{
  "schema_version": "1.0.0",
  "rubric_version": "1.0",
  "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
  "record": {
    "id": "K-0017",
    "slug": "compartmentalization",
    "title": "Compartmentalization",
    "aliases": [
      "pods",
      "compute compartments"
    ],
    "status": "draft",
    "last_reviewed": "2026-09-23",
    "review_interval_days": 90,
    "steward": null,
    "provenance": {
      "drafted_by": "ai",
      "reviewed_by": []
    },
    "risk_flags": [],
    "flags": [],
    "one_liner": "Dividing a facility's accelerators into isolated groups with restricted communication between them, so that no group can join a larger prohibited workload.",
    "sources": [
      {
        "source": "S-0005",
        "supports": "pods of well-connected chips; between pods, inference needs only tokens while other forms of parallelism transfer activations or gradients; efficient inference on dozens to low hundreds of chips versus thousands for large training",
        "locator": "Interconnect bandwidth limits"
      },
      {
        "source": "S-0057",
        "supports": "fixed-set HEM restricting networking of small, fixed sets of GPUs",
        "locator": "p. viii"
      },
      {
        "source": "S-0053",
        "supports": "compute caps enforced via physical limits on chip-to-chip networking",
        "locator": "enforcement mechanisms"
      },
      {
        "source": "S-0018",
        "supports": "air-gapped evaluation environments; optical splitters and data diodes as inspectable components enforcing one-way data movement",
        "locator": "system architecture"
      },
      {
        "source": "S-0002",
        "supports": "network taps observing data exchanged between chips",
        "locator": "§4.2"
      },
      {
        "source": "S-0038",
        "supports": "physical channels could bypass network monitoring",
        "locator": "side channels of concern"
      }
    ],
    "related": [
      "K-0021",
      "K-0025",
      "K-0013"
    ],
    "type": "concept",
    "url": "https://trustbutveri.fyi/concepts/compartmentalization/",
    "source_file": "content/concepts/compartmentalization.md",
    "flags_all": [
      "ai-drafted"
    ],
    "body_markdown": "Compartmentalization divides a facility's accelerators into groups and restricts communication between the groups, so that no group can take part in a larger workload than it is allowed [[S-0005]] [[S-0057]].\n\nScher and Thiergart describe pods with high-bandwidth interconnect inside and very little bandwidth between them: between pods, inference needs to pass only tokens, whereas training exchanges gradients or activations [[S-0005]]. Efficient inference fits within dozens to low hundreds of closely connected accelerators, while large-scale training links thousands [[S-0005]]. RAND's \"fixed set\" design likewise restricts networking so that small, fixed sets of GPUs cannot be combined into large clusters [[S-0057]], and Sastry and colleagues list physical limits on chip-to-chip networking as a way to enforce compute caps [[S-0053]]; these ideas underlie [[M-0014|bandwidth limits and compartmentalization]].\n\nCompartments can also separate trust domains: one low-trust design air-gaps its evaluation environments and uses optical splitters and data diodes, simple components that can be inspected for tampering, to enforce one-way data movement [[S-0018]]. The boundaries can be checked by observing traffic between accelerators with [[K-0014|network taps]] [[S-0002]], while physical channels that could bypass monitored links are the target of [[M-0022|side-channel suppression]] [[S-0038]].",
    "body_text": "Compartmentalization divides a facility's accelerators into groups and restricts communication between the groups, so that no group can take part in a larger workload than it is allowed [S-0005] [S-0057]. Scher and Thiergart describe pods with high-bandwidth interconnect inside and very little bandwidth between them: between pods, inference needs to pass only tokens, whereas training exchanges gradients or activations [S-0005]. Efficient inference fits within dozens to low hundreds of closely connected accelerators, while large-scale training links thousands [S-0005]. RAND's \"fixed set\" design likewise restricts networking so that small, fixed sets of GPUs cannot be combined into large clusters [S-0057], and Sastry and colleagues list physical limits on chip-to-chip networking as a way to enforce compute caps [S-0053]; these ideas underlie bandwidth limits and compartmentalization. Compartments can also separate trust domains: one low-trust design air-gaps its evaluation environments and uses optical splitters and data diodes, simple components that can be inspected for tampering, to enforce one-way data movement [S-0018]. The boundaries can be checked by observing traffic between accelerators with network taps [S-0002], while physical channels that could bypass monitored links are the target of side-channel suppression [S-0038].",
    "referenced_by": [
      {
        "id": "M-0014",
        "title": "Bandwidth limits and compartmentalization",
        "url": "https://trustbutveri.fyi/mechanisms/bandwidth-limits-and-compartmentalization/"
      },
      {
        "id": "M-0024",
        "title": "Bounding unexplained information in outputs",
        "url": "https://trustbutveri.fyi/mechanisms/bounding-unexplained-information/"
      },
      {
        "id": "M-0022",
        "title": "Side-channel suppression for isolated facilities",
        "url": "https://trustbutveri.fyi/mechanisms/side-channel-suppression/"
      },
      {
        "id": "I-0010",
        "title": "RAND secure inference data center (SIDC) design",
        "url": "https://trustbutveri.fyi/implementations/rand-secure-inference-data-centers/"
      },
      {
        "id": "C-0008",
        "title": "Communication between compute groups is bounded",
        "url": "https://trustbutveri.fyi/claims/bandwidth-is-bounded/"
      },
      {
        "id": "C-0004",
        "title": "This compute runs inference, not training",
        "url": "https://trustbutveri.fyi/claims/inference-not-training/"
      },
      {
        "id": "K-0007",
        "title": "Hardware-enabled mechanism (HEM)",
        "url": "https://trustbutveri.fyi/concepts/hardware-enabled-mechanism/"
      },
      {
        "id": "K-0025",
        "title": "Inference and training workloads",
        "url": "https://trustbutveri.fyi/concepts/inference-and-training-workloads/"
      },
      {
        "id": "K-0021",
        "title": "Interconnect bandwidth",
        "url": "https://trustbutveri.fyi/concepts/interconnect-bandwidth/"
      },
      {
        "id": "K-0013",
        "title": "Side channel",
        "url": "https://trustbutveri.fyi/concepts/side-channel/"
      }
    ]
  }
}