So you think you can airgap? (No.)
summary
Anthropic deploys and operates an egress limiter that literally counts every byte leaving training clusters, implements a large-burst token bucket to allow occasional researcher transfers, and enforces S3 invariants by designating in-boundary buckets and proxying cross-boundary access. The system isolates the appliance in a locked cloud account and yields an effective 98% reduction in unrestricted egress; rollout produces slow, cascading failures and major observability pain, but it makes terabyte‑scale weight theft take days to months.
AI-written summary · about
chapters (11)
- 0:00Introduction and setup
- 1:05Why airgapping research clusters fails
- 3:13Research cluster attack surface
- 6:46Perimeter defenses and limitations
- 9:17Narrowing the egress pipe
- 13:50Hardening the egress limiter
- 16:17Design challenges and solutions
- 21:31Rollout nightmare and fixes
- 23:59Benefits and practical impact
- 26:44Future of secure model access
- 28:33Q&A session
related talks
15mThe Airgap Paradox: Adversarial Tactics & Defensible Design
29mAir-Gapping: A Moat for the 21st Century
30mBlank Space: Filling the Gaps in Atomic and...
31mYour Infrastructure Needs to D.I.E.
23mZero Privilege Architecture - 3 Years Onward
50mBabar-ians at the Gate: Data Protection at Massive Scale
37mOf Data Dropboxes and Data Gloveboxes
21mEscape Plan: How We Survived Without EKS and Learned To Love Air-Gapped