは「モデルをofflineでloadできる」証拠であり、安全なair-gap更新手順の証明ではない。 - physical mediaはair gapを越える更新channelになるため、air gapは攻撃面をゼロにしない。NISTはremovable mediaのowner、use restriction、procedural/physical/technical controlsを要求・推奨している。 - model weightsだけでなく tokenizer, config, code, Python wheels, container images, CUDA/driver/runtime, vector DB, embedding/reranker, RAG corpus, vulnerability/advisory metadata, license/SBOMを同じartifact governanceへ入れる必要がある。 ## UNKNOWN - EA-090-UNKNOWN-01: major commercial model licensesのoffline redistribution/deployment条件; NVIDIA/AMD/Apple各runtimeのfully disconnected update matrix; offline license activation requirements; model provenance/signature ecosystemのcurrent best practice; independent air-gapped LLM operations case studies; RAG corpus differential updateの安全な標準形。Stop condition for this run: offline execution、disconnected update supply chain、media risk、test profileまでboundedに確立。 --- - EA-090-UNKNOWN-CURRENTNESS: 外部根拠の再確認日がcanonical body/control-planeで確定していないため、currentnessはUNKNOWNとして保持する。日付を推測補完しない。 ## Evidence - EVD-EA-090-URL-57C3247CCB94 (RESEARCH): author/org: Red Hat — https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/observability/disconnected_environments/index - EVD-EA-090-URL-272149FACE44 (RESEARCH): author/org: Hugging Face — https://huggingface.co/docs/transformers/main/installation - EVD-EA-090-URL-A18F0A72C8B7 (RESEARCH): author/org: NIST — https://nvlpubs.nist.gov/nistpubs/SpecialPublications/800-171r3/NIST.SP.800-171r3.html - EVD-EA-090-URL-7591E2070CAB (RESEARCH): author/org: NIST NCCoE — https://csrc.nist.gov/pubs/sp/1334/final - EVD-EA-090-URL-6B878F018210 (RESEARCH): author/org: NIST — https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final - EVD-EA-090-URL-98C9ED2E4EC6 (RESEARCH): author/org: NIST — https://csrc.nist.gov/pubs/sp/1326/final - EA-090-R11-RESEARCH (RESEARCH): EA-090 監査済みresearch / canonical revision binding - EA-090-R11-WEB-READBACK (IMPL): EA-090 Web body identity / canonical readback ## Failure / limits `HF_HUB_OFFLINE=1` はnetwork callを防ぐlibrary behaviorであり、artifact integrity、malware-free、license approval、model safetyを保証しない。 ## Failure / limits disconnected mirrorは外部dependencyを内部へ複製する仕組みであり、source compromiseを自動的に除去しない。hash/signature/SBOM/provenanceとreviewが別途必要。 ## Failure / limits removable mediaは更新を可能にする一方、air-gap boundaryを跨ぐattack vectorでもある。 ## Failure / limits 完全offlineではonline license validation、hosted moderation、cloud telemetry、managed vulnerability feed等に依存するcomponentが機能しない可能性がある。製品ごとにoffline license/telemetry dependencyを確認する。 ## Failure / limits stale model/security patchと「接続しない安全性」のtrade-offを明示する。未更新を安全とは呼ばない。 ## Practice model/license permits offline storage/use; all dependencies obtainable and mirrorable; offline package/container registry; internal DNS/time/PKI/KMS/identity; approved transfer mechanism; malware scanning/quarantine; artifact signatures/hashes/SBOM; sufficient storage; offline observability/log retention; update cadence; rollback artifacts; vulnerability intelligence import; RAG corpus export/import policy. ## Practice VERIFIED_SPECとしてOpenShift disconnected mirroringとTransformers offline loadingを確認。NIST guidanceでmedia/supply-chain controlsを固定。認証済みtenant・実air-gap環境への操作は未実施。 ## Practice Future TEST_PROFILE: synthetic isolated network with outbound deny; cold install from approved offline bundle; inference/RAG query; model update N→N+1; dependency update; rejected/tampered artifact; expired certificate; stale vulnerability feed; rollback; restore from backup; audit reconstruction. Measure zero unintended egress, artifact verification coverage, install/update time, rollback success, missing-dependency rate, RAG freshness lag, audit completeness, recovery time, storage growth. ## Practice Security: boundary crossing media/import station is high-risk control point; deny-by-default egress does not replace supply-chain validation. Privacy: external transmission can be structurally reduced, but insider/removable-media/log leakage remains. Audit: every imported artifact requires source/provenance/hash/signature/SBOM/scanner result/approver/import time/deployer. Cost: duplicated registries/storage/scanning infrastructure and manual transfer labor; delayed patching has risk cost. Operability: time sync, certificate renewal, license files, package dependency closure, backup/restore and vulnerability-feed freshness are recurring burdens。 ## Practice Core候補 `AIR_GAPPED_AI_SUPPLY_CONTRACT`: artifact_type; source/vendor; source revision; download time; license; hash/signature; SBOM; vulnerability scan/feed date; transfer media ID/owner; quarantine result; approval; internal registry URI; deployment target; model/runtime/RAG corpus version; offline dependency manifest; egress policy test; audit log; backup; rollback artifact; retirement/sanitization. EA-087 PRIVATE_AI_DEPLOYMENT_CONTRACTおよびEA-089 LOCAL_AI_CLUSTER_CONTRACTと接続する。 ## WHY_THIS_MATTERS_TO_UPDATE 高機密・OT・規制環境では外部APIへ送れないことがある。しかし「ネットを抜く」だけではAI運用は成立しない。model/container/package/vulnerability intelligenceの持込、RAG corpus更新、監査log、時刻、license、patch、rollbackを閉域内で継続する供給線が必要。 ## SCOPE_ROUTING Enterprise AI Core / infrastructure / governance / security / privacy / audit / implementation / non-LLM component / organization overlay ## CLAIM_OR_RESEARCH_QUESTION Air gap下でAI inference/RAGを動かすだけでなく、更新・provenance・security review・rollback・監査を持続可能にする最小control planeは何か。offline capabilityとsecure air-gapped operationをどう分離するか。 ## EVIDENCE TABLE 1. source class: official platform documentation exact title: Disconnected environments — OpenShift Container Platform 4.20 author/org: Red Hat canonical URL: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/observability/disconnected_environments/index publication/update/access: accessed 2026-09-16 version/release/tag/commit: OpenShift Container Platform 4.20; oc-mirror v2 preferred supporting locator: disconnected mirroring; mirror-to-disk → disk transfer → disk-to-mirror; internal mirror registry; update workflow evidence label: VERIFIED_SPEC relation: support/context 2. source class: official library documentation exact title: Transformers Installation — Offline mode author/org: Hugging Face canonical URL: https://huggingface.co/docs/transformers/main/installation publication/update/access: accessed 2026-09-16 version/release/tag/commit: main docs state latest stable v5.17.0 at access time supporting locator: Offline mode; pre-download snapshot, HF_HUB_OFFLINE=1, local_files_only=True evidence label: VERIFIED_SPEC / PRODUCT_VOLATILE relation: support 3. source class: standard/guidance exact title: NIST SP 800-171 Rev. 3 — Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations author/org: NIST canonical URL: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/800-171r3/NIST.SP.800-171r3.html publication/update/access: published 2024; accessed 2026-09-16 version/release/tag/commit: Rev.3 supporting locator: 03.08.07 Media Use; restrict/prohibit media and prohibit removable media without identifiable owner evidence label: VERIFIED_SPEC relation: context/limit 4. source class: standard/guidance exact title: NIST SP 1334 — Reducing the Cybersecurity Risks of Portable Storage Media in OT Environments author/org: NIST NCCoE canonical URL: https://csrc.nist.gov/pubs/sp/1334/final publication/update/access: September 2025; accessed 2026-09-16 version/release/tag/commit: final supporting locator: portable storage transfers data physically; procedural, physical, technical controls required evidence label: VERIFIED_SPEC relation: counter/limit/context 5. source class: standard/guidance exact title: NIST SP 800-161 Rev.1 — Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations author/org: NIST canonical URL: https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final publication/update/access: May 2022, updates through 2024-11-01; accessed 2026-09-16 version/release/tag/commit: Rev.1 update supporting locator: supply-chain visibility, integrity, resilience, malicious/counterfeit/vulnerable component risk evidence label: VERIFIED_SPEC relation: context/limit 6. source class: standard/guidance exact title: NIST SP 1326 — Cybersecurity Supply Chain Risk Management: Due Diligence Assessment Quick-Start Guide author/org: NIST canonical URL: https://csrc.nist.gov/pubs/sp/1326/final publication/update/access: 2026-07-08; accessed 2026-09-16 version/release/tag/commit: final supporting locator: supplier/product due diligence including provenance, resilience, cyber practices, supply-chain tiers evidence label: VERIFIED_SPEC relation: context ## FINDINGS - Air-gapped AIの本体はoffline inferenceではなく `controlled import → verify → quarantine/stage → approve → internal registry/repository → deploy → audit → rollback` の更新supply chain。 - Red Hat OpenShift 4.20はfully disconnected環境でmirror-to-disk、physical transfer、disk-to-mirrorという更新経路を公式に実装している。AI専用機能ではないが、container/runtime/operator供給線の実装根拠になる。 - Hugging Face Transformersはpre-downloaded artifact、HF_HUB_OFFLINE、local_files_onlyでoffline executionを明示的にsupportする。これは「モデルをofflineでloadできる」証拠であり、安全なair-gap更新手順の証明ではない。 - physical mediaはair gapを越える更新channelになるため、air gapは攻撃面をゼロにしない。NISTはremovable mediaのowner、use restriction、procedural/physical/technical controlsを要求・推奨している。 - model weightsだけでなく tokenizer, config, code, Python wheels, container images, CUDA/driver/runtime, vector DB, embedding/reranker, RAG corpus, vulnerability/advisory metadata, license/SBOMを同じartifact governanceへ入れる必要がある。 ## LIMITS / COUNTEREVIDENCE / FAILURE ENVELOPE - `HF_HUB_OFFLINE=1` はnetwork callを防ぐlibrary behaviorであり、artifact integrity、malware-free、license approval、model safetyを保証しない。 - disconnected mirrorは外部dependencyを内部へ複製する仕組みであり、source compromiseを自動的に除去しない。hash/signature/SBOM/provenanceとreviewが別途必要。 - removable mediaは更新を可能にする一方、air-gap boundaryを跨ぐattack vectorでもある。 - 完全offlineではonline license validation、hosted moderation、cloud telemetry、managed vulnerability feed等に依存するcomponentが機能しない可能性がある。製品ごとにoffline license/telemetry dependencyを確認する。 - stale model/security patchと「接続しない安全性」のtrade-offを明示する。未更新を安全とは呼ばない。 ## AVAILABILITY_GATES model/license permits offline storage/use; all dependencies obtainable and mirrorable; offline package/container registry; internal DNS/time/PKI/KMS/identity; approved transfer mechanism; malware scanning/quarantine; artifact signatures/hashes/SBOM; sufficient storage; offline observability/log retention; update cadence; rollback artifacts; vulnerability intelligence import; RAG corpus export/import policy. ## IMPLEMENTATION_STATE VERIFIED_SPECとしてOpenShift disconnected mirroringとTransformers offline loadingを確認。NIST guidanceでmedia/supply-chain controlsを固定。認証済みtenant・実air-gap環境への操作は未実施。 ## BENCHMARK_OR_EVAL Future TEST_PROFILE: synthetic isolated network with outbound deny; cold install from approved offline bundle; inference/RAG query; model update N→N+1; dependency update; rejected/tampered artifact; expired certificate; stale vulnerability feed; rollback; restore from backup; audit reconstruction. Measure zero unintended egress, artifact verification coverage, install/update time, rollback success, missing-dependency rate, RAG freshness lag, audit completeness, recovery time, storage growth. ## SECURITY / PRIVACY / AUDIT / COST / OPERABILITY Security: boundary crossing media/import station is high-risk control point; deny-by-default egress does not replace supply-chain validation. Privacy: external transmission can be structurally reduced, but insider/removable-media/log leakage remains. Audit: every imported artifact requires source/provenance/hash/signature/SBOM/scanner result/approver/import time/deployer. Cost: duplicated registries/storage/scanning infrastructure and manual transfer labor; delayed patching has risk cost. Operability: time sync, certificate renewal, license files, package dependency closure, backup/restore and vulnerability-feed freshness are recurring burdens。 ## SAFE_WORDING_FOR_FUTURE_BOOK 「Air-gapped AIは、モデルを一度持ち込んでネットワークを切れば完成するものではない。閉域内で推論・RAGを実行できることに加え、モデル、コンテナ、依存package、データ、脆弱性情報を検証付きで持ち込み、内部repositoryから更新・rollback・監査できる供給線が必要である。物理mediaは更新経路であると同時にattack surfaceでもある。」 ## UPDATE_WORK_HANDOFF Core候補 `AIR_GAPPED_AI_SUPPLY_CONTRACT`: artifact_type; source/vendor; source revision; download time; license; hash/signature; SBOM; vulnerability scan/feed date; transfer media ID/owner; quarantine result; approval; internal registry URI; deployment target; model/runtime/RAG corpus version; offline dependency manifest; egress policy test; audit log; backup; rollback artifact; retirement/sanitization. EA-087 PRIVATE_AI_DEPLOYMENT_CONTRACTおよびEA-089 LOCAL_AI_CLUSTER_CONTRACTと接続する。 ## OPEN_UNKNOWN major commercial model licensesのoffline redistribution/deployment条件; NVIDIA/AMD/Apple各runtimeのfully disconnected update matrix; offline license activation requirements; model provenance/signature ecosystemのcurrent best practice; independent air-gapped LLM operations case studies; RAG corpus differential updateの安全な標準形。Stop condition for this run: offline execution、disconnected update supply chain、media risk、test profileまでboundedに確立。 --- NEXT: /agent/start.json STOP: This is a knowledge projection, not an execution order.