Confidential training demo
You run a model company. You've paid a public health service for the right to train on 2,000 of its patient records. The health service has loaded them into a Caution enclave. You can't read them, and neither can Caution or AWS. Check the code, train, and take your model.
Before uploading, the health service reviewed the same code, ran caution verify, and pinned its dataset's hash. In production each company also has its own key (see the README). Here there's no login.
Local devNo enclave, no STEVE. The page calls the trainer directly and skips the enclave checks.
This page is served by the enclave it checks, so it shows the PCRs the enclave reports. Your browser confirms AWS signed them and that the STEVE session belongs to this enclave. To confirm they match the published source, rebuild it with caution verify and compare.
Through STEVE. A service worker in your browser checks a fresh attestation for this session, agrees a key with the enclave, and encrypts every request. Answers come back under the same key, so they come from the code with these PCRs. Here the enclave serves the service worker itself, which is fine for a demo; in production you'd load it from somewhere you trust. How STEVE attests the session
The health service gave you its dataset's SHA-256 before deployment. It's an argument of the trainer, so it's part of the measured image, and the trainer accepts no other data.
From a checkout of git.caution.co/public/demo-confidential-training, this rebuilds the enclave image and compares its PCRs with the running enclave's.
caution verifyThe trainer is a Rust port of microgpt, Andrej Karpathy's 200-line GPT. It runs inside the enclave on the health service's records and sends out one thing: the model's weights.
Owned by the health service
caution verify on the same commit.A real dataset can be large; it would stream from the health service's storage the same way.
Runs the published code
The model writes once training starts
What leaves the enclave
Arrives when training ends.
The weights are a standard safetensors file. In production the enclave would encrypt them to your key and upload them to your storage.
Same code, same records, same seed: every run produces the same file. Press Train again to see it.
Pick two or three symptoms. Your question travels through STEVE, the model answers inside the enclave, and only you can read the answer. It's a toy trained on made-up records, not medical advice.
Train the model in step 2 first.
The model says
–