Several parties train one model. No one sees the weights or anyone else's data.

Each party contributes private data to a model running inside a confidential GPU. The model trains on it and is tested, and the new weights are hashed and signed. No party sees another's data, and the weights never leave. A signed record of every version is public.

In this demo the private data is a cipher. Each party sends a secret key, the enclave turns it into training examples, and the model learns to decode messages written in that cipher.

Loading the recorded run…

Code on GitHub Audit the run

Open, closed and sealed weights

	Open	Closed	Sealed
Who holds the weights	Anyone who downloads them	One provider	A hardware enclave. No route returns them.
Who can see the training data	Whoever trained the model	The provider	Only the party that sent it
What an outsider can check	The weights themselves	Nothing. You trust the provider.	Which code and base model ran, and a signed record of every update

The run, version by version

Share of the contributor's test messages decoded correctly, before → afterLargest drop it caused on an earlier cipher

How one contribution becomes a version

Stays insideKey, training pairs and weights

Comes outSalted key commitment, scores, weights hash and signature

Each party can use only what it added

One model has learned every party's cipher. The enclave checks the token on each request and decodes a cipher only for the party that contributed it.

The example shown uses a public demo key (shift 3).

Replay the run Audit the run

Several parties take turns fine-tuning one shared model inside a confidential GPU. No party sees another's data. Each update to the weights is hashed, scored and signed inside the enclave, so anyone can verify what every contribution changed.

01Take your turn: add training data

In your browser

Name

Cipher

Shift

What your key turns into

Preview made on your device. It never gets sent.

Inside the enclave

Your key becomes 300 training pairs, generated here on the GPU.

Training pairs300

Held out for scoring40

Trains intoshared adapter

Stays inside

your keythe 300 pairsthe trained weights

What comes back to you

Your token, shown once

appears after you send

Only this unlocks the cipher you taught.

Commitment to your key

sha256(salt + key)

Later, prove your key went in without revealing it.

Your row in the ledger

appears when your version is signed

02One shared model, updated at each step

Each contribution trains the version before it. Open Replay to see what every update changed.

03Use what you added

Your cipher

Ciphertext in your cipher

The decoded text appears here.

Same request with another party's token

401 · this token can't use maya's cipher

The cipher sits in the shared weights. The enclave app only answers for a cipher when its contributor's token comes with the request.

See the recorded run, version by version

Replay the run

In this demo each party's private data is a cipher: a secret way of scrambling letters. The model trains on examples of it, then is tested on scrambled messages it has not seen. KHOOR, for instance, should come back as HELLO. Step through the run to see how many it gets right after each contribution.

How well the model decodes each party's cipher

0.00 1.00 of test messages decoded

Score at the last versionIts highest score at any version

Each party's training examples stay inside the enclave for the length of the run, and a sample is replayed whenever a later party contributes. That is how the model keeps the ciphers it learned earlier.

Audit the run

There are two kinds of check. Your browser re-checks the signed record of the run itself. The hardware checks were run with Tinfoil's verifier when the run was saved, and you can run them again with one command.

Checked in your browser, just now

The signed record

Try it: change one byte of a past version and watch the checks fail.

What this does and does not show

It shows

Which code and which base model ran, from the hardware attestation.
The order of the updates, and each version's scores and weights hash, from the signed record.
That the record was signed by a key that existed only inside that enclave.
That no route in the released code returns a key, training data or weights.

It does not show

That the weights still exist. They lived in memory and were gone when the enclave stopped.
That the weights hash can be reproduced. Training is not bit-for-bit repeatable, so the hash commits to the weights that existed.
That the model keeps training data secret. A model can memorize what it trains on, which is why decoding needs the contributor's token.

The ledger

Each row includes the hash of the row before it, so changing a past row breaks every row after it. The key commitment is a salted hash of the contributor's key; only the contributor holds the salt.

Take a turn on the live model