# Diagrams — Module FT22: Government, Military, and Air-Gapped Deployment

**Module**: FT22 — Government, Military, and Air-Gapped Deployment
**Diagram count**: 6
**Tool**: Mermaid (primary). Each diagram validated in [Mermaid Live Editor](https://mermaid.live).

---

## Diagram 1 — The DoD Impact Levels (IL2 → IL7+)

**Type**: Stacked compliance ladder
**Purpose**: The canonical reference for every government AI deployment. Each rung escalates the FedRAMP baseline, data class, and network. Air-gap begins at IL7+.
**Reading the diagram**: Bottom-up. IL2 is commercial cloud, NIPRNet, unclassified. Each step up tightens the baseline, raises the data class, and at IL7+ severs the network entirely.

```mermaid
block-beta
  columns 1
  IL7["IL7+  ·  BEYOND FEDRAMP\nTS / SCI  ·  JWICS (air-gapped)\nStandalone, no commercial cloud"]
  IL6["IL6  ·  High + classified overlays\nSECRET  ·  SIPRNet\nDedicated / classified cloud"]
  IL5["IL5  ·  FEDRAMP HIGH\nCUI / National Security Systems  ·  NIPRNet / SIPRNet\nAuthorized commercial cloud"]
  IL4["IL4  ·  Moderate + DoD overlays\nCUI  ·  NIPRNet\nCloud w/ DoD overlays"]
  IL2["IL2  ·  FEDRAMP MODERATE (~325 controls)\nUnclassified, non-public  ·  NIPRNet\nAuthorized commercial cloud"]

  IL2 --> IL4
  IL4 --> IL5
  IL5 --> IL6
  IL6 --> IL7

  style IL2 fill:#14141f,stroke:rgba(255,255,255,0.18),color:#9494a0
  style IL4 fill:#14141f,stroke:rgba(255,255,255,0.22),color:#e4e4e8
  style IL5 fill:#14141f,stroke:#5eead4,color:#e4e4e8
  style IL6 fill:#14141f,stroke:rgba(240,168,104,0.7),color:#e4e4e8
  style IL7 fill:#14141f,stroke:#f08080,stroke-width:1.5px,color:#e4e4e8
```

---

## Diagram 2 — Why IL5/IL6 Demand Auditable Open-Data

**Type**: Decision flow with rationale
**Purpose**: The structural argument for open-data (MiniCPM, OLMo, Tülu) at sensitive tiers. FedRAMP authorizes the *cloud*, not the *model*. At IL5+ you need to audit weights AND training data — which forces the open-data choice.
**Reading the diagram**: Left = the question every IL5+ deployment must answer. Right = the three properties that follow from "auditable," and the model-type consequence at each step.

```mermaid
flowchart TD
  Q["FedRAMP authorizes the cloud service.\nWho authorizes the WEIGHTS?"]
  Q --> R["At IL5+ you must audit:\nweights AND training data"]
  R --> P1["1. REPRODUCIBILITY\nopen corpus + code\n(could re-derive in principle)"]
  R --> P2["2. NO HIDDEN\nTRAINING-TIME EXFIL\ninspect the corpus"]
  R --> P3["3. NO EMBEDDED\nBEHAVIOR YOU CAN'T\nACCOUNT FOR\nprobe activations"]

  P1 --> T1["Open-data (MiniCPM, OLMo, Tülu)\n-> REQUIRED at IL5+"]
  P2 --> T2["Open-weights-only (Llama 3.x)\n-> liability at IL5+"]
  P3 --> T3["Closed-weight (API)\n-> incompatible with air-gap"]

  style Q fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#e4e4e8
  style R fill:#14141f,stroke:rgba(94,234,212,0.5),color:#e4e4e8
  style P1 fill:#14141f,stroke:rgba(94,234,212,0.5),color:#e4e4e8
  style P2 fill:#14141f,stroke:rgba(94,234,212,0.5),color:#e4e4e8
  style P3 fill:#14141f,stroke:rgba(94,234,212,0.5),color:#e4e4e8
  style T1 fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#e4e4e8
  style T2 fill:#14141f,stroke:rgba(240,168,104,0.6),color:#9494a0
  style T3 fill:#14141f,stroke:rgba(240,128,128,0.6),color:#9494a0
```

---

## Diagram 3 — The LoRA / Merge Supply-Chain Attack Chain

**Type**: Threat-model chain (OWASP LLM03:2025 + research)
**Purpose**: Visualize how a compromised adapter or merge propagates an implanted backdoor through the trust chain — surviving quantization, merge, and weight-diff.
**Reading the diagram**: Left-to-right. Attacker compromises one link (data, adapter, or package). The poisoned artifact passes standard eval. At deployment, the trigger activates the backdoor.

```mermaid
flowchart LR
  subgraph Attacker["ATTACK SURFACE (OWASP LLM03:2025)"]
    A1["Poisoned DATA\n(small-samples-poison)"]
    A2["Compromised LoRA ADAPTER\n(MasqLoRA, CVPR 2026)"]
    A3["Vulnerable PACKAGE\n(transformers, peft, safetensors)"]
  end

  subgraph Chain["THE TRUST CHAIN"]
    C1["Base weights\n(open-data)"]
    C2["Adapter merged\n(survives merge)"]
    C3["Quantized GGUF/AWQ\n(survives quantization)"]
    C4["Community merge artifact\n(opaque provenance)"]
  end

  subgraph Survive["EVASION"]
    E1["Passes benchmarks\n(Causal-Guided Detoxify)"]
    E2["Survives weight-diff\n(rank-compatible)"]
    E3["Activates on TRIGGER\nat deployment"]
  end

  A1 --> C1
  A2 --> C2
  A3 --> C2
  C1 --> C2 --> C3 --> C4
  C2 --> E1
  C3 --> E2
  C4 --> E3

  style Attacker fill:#08080c,stroke:rgba(240,128,128,0.4),color:#9494a0
  style Chain fill:#08080c,stroke:rgba(255,255,255,0.08),color:#9494a0
  style Survive fill:#08080c,stroke:rgba(240,168,104,0.4),color:#9494a0
  style A1 fill:#14141f,stroke:rgba(240,128,128,0.5),color:#e4e4e8
  style A2 fill:#14141f,stroke:rgba(240,128,128,0.5),color:#e4e4e8
  style A3 fill:#14141f,stroke:rgba(240,128,128,0.5),color:#e4e4e8
  style C1 fill:#14141f,stroke:#5eead4,color:#e4e4e8
  style C2 fill:#14141f,stroke:rgba(240,168,104,0.7),color:#e4e4e8
  style C3 fill:#14141f,stroke:rgba(240,168,104,0.7),color:#e4e4e8
  style C4 fill:#14141f,stroke:#f08080,color:#e4e4e8
  style E1 fill:#14141f,stroke:rgba(255,255,255,0.18),color:#9494a0
  style E2 fill:#14141f,stroke:rgba(255,255,255,0.18),color:#9494a0
  style E3 fill:#14141f,stroke:#f08080,stroke-width:1.5px,color:#e4e4e8
```

---

## Diagram 4 — The Defensive Playbook (5 Steps)

**Type**: Sequential verification pipeline
**Purpose**: How to verify a model you did not train. Five steps, applied in order, skip none at IL5+.
**Reading the diagram**: Top-down. Step 1 gates the choice of base. Steps 2–3 eliminate the poisoned-artifact and backdoor classes. Step 4 catches known failure modes. Step 5 enforces the trust boundary at load time.

```mermaid
flowchart TD
  S1["STEP 1 — Prefer open-data models\nMiniCPM, OLMo, Tülu, SmolLM3\n(weights + corpus published)"]
  S2["STEP 2 — Re-derive quants/LoRAs from source\nno opaque community artifacts\npinned toolchain, published recipe"]
  S3["STEP 3 — Diff-in-means / activation probing\nreuse FT17 abliteration toolkit\nfind UNEXPECTED steering directions"]
  S4["STEP 4 — Behavioral evals\nPromptfoo + Garak + your adversarial suite\nbefore any IL4+ load"]
  S5["STEP 5 — Checksum/sign + pinned internal mirror\nnever hf pull inside the trust boundary\nverify on load, refuse on mismatch"]

  S1 --> S2 --> S3 --> S4 --> S5
  S5 --> Deploy["CLEARED FOR DEPLOYMENT"]

  style S1 fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#e4e4e8
  style S2 fill:#14141f,stroke:#5eead4,color:#e4e4e8
  style S3 fill:#14141f,stroke:#5eead4,color:#e4e4e8
  style S4 fill:#14141f,stroke:#5eead4,color:#e4e4e8
  style S5 fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#e4e4e8
  style Deploy fill:#14141f,stroke:rgba(130,224,170,0.7),stroke-width:1.5px,color:#82e0aa
```

---

## Diagram 5 — Air-Gapped Deployment Architecture

**Type**: Network-zone architecture
**Purpose**: The four-verb design of air-gap — pre-load, sever, bind, log. Shows the one-way media transfer from inbound gate to deployment host, and the loopback-only bind.
**Reading the diagram**: Left = network-connected inbound gate (staging). Center = one-way transfer. Right = air-gapped deployment host with loopback bind and local audit log. The big red bar is the severed network.

```mermaid
flowchart LR
  subgraph Net["NETWORK-CONNECTED ZONE"]
    HF["Hugging Face / upstream"]
    Gate["INBOUND GATE\n(staging host)\npull -> hash -> sign"]
    Mirror["INTERNAL MIRROR\n(signed artifacts only)"]
    HF --> Gate --> Mirror
  end

  Xfer["ONE-WAY MEDIA\n(CD-ROM / data diode /\nverified transfer)"]

  subgraph Air["AIR-GAPPED DEPLOYMENT HOST (IL5+ / JWICS)"]
    Verify["VERIFY ON LOAD\nre-hash, check signature\nrefuse on mismatch"]
    Model["llama.cpp / vLLM server\nbind 127.0.0.1 or Unix socket"]
    Harness["Harness (co-located)\ntalks over loopback only"]
    Log["AUDIT LOG\nlocal append-only\nprompt + generation + load"]
    Verify --> Model
    Model <-->|"loopback"| Harness
    Model --> Log
    Harness --> Log
  end

  Net -.severed.- Air
  Mirror --> Xfer --> Verify

  style Net fill:#08080c,stroke:rgba(94,234,212,0.3),color:#9494a0
  style Air fill:#08080c,stroke:#5eead4,stroke-width:1.5px,color:#e4e4e8
  style HF fill:#14141f,stroke:rgba(255,255,255,0.18),color:#9494a0
  style Gate fill:#14141f,stroke:rgba(94,234,212,0.5),color:#e4e4e8
  style Mirror fill:#14141f,stroke:rgba(94,234,212,0.5),color:#e4e4e8
  style Xfer fill:#14141f,stroke:rgba(240,168,104,0.7),color:#e4e4e8
  style Verify fill:#14141f,stroke:#5eead4,color:#e4e4e8
  style Model fill:#14141f,stroke:#5eead4,color:#e4e4e8
  style Harness fill:#14141f,stroke:rgba(94,234,212,0.5),color:#e4e4e8
  style Log fill:#14141f,stroke:rgba(130,224,170,0.6),color:#e4e4e8
```

---

## Diagram 6 — The CDAO Closed-Vendor Gap

**Type**: Tension / contrast
**Purpose**: Visualize the structural gap between CDAO's announced closed-weight partners (Anthropic, Google, OpenAI, xAI) and the auditability requirement at IL5+/JWICS. Closed-weight API access is incompatible with air-gap; the open-weights curriculum is the response.
**Reading the diagram**: Left = the capability CDAO procured (closed-weight, API). Right = the IL5+ requirement (auditable, air-gapped). The tension arrow in the middle is the gap this course addresses.

```mermaid
flowchart LR
  subgraph CDAO["CDAO ANNOUNCED PARTNERS"]
    direction TB
    P1["Anthropic\n(closed)"]
    P2["Google\n(closed)"]
    P3["OpenAI\n(closed)"]
    P4["xAI\n(closed)"]
    Note1["All CLOSED-weight\nAPI-only\nNot auditable at weight level"]
  end

  Gap["THE GAP\nclosed-weight API\nis incompatible with\nIL5+ / JWICS air-gap"]

  subgraph Need["IL5+ / JWICS REQUIREMENT"]
    direction TB
    R1["Auditable weights\n(open-data)"]
    R2["Auditable corpus\n(open-data)"]
    R3["Air-gapped deploy\n(open-weights stack)"]
    R4["Re-derivable artifacts\n(no opaque merges)"]
    Note2["MiniCPM, OLMo, Tülu\n+ the fine-tuning\nin this course"]
  end

  CDAO ====>"|gap|" Gap
  Gap ===> Need

  style CDAO fill:#08080c,stroke:rgba(240,128,128,0.4),color:#9494a0
  style Gap fill:#14141f,stroke:rgba(240,168,104,0.8),stroke-width:1.5px,color:#f0a868
  style Need fill:#08080c,stroke:#5eead4,stroke-width:1.5px,color:#e4e4e8
  style P1 fill:#14141f,stroke:rgba(255,255,255,0.18),color:#9494a0
  style P2 fill:#14141f,stroke:rgba(255,255,255,0.18),color:#9494a0
  style P3 fill:#14141f,stroke:rgba(255,255,255,0.18),color:#9494a0
  style P4 fill:#14141f,stroke:rgba(255,255,255,0.18),color:#9494a0
  style Note1 fill:#14141f,stroke:rgba(240,128,128,0.4),color:#e4e4e8
  style R1 fill:#14141f,stroke:#5eead4,color:#e4e4e8
  style R2 fill:#14141f,stroke:#5eead4,color:#e4e4e8
  style R3 fill:#14141f,stroke:#5eead4,color:#e4e4e8
  style R4 fill:#14141f,stroke:#5eead4,color:#e4e4e8
  style Note2 fill:#14141f,stroke:#5eead4,color:#e4e4e8
```

---

## Validation notes

- All six diagrams use the course design system colors: `#14141f` panel fill, `#5eead4` accent for primary, `rgba(255,255,255,0.12–0.22)` for secondary borders, `#e4e4e8` / `#9494a0` for text. Danger states use `#f08080`; warning states use `#f0a868`; success states use `#82e0aa`.
- Paste each into [Mermaid Live Editor](https://mermaid.live) to render. All use stable Mermaid syntax (`block-beta`, `flowchart`) supported in current Mermaid (v10.4+). Diagram 6 uses a thick-link arrow (`====>`) — if your Mermaid version dislikes it, substitute `==>`.
- For the slide deck (artifact 03), these are rendered as static SVG/PNG captures from Mermaid Live, inlined into reveal.js.