Air-gapped LLM workflows let a defense team run a private LLM on classified material inside an accredited enclave by sending the model the structure of the work, not the raw values, running the analysis in place, and reconstructing the finished product against the real data behind the boundary.
Defense pushes the confidential-data problem to its hardest edge. There is no “send it out carefully” option, because there is no outside. And the bar is written down now: NSA and CISA, joined by their Five Eyes partners, have published joint guidance on deploying AI systems securely, organized around the confidentiality, integrity, and availability of AI systems and their data in sensitive environments. The tooling is catching up to the constraint: research toolkits like OnPrem.LLM exist specifically to apply large language models to sensitive, non-public data in offline or restricted environments. A classified enclave is exactly the kind of environment that guidance describes, and the first obstacle there is blunt: the data cannot reach the model.
The analyst who synthesizes by hand
Picture a defense analyst with a stack of intelligence reports to synthesize before a morning briefing. The reports are dense, cross-referencing, and full of the kind of detail a model could pull together in minutes. But the work happens on an air-gapped network with no path to the outside, and the strongest models the analyst has heard about live on an internet the enclave cannot reach.
The data cannot come to the model, and the model cannot come to the data. So the analyst synthesizes by hand, again, while the capability everyone else uses stays on the far side of the gap. Multiply that by every shift and every desk, and the cost is not one late briefing; it is a standing tax on how fast the mission can reason.
Why the obvious answers do not hold
The first instinct is to bring a smaller private LLM inside the enclave and run everything locally. That genuinely helps, and many programs do it, but it trades away the capability gap: the in-enclave model often sits well behind the frontier, and on hard synthesis tasks that distance shows in the output.
The second instinct is to sanitize the reports down to a level cleared for an outside system. In practice that means stripping so much that the model is synthesizing a hollowed-out version of the material, and the analyst still has to redo the real work by hand. Neither path lets a strong model reason over the actual intelligence.
Both approaches share a hidden assumption, that the classified content and its structure are one indivisible thing that either stays locked in or gets gutted. That assumption is where they break, because the two come apart.
Substitute, Execute, Reconstruct inside the boundary
The enablement approach lets the structure of the work be processed while the classified values stay put. Three steps carry it.
Substitute. Sensitive entities, designators, locations, and identifiers are swapped for consistent stand-ins, while the shape of each report is preserved: the references between documents, the sequence of events, the analytic relationships. The same real value maps to the same stand-in every time, so cross-document reasoning still holds.
Execute. The model synthesizes against that structure. Where it runs depends on the program’s accreditation; in a fully air-gapped posture the whole flow executes on approved infrastructure inside the boundary, with nothing crossing the gap at any step.
Reconstruct. When the model returns a draft, that draft is rebuilt against the real values behind the boundary using a protected mapping layer, so the analyst reads a finished product with the classified detail back in place. This closes the workflow: the analyst gets an operational artifact, not a redacted sketch they still have to finish.
For production defense AI the question is not only which model ran, but which data state and execution conditions produced the result. The point of the design is that classified values never become the thing that has to travel; only the work’s structure moves, and only inside walls that are already accredited to hold it.
A private LLM compared to the alternatives
The three paths a program can take diverge on one axis: does a strong model ever reason over the real material, and does the classified data stay put while it does.
| Approach | Strong model on real material | Classified data leaves the enclave |
|---|---|---|
| Small in-enclave model | Partial | No |
| Sanitize and send out | No | Partial |
| Substitute, Execute, Reconstruct | Yes | No |
The first row keeps the data safe but caps the reasoning. The second row reaches for a better model but hands out a gutted version of the work. Only the third row lets a frontier-grade model reason over the true structure while the sensitive values stay inside the boundary.
A quick self-check for your enclave
Run these five questions against any AI workflow you are weighing for classified or restricted work. If you answer “no” to more than one, the workflow is either capping your model or leaking your data.
- Does the classified value ever have to leave the accredited boundary for the model to work?
- Can the model you actually want to use reason over the real analytic structure, not a stripped-down copy?
- Does the same real entity map to a consistent stand-in across every document in the set?
- When the draft comes back, is it reconstructed into a usable product inside the enclave, or does an analyst finish it by hand?
- Can the security authority point to a concrete reason the data-handling rules are satisfied?
Where it fits
This is defense’s instance of sensitive AI workflow enablement, under the strictest version of the constraint. The same separation of structure from values that lets a telecom NOC reason over a live network without exposing it lets an analyst synthesize intelligence without exposing the source, and the same pattern shows up in confidential financial documents. The substitution and reconstruction are performed by a Context-Preserving Data Layer for AI, in CUBIG’s case LLM Capsule, embedded in the environment the program already runs rather than bolted on as a new external service. It runs on the CUBIG Syntitan platform.
Because the classified values never leave the boundary, the workflow fits the handling rules the environment is accredited under, and the security authority has a concrete basis to approve. The posture parallels how NIST treats operational technology in SP 800-82 Rev. 3: certain systems carry performance, reliability, and safety constraints so particular that the security guidance has to be written around them. That approval matters more here than anywhere, and it is still a by-product. The point was to put a frontier-grade tool in the analyst’s hands on the real material, and to see it hold up on your own workflow before you trust it.
LLM Capsule lets a private LLM run the same pattern inside an air-gapped environment. The model executes in place on substituted data, so nothing crosses the boundary and the mission data never leaves.
