Air-gapped sovereign AI for a UK defence organisation

A delivered engagement, not an illustration. The client is not named, the use cases are not described, and no operational or capability detail appears here. What is published is the platform and assurance pattern.

The constraint

The starting position was stricter than the government deployment, and the difference is not one of degree. There is no transfer path running the other way, no supplier connection, no telemetry, and no possibility of a vendor reaching in to fix something. Anything that cannot be operated by cleared staff standing in front of it does not work here.

That eliminates most commercial AI platforms outright, and a good deal of standard open-source tooling with them, because it tends to assume it can fetch a tokeniser, a config file or a dependency at runtime. A component that silently reaches out on first run is not a bug to be patched later; on this network it is a design failure that surfaces at the worst possible moment.

Alongside that, MOD Secure by Design meant the security case had to be live from the beginning: evidenced continuously through delivery by the delivery team, rather than assembled into a submission at the end.

Why HGX rather than a turnkey system

HGX B300 was the right choice here for a reason that has little to do with performance. It gave freedom over the server vendor and the physical build while keeping the NVIDIA reference architecture underneath, which matters when the chassis, the rack, the supply chain and the physical installation all have to be acceptable to the accreditor as well as to the engineers.

In defence the question "who built this, and where" is asked seriously and answered in writing. Being able to satisfy that without giving up the validated GPU platform underneath is worth a great deal, and it decides HGX against a turnkey system more often than raw throughput does.

The transfer boundary is the design

On an air-gapped defence network the interesting security surface is not the running system. It is the point where artefacts come in, because that is the only place anything can arrive at all. Every artefact crossing it is treated as untrusted until proven otherwise, and the procedure was agreed with the accreditor before the build rather than presented to them after it.

• Hashes recorded on both sides of the transfer, and verified rather than assumed
• Model weights accepted only in formats that do not execute code on load, which rules out pickle-based checkpoints however convenient they are
• Container images pinned by digest, scanned inside the boundary, and rescanned against imported CVE data on a defined cadence
• Signature verification where the artefact supports it, and a recorded provenance position where it does not
• A one-way procedure with a named approver, so a transfer is an auditable event rather than a habit

Hardening and the security case

Hosts, container runtime and orchestration were built from DISA STIG baselines reconciled against CIS Benchmarks Level 2, in code, and scanned before handover. Deviations are documented individually with the finding ID, the reason and the compensating control.

The Secure by Design security case was maintained as a living artefact through delivery, which changes how the work is sequenced. Controls are evidenced as they are implemented, risks are recorded when they are identified rather than when they are closed, and the risk position can be stated at any point on request instead of reconstructed for a gate.

Supply-chain expectations under Def Stan 05-138 and DEFCON 658 were treated as in scope for our own delivery, not only for the client platform. That is the part suppliers tend to discover late and at cost.

Model provenance as a first-class control

Open-weight models are frequently easier to defend in this setting than hosted ones, but only when the provenance work is done properly. You need to know exactly which artefact is running, be able to prove it has not changed, and be able to rebuild the whole deployment from your own mirror with the wire cut.

In practice that means weights held locally with recorded hashes, a pinned and reproducible serving stack, an evaluation baseline captured against the specific artefact in service, and a model update process that repeats the entire transfer, verification and evaluation sequence rather than trusting that a newer version is a better one.

It is also the honest answer to the question defence programmes ask most often about open weights. The concern is rarely openness itself. It is provenance, and provenance is solvable.