Fortanix Confidential AI for Air-Gapped Defense AI

Cloud-connected, API-driven AI deployments offer speed and convenience by enabling rapid queries to hosted models. However, this approach is unsuitable for the most critical AI applications.

Intelligence analysis, battlefield decision support, signal processing, threat attribution, and strategic planning on classified datasets cannot use public APIs or infrastructure managed by external parties. These applications require security guarantees beyond conventional access controls or software-based isolation. Confidential AI was designed to address this challenge.

Defense AI Faces a Threat That Standard Security Can't Address

AI security typically focuses on protecting data in transit and at rest. While important, these measures do not address the primary threats faced by defense organizations.

The greater risk comes from individuals with physical or administrative access to the system, such as compromised insiders or unauthorized contractors. During AI operations, model weights, input data, and outputs are exposed in memory. On standard infrastructure, anyone with sufficient access can read this memory, and software policies alone cannot fully mitigate this risk.

For classified intelligence analysis, both the data and the resulting insights are highly sensitive. Models fine-tuned on classified materials or specialized techniques represent valuable intellectual property that must remain within the system.

While air-gapped environments mitigate network-based threats, they do not resolve AI's in-memory exposure. Even without network connectivity, individuals with hardware access can still compromise the system. An air gap is necessary but not sufficient.

What Cryptographic Guarantees Mean in Practice

Confidential AI mitigates in-memory exposure at the hardware level. AI workloads operate within trusted execution environments (TEEs), where data remains encrypted in memory during processing and isolation is enforced by the hardware.

Within a TEE, the host operating system cannot access enclave memory. Even administrators with root access are restricted. Only code running inside the verified enclave can access encrypted memory, with its identity confirmed through cryptographic attestation tied to the hardware.

Before a classified workload begins, the hardware generates a signed cryptographic report confirming the processor's identity, firmware state, security configuration, and the code loaded into the enclave. This report is signed with a key embedded in the silicon during manufacturing, preventing fabrication regardless of privilege level.

A relying party, such as a key management system, policy enforcement engine, or human reviewer, verifies the report before releasing any sensitive data or keys. The workload only starts once the environment is fully verified.

Fortanix Delivers Confidential AI Inside an Accreditation Boundary

Fortanix has developed its confidential AI platform specifically for environments where external dependencies are not permitted.

Standard confidential computing relies on external attestation services managed by silicon vendors. In air-gapped environments, this approach fails unless the system is designed for offline operation. Fortanix addresses this with offline verification modes for disconnected deployments. The trust infrastructure remains fully self-contained within the classified network boundary.

Fortanix Data Security Manager (DSM), a FIPS 140-2 Level 3-certified hardware security module, manages encryption key custody and release entirely on-premises. Keys are generated, stored, and released within the classified environment and never leave it. Key management is a highly scrutinized aspect of classified system accreditation, and a certified HSM as the cryptographic root of trust significantly simplifies the authorization process.

Fortanix also addresses a less recognized aspect of defense AI: protecting the model itself. AI models fine-tuned for defense and intelligence represent significant investment and contain sensitive, embedded knowledge. Conventional infrastructure cannot prevent privileged insiders or compromised systems from extracting model weights once loaded into memory for inference.

Fortanix Confidential AI keeps model weights encrypted throughout the inference lifecycle, decrypting them only within attested TEEs and never exposing them outside the hardware-enforced enclave. The same protection applied to classified data also safeguards the model.

Composite attestation across CPU and GPU environments is essential. Since AI inference runs on GPUs, Fortanix performs composite attestation across Intel TDX and AMD SEV-SNP CPU TEEs, as well as NVIDIA Hopper and Blackwell confidential computing GPUs, establishing a chain of trust for the entire inference stack.

Deployable Architecture for Missions That Can't Get Security Wrong

To meet mission requirements, defense and intelligence organizations need deployments that can be verified, audited, and trusted. The key architectural steps include operating within strictly controlled environments, ensuring cryptographic guarantees at all stages, and implementing hardware-enforced protections that remain effective regardless of whether individuals have physical or administrative access to the system.

Fortanix Confidential AI delivers hardware-enforced in-memory encryption, composite CPU and GPU attestation for disconnected operation, FIPS-certified key management, and model IP protection for air-gapped defense deployments. It is now available on validated NVIDIA Hopper and Blackwell GPU infrastructure.

For the most critical intelligence analysis use cases, security cannot be compromised. This architecture is purpose-built to meet those needs.