Confidential by design

HoloNear runs on hardware you don't trust — the machines doing the work can read neither the data nor the weights. One axiom, bought twice over: no single node ever holds the whole secret.

Your data, hidden from the host

A node's own operator — with root and physical custody — still cannot read the data or prompts flowing through it. That comes from three things working together:

• Hardware attestation — a node proves it's running a genuine, unmodified HoloNear build on real, secure hardware before the coordinator assigns it any work. Stake-backed identity makes a forged posture costly.
• Hardened in-process execution — the compute engine is native Rust behind a backend trait, with no Python in the threat model.
• End-to-end encryption — tensors are sealed on the wire and at rest; the coordinator only ever relays ciphertext.

The weights, hidden from providers

The model is pipeline-sharded: each node is assigned only a few transformer blocks, never the whole network. The full set of weights never materializes on any single machine — not even the coordinator's, which sits outside the FLOP path and only relays sealed activations between stages.

Why a chain at all

NEAR carries only the trust-critical, low-frequency layer: operator identity and stake, attestation-bound coordinator keys, collective ownership of protocol-trained models, and eventual settlement rules. It removes the need to trust the coordinator for mainnet-critical state — without ever being in the training hot path.