Secure LLMs · the sovereign tier
We run open-weight models inside your perimeter with no route to the internet and no name to resolve. The weights are proven byte-identical to the public artifact. Every call is anchored to a tamper-evident chain. You get the evidence, not our word for it.
The substrate is why you’re allowed to buy the application.
See it carrying a real one: Hyfstele MLR for pharma promotional review →
What we do
We prove it’s byte-identical to the public artifact, so no backdoor can be aimed at you. We enumerate its dormant capacity and prune what never fires. We give it no channel to talk. And we record everything it does.
Four independent controls. Each one is verifiable on your own hardware, by your own people, without taking our word for anything — or the model publisher’s.
Hash every weight file against the digest the publisher posted publicly. Anything surviving byte-identity is in the artifact the whole world runs — so it can’t be aimed at you.
A backdoor hides in capacity ordinary traffic never touches. Routing is discrete and countable, so we histogram it and ablate what never fires. Deleting the hiding place beats auditing it.
The enclave initiates zero outbound connections and resolves zero names. Not an allow-list. Not a policy. The capability does not exist.
Every input, output, and routing fingerprint anchored to a tamper-evident chain. When prevention fails, detection survives — and corrections supersede in the record rather than replacing it.
Proving a model is clean is impossible. Proving it is the same bytes everyone else is running is a hash comparison. That substitution is the most valuable move in this architecture, and it is widely missed.
We hash every weight file of our own copy against the digest the publisher has posted publicly, built as a Merkle tree at file granularity — so a mismatch localises to a specific tensor file rather than condemning the artifact wholesale.
Verified. Our archived copy’s tokenizer.json hashes to 0614fe83cadab421…, matching the published digest exactly. Full-artifact verification across all 22 weight shards is a mechanical extension of the same check.
Why this is decisive:
A backdoor is only worth building if it has a channel: data out, or a trigger in. The Blackhole removes the channel.
The naive version is an allow-list — “the model may only talk to your internal systems.” That is not a guarantee. Those systems reach the internet, so a trickle through them reaches it too. Transitive egress is egress. We don’t police the capability. We remove it.
Why it still works. Cloud firewalls are stateful: responses to an allowed inbound connection flow back regardless of egress rules. So deny-all-egress plus allow-ingress is a complete request/response service that can never initiate. The model doesn’t fetch your data — your application pushes it in and receives the answer on the same connection. Retrieval data lives inside the enclave. Nothing reaches out.
Evidence, from inside the running model container on the sealed machine:
api.openai.com — no route. The address resolved; the packets went nowhere.The lockdown was so complete that Google’s own container agent couldn’t reach its registry until we explicitly allow-listed a private path for it.
Our first seal leaked, and the way it leaked is instructive enough that we publish it.
Cloud instances resolve names through a link-local metadata service. It sits outside the egress firewall’s jurisdiction and performs recursive DNS resolution on the machine’s behalf. So even on a machine with no external address, no NAT, and a deny-all egress rule, a backdoor can encode stolen data into a hostname — <encoded-secret>.attacker.com — and the resolver dutifully walks the DNS hierarchy until the query reaches the attacker’s own authoritative nameserver. They read the data out of their query logs. Your firewall never sees a packet, because your machine never sent one. The metadata service did.
Bandwidth is roughly 30–60 bytes per query. Slow for bulk data; entirely sufficient for an API token or a credential.
How we proved it was live. We queried a hostname that had never existed, from inside the model container. It returned a definitive “domain not found” — not a timeout. A never-before-seen label can’t be answered from cache; a definitive answer is only possible if the query travelled the public hierarchy to that domain’s authoritative nameserver. The encoded label reached its operators. Demonstrated, not theorised.
How we closed it. The enclave initiates nothing, so it needs no resolver at all. We run the inference container with its resolver pointed at a dead in-network address, and the container runtime persists that setting — so the resolver is blackholed at every boot with no script to run and no ordering race to lose. Verified across a reboot — the test that caught two earlier attempts. Sealed and serving.
02 — Dormancy · the audit surface
countable slots — not 120 billion floats.
Dormancy only catches a backdoor parked in unused capacity; a competent adversary would distribute it across hot experts. The closure comes from abandoning static analysis entirely — a backdoor must change the computation in order to change the output. In a Mixture-of-Experts, behaviour factors into which experts are selected and what they output; there is nowhere else for a trigger to live. So every request yields a routing fingerprint, and a trigger that reroutes is out-of-distribution — flagged without anyone knowing what the trigger is. Real routers specialise, so the output is a ranked suspicion list, not a verdict.
The enclave runs inside your environment. It reads your data and has no path out. The control is cloud-agnostic — the same architecture in three dialects:
| Environment | The same control |
|---|---|
| GCP | VPC + deny-egress firewall + private service access |
| AWS | VPC + security groups + no internet gateway / no NAT + S3 endpoint |
| On-prem | physical network + firewall |
Who controls the egress? You do. In your account you hold root, and you could change the policy tomorrow. We won’t claim otherwise — and no serious security team would accept a vendor holding unilateral control of their network anyway.
What we provide instead is continuous proof. The policy ships as attested configuration; the harness re-verifies it and anchors the result; drift is detected and recorded. And because the sealed state contains zero allow-egress rules, there’s no rule to quietly weaken — defeating it requires adding a NAT gateway, which is a loud, auditable act that the next verification catches.
Not because we haven’t looked — because nobody on earth can make that claim honestly, and the people who can approve your deployment already know it.
No source, no call graph, nothing to review. A backdoor would be an unknown input triggering unknown behaviour encoded across 120 billion numbers.
Interpretability cannot prove the absence of a trigger at this size. Not us, not a lab, not a scanner. Anyone claiming otherwise is overclaiming.
Four controls that don’t depend on the answer. Byte-identity, dormancy, containment, and the record hold whether or not anything is hiding in there.
This section is the point. Never fill the silence with a bigger claim — the residual is the credibility.
The answer channel is open. Zero egress does not close the semantic channel. A backdoored model can encode data in its reply to whoever asked. That reply goes to the caller — so an external attacker can’t read it unless the enclave is public-facing, in which case they could be a user, send a trigger, and receive data in the response. This is real. It’s bounded by recording every input/output pair and by routing-fingerprint anomaly detection. That is detection, not prevention. The Blackhole closes the network channel, not the semantic one.
Dormancy is a heuristic. A “dormant” expert may simply be specialised for a domain absent from the test corpus. Corpus breadth is load-bearing, and ablation — not the count — is the check that matters.
An adaptive adversary is not closed out. An attacker who shapes a trigger so its routing and activation signatures sit inside the benign distribution is not caught by our detectors. Nothing closes this. What changes is the cost: they must compromise the artifact the entire world runs, with a signature indistinguishable from normal computation, to produce an effect that cannot exfiltrate and is permanently recorded. That’s four independent controls deep — a research programme against a defended target, not an afternoon’s work.
Tiers are not interchangeable. Our fast tier runs on managed GPU infrastructure with open egress by design. We don’t claim containment there, and we never will. The sovereign tier is the one that carries the guarantee. Anyone conflating them is selling you something.
A page that only lists green items is marketing. Where this says a thing isn’t proven yet, that’s not a roadmap — it’s the current truth.
| Capability | State |
|---|---|
| Egress lockdown, sovereign tier | PROVEN — survives reboot; on-chain (block 1405) |
| DNS exfiltration channel | CLOSED & verified across reboot |
| Tamper-evident audit trail | LIVE |
| Two-layer access policy | LIVE & enforcing |
| Byte-identity attestation | Verified on real bytes; full-artifact run pending |
| MoE dormancy audit | Built; not yet run against real weights |
| Runtime OOD scorer | Reference distribution emitted; scorer not built |
| 120b served under containment | NOT YET — proven with a stand-in model. The control is model-agnostic: a firewall doesn’t care what serves. |
The last row deserves emphasis. The containment proof used a small open model rather than the 120b, because the egress control is model-agnostic — proving one model can’t phone home and proving another can’t are the same proof. We say so rather than let the demo imply otherwise.
A substrate nobody builds on is a diagram. Hyfstele MLR reviews pharma promotional copy against the full FDA OPDP enforcement record — on a model that physically cannot phone home, with every decision on a tamper-evident chain. Your unreleased copy never leaves your perimeter, and you can prove it to your auditor.