You raise fair concerns. So, we need to get data to systems they're reading from. But, they can't connect back over those lines.

The safest way to do that is a high-assurance, data diode (one-way link). One builds hardware that, physically and by software, only allows information to flow one day. Many are available commercially.

Sometimes you need proof of acknowledgement of each packet but nothing else. Naval Research Laboratory had The [Network] Pump that allowed only Ack's back and with algorithm to throw off covert, timing channels.

Next, one might want to let people send them requests over an API which they can respond to in limited ways. One can use a high-assurance guard with secure, hardware/software architecture. It uses simplified I/O with a message format that's easy to parse securely.

At this point, I'm also thinking it might be better to use the closed-source, proprietary solutions. The AI's are rapidly scanning the open-source code for vulnerabilities which I'm sure they're not always sharing. They'd be more likely to have attacks on it.

So, don't tell the untrusted model how the guard works, use private models + traditional verification to secure its code, and include both HIDS and NIDS monitoring. Also, make the systems as predictable and boring as possible to make anomalies easier to spot.