Local LLM Vault ― the input-purification gate
The original never
crosses the boundary
What crosses is only a Slot that has been purified, typed and policy-bound. The original data itself never crosses, not once. Most guardrails inspect after the output. This one purifies at the entrance.
RoleSlot Transfer Protocol / SlimeGate
What this design actually gives you
A model's origin stops mattering for confidentiality
If it runs inside the vault, if every line out is physically one-way, and if what leaves is only a purified, typed, policy-bound Slot ―― then even a model you do not trust cannot carry anything out. Conversely, a Western-origin cloud model has egress, so its origin alone does not make it safe.
“Which model can we trust?”
A vendor-selection problem. The more you exclude, the more capability you lose ― the classic failure of being so safe you become unusable.
“Any model will do.”
It collapses into a boundary problem. Use the strongest model, whatever its origin. Not a restriction ― a release of capability.
To be honest about it, though: the vault is only half. What it closes is exfiltration, not manipulation of the output. A model with tampered weights can tell you a lie from the inside without sending anything out. Closing that is the job of the other half ――
Both ends: entrance and exit
The sovereignty sandwich ― don't let it out, don't take it on trust
Don't let it out
The original never crosses. What crosses is a typed Slot, or a sealed reference. A transparent tunnel is not among the options.
Don't take it on trust
Never adopt the AI's answer as-is. Judge it bit-exact with a deterministic clamp, and promote only what passes.
Sovereignty Without Ownership →Only with both can you say “origin does not matter”. With one alone, you cannot. AI sovereignty does not begin with model selection ― it begins with input purification.
What happens at the boundary
Four gates ― all YES becomes a Slot, one NO gets sealed
Can it be reduced to a known grammar?
Is there a defined vessel for its meaning?
Can who-may-use-it-for-what be fixed?
Can it be reproduced deterministically later?
→ becomes a Slot and passes
→ the original is sealed; only a reference passes
→ fail-closed
We do not force maximum strength on day one. Purification level is chosen, and adopted in stages. The one floor you cannot opt out of is the binary “a typed Slot, or a sealed reference” ―― anything unknown is sealed and passed by reference, so nothing hard-stops. Nothing is discarded, nothing is blocked, and the strength is yours to set. Being so safe you become unusable is designed out.
Put the guarantee in the wiring, not the policy
Only the logical layer is bidirectional
Four physically one-way lines. No direction shares a line with another. Each direction is purified and reviewed independently. The reverse pair is simply not wired ―― one-way is a property of the line, not a promise made in software.
The four physical one-way lines (RS-422 / optical diode) are a design; the field evaluation is the next stage. The PoC#1 mutual information I(S;R) was measured on in-process loopback; the physical layer is not measured. Model names inside the vault are examples; the configuration is free.
The ACK generator can be moved to its own node. You can build it so that no path physically exists from the validator's verdict to the ACK generator. “A rejection never emits a resend request” stops being a discipline in the code and becomes a consequence of the wiring.
We keep them separate rather than in one multi-pair jacket, because what earns credit in an audit is visual inspection and a continuity test. “This line is one-way; the reverse pair is unwired” can be shown one cable at a time. Bundled, it cannot be checked without opening the jacket.
The ACK node receives the frame bytes to compute the CRC, so it can see the contents. It simply has no path to receive the verdict, so it cannot act on them. We do not claim it is blind.
What passes, and what does not
Transfer classes ― raw bytes that fit no class never pass
“Just dig a tunnel” is not on the menu. Anything that passes belongs to one of these classes.
Already canonical; passed through as-is.
A body that cannot be canonicalised is sealed in an outside vault; only a hash-bearing reference passes. The original stays outside ― the answer to the legal-original problem.
Only the output of an approved extractor (PDF→clauses, image→detections, CSV→typed records). The extractor runs outside and is deterministically reproducible.
Text in a known grammar, decomposed into a typed block tree of sections, headings, body, links, code and tables.
CSV promoted to a table schema, with typing and PII policy applied. Formula injection is rejected or escaped at the boundary.
Every number carries its conditions and its artefacts
Evidence status ― what is done, and what is not
Every number we publish carries three things: corpus_sig (the scale measured), the pass criteria, and the artefact path. If we cannot attach them, we do not publish the number.
If the ARQ control return line is constructed as a function of channel facts only (CRC and sequence number), the reverse signal becomes statistically independent of the transferred content. We measured this as mutual information.
| Correct design | I = 0.0001 ± 0.0003 bit ― indistinguishable from the null floor (i.e. nothing leaks) |
| Wrong design | 88% of the secret is recoverable from the reverse signal alone (I = 0.883 ± 0.010 bit, H(S)=1.0 bit) |
| corpus_sig | 50 seeds × n=5000 (ablation: 30 seeds × n=5000) |
| Criteria | G1 indistinguishable from null / G3 95% CI lower bound of the design gap = 0.884 bit > 0 / G5 the reverse-signal function's signature contains no content and no verdict (static check) ―― G1–G5 all PASS |
| Artefacts | PoC1 report .md sha256:1b3b41cd1a16f112… analysis/mi_results.csv · invariant_assert.txt · runs/{A,B}_seed3000.jsonl |
| Reproduce | python3 poc1.py --n 5000 --seeds 50 |
| Conditions | In-process loopback (physical-layer independent). Not measured on real RS-422 hardware. |
A public demo is live where you can confirm zero transmission in your browser's developer tools (L1), together with a published configuration attestation of non-transmission (L2). Verified over the real delivery path: the outbound-fetch log does not grow. Open the demo →
Physical one-wayness (wiring diagram + reverse-transmission test log), zero-port claim (same Slot → same hash), re-measurement on hardware, effective throughput. None of it is measured, so no numbers are published.
The build that promotes “a rejection never emits a resend request” into a consequence of the wiring. The design is settled; implementation and evidence are not started.
The standard's ceiling and this implementation's measured rate are different things. Until we measure, we publish neither number.
Discipline on external claims
The words we forbid ourselves
A strong phrase collapses under review the moment it reaches wider than the thing it describes. So we write them down ourselves, first.
As long as there is a return line for retransmission control, the system is not perfectly one-way.
That IP does not traverse and that an outsider's intent does not reach execution on the inside are two different statements. What creates safety is the validator, not the line. The line only guarantees that backflow cannot physically occur.
A CRC is error detection, not cryptographic tamper resistance.
What we proved is a protocol-layer proposition; the measurement ran on in-process loopback.
One more: we do not use off-the-shelf IP-to-RS-422 converters (serial device servers) at the boundary. Turning the RS-422 segment into a transport for IP is precisely that product's value, so the moment one is installed, “no IP path exists” becomes false. Using one outside the vault, as a connection point to existing plant equipment, is perfectly sound.
You can try it today
Proof of non-transmission is a four-rung ladder
Confirm in developer tools. Live in the public demo
A published build that holds no external connection. Live in the public demo
Outbound traffic blocked, with packet-level records (production)
This is where the Vault sits
You do not have to start the conversation at RS-422. Feel L1 and L2 in the free demo first, and climb to L3 / L4 when you need to ―― same ladder, different rungs.
So your enterprise can use local AI to the hilt
Stop burning energy on “which model is safe” and settle the boundary instead. Then you get to choose on capability. We welcome enquiries about the architecture and about running a PoC.
Contact us → See the other half ― the clamp →