A data diode cannot fetch: on-prem inference, guarded retrieval, and the question that leaks
A hospital runs a clinical assistant on a server with no route to the internet. Every night an analyst on the public network pulls the current drug-interaction database, scans it, and pushes it through a one-way gateway into the enclave. The assistant always has fresh pharmacology. No patient record has ever crossed the door, and no configuration change can make one cross, because the door has no second direction.
Then a clinician asks the assistant to check a new paper. Not the nightly feed. A specific paper, named by title, that nobody on the public side thought to push in. The assistant cannot ask for it. The gateway has no slot for a question.
That moment, when an air-gapped model needs to reach out rather than be fed, is where most sovereign AI designs quietly break. The usual answer is a second gateway pointed the other way plus a content filter. That answer protects the documents and forgets the question.
What a diode is, and what it is not
A data diode, or unidirectional gateway, enforces direction in hardware. The transmit side has a laser and no receiver, or an equivalent physical asymmetry. It cannot be reconfigured into a two-way link by a rule change, a misapplied patch, or a compromised administrator. That property is why the defense and operational-technology worlds trust it over a firewall, and it is a real property, not a marketing one.
The same physics imposes two costs. The sender never learns whether a transfer arrived, so there is no acknowledgment and no back-pressure. And the device guarantees direction only. It knows nothing about content. Classification, sanitization, and malware inspection happen in software on one side or the other, and that software is where the assurance argument lives.
Most published guidance covers the high-to-low direction, where the diode protects a sensitive network from leaking. Feeding external data into an on-prem retrieval index runs low-to-high. The threat model flips. The risk is no longer leakage. It is poisoned mail: malware in a PDF, a web page with instructions hidden in white text, a dataset seeded to bias the index.
Two directions, two different dangers
Retrieval is a request and a response. Each half crosses the boundary in a different direction and carries a different risk.
The response, low to high. This is the integrity path. Retrieved content must be scanned, sanitized, ideally regenerated into a known-safe format, and re-verified on the high side with its own hash. This is well-trodden ground. The United States accredits these transfer paths through the National Cross Domain Strategy and Management Office under the "Raise the Bar" baseline (document NCDSMO-R-00008-002_00), and vendors have shipped filtering guards against that baseline for years.
The request, high to low. This is the confidentiality path, and it is the one nobody budgets for. The query is composed inside the enclave by someone, or something, holding classified context. A retrieval query that reads "find reports on the chemical plant near the river from last March" tells an observer on the public side that someone inside cares about that plant and that month. The documents it retrieves were never secret. The fact of the question was.
An analyst at a defense prime asks an internal model to study a competitor. The model searches the open web for a radar contract, a location, and a year. Every term left the building. Nothing classified moved. An adversary watching outbound queries now knows which bid the prime is working on.
The Raise the Bar baseline scrutinizes high-to-low flow hardest because this is the spillage direction. A probabilistic classifier deciding whether a query is safe to release will not pass that scrutiny on its own. The enforcement point must be deterministic and auditable.
Three shapes that survive the question
In order of assurance, from most to least:
Push only. The high side never asks. A curator on the low side decides what to push through the diode and on what schedule. Easiest to accredit. The model only knows what the curator thought to send, which is the hospital's situation above, and it is the right design for a surprising number of workloads.
A pre-cleared vocabulary. Queries leave the enclave only as members of a fixed, unclassified set: public company names, standard numbers, drug names from an approved formulary. A guard checks set membership. Humans review the vocabulary when it changes, not each query. The model becomes a vending machine toward the outside world rather than a conversational partner. That is a feature.
Free queries through a guard pair. Two diodes plus a filtering guard per direction. Outbound queries are minimized and redacted by a deterministic policy before release. Highest utility and highest accreditation cost. The outbound filter is the weak point, and that weakness compounds: a single leaked term can be harmless while a month of leaked terms draws the map.
Inside the enclave, the mechanism that makes any of these work is not the model. It is label tracking around the model. Two 2025 research systems made this concrete. CaMeL, from Google DeepMind, separates the control flow extracted from the trusted user request from the data flow of untrusted retrieved content, attaches a capability label to every value, and enforces policy at tool-call time in a custom interpreter outside the model. Its authors report 77% of AgentDojo tasks solved with provable security against 84% undefended. FIDES, from Microsoft Research, extends the same idea into full information-flow control with confidentiality and integrity labels and reports stopping every prompt injection in the same benchmark when policy checks are enabled. The lesson generalizes beyond prompt injection: a chunk that entered through the low-side guard carries a label that says so, and that label follows it into the context window, into the answer, and into the audit log. The model may quote untrusted text. The system refuses to let untrusted text steer an action.
One operational rule falls out of this. Every embedding model, reranker, and vector store runs inside the enclave. A retrieval library that calls a hosted embedding service by default is the most common way an air gap becomes a cardboard wall, and it happens without anyone choosing it.
Where on-prem deployments struggle
The diode is the visible part. These are the parts that surface in audits.
Derived data inherits classification. Embeddings, vector indexes, prompt caches, trace logs, and evaluation sets carry the sensitivity of their source corpus. Teams lock the contracts in a vault and leave the searchable index of the contracts on a shared drive. The index is a reformatted copy.
Aggregation. Retrieval assembles chunks whose union is more sensitive than any part. The model's answer can up-classify ten harmless facts into one sentence that reveals something none of them did. This is why per-chunk provenance has to be present at generation time, not reconstructed afterward from logs.
No receipt. The diode gives no delivery confirmation. A nightly push of ten thousand documents may land nine thousand eight hundred, and nobody learns it until a user asks about one that is not there. Sequence numbers, content hashes, and a periodic full reconciliation from the high side are not optional.
The model file is a stranger. A 70-billion-parameter model at two bytes per weight is roughly 140 gigabytes of artifact whose author, license, and integrity in transit are all unverified at download time. The OpenSSF Model Signing specification puts a Sigstore-bundle signature over weights, tokenizer, and configuration as one unit. CycloneDX carries a machine-learning bill of materials and SPDX 3.0 has an AI profile. Scanner support for both remains uneven, and license terms vary per model family in ways that affect redistribution, so the bill of materials must record the verified license rather than assume it.
Hidden egress. Telemetry, license checks, update channels, and crash reporters all leave the boundary. A contract clause does not prove zero egress. A packet capture on the egress interface during a live inference does.
Every update is a new stranger. The first model import gets a careful review. The sixth, on a Friday, does not. Each new version needs the same scan, signature check, and chain-of-custody record as the first, through the same transfer path.
The law governs different things than people assume. Article 10 of the EU AI Act governs the quality and governance of training, validation, and test data for high-risk systems. It says nothing about where inference runs. The Schrems II line of cases and the transfer impact assessment they require apply only when personal data leaves the European Union, which a Frankfurt server avoids unless the vendor's support channel ships logs to Virginia. In United States defense work, Controlled Unclassified Information obligations trace to NIST SP 800-171 through DFARS 252.204-7012, and CMMC levels and DoD cloud impact levels are different scales that get conflated in procurement language.
Auditors want receipts. The question is "show me which sources produced this answer, and prove the log was not edited." Citation is provenance. A tamper-evident record of every retrieval and every generation is the artifact that answers it.
The principle
Direction is a hardware property. Trust is a label property. A sovereign retrieval path needs both, and it needs them at different layers.
The diode fixes direction and nothing else. Labels fix what each byte is allowed to do once inside, and they have to be attached at the boundary and carried, unbroken, through the retrieval pipeline, the context window, the answer, and the log. A design that has the diode and not the labels has solved the part of the problem that was already solved.
The failure mode of this idea is its own guard. A guard that reads labels and decides what leaves the enclave is a privileged component in the exact position an attacker wants. If the guard's policy is a model, the guard is a target for the same injection it exists to stop. If the guard's policy is a deterministic table, the table is the attack surface, and it had better be small, reviewed, and signed. The door must never become a chatbot.
Where this stands
AiOS already carries a peer's identity in every AethyrWire Protocol frame, and the node runtime that implements it judges each peer by a verifiable credential under a deny-by-default policy. Frame types are gated by privilege. Cryptographic events land in a Merkle-backed, tamper-evident audit log. Tenant data lives in per-organization encrypted stores. Those are the building blocks of the guard described above, and they exist in running code with tests.
What does not exist yet is a label on the payload. A frame tells the receiver who sent it and what privilege that sender holds. It does not say where the bytes inside came from or what they are allowed to do next. A retrieved chunk cannot currently carry "arrived through the low-side guard, integrity untrusted, may inform but may not steer" from ingress to answer. Without that label, the runtime can be the mail slot but not yet the censor.
We are opening a design decision on exactly this: a provenance and sensitivity label bound to frame payloads under the existing signature, a guard role in the peer policy that reads it, and propagation rules through the retrieval and tool-call path, with the information-flow results above as prior art. That is a protocol change, so it goes through a request for comments first and ships with a formal argument second. Until it ships, the correct statement about our system is that it enforces who may speak, and does not yet enforce what each thing said may do.
Research figures cited as of 2026-10-09. The CaMeL and FIDES numbers are the authors' own reports on the AgentDojo benchmark and were not independently reproduced here.
Aethyr Research, Salt Lake City, UT