PRIVATE TRAINING
Bring a confidential corpus — call transcripts, support threads, deal email, incident history. One pipeline distills it, builds a held-out eval, trains an open-weight model inside an attested confidential VM, and hands back the model with a signed receipt: what trained, on which data digests, and how much better it scored than its base. Nobody outside the enclave — Ember included — can read the data.
WHAT YOU BRING
A dataset. A folder of documents, a JSONL export, meeting-transcript exports, or ready-made chat examples — four input formats, one line of config each.
One sentence of intent. The domain field: what the model should be a deep expert
on. It drives both the distillation and the exam the model is graded against.
That's the whole interface. Everything derived from your data — training examples, eval questions, the adapter — stays in a working directory on your machine; the pipeline refuses to put it inside a repository.
WHAT COMES BACK
A LoRA adapter for the base model, downloadable only with the output token minted at seal time.
A signed receipt from inside the enclave — base model, dataset digests, adapter digest, and the held-out eval score (baseline → final) — verifiable long after the VM is destroyed. Review it in the public receipt verifier or with the complete offline CLI.
An eval that means something. Questions are generated only from held-out documents, then every question a no-context frontier model can guess is thrown away. What survives can only be answered by knowing your data. On the reference run, training moved 30.4% → 39.1% on that filter — and won a blind pairwise comparison against its base 40 to 3.
HOW A RUN GOES
01 · PREP
pl pipeline run --until assemble
Ingest, distill, generate + adversarially filter the eval. Local, no GPU, inspect everything.
02 · TRAIN
pl pipeline run
Seal to the release policy, upload ciphertext, key released only to the attested trainer, train.
03 · VERIFY
pl pipeline status
Adapter + receipt collected; signature, attestation chain, and digests checked on your machine.
INSTALL
# Python ≥ 3.10; prep also uses your local `claude` CLI (subscription, no API key)
pip install https://embersovereignty.com/train/private-learning.tar.gz
pl pipeline init --config my-model.json
Edit four fields — name, workdir, source, domain —
and run. Every stage is resumable; a killed run continues where it stopped.
INPUT FORMATS
| format | what it is |
|---|---|
| docs-jsonl | One document per line: {"text", "title"?, "date"?, "notes"?}. The easiest export target for email, chat, or tickets. |
| text | A directory of .md / .txt files, one document each; a leading YYYY-MM-DD in the filename becomes the date. |
| transcripts | Otter and Gemini meeting-transcript exports; duplicate meetings dedupe by date + title. |
| sft-jsonl | Ready {"messages": [...]} rows — skips distillation, still gets the held-out eval. |
THEN SERVE IT
The same custody story, run again with a serving payload: pl serve seals the trained
adapter to an attested serving VM, which merges it into the base model inside the enclave and
fronts it with an OpenAI-compatible endpoint — attested TLS (no CA, no DNS), bearer API keys you mint,
and per-key token metering signed by the enclave: a billing record neither side can forge. A localhost
bridge (pl serve proxy) lets any chat GUI talk to it.
pl serve upload --url https://IP:8000 --adapter result/adapter.tar.gz pl serve release # attestation gates verified → key released → serving pl serve chat "..." # or: pl serve proxy → point Chatbox/Jan at localhost:8080/v1
GIVE YOUR AGENT THE SKILL
This whole pipeline is written up as an agent skill — the config schema, the custody rules, the backends, cost expectations, the troubleshooting playbook. Install it once and your agent can take a dataset to a trained, verified model on its own:
mkdir -p ~/.claude/skills/ember-train curl -fsSL https://embersovereignty.com/train/SKILL.md -o ~/.claude/skills/ember-train/SKILL.md
That's a personal skill — it rides along in every project. To pin it to one repo, put the same file at
.claude/skills/ember-train/SKILL.md. Or read it yourself:
SKILL.md →
TWO CUSTODY MODES, SAME PROOF
Hosted. The data key is sealed to Ember's release policy engine — a threshold network that re-runs the attestation checks with the approval policy on-chain — so you can be offline at release time. Sign in at the console; trainer capacity is provisioned per engagement (request a briefing).
Self-hosted. No account at all: the data key is wrapped with your passphrase, verification runs on your machine, and the trainer runs in your own GCP project (TDX + H100; reference profiles ship in the package). Any base model, any parameters.
Identical envelope, attestation gates, trainer runtime, and receipt in both — the release decision is a pluggable backend, not a different product. Method details: whitepaper →
START A TRAINING RUN
Prep runs on your laptop for free — bring a dataset and see your train/eval sets today. A briefing gets you hosted trainer capacity and a guided first run.
Request a briefing