How to patch an air-gapped AI system offline

You patch an air-gapped AI system by staging every update on a separate connected enclave, verifying its cryptographic signatures and checksums there, then carrying the vetted bundle across the air gap on approved physical media or through a one-way data diode. Inside the isolated network, the update, whether new model weights, a dependency, or a security patch, is loaded as a new version under change control so it can be tested against the running one and rolled back on failure. There is no live download and no automatic update: every change is deliberate, signed, and logged.

This guide covers the transfer patterns that make offline updates safe, how model-weight and CVE updates differ in cadence, and the change-control and audit expectations regulated buyers apply. For the underlying concept, see what air-gapped AI is and how it works.

How do you get updates into an air-gapped AI system?

You get updates into an air-gapped AI system through a controlled, one-way transfer: nothing is downloaded inside the isolated zone, so every artifact is fetched and validated on connected infrastructure first, then moved across the gap. The pattern uses two environments. A staging enclave (connected to the internet) pulls the model weights, container images, packages, and patches, then scans and verifies them. The production enclave (air-gapped) receives only the approved bundle. This two-stage design is what turns “no internet” from a blocker into a repeatable operational routine. The move across the gap is the sensitive step: it must let approved bytes in without creating any path for data to leak out.

What are the one-way transfer patterns for air-gapped updates?

Air-gapped updates rely on transfer mechanisms that admit verified artifacts while preventing any outbound flow. The table below compares the four common patterns.

These patterns are not exclusive. A mature setup uses a staging enclave to build a signed artifact bundle, pushes it through a data diode or on review-and-import media, and verifies the signatures again on the inside before anything is installed. The principle is defense in depth: assume the transfer medium is untrusted and let signatures, not the medium, establish integrity.

How do you update model weights in an air-gapped deployment?

You update model weights in an air-gapped deployment by fetching the new open-weight files on the staging enclave, verifying the publisher’s checksums, importing them as a parallel version, and promoting only after evaluation. Open-weight models release frequently: a newer Llama, Qwen, Mistral, Gemma, or DeepSeek version can meaningfully change accuracy, context length, or hardware footprint. Because the weights are static files you host yourself, the update is a file swap, not an API change, which is exactly why air-gapped deployment is possible.

The safe sequence keeps the running model untouched until the new one has earned promotion:

1. Fetch and verify the weight files on the staging enclave, checking the publisher’s signature and checksum and recording the license and version.
2. Import as a new version into the air-gapped zone; do not overwrite the current model.
3. Evaluate on your own data, using a representative test set of your real documents and questions rather than public benchmarks. Our method is in how to evaluate RAG accuracy.
4. Promote or reject. If the new model clears your accuracy and safety bar, switch traffic to it; if not, discard it and keep the previous version loaded for instant rollback.

Treat model versions the way you treat any other controlled artifact: pinned, signed, tested, and reversible. Open-weight models improve quickly, so plan for periodic versioned swaps rather than a one-time install.

How often should you patch CVEs on an air-gapped AI system?

You should patch critical and actively exploited CVEs on a fast-track SLA even in an air-gapped AI system, and batch lower-severity fixes into a regular cadence such as monthly. Air-gap isolation shrinks the attack surface, but it does not eliminate it: an attacker who reaches the isolated network through the supply chain, insider action, or compromised media still benefits from an unpatched flaw. The components that need tracking are the same ones you deployed, per the on-premise LLM architecture guide:

• The inference server and serving runtime that host the model weights.
• The vector database and embedding service in the retrieval layer.
• Container images, Python and system libraries, and the OS, which carry most CVEs.
• The orchestration and access-control layer that fronts user requests.

A workable cadence: subscribe to vulnerability feeds on the staging enclave (the connected side allowed to reach them), triage by severity and exploitability, fast-track anything critical, and roll the rest into a scheduled import. Maintain a software bill of materials (SBOM) for the deployment so you can answer “are we affected by this CVE?” without guesswork. The isolation buys you time to test patches properly; it is not a reason to skip them.

What change-control and audit expectations apply to air-gapped updates?

Regulated buyers expect every air-gapped AI update to pass documented change control: who approved it, where each artifact came from, how it was verified, what testing it passed, and how to roll it back. Banks, hospitals, universities, and government bodies are examined against exactly this evidence. The checklist below states what good looks like and the red flag for each expectation.

The through-line is traceability. An examiner should be able to reconstruct any update: the artifact, its signature, the approval, the test result, and the log entry. This is where a tamper-evident audit log stops being a nice-to-have and becomes the artifact that satisfies the review. The Teclops AI security and compliance approach treats the update boundary as a first-class control, not an afterthought.

How do Samvad AI and Gist handle controlled updates?

Samvad AI, Teclops AI’s secure, source-cited RAG assistant, runs entirely inside the customer perimeter and deploys on-premise, air-gapped, or hybrid, switchable by configuration, so its updates follow the staged, one-way, change-controlled workflow described above. New model weights, patches, and dependencies are staged and verified outside the gap, imported as versioned artifacts, evaluated, and promoted or rolled back, with every change written to a tamper-evident audit log. Because Samvad AI answers only from your own documents and cites the exact source passage, a model swap is validated against your real content before it goes live.

Gist, the agentic analytics assistant, likewise runs inside your infrastructure and reasons over a governed semantic layer, so metric definitions and access rules stay stable across controlled updates. If you need model updates, CVE patching, and change control operated inside your own air-gapped perimeter, Teclops AI builds and runs AI systems in your environment. Reach the team at teclops.ai@gmail.com.