RAND: to protect national-security AI from nation-states, build it a fortress data center

A new RAND research report argues that the AI models handling national-security and emergency-response work should sit inside purpose-built facilities called "secure inference data centers," or SIDCs. The design centers on a one-way data pipe: queries flow in, answers flow out, and a physically present attacker cannot pull the model back out. The same plumbing that keeps the weights safe is what locks the software in place.

The proposal, published Aug. 4, 2026 as RAND research report RRA4827-1, treats AI model theft as a hardware problem. Its central component is a unidirectional data diode, a physical device that lets information move one way only. Combined with rigorous system partitioning, "Security Level 5" construction (a high-assurance, audit-grade tier used for classified and other high-stakes systems), and software components whose behavior is mathematically proven rather than merely tested, the design is meant to preserve the confidentiality and integrity of the model and its outputs over a five-year operational period.

The "inference" in the name matters. The SIDC is for running a model that has already been trained, not for training it. Queries go in, predictions come out, and the model itself stays sealed. The model weights, the parameters that encode what the AI has learned, never leave the facility, and no one inside the SIDC needs to reach the outside internet to answer a question.

That five-year window is the report's own design target, not an industry guarantee. It reflects a deliberate trade between update speed and adversarial exposure. The same features that make the facility hard to break into also make it hard to change. Software inside the SIDC is meant to be fixed, physical access is restricted, and connectivity to the outside world is sharply limited. A user at a remote terminal can ask the model a question; they cannot push a new training run, patch the weights, or even retrieve intermediate computations. The AI inside an SIDC is frozen in time, on purpose.

No fundamental research breakthroughs are required. The cost estimate, attributed to RAND researchers, is $37 million to $50 million for a proof-of-concept facility and $277 million to $345 million for an enterprise-scale version. Under emergency or national-priority conditions, the report says, a deployment could be stood up in as few as 14 months.

The use case is narrow on purpose. RAND points to national-security, emergency-response, and pilot deployments as the intended setting. General-purpose cloud AI, the kind that retails, recommends, and chats, is explicitly out of scope. The report concedes that the constraints which make SIDCs secure, including limited connectivity, fixed software, and restricted physical access, are exactly why the design is not a general answer to AI security. An AI used for a missile-defense decision aid or a disaster-response planner could tolerate being frozen; a consumer chatbot cannot.

The proposal lands alongside a companion RAND report, RRA4881-1, "Verified Machine Learning Infrastructure", which surveyed 23 experts in early 2026 on formal methods for AI infrastructure. That report catalogued three threat classes the SIDC proposal is meant to address: model-weight theft, infrastructure disruption, and misaligned-AI self-exfiltration, a trained model attempting to copy itself out of its own host. Together, the two reports mark a step from "AI security as a software problem" to "AI security as a building problem."

The SIDC is a policy proposal, not a procurement. No agency has committed to build one. The report's authors describe a scenario in which an attacker with physical proximity to a conventional data center could, in principle, exfiltrate a model; the SIDC's answer is to make that physically impossible by design. The residual risk, supply chain compromise during construction and insider access by the people who built the facility, is one the report does not eliminate.

RAND's timeline for the next step is the report itself. The two August 2026 publications are the proposal. Adoption, if any, will show up in agency budgets, classified procurement records, and construction contracts, not on the think tank's landing page. The first concrete signal of seriousness would be a budget line for a Security Level 5 facility in a national-security appropriations bill, something the report does not currently point to.