A base model becomes yours by learning from the data only you hold. Training runs inside the border, on sovereign hardware, and the resulting weights never leave your custody.
Fine-tuning executes on sovereign GPU infrastructure so regulated data never crosses a jurisdiction.
Training corpora — tax records, supervisory filings, payment logs — are read only within the national data center. No gradient, sample, or checkpoint is copied to external infrastructure.
Runs execute on the operator's own AI/GPU clusters, the same EPC-delivered fabric Sovex builds. Capacity is scheduled and metered under national control rather than rented from a foreign cloud.
The output of a run is a set of weights encrypted under keys the institution holds. Sovex operates the pipeline but cannot exfiltrate or reconstitute the model.
For classified corpora the pipeline runs fully disconnected. Datasets and checkpoints move only across an audited one-way boundary.
The right technique depends on data volume, the base model's size, and how much behavior must change.
Curated instruction and response pairs teach a ministry's formats, terminology, and procedures — how a central bank phrases a supervisory finding, not just generic prose.
Low-rank adapters specialize a frozen base at a fraction of the memory cost. A single base model can host many task-specific variants without full retraining.
DPO and RLHF align outputs to reviewer judgment — deferring to statute, refusing to speculate on a determination — rather than merely predicting the next token.
For low-resource national languages or dense legal registers, further pretraining on raw in-nation text closes vocabulary and domain gaps before task tuning begins.
Every example that shapes the model is traceable to a source and to a decision to include it.
Each record carries its origin, classification, and consent basis. The training manifest is hashed into the tamper-evident ledger, tying a given model to the exact corpus that produced it.
PII and account identifiers are stripped or tokenized before a sample enters the set. The redaction policy itself is under review and version control.
Datasets are immutable, content-addressed snapshots. A model can be rebuilt bit-for-bit from a recorded manifest for audit or dispute.
Fine-tuning is accepted only when measured against held-out sovereign tasks and safety checks.
Models are scored on tasks drawn from the agency's own work and kept out of training, so gains reflect capability rather than memorization.
Each candidate is checked against prior versions to catch capability loss and unwanted behavior drift before it can be promoted.
Adversarial prompts probe for leakage of training records and for overconfident answers on legally consequential questions.
An approved model is signed with ML-DSA-65 and recorded in the ledger. Deployment runtimes verify the signature before loading weights.
Ownership of a fine-tuned model is enforced by keys and signatures, not by contract language.
Encryption keys for weights live in the institution's HSMs. Sovex cannot decrypt or serve a model without the owner's authorization.
Model artifacts and their lineage are signed with ML-DSA-65 (FIPS 204), so provenance survives the arrival of quantum adversaries.
An owner can revoke a model's signing certificate to halt inference across every runtime that honors the chain — a hard kill switch over deployed variants.