Private Training
SFT · DPO · RLHF · PEFT · continued pre-training. Your stack, sealed end-to-end. Signed manifest out, no logs by construction.
SFT, DPO, RLHF, LoRA / QLoRA / PEFT, continued pre-training, and multimodal extension. Run the pipeline you already use with TRL, Unsloth, and HuggingFace — on data that never leaves the silo.
training pipelines · single-tenant
fork · register · seal
phase
pipeline
base · method
hardware
status
cross-silo consortia · multi-party
multi-sig · k-of-n unwrap
consortium
records
training method
status
Cardio-renal cohort
4 hospitals · EU + US
Cross-bank fraud signals
6 banks · US + UK + SG
Rare-disease genomics
3 research consortiums
Supply-chain risk benchmark
8 vendors · global
Toggle dstack off to see exactly which guarantee disappears at each step.
SFT · DPO · RLHF · PEFT · continued PT — encrypted gradients across attested H200 nodes, signed manifest out
Every data owner derives a wrap key locally: HKDF(kms_root_pubkey, training_app_id, training_compose_hash, owner_id), encrypts their shard, and publishes ciphertext. The training compose-hash pins the framework, training script, and hyperparameter file (TRL · Unsloth · HF Trainer). Approval is co-registered on-chain via a multi-sig that owns DstackApp.sol.
Supervised fine-tuning
TRL SFTTrainer or Unsloth. unwrap_dataset() pulls per-owner keys via dstack-guest-agent — your training loop is unchanged. Out: a sealed checkpoint plus a signed manifest.
Preference / RL alignment
DPOTrainer / IPOTrainer for preference-pair optimization, or full RLHF with a reward model + PPO. Sealed prompts, sealed preference data, attested reward model.
PEFT · LoRA / QLoRA
HuggingFace PEFT. Train low-rank adapters against a frozen base; the LoRA weights are sealed to the compose-hash and merged on attested re-derive. 4-bit QLoRA for memory-bound runs.
Continued pre-training
Domain-adapt a base model on sealed token corpora. Streaming dataloader unwraps shards in TDX memory; the run emits one signed manifest covering token-hashes, hyperparameters, and final checkpoint.
sealed dataset · cohort-A.tar
1.6M rows
Each owner's wrap key is HKDF(kms_root, app_id, compose_hash, owner_id). Change the recipe → key changes, old ciphertext is permanently locked out. The wrap key only re-derives inside an attested CVM whose compose-hash matches.
training manifest · sign-rpc
signedOut of every run: a Sign-RPC manifest binding code, datasets, hyperparameters, and model checksum to the on-chain compose-hash. Hand the regulator the manifest, not the model file.
in production today
Recipe-bound fine-tunes that ship a sealed model. Cross-silo training where the manifest, not the model file, is the regulator artifact.
HIPAA-grade · 13B QLoRA
“Patient-conversation fine-tune in TDX + H200. Weights never touch our cloud or theirs — sealed to the recipe, KMS re-derives only inside an attested CVM.”
medical-chat v3
TDX + H200 · weights sealed
4 hospitals · EU + US + CH
“Each hospital seals their dataset; KMS only unlocks for the approved compose. Out the other side: a signed manifest that binds code, datasets, and model checksum.”
1.6M records
multi-sig DstackApp · DP-aggregate out
6 banks · global
“Joint AML model trained without any bank seeing another bank's ledger. Hand the regulator the manifest, not the model file.”
78M tx records
k-of-n quorum · sign-rpc manifest
HIPAA-grade
patient data sealed
GDPR / UK GDPR
data residency preserved
PCI / FFIEC
cross-bank joins gated
SOC 2 Type II
attested run history
AI solution paths
The private model endpoint is the first entry point. The same privacy primitive extends to agents, data workflows, and training.
Serve OpenAI-compatible model calls where prompts, outputs, and customer context need encrypted-in-use protection.
128K
$0.27/M input
256K
$0.40/M input
128K
$0.15/M input
128K
$0.10/M input
200K
$3.00/M input
1M
$1.25/M input
Run agents with keys, tools, memory, and actions inside a verified runtime instead of a visible automation cloud.
Move models to sensitive records and return approved outputs without exposing raw data to the model operator.
source
EHR data
source
Customer records
source
Internal docs
TEE clean room
approved output
Deploy private training
Fine-tune for one customer or co-train across silos. Per-owner HKDF, multi-sig DstackApp gate, signed manifest binding code, datasets, and model. TDX + H100/H200.
