Security

Frontier weights, concentrated accelerator inventory and plant controls are different valuable assets. Name which adversary can steal, disable or manipulate each before you select controls.

Siting fixes physical security years before the first attack. Standoff, aerial approach paths and exposed utility ties can bypass a ground-intrusion perimeter, and armed drone strikes reached commercial data centers in 2026, so assess their reach and outage consequence before you treat detection as protection.

Carry supplier, custody, identity and measured-state evidence from the fab through receiving, repair and media destruction. Cryptography cannot replace physical custody evidence.

An immutable silicon root can authenticate measured firmware evidence. Where the BMC controls host and device power, making it the anchor lets one rooted controller own the node below every defense and, over a flat management network, the rack. Test those powers and recovery paths.

A supported CPU/GPU TEE can keep the operator's software out of your plaintext, though not an operator with physical access. It costs attestation plumbing, key-broker availability, residual side channels and a performance tax: severe on PCIe-bound paths, ~1–3% on a tuned Blackwell serving stack.

Pick a sharing mode for the boundary it actually enforces, not the one its product name suggests. Then check tenant handoff, privileged control paths and failure propagation before you sell the same resource to hostile tenants.

On a training fabric with broad east-west reach, a perimeter firewall leaves every interior path open to one compromised node. Enforce on the NIC, DPU or switch carrying each flow, isolate the management plane, default-deny the weights enclave's egress, and test the denied paths.

An exfiltrated copy of frontier weights cannot be recalled by revoking a key. Size the real artifact and every export channel, then bind key release and export policy to the model release.

Insiders reach the asset through many attack vectors, and RAND's threat model adds them at Security Level 3, not 2. Cap one person's authority, bind exceptional access to one action, prove every credential and session revoked, and weigh SL4–5 friction against risk removed.

An attacker who reaches the BMS, CDU, battery or GPU power-cap controls can trip the interconnection, overheat a hall, push a battery toward runaway or brick accelerators. Decide at design time which protections no compromised controller can defeat; retrofitting them is costly and sometimes impossible.

The applicable compliance portfolio limits which workloads you may host, where data may sit and who may touch the systems. A mismatch can leave an otherwise working campus unable to win contracts.

On an AI campus, a cyber intrusion can turn into an OT, life-safety or grid event; when it does, the SOC hands it to 14.11's incident command. A SOC divided into separate IT, OT and physical towers misses attacks that cross from one to another.