Emergency operations wants air-gapped model updates delivered with signed USB transfer procedures. What update-channel property is essential?
Select an answer to reveal the explanation.
Short Explanation
Air-gapped does not mean “trust every thumb drive.” Sign and control how models walk into disconnected civic hosts. Break-room USBs, skipping signatures, and unsigned email drops break the channel.
Full Explanation
Emergency operations wanting air-gapped model updates via signed USB transfer procedures need integrity-verified, controlled transfer of models into disconnected civic GenAI hosts. Air gaps reduce remote network risk but do not make physical media trustworthy; update channels still require chain-of-custody, cryptographic signatures or hashes from approved publishers, malware scanning of media, and restricted import procedures into municipal inference environments used for emergency operations.
Allowing any USB found in the break room to install the newest weights treats physical proximity as trust and invites malware or tampered artifacts onto disconnected hosts. Skipping signatures because air gaps supposedly make malware impossible ignores insider, supply-chain, and previously compromised media risks. Emailing unsigned weight archives to a shared inbox beside a SCIF reintroduces an unverified channel adjacent to a sensitive facility and undermines the air-gap intent.
Exam caveat: signatures verify integrity and publisher authenticity relative to trusted keys—key management and who may authorize imports remain essential parts of the control, not optional paperwork. Operational check: exercise a model update with signed media, verify that signature failure rejects the load, document custodians allowed to perform air-gapped GenAI imports, and retain transfer logs for emergency-operations audit.