Yes, but artifacts created in these air-gapped networks are expected to stay there. This is not true for AI lab models, who would get access to the internet once live.
That is not the case, a key purpose for most intelligence functions is dissemination, not holding the secrets in the darkness. For example, satellites take pictures, mobile phones are geolocated, HUMINT sources drop dimes. Then analysis happens high side, and a version of that is automatically and certifiably downgraded to e.g. a report about troop movements, without revealing specific characteristics of the sources used.
The pipeline for model assessments could easily report summary statistics down via a trusted guard product. These are amongst the most highly validated software/hardware devices made, and provide a central point for logging and authorisation out of band.
That is not the case, a key purpose for most intelligence functions is dissemination, not holding the secrets in the darkness. For example, satellites take pictures, mobile phones are geolocated, HUMINT sources drop dimes. Then analysis happens high side, and a version of that is automatically and certifiably downgraded to e.g. a report about troop movements, without revealing specific characteristics of the sources used.
The pipeline for model assessments could easily report summary statistics down via a trusted guard product. These are amongst the most highly validated software/hardware devices made, and provide a central point for logging and authorisation out of band.