“Completely air-gapping this infrastructure—that is, disconnecting it entirely from external networks—isn’t currently feasible, since we need external connections in order to run and monitor experiments”
If they wanted to, they would.
The pipeline for model assessments could easily report summary statistics down via a trusted guard product. These are amongst the most highly validated software/hardware devices made, and provide a central point for logging and authorisation out of band.
If the software under test can attack the IPMI to gain access to the management network it's connected to, and then hop out to the Internet through either the VPN server or the IPMI client software, and the problem wasn't caused by a boneheaded misconfiguration, then that's a very interesting finding that everyone will want to hear... because that's a vulnerability in a component that's expected to safely run alongside hostile workloads.
[0] I'm using the name "IPMI", but the thing goes by many other names: BMC, LOM, iDRAC, iLO, etc, etc, etc. Whatever you call it, it's a little computer built into the motherboard to provide remote access and management to the system it's built into.
It's a pretty darn slim surface for an attack. Technically doesn't meet the definition of an "air gap", but it gives you 100% of the utility of remote work with effectively 0% of the vulnerability, at the cost of a tiny amount of power and a few extra cables in the rack.
You create an airgapped network and monitor the systems using that. This is not rocket surgery.