Threat Model, Assets & Security Levels for AI Infrastructure

Every control in an AI data center follows from a question almost nobody states: which adversary are you trying to stop? Not "hackers" in the abstract, but a specific tier, from a bored insider with a USB stick to a top-priority operation run by the most cyber-capable state on earth. That answer drives Part 11 the way the workload archetype drove Part 1. Pick it and the firewall rules, the standoff distance, the attestation flow, the egress cap and the two-person rule all follow. Skip it and you buy expensive controls that defend the wrong asset against the wrong attacker, and you find the gap the day a competitor’s frontier weights show up on someone else’s cluster.

The chapter builds the threat model in three moves. First, why AI data centers are a special case: asset-value density, IP concentration and strategic targeting together make an unscoped cloud-security posture inadequate for some services. Second, the asset taxonomy and adversary tiers, anchored on the RAND Securing AI Model Weights framework: five Weights Security Levels, five operational-capacity adversary tiers, and the 38 attack vectors that map between them. Third, the defense-in-depth reference architecture and the method of setting a target level and deriving controls from it. Each control you select must name the attack path it constrains, the proof that it is enforced, and its cost in capex, performance or operability. The target level and service boundary frame that trade before you commit steel, silicon or staff. For the platform side, NIST’s draft SP 800-239 (initial public draft, July 2026; comments closed 25 September 2026) analyzes threats and security gaps across AI data-center architecture, hardware, software, workflows and storage. Treat it as a gap checklist alongside RAND, and remember it is still a draft.

A hyperscale e-commerce hall and a frontier-training campus can look the same from the road and run the same SOC 2 controls, yet sit in completely different threat models. Three properties make the AI facility a special case, and each one breaks an assumption that generic data-center security relies on.

Asset-value density. A single GB200 NVL72 rack is about $3.1M for the server alone in SemiAnalysis’s August 2025 hyperscaler model. Its accelerator supply and replacement lead time add a separate exposure, and its GB300 and Vera Rubin successors (the latter shipping since June 2026) come out of the same constrained allocation. The constraint, not the dollar figure, changes the economics. Generic cloud hardware is fungible and insured. A stolen or destroyed NVL72 is not replaced by a purchase order but by waiting at the back of an allocation queue measured in quarters. That inverts the loss function: the asset is worth more because it cannot be re-bought quickly, which makes physical theft and physical destruction rational adversary goals in a way they never were for commodity servers. The March 2026 drone strikes (below) show that the destruction case is no longer hypothetical.

IP concentration. The frontier model weights on the cluster are arguably the highest-value digital asset in existence: a multi-hundred-million-dollar training run compressed into a few terabytes that, once exfiltrated, hand a competitor or an adversary state a capability they did not pay to build. RAND treats frontier weights as a national-security asset warranting defenses up to nation-state grade. The loss is silent and complete. Unlike a stolen database, a copied weight file leaves the original in place, so there is no outage, no missing inventory and no obvious tell; the first signal may be a rival model that is suspiciously similar. So egress control, not perimeter control, becomes the linchpin (→ Chapter 11.8).

Strategic targeting. States now treat AI compute as strategic infrastructure, so the adversary set includes actors with intelligence services, kinetic reach and supply-chain access, not just criminals. On 1 March 2026, during the US–Israel–Iran war, drones directly struck two AWS facilities in the UAE and damaged a third in Bahrain with a nearby strike. AWS reported structural damage, power loss and fire-suppression water damage, and two of the three UAE availability zones went down at once, so multi-AZ redundancy failed (AWS Health Dashboard; CNBC; The Conversation, March 2026). IRGC-linked media claimed the sites were targeted deliberately for supporting US military and intelligence work; Amazon has not confirmed a motive. Industry analysts called it likely the first publicly confirmed military attack on a US hyperscaler’s data centers. The outage did not end there. In September 2026 a status update from AWS said it could not restore customers’ access to resources and data that existed only in mec1-az2, one of the UAE zones. Nor could AWS restore its Bahrain region, offline since April, when a second zone there was disrupted (Reuters, 16 September 2026). Losing availability is loud, yet the loss is recoverable only where copies and spare capacity sit outside the blast radius: another region, not just another zone. The planning consequence is blunt: "kinetic attack on a data center" moved from a tail risk you accept to a design case you must address, and most legacy physical controls (fences, cameras, ground access control) were never designed for an aerial threat (→ Chapter 11.2).

You cannot derive controls from a target level until you know which assets the level protects, and the most common scoping error is treating every asset as equally precious. An AI data center has a clear hierarchy of crown jewels. The heaviest controls belong on the top tier, with lighter controls deliberately accepted below it, because a budget spread evenly defends nothing well. Five asset classes follow, ranked by what an adversary actually wants and what its loss costs.

Read the table top-down as a budgeting instrument. Unreleased frontier weights sit at the top of this confidentiality example because a copied artifact can leave the owner unaware and cannot be recalled. They justify confidential computing, attestation and hard egress caps where the adversary and exposure justify the cost. Facility availability sits at the bottom of the confidentiality hierarchy not because outages are cheap but because they are loud: you may detect the loss promptly, though failover needs tested capacity and an eligible recovery path, whereas a copied weight file is the loss you never see. The management plane is the sleeper. It is rarely the adversary’s objective, but it can be a path, which is why it gets crown-jewel-grade controls despite holding no IP of its own. For an open-weight service, tenant prompts, credentials and availability can rank above the already-public weights. Misranking these is how budgets get spent on hardening the loud asset, whose recovery depends on copies held outside the region, while the silent, unrecoverable one walks out an unmonitored egress.

The RAND Securing AI Model Weights report (RRA2849-1) is the field’s shared vocabulary. Its central insight is that you cannot reason about "is this secure" without naming the adversary. RAND defines five operational-capacity (OC) tiers of attacker, from OC1 (amateurs) to OC5 (the top cyber-capable states running their highest-priority operations), and enumerates 38 distinct attack vectors across them, from social engineering and supply-chain implants to side-channels and human intelligence. The decisive finding for design: RAND assesses eight vectors as likely infeasible for OC1–OC3 and likely feasible for OC4 or OC5, so the required control set steps up along the continuum of attacker capability.

Mapped onto those adversaries are five Weights Security Levels (SL1–SL5), each defined operationally: an SL is the posture assessed as likely to thwart the matching OC tier’s attempt to steal the weights. SL1 thwarts amateurs. SL2 thwarts professional opportunistic attackers running moderate-effort, non-targeted operations. SL3 thwarts cybercrime syndicates and capable insiders. SL4 thwarts the standard operations of leading cyber-capable institutions. SL5 could plausibly claim to thwart the top-priority operations of the most capable states (RAND, 2024). The framework replaces "we’re secure" with a question: secure against which adversary? It also gives a campus a target number to design toward. RAND did not mean the 2024 levels as a standard: it calls the benchmark measures it lists for each level neither a complete standard nor a compliance regime. Its first standardized control set is the August 2026 SL3 framework (below), which stops at SL3, so a claim of SL4 or SL5 still rests on an assessor’s judgment against the 2024 benchmarks.

Defense in depth in an AI data center is a stack of independent boundaries, each owned by a different chapter of Part 11, arranged so that defeating one layer does not defeat the asset. Read it from the outside in. That is the order an outside attacker must traverse, and the order in which a missing layer turns a partial compromise into a total one.

• Physical perimeter and zones — siting standoff and the concentric zones (perimeter → facility → data hall → cage/rack, deepened into a five-zone reference model) with escalating MFA, surveillance and, now, counter-UAS for the aerial threat the March 2026 strikes made real (→ Chapter 11.2).
• Supply-chain and provenance — vetting silicon and firmware before it enters the fence, tamper-evident logistics, HBOM/SBOM and OCP S.A.F.E. firmware audits, because a counterfeit part or implant defeats every layer above it from inside (→ Chapter 11.3).
• Hardware root of trust and firmware — a silicon RoT (Caliptra, DICE identity on DC-SCM), secure and measured boot, and a hardened, segmented BMC, so the foundation every higher control trusts is itself attestable and not the soft underbelly (→ Chapter 11.4).
• Confidential computing and tenant isolation — a GPU TEE that fences a compute-protected region of HBM behind hardware firewalls (NVIDIA does not encrypt HBM; on-package memory is simply hard to reach), traffic to and from the GPU encrypted through bounce buffers, NVLink encrypted on Blackwell between the GPUs of one confidential VM, and attestation, plus the MIG/vGPU isolation boundary whose documented limits set how far you can trust a shared GPU (→ Chapter 11.5, Chapter 11.6).
• Network segmentation and zero trust — DPU-enforced microsegmentation, management-plane isolation, and egress control as the anti-exfiltration choke point (→ Chapter 11.7).
• Model and weight protection — the crown-jewel layer: at-rest encryption, in-transit protection, attestation-gated in-use keys, and the egress caps that catch the silent loss (→ Chapter 11.8).
• The human layer and OT plane — insider-threat controls, two-person rules, and hardening of the facility’s OT/ICS (BMS/EPMS/CDU/BESS) against cyber-physical sabotage, the layers that no amount of cryptography can substitute for (→ Chapter 11.9, Chapter 11.10).

The layers are arranged for independence. A compromised BMC should not yield the weights if confidential computing and egress caps still stand, and a defeated fence should not yield the silicon if the data hall and cage zones still gate access. Defense in depth fails not when one layer is breached, which is expected, but when layers share a single point of failure (a flat management network, a universal admin credential, an unmonitored egress) that lets one breach cascade.

The method inverts how security is usually bought. Instead of starting from a catalog of controls and asking which to adopt, start from the target Weights Security Level, the adversary tier you have decided the campus must survive, and derive the controls necessary to reach it. The level is the design basis and the controls are its consequences. It is the same shape as the workload archetype driving the whole facility in Part 1: one upstream decision that collapses a hundred downstream ones.

The target level is a business decision, not a security one. A neocloud renting commodity inference capacity to many tenants may rationally target SL2–SL3: its assets are valuable but are not frontier weights, and the cost of SL4 controls (performance overhead, operational drag, supply-chain vetting) would price it out of a margin-thin market. A frontier lab training a flagship model has no such luxury. Its adversary is OC4–OC5 by definition, so anything below SL4 is a posture mismatched to its actual threat, and the over-investment is the only rational investment. The error is choosing a level by budget and hoping the adversary cooperates. The adversary is set by what you hold, not by what you can afford.

Two consequences make the level a substrate decision, not a policy one. First, the irreversible layers must be built to the highest level the campus might ever host, because you cannot retrofit standoff distance, network trust zones or a hardware root of trust (→ Chapter 11.4) into a running cluster without tearing it down. The same density-ramp logic governs floor loading and water (the ramp framing in Chapter 1.1; structure in Chapter 6.2). Second, every level above SL2 taxes goodput and operability: isolation strands capacity, attestation adds latency, egress caps constrain legitimate data movement, and two-person rules slow operations. The target level prices that tax up front, which is why it must be decided before the controls are bought. The trade is then made with eyes open, not discovered control by control after the cluster is live.

The same mis-scopes recur because each comes from skipping the target-level question and reasoning from a control catalog or a compliance checkbox instead. Four are worth naming:

• Compliance as security. Treating SOC 2 attestation or ISO 27001 certification as evidence of an SL4 posture. These frameworks verify that controls exist and are operated; they do not establish that those controls thwart an OC4 adversary. A clean audit and a copied weight file are fully compatible.
• Perimeter thinking for a silent asset. Spending the security budget on fences, badges and ingress controls while the egress path the weights would actually leave through goes unmonitored and uncapped. You are guarding the entrance to a building whose crown jewel walks out the exit (→ Chapter 11.8).
• Over-defending the loud asset, under-defending the silent one. Hardening facility availability (which announces its own loss via an outage) to 2N-grade resilience while the weights (whose loss is silent and permanent) sit behind SL2 controls. Match the control to the loss signature, not to the dollar value alone.
• Budget-chosen levels. Picking a security level the organization can comfortably afford and assuming the adversary will scale down to match. Choosing SL2 because SL4 is expensive does not make your OC4 adversary go away; it leaves that attack path outside the claimed defense.

Choose the service and adversary before buying controls, and attach each acceptance result to its asset and owner. A lower-threat offering saves operating friction only while its intake excludes the higher-risk workload. Accepting frontier weights later without raising that boundary transfers an unpriced theft risk to the customer.