RAND secure inference data center (SIDC) design

What it is

RAND's Highly Secure Inference Data Centers report, published in August 2026, sets out a strategy for secure inference data centers (SIDCs): purpose-built facilities designed to protect AI models from advanced nation-state adversaries ¹. SIDCs are compact facilities that deploy models already trained elsewhere ¹. The authors write for AI laboratories, cloud providers and government stakeholders who need to protect strategically important deployments ¹.

The target adversary is at RAND's OC5 level: an operation comparable to about 1,000 experts working years ahead of the public state of the art, over several years, with a budget of up to $1 billion and state-level infrastructure ¹. The report states two protection objectives:

• confidentiality and integrity of the copies of model weights, inference algorithms and reference data inside the facility ¹;
• confidentiality and integrity of prompts and responses while they are inside ¹.

It makes two further security claims:

• verifiability of each inference response, given valid weights, model architecture and the context retrieved from reference data ¹;
• resilience, so that compromise of any single subsystem or person does not enable a violation of these objectives ¹.

These are security objectives for the operator. The public report does not describe how a party other than the operator would check that they hold ¹.

How it works

The design rests on three invariants ¹:

• Realm partitioning divides the facility into security domains, called realms, that do not trust one another ¹.
• A fixed diode-gated topology routes all communication between realms through data diodes in a fixed arrangement, which enforce one-way flow at the physical layer ¹. See Bandwidth limits and compartmentalization.
• Verified boundary protocols mediate every crossing between realms, and each protocol implementation must be verified against its security specification ¹.

Realms

A realm is a physically isolated domain with exclusive control over its compute, storage, devices and personnel access ¹. The main realms are:

• Interface room (IR). The only point of contact with users. Staff screen plaintext prompts and responses here ¹.
• Payload exchange room (PER). It accepts only two inbound payloads: prompts, passed to the IR, and reference-data updates, passed to the information technology management realm (ITM) ¹.
• Information technology management (ITM). It ingests and validates vetted reference data under two-person integrity controls ¹.
• Trusted inference compute sanctum (TICS). It holds the weights, the inference algorithm, reference data storage and all compute hardware ¹.
• Trustworthy recovery vault (TRV). It keeps read-only copies of critical state and the reference measurements, as the integrity anchor for the TICS ¹.
• Protection operations center (POC). It receives hazard signals from every realm over one-way inbound channels and leads incident response ¹.

Serving a request

In the report's example, a national-security user submits a signed, encrypted prompt over a classified network ¹:

1. The PER receives the prompt and passes it to the IR ¹.
2. IR staff screen the prompt for compliance and adversarial inputs, then pass it to the TICS ¹.
3. The TICS checks that the resident weights and reference data match the reference measurements held in the TRV, and produces the response ¹. See Hardware-attested weight binding.
4. IR staff screen the response, which leaves through the PER ¹.

Monitoring

Any deviation from expected control, data, matter, energy or personnel flows raises a hazard and triggers immediate containment ¹. Power delivery, heat and electromagnetic emissions are measured continuously and kept within bounds ¹. See Side-channel suppression for isolated facilities. All realms keep audit logs of interactions within and between realms ¹.

Trusted setup

A trusted setup phase establishes the root of trust ¹:

• All hardware is destructively sampled and verified before installation. Components that pass are sealed, logged and installed under two-person integrity controls ¹.
• Cryptographic keys are generated inside the facility and bound to verified hardware ¹.
• Weights and reference data are checked against reference measurements supplied by the model provider ¹.

The authors assume that supply-chain compromise of commodity compute hardware is likely ¹. Their "concept to circuit" method is meant to trace each security requirement down to formally verified protocols and circuit-level designs ¹. So far the authors report machine-checking safety properties of the cross-realm channel's control logic in the TLA+ specification language, a model that excludes cryptographic soundness, implementation correctness and hardware timing ¹.