Air-gapped AI

高機密・OT・規制環境では外部APIへ送れないことがある。しかし「ネットを抜く」だけではAI運用は成立しない。model/container/package/vulnerability intelligenceの持込、RAG corpus更新、監査log、時刻、license、patch、rollbackを閉域内で継続する供給線が必要。

Enterprise AI Core / infrastructure / governance / security / privacy / audit / implementation / non-LLM component / organization overlay

Air gap下でAI inference/RAGを動かすだけでなく、更新・provenance・security review・rollback・監査を持続可能にする最小control planeは何か。offline capabilityとsecure air-gapped operationをどう分離するか。

• source class: official platform documentation exact title: Disconnected environments — OpenShift Container Platform 4.20 author/org: Red Hat canonical URL: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/observability/disconnected_environments/index publication/update/access: accessed 2026-09-16 version/release/tag/commit: OpenShift Container Platform 4.20; oc-mirror v2 preferred supporting locator: disconnected mirroring; mirror-to-disk → disk transfer → disk-to-mirror; internal mirror registry; update workflow evidence label: VERIFIED_SPEC relation: support/context

• source class: official library documentation exact title: Transformers Installation — Offline mode author/org: Hugging Face canonical URL: https://huggingface.co/docs/transformers/main/installation publication/update/access: accessed 2026-09-16 version/release/tag/commit: main docs state latest stable v5.17.0 at access time supporting locator: Offline mode; pre-download snapshot, HF_HUB_OFFLINE=1, local_files_only=True evidence label: VERIFIED_SPEC / PRODUCT_VOLATILE relation: support

• source class: standard/guidance exact title: NIST SP 800-171 Rev. 3 — Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations author/org: NIST canonical URL: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/800-171r3/NIST.SP.800-171r3.html publication/update/access: published 2024; accessed 2026-09-16 version/release/tag/commit: Rev.3 supporting locator: 03.08.07 Media Use; restrict/prohibit media and prohibit removable media without identifiable owner evidence label: VERIFIED_SPEC relation: context/limit

• source class: standard/guidance exact title: NIST SP 1334 — Reducing the Cybersecurity Risks of Portable Storage Media in OT Environments author/org: NIST NCCoE canonical URL: https://csrc.nist.gov/pubs/sp/1334/final publication/update/access: September 2025; accessed 2026-09-16 version/release/tag/commit: final supporting locator: portable storage transfers data physically; procedural, physical, technical controls required evidence label: VERIFIED_SPEC relation: counter/limit/context

• source class: standard/guidance exact title: NIST SP 800-161 Rev.1 — Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations author/org: NIST canonical URL: https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final publication/update/access: May 2022, updates through 2024-11-01; accessed 2026-09-16 version/release/tag/commit: Rev.1 update supporting locator: supply-chain visibility, integrity, resilience, malicious/counterfeit/vulnerable component risk evidence label: VERIFIED_SPEC relation: context/limit

• source class: standard/guidance exact title: NIST SP 1326 — Cybersecurity Supply Chain Risk Management: Due Diligence Assessment Quick-Start Guide author/org: NIST canonical URL: https://csrc.nist.gov/pubs/sp/1326/final publication/update/access: 2026-07-08; accessed 2026-09-16 version/release/tag/commit: final supporting locator: supplier/product due diligence including provenance, resilience, cyber practices, supply-chain tiers evidence label: VERIFIED_SPEC relation: context

• Air-gapped AIの本体はoffline inferenceではなく controlled import → verify → quarantine/stage → approve → internal registry/repository → deploy → audit → rollback の更新supply chain。
• Red Hat OpenShift 4.20はfully disconnected環境でmirror-to-disk、physical transfer、disk-to-mirrorという更新経路を公式に実装している。AI専用機能ではないが、container/runtime/operator供給線の実装根拠になる。
• Hugging Face Transformersはpre-downloaded artifact、HF_HUB_OFFLINE、local_files_onlyでoffline executionを明示的にsupportする。これは「モデルをofflineでloadできる」証拠であり、安全なair-gap更新手順の証明ではない。
• physical mediaはair gapを越える更新channelになるため、air gapは攻撃面をゼロにしない。NISTはremovable mediaのowner、use restriction、procedural/physical/technical controlsを要求・推奨している。
• model weightsだけでなく tokenizer, config, code, Python wheels, container images, CUDA/driver/runtime, vector DB, embedding/reranker, RAG corpus, vulnerability/advisory metadata, license/SBOMを同じartifact governanceへ入れる必要がある。

• HF_HUB_OFFLINE=1 はnetwork callを防ぐlibrary behaviorであり、artifact integrity、malware-free、license approval、model safetyを保証しない。
• disconnected mirrorは外部dependencyを内部へ複製する仕組みであり、source compromiseを自動的に除去しない。hash/signature/SBOM/provenanceとreviewが別途必要。
• removable mediaは更新を可能にする一方、air-gap boundaryを跨ぐattack vectorでもある。
• 完全offlineではonline license validation、hosted moderation、cloud telemetry、managed vulnerability feed等に依存するcomponentが機能しない可能性がある。製品ごとにoffline license/telemetry dependencyを確認する。
• stale model/security patchと「接続しない安全性」のtrade-offを明示する。未更新を安全とは呼ばない。

model/license permits offline storage/use; all dependencies obtainable and mirrorable; offline package/container registry; internal DNS/time/PKI/KMS/identity; approved transfer mechanism; malware scanning/quarantine; artifact signatures/hashes/SBOM; sufficient storage; offline observability/log retention; update cadence; rollback artifacts; vulnerability intelligence import; RAG corpus export/import policy.

VERIFIED_SPECとしてOpenShift disconnected mirroringとTransformers offline loadingを確認。NIST guidanceでmedia/supply-chain controlsを固定。認証済みtenant・実air-gap環境への操作は未実施。

Future TEST_PROFILE: synthetic isolated network with outbound deny; cold install from approved offline bundle; inference/RAG query; model update N→N+1; dependency update; rejected/tampered artifact; expired certificate; stale vulnerability feed; rollback; restore from backup; audit reconstruction. Measure zero unintended egress, artifact verification coverage, install/update time, rollback success, missing-dependency rate, RAG freshness lag, audit completeness, recovery time, storage growth.

Security: boundary crossing media/import station is high-risk control point; deny-by-default egress does not replace supply-chain validation. Privacy: external transmission can be structurally reduced, but insider/removable-media/log leakage remains. Audit: every imported artifact requires source/provenance/hash/signature/SBOM/scanner result/approver/import time/deployer. Cost: duplicated registries/storage/scanning infrastructure and manual transfer labor; delayed patching has risk cost. Operability: time sync, certificate renewal, license files, package dependency closure, backup/restore and vulnerability-feed freshness are recurring burdens。

「Air-gapped AIは、モデルを一度持ち込んでネットワークを切れば完成するものではない。閉域内で推論・RAGを実行できることに加え、モデル、コンテナ、依存package、データ、脆弱性情報を検証付きで持ち込み、内部repositoryから更新・rollback・監査できる供給線が必要である。物理mediaは更新経路であると同時にattack surfaceでもある。」

Core候補 AIR_GAPPED_AI_SUPPLY_CONTRACT: artifact_type; source/vendor; source revision; download time; license; hash/signature; SBOM; vulnerability scan/feed date; transfer media ID/owner; quarantine result; approval; internal registry URI; deployment target; model/runtime/RAG corpus version; offline dependency manifest; egress policy test; audit log; backup; rollback artifact; retirement/sanitization. EA-087 PRIVATE_AI_DEPLOYMENT_CONTRACTおよびEA-089 LOCAL_AI_CLUSTER_CONTRACTと接続する。

major commercial model licensesのoffline redistribution/deployment条件; NVIDIA/AMD/Apple各runtimeのfully disconnected update matrix; offline license activation requirements; model provenance/signature ecosystemのcurrent best practice; independent air-gapped LLM operations case studies; RAG corpus differential updateの安全な標準形。Stop condition for this run: offline execution、disconnected update supply chain、media risk、test profileまでboundedに確立。

---