{
  "schema_version": "1.0.0",
  "rubric_version": "1.0",
  "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
  "record": {
    "id": "I-0010",
    "slug": "rand-secure-inference-data-centers",
    "title": "RAND secure inference data center (SIDC) design",
    "aliases": [
      "Secure inference data center",
      "SIDC",
      "Highly Secure Inference Data Centers"
    ],
    "status": "draft",
    "last_reviewed": "2026-09-23",
    "review_interval_days": 90,
    "steward": null,
    "provenance": {
      "drafted_by": "ai",
      "reviewed_by": []
    },
    "risk_flags": [],
    "flags": [
      "provider-reported"
    ],
    "one_liner": "A RAND design for a purpose-built facility that serves already-trained AI models while protecting weights and inference data against state-level attackers.",
    "summary": "RAND's secure inference data center (SIDC) is a design for a compact, purpose-built facility that serves already-trained AI models, for example to national-security users. It aims to keep model weights, inference algorithms, prompts and responses confidential and intact against a well-resourced, state-backed attacker. The facility is split into physically isolated realms linked only by one-way data diodes in a fixed layout, with formally verified protocols at every boundary, human screening of each prompt and response, and checks of loaded weights against reference measurements. RAND estimates $37–50 million for a proof-of-concept and $277–345 million for an enterprise-scale facility, built in as few as 14 months under emergency or national-priority conditions. It is a published design, and RAND recommends prototyping its key security features now. It describes no way for an outside party to check the facility's properties, and its guarantees rest on an uncompromised setup phase.",
    "technical": "- **Assurance chain.** The cross-realm solution that mediates every boundary crossing is justified step by step [[S-1510]]. A hazard analysis (STPA-Sec) justifies the component, and the requirements are allocated in a system model. A finite-state protocol specification fixes authorized behaviour, sequencing, timing and fail-secure transitions. Cryptographic protocol analysis with Tamarin and CryptoVerif covers end-point authentication, secrecy, replay resistance and key freshness under stated assumptions, and state-machine model checking shows that unsafe control states are unreachable. The specified behaviour can then be translated into synthesizable hardware logic, such as FPGA-based channel control, and circuit-level assertions can check selected temporal properties at the register-transfer level [[S-1510]].\n- **Hardware assumptions.** Cost estimates assume 150 GPUs at about 250 kW for the proof-of-concept and 375 GPUs at about 3 MW at enterprise scale; the design is agnostic to the accelerator type [[S-1510]].\n- **Staffing.** About 100 cleared staff for a proof-of-concept and 300 for a deployment-scale facility [[S-1510]].\n- **Schedule.** The 14-month estimate assumes emergency or national-priority conditions and a government-owned facility built inside an existing hangar or warehouse. Otherwise RAND expects two to two and a half years to deploy, plus about a year for accreditation [[S-1510]].",
    "category": "isolation-architecture",
    "secondary_categories": [
      "off-chip-devices"
    ],
    "verifies": [
      {
        "claim": "C-0009",
        "role": "primary",
        "note": "Designed to keep weights and inference data inside the facility; the report does not describe how an external party would verify this."
      },
      {
        "claim": "C-0005",
        "role": "supporting",
        "note": "The compute sanctum checks resident weights against reference measurements before serving."
      },
      {
        "claim": "C-0004",
        "role": "supporting",
        "note": "Scoped to serving already-trained models."
      }
    ],
    "threat_model": "semi-trusted",
    "adversarial_evaluation": "analysis",
    "hardware_requirement": "retrofit-device",
    "prover_cooperation": "required",
    "confidentiality": "partial",
    "depends_on": [
      {
        "target": "M-0012",
        "note": "Integrity checks compare loaded weights with reference measurements from a trusted setup."
      }
    ],
    "readiness": {
      "assessment": true,
      "level": "R1",
      "rubric_version": "1.0",
      "rationale": "R1: a detailed, costed design with no prototype, whose stated objectives are security properties for the operator rather than claims an outside party could check.\n\n- **R1** met for the security design: the report states its protection objectives, including that each inference response is verifiable given valid weights, architecture and retrieved context. It also states its threat model and assumptions, such as a trusted setup and likely supply-chain compromise of commodity hardware [[S-1510]].\n- **R2** not met: no facility or prototype has been published, and RAND recommends prototyping key security features now [[S-1510]].\n\nConfidence is low because the stated verification use is only partly addressed. The report describes internal integrity checks and audit logging, but no way for a party outside the operator to verify the facility's properties, and it omits architectural blueprints and detailed implementations from the public version [[S-1510]].",
      "evidence": [
        "S-1510"
      ],
      "next_level_gaps": [
        "A public working prototype, or reproducible published results, for key features such as the diode-gated realm topology and cross-realm protocols.",
        "A published way for a party other than the operator to verify the facility's claims, for example weight confidentiality or which model is served."
      ],
      "confidence": "low",
      "assessed_by": [
        "ai-draft"
      ],
      "assessed_on": "2026-09-23",
      "status": "current",
      "dispute": null
    },
    "flaws": [
      {
        "assessment": true,
        "title": "Everything rests on the trusted setup",
        "kind": "theoretical-argument",
        "severity": "significant",
        "status": "open",
        "description": "Reference measurements for model weights and reference data are established in a trusted setup phase. The report states that the system cannot detect compromise that happened before ingestion if the trusted setup itself is compromised.",
        "sources": [
          "S-1510"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "Security weakens over long operation",
        "kind": "theoretical-argument",
        "severity": "minor",
        "status": "open",
        "description": "The authors claim that the facility can withstand attacks at the OC5 level for a five-year operational period. They expect its ability to withstand long OC5 campaigns to become less robust the longer the facility remains in operation.",
        "sources": [
          "S-1510"
        ],
        "response": null
      }
    ],
    "blockers": [
      {
        "text": "No prototype exists; RAND recommends prototyping key security features and integration now.",
        "theme": "adversarial-validation",
        "blocked_by": null,
        "sources": [
          "S-1510"
        ]
      },
      {
        "text": "The report describes internal integrity checks, audit logging and accreditation, but no way for a party outside the operator to verify the facility's properties.",
        "theme": "access-governance",
        "blocked_by": null,
        "sources": [
          "S-1510"
        ]
      },
      {
        "text": "Human review of every prompt and response makes each request take three to five minutes, with the review steps as the rate-limiting factor.",
        "theme": "performance-compatibility",
        "blocked_by": null,
        "sources": [
          "S-1510"
        ]
      },
      {
        "text": "Detailed design information is withheld from the public report and is to be evaluated privately with stakeholders, which limits independent public scrutiny.",
        "theme": "access-governance",
        "blocked_by": null,
        "sources": [
          "S-1510"
        ]
      }
    ],
    "challenge_themes": [
      "hardware-trust",
      "evidence-binding",
      "access-governance",
      "adversarial-validation",
      "performance-compatibility"
    ],
    "organizations": [
      "O-0200"
    ],
    "people": [],
    "sources": [
      {
        "source": "S-1510",
        "supports": "title, authors and date; objectives; OC5 threat model; realm architecture; request lifecycle; hazards and energy monitoring; trusted setup; formal-methods chain; costs, schedule and staffing; limitations; recommendations",
        "locator": "Summary (p. v); ch. 1 (pp. 1-3); ch. 3 (pp. 9-15); ch. 4 (pp. 18-22); ch. 5 (p. 24); Appendix B (pp. 27-30)"
      },
      {
        "source": "S-1706",
        "supports": "Intelligence Security Laboratories' stated aim, its use of STPA-Sec, and its reference to this report"
      },
      {
        "source": "S-1707",
        "supports": "ISL's executive director, Gabriel Kulp, a co-author of the report"
      }
    ],
    "concepts": [
      "K-0005",
      "K-0015",
      "K-0017",
      "K-0018",
      "K-0022"
    ],
    "kind": "proposed-architecture",
    "developer": [
      "O-0200"
    ],
    "realises": [
      "M-0014",
      "M-0022"
    ],
    "homepage": "https://www.rand.org/pubs/research_reports/RRA4827-1.html",
    "type": "implementation",
    "url": "https://trustbutveri.fyi/implementations/rand-secure-inference-data-centers/",
    "source_file": "content/implementations/rand-secure-inference-data-centers.md",
    "flags_all": [
      "provider-reported",
      "ai-drafted"
    ],
    "body_markdown": "## What it is\n\nRAND's *Highly Secure Inference Data Centers* report, published in August 2026, sets out a strategy for secure inference data centers (SIDCs): purpose-built facilities designed to protect AI models from advanced nation-state adversaries [[S-1510]]. SIDCs are compact facilities that deploy models already trained elsewhere [[S-1510]]. The authors write for AI laboratories, cloud providers and government stakeholders who need to protect strategically important deployments [[S-1510]].\n\nThe target adversary is at RAND's OC5 level: an operation comparable to about 1,000 experts working years ahead of the public state of the art, over several years, with a budget of up to $1 billion and state-level infrastructure [[S-1510]]. The report states these protection objectives:\n\n- confidentiality and integrity of the copies of model weights, inference algorithms and reference data inside the facility [[S-1510]];\n- confidentiality and integrity of prompts and responses while they are inside [[S-1510]];\n- verifiability of each inference response, given valid weights, model architecture and the context retrieved from reference data [[S-1510]];\n- resilience, so that compromise of any single subsystem or person does not enable a violation of these objectives [[S-1510]].\n\nThe objectives are defences against outside attackers. The public report does not describe how a party other than the operator would check that they hold [[S-1510]].\n\n## How it works\n\nThe design rests on three invariants [[S-1510]]:\n\n- **Realm partitioning.** The facility is divided into security domains that do not trust one another [[S-1510]].\n- **Fixed diode-gated topology.** All communication between realms passes through data diodes in a fixed arrangement, which enforce one-way flow at the physical layer [[S-1510]]. See [[M-0014]].\n- **Verified boundary protocols.** Every crossing between realms is mediated by a protocol implementation verified against its security specification [[S-1510]].\n\n### Realms\n\nA realm is a physically isolated domain with exclusive control over its compute, storage, devices and personnel access [[S-1510]]. The main realms are:\n\n- **Interface room (IR).** The only point of contact with users. Staff screen plaintext prompts and responses here [[S-1510]].\n- **Payload exchange room (PER).** It accepts only two inbound payloads: prompts, passed to the IR, and reference-data updates, passed to the information technology management realm (ITM) [[S-1510]].\n- **Information technology management (ITM).** It ingests and validates vetted reference data under two-person integrity controls [[S-1510]].\n- **Trusted inference compute sanctum (TICS).** It holds the weights, the inference algorithm, reference data storage and all compute hardware [[S-1510]].\n- **Trustworthy recovery vault (TRV).** It keeps read-only copies of critical state and the reference measurements, as the integrity anchor for the TICS [[S-1510]].\n- **Protection operations center (POC).** It receives hazard signals from every realm over one-way inbound channels and leads incident response [[S-1510]].\n\n### Serving a request\n\nIn the report's example, a national-security user submits a signed, encrypted prompt over a classified network [[S-1510]]:\n\n1. The PER receives the prompt and passes it to the IR [[S-1510]].\n2. IR staff screen the prompt for compliance and adversarial inputs, then pass it to the TICS [[S-1510]].\n3. The TICS checks that the resident weights and reference data match the reference measurements held in the TRV, and produces the response [[S-1510]]. See [[M-0012]].\n4. IR staff screen the response, which leaves through the PER [[S-1510]].\n\n### Monitoring\n\nAny deviation from expected control, data, matter, energy or personnel flows raises a hazard and triggers immediate containment [[S-1510]]. Power delivery, heat and electromagnetic emissions are measured continuously and kept within bounds [[S-1510]]. See [[M-0022]]. All realms keep audit logs of interactions within and between realms [[S-1510]].\n\n### Trusted setup\n\nA trusted setup phase establishes the root of trust [[S-1510]]:\n\n- All hardware is destructively sampled and verified before installation. Components that pass are sealed, logged and installed under two-person integrity controls [[S-1510]].\n- Cryptographic keys are generated inside the facility and bound to verified hardware [[S-1510]].\n- Weights and reference data are checked against reference measurements supplied by the model provider [[S-1510]].\n\nThe authors assume that supply-chain compromise of commodity compute hardware is likely [[S-1510]]. Their \"concept to circuit\" method traces each security requirement down to formally verified protocols and circuit-level designs [[S-1510]].\n\n## Evidence\n- **Design and cost study.** RAND estimates $37–50 million for a proof-of-concept facility and $277–345 million for an enterprise-scale version [[S-1510]]. It reports that an SIDC can be built today with proven, off-the-shelf compute hardware, and that no fundamental research breakthroughs are required [[S-1510]].\n- **Schedule.** Construction and deployment could take as few as 14 months under emergency or national-priority conditions, and two to two and a half years otherwise, plus time for accreditation [[S-1510]].\n- **No prototype yet.** RAND recommends prototyping key security features and integration now, and notes that FPGA-based channel control with formally verified protocols and optical diodes can be tested immediately [[S-1510]]. Its other recommendations are to begin procurement, engage a system integrator and select a site early [[S-1510]]. [[O-0210|Intelligence Security Laboratories]], a nonprofit led by one of the report's co-authors, states that it aims to develop and demonstrate the security that critical AI deployments need, applies the same STPA-Sec method, and points to the report for details [[S-1706]] [[S-1707]].\n\n## Limitations\n- **Trusted setup.** The facility cannot detect compromise that happened before ingestion if the trusted setup itself was compromised [[S-1510]].\n- **No external check.** The public report omits architectural blueprints, detailed technical implementations and deployment procedures, and says these must be evaluated privately with stakeholders [[S-1510]]. It describes internal checks, audit logging and accreditation, but no verification path for outside parties [[S-1510]].\n- **Scope.** The facility does not defend against undetected biases or latent model behaviours [[S-1510]].\n- **Latency.** Human review makes a full request–response cycle take three to five minutes; automating some human-mediated steps could bring the overhead under a minute [[S-1510]].\n- **Time horizon.** The security claims are framed over a five-year operational period, and the authors expect resistance to long OC5 campaigns to weaken the longer the facility operates [[S-1510]].",
    "body_text": "What it is RAND's Highly Secure Inference Data Centers report, published in August 2026, sets out a strategy for secure inference data centers (SIDCs): purpose-built facilities designed to protect AI models from advanced nation-state adversaries [S-1510]. SIDCs are compact facilities that deploy models already trained elsewhere [S-1510]. The authors write for AI laboratories, cloud providers and government stakeholders who need to protect strategically important deployments [S-1510]. The target adversary is at RAND's OC5 level: an operation comparable to about 1,000 experts working years ahead of the public state of the art, over several years, with a budget of up to $1 billion and state-level infrastructure [S-1510]. The report states these protection objectives: - confidentiality and integrity of the copies of model weights, inference algorithms and reference data inside the facility [S-1510]; - confidentiality and integrity of prompts and responses while they are inside [S-1510]; - verifiability of each inference response, given valid weights, model architecture and the context retrieved from reference data [S-1510]; - resilience, so that compromise of any single subsystem or person does not enable a violation of these objectives [S-1510]. The objectives are defences against outside attackers. The public report does not describe how a party other than the operator would check that they hold [S-1510]. How it works The design rests on three invariants [S-1510]: - Realm partitioning. The facility is divided into security domains that do not trust one another [S-1510]. - Fixed diode-gated topology. All communication between realms passes through data diodes in a fixed arrangement, which enforce one-way flow at the physical layer [S-1510]. See Bandwidth limits and compartmentalization. - Verified boundary protocols. Every crossing between realms is mediated by a protocol implementation verified against its security specification [S-1510]. Realms A realm is a physically isolated domain with exclusive control over its compute, storage, devices and personnel access [S-1510]. The main realms are: - Interface room (IR). The only point of contact with users. Staff screen plaintext prompts and responses here [S-1510]. - Payload exchange room (PER). It accepts only two inbound payloads: prompts, passed to the IR, and reference-data updates, passed to the information technology management realm (ITM) [S-1510]. - Information technology management (ITM). It ingests and validates vetted reference data under two-person integrity controls [S-1510]. - Trusted inference compute sanctum (TICS). It holds the weights, the inference algorithm, reference data storage and all compute hardware [S-1510]. - Trustworthy recovery vault (TRV). It keeps read-only copies of critical state and the reference measurements, as the integrity anchor for the TICS [S-1510]. - Protection operations center (POC). It receives hazard signals from every realm over one-way inbound channels and leads incident response [S-1510]. Serving a request In the report's example, a national-security user submits a signed, encrypted prompt over a classified network [S-1510]: 1. The PER receives the prompt and passes it to the IR [S-1510]. 2. IR staff screen the prompt for compliance and adversarial inputs, then pass it to the TICS [S-1510]. 3. The TICS checks that the resident weights and reference data match the reference measurements held in the TRV, and produces the response [S-1510]. See Model identity attestation. 4. IR staff screen the response, which leaves through the PER [S-1510]. Monitoring Any deviation from expected control, data, matter, energy or personnel flows raises a hazard and triggers immediate containment [S-1510]. Power delivery, heat and electromagnetic emissions are measured continuously and kept within bounds [S-1510]. See Side-channel suppression for isolated facilities. All realms keep audit logs of interactions within and between realms [S-1510]. Trusted setup A trusted setup phase establishes the root of trust [S-1510]: - All hardware is destructively sampled and verified before installation. Components that pass are sealed, logged and installed under two-person integrity controls [S-1510]. - Cryptographic keys are generated inside the facility and bound to verified hardware [S-1510]. - Weights and reference data are checked against reference measurements supplied by the model provider [S-1510]. The authors assume that supply-chain compromise of commodity compute hardware is likely [S-1510]. Their \"concept to circuit\" method traces each security requirement down to formally verified protocols and circuit-level designs [S-1510]. Evidence - Design and cost study. RAND estimates $37–50 million for a proof-of-concept facility and $277–345 million for an enterprise-scale version [S-1510]. It reports that an SIDC can be built today with proven, off-the-shelf compute hardware, and that no fundamental research breakthroughs are required [S-1510]. - Schedule. Construction and deployment could take as few as 14 months under emergency or national-priority conditions, and two to two and a half years otherwise, plus time for accreditation [S-1510]. - No prototype yet. RAND recommends prototyping key security features and integration now, and notes that FPGA-based channel control with formally verified protocols and optical diodes can be tested immediately [S-1510]. Its other recommendations are to begin procurement, engage a system integrator and select a site early [S-1510]. Intelligence Security Laboratories, a nonprofit led by one of the report's co-authors, states that it aims to develop and demonstrate the security that critical AI deployments need, applies the same STPA-Sec method, and points to the report for details [S-1706] [S-1707]. Limitations - Trusted setup. The facility cannot detect compromise that happened before ingestion if the trusted setup itself was compromised [S-1510]. - No external check. The public report omits architectural blueprints, detailed technical implementations and deployment procedures, and says these must be evaluated privately with stakeholders [S-1510]. It describes internal checks, audit logging and accreditation, but no verification path for outside parties [S-1510]. - Scope. The facility does not defend against undetected biases or latent model behaviours [S-1510]. - Latency. Human review makes a full request–response cycle take three to five minutes; automating some human-mediated steps could bring the overhead under a minute [S-1510]. - Time horizon. The security claims are framed over a five-year operational period, and the authors expect resistance to long OC5 campaigns to weaken the longer the facility operates [S-1510].",
    "referenced_by": [
      {
        "id": "M-0014",
        "title": "Bandwidth limits and compartmentalization",
        "url": "https://trustbutveri.fyi/mechanisms/bandwidth-limits-and-compartmentalization/"
      },
      {
        "id": "M-0022",
        "title": "Side-channel suppression for isolated facilities",
        "url": "https://trustbutveri.fyi/mechanisms/side-channel-suppression/"
      },
      {
        "id": "C-0009",
        "title": "Model weights or data have not left the facility",
        "url": "https://trustbutveri.fyi/claims/weights-have-not-left/"
      },
      {
        "id": "O-0210",
        "title": "Intelligence Security Laboratories",
        "url": "https://trustbutveri.fyi/organizations/intelligence-security-laboratories/"
      },
      {
        "id": "O-0200",
        "title": "RAND",
        "url": "https://trustbutveri.fyi/organizations/rand/"
      }
    ]
  }
}