MAIN Introduces THESEUS, a Secure AI Lab Developed at MGCCC

At a glance

• Purpose: AI coursework, workforce training, technical demonstrations and controlled experimentation
• Design: Air-gapped compute environments with no electronic links between domains
• Required component: A dedicated workstation that quarantines and inspects external media
• Expansion options: Server, CPU-cluster and GPU-workstation domains
• Development: Mississippi Gulf Coast Community College through MAIN, with support from AccelerateMS

Built for hands-on AI instruction

Students and trainees can work directly with infrastructure used for AI inference, training, data preparation and image-generation workflows. The MGCCC environment includes Ollama, vLLM, PyTorch, ComfyUI and Jupyter.

The lab can support college coursework, training for public agencies and employers, and technical demonstrations for groups evaluating AI. Because the systems run locally, instructors can teach hardware and model operations alongside access control, data handling, audit records and risk management.

The air-gapped design allows training to continue without a cloud service or an active internet connection. Models, datasets, software and other files enter through a documented media-review process.

Four domains, one required security checkpoint

THESEUS divides its computing resources into four domain types. Each domain has a separate purpose and remains electronically isolated from the others. Domain D controls entry to the lab. Domains A, B and C provide optional computing capacity.

Domain D: Media quarantine (required)

Domain D is a fully isolated workstation used to inspect external media before material enters a compute domain. Files pass through antivirus screening and a chain-of-custody process at this station. The procedure applies to external datasets, models, software packages and other digital material introduced into the lab.

Domain A: Server compute (optional)

Domain A provides general-purpose server infrastructure. MGCCC uses it for server-grade AI inference and training, local model and data storage, and audit management. Another organization can configure the domain for server workloads that fit its own program.

Domain B: CPU cluster compute (optional)

Domain B distributes work across CPU nodes connected through a standard Ethernet backbone. An organization can deploy additional Domain B instances when it needs more CPU capacity.

Domain C: GPU workstation compute (optional)

Domain C provides GPU-accelerated workstations on a 100-gigabit-per-second high-speed fabric. It supports parallel inference, model training, image-generation workflows and other GPU-intensive work. Additional Domain C instances can increase capacity or serve more users at the same time.

Configurations can grow with the program

The domain structure allows an organization to build a focused lab first and add capacity later. Example configurations include:

• Domain D plus Domain C for a GPU-focused lab
• Domain D, Domain A and multiple Domain B instances for server infrastructure and a scaled CPU cluster
• Domains D, A, B and C for a full teaching and workforce laboratory

Domains A, B and C can be combined according to the planned coursework, workloads, number of users and available funding.

Security and compliance boundaries

THESEUS has no internet connection, and its domains have no electronic links to one another. Moving a file into a compute domain requires physical media and the Domain D review process. Each compute domain maintains its own audit trail, so one domain does not depend on another for audit records.

These controls are intended to support work involving audit accountability, media protection, access control and system isolation. They may be useful when an organization plans an environment subject to NIST SP 800-53 controls or, where applicable, FERPA, NERC CIP-003-8 or CMMC Level 2 requirements.

The architecture does not establish compliance on its own. Each implementing organization remains responsible for determining which requirements apply, configuring and documenting its controls, training personnel, maintaining evidence, and completing any required assessment or authorization process.

A design other organizations can adapt

THESEUS gives colleges, agencies and employers a starting design for local AI instruction and controlled experimentation. A community college could configure a GPU lab for model and media coursework. An agency could use an isolated installation for employee training. An employer could build a test environment that remains separate from its internet-connected production systems.

An organization can begin with the required quarantine station and one compute domain, then add server, CPU or GPU capacity as its program changes. This separates the initial purchasing decision from future expansion.

For MGCCC and MAIN, the lab connects AI workforce training with the operating practices required to manage local infrastructure and controlled data. Learners can see how an AI system runs and practice the procedures used to operate it responsibly.

Learn more about THESEUS

Organizations interested in the architecture or its technical documentation may contact Wayne Francis, AI Strategist for MAIN, through MAIN at MAIN@mgccc.edu.

The Mississippi Artificial Intelligence Network is Mississippi’s statewide AI initiative. Mississippi Gulf Coast Community College serves as MAIN’s anchor institution, providing operational and fiscal coordination for the network.

• Explore MAIN’s statewide AI work
• Find MAIN AI courses and workforce training
• View the SysML v2 Jupyter Kernel used for architecture rendering