Mission Data, Open Models, and the Inference Privacy Layer for Shared Government AI

Protopia AI Stained Glass Transform (SGT) is now available for NVIDIA Nemotron 3 Super and Nemotron 3 Nano Omni, two open-weight models built for long-running work. SGT eliminates plaintext exposure from the inference path. A command can run controlled unclassified information and classified mission data on shared government AI infrastructure instead of standing up another sole-tenant enclave to protect it. The model is not modified and the serving stack is not redesigned. Accuracy is retained to within 99 percent of the base model, with under 1 percent latency overhead.

---

The Problem Every Program Office Recognizes

The Department of War has made serious investments in AI compute. Service cloud environments, coalition and mission partner enclaves, installation-level capability, and commercial shared cloud under government service models are all in place or in build.

But when real mission data shows up, the capacity gets carved into pieces.

Intelligence is processed in one enclave. Mission planning goes to another. Personnel and medical readiness data goes to a third. Each carve-out is a defensible decision by an accountable officer protecting data they own. Each one also strands compute, duplicates accreditation work, and pushes the schedule right.

This is the isolation tax. It is not a policy failure. It is the rational response to a technical fact.

Why the Data Is Exposed in the First Place

When sensitive data is submitted to an AI model, it resolves to readable plaintext inside the inference environment. That is not a flaw in any particular product. It is how inference works: the model has to read the content to reason over it.

The exposure is not confined to the processor. Inference servers log request payloads. Serving frameworks cache prompts and spill them to disk. Observability pipelines capture inputs. Schedulers record metadata. Crash dumps write memory to storage. Traffic crosses fabric between racks. Every one of those is a standard, intended part of how a serving stack operates, and every one is a place where mission data sits in readable form on infrastructure the data owner does not operate.

This exposure happens beyond the reach of perimeter controls.  Encryption at rest and in transit cannot address this because the data must be plaintext, and therefore readable,  at the point of processing. Confidential computing is useful for protecting the model weights and GPU memory, but, but its boundary is scoped to a hardware execution environment, at present one rack at the outside. The surfaces above sit outside that boundary regardless of how the hardware is configured.

NVIDIA acknowledges the structural version of this in its own Secure Agent Workspace reference design, which states that inference is a hard dependency for these workloads and is architecturally separate from the governance wrapped around them.

So the mission owner does the only thing available: keep the data off shared infrastructure. The capacity sits idle, and the missions that would benefit most from AI are the last ones to get it.

Where This Shows Up in the Mission

• • All-source intelligence. Analysts want a model over classified reporting, entity resolution across holdings, and summarization at volume. The holdings stay pinned to a dedicated enclave, so the model available to the analyst is not the model the enterprise actually bought.

• • Mission planning and command and control. Course of action generation is the high-value, compute-heavy work that shared capacity was justified on. Operational plans and force disposition data are exactly the content that cannot sit in a log file on infrastructure the command does not operate.

• • Sustainment and readiness. Maintenance narratives, supply status, and unit readiness reporting are unclassified in isolation and revealing in aggregate. Most commands treat the aggregate as controlling and hold the data back.

• • Software sustainment. Software engineering groups modernizing weapons system code want to leverage AI for code review and validation.  To protect the source-code crown jewels, the model runs in a walled garden, tying up GPU capacity that it uses a small fraction of in practice..

• • Acquisition and contracting. Source selection material, pricing, and proposal content carry procurement sensitivity that keeps entire workflows off shared services.

• • Cyber defense. Incident triage and log analysis benefit substantially from model reasoning, and the artifacts being analyzed are among the most sensitive on the network.

• • ISR and multimodal. Full motion video, imagery, and sensor feeds carry the same constraint as text, with the added problem that most protection approaches were never designed for pixels.

Each is a real mission need paired with a real data constraint. The constraint is not going away. The question is whether it has to keep costing capacity.

What Stained Glass Transform Does

SGT converts sensitive inputs into protected representations before they leave the mission owner’s control. Technically these are stochastic representations, meaning the model reads them natively and no key or decoder exists anywhere downstream to turn them back into the original content.

The transformation runs on equipment the government owns and operates, inside the mission owner’s own accreditation boundary, before anything crosses to shared infrastructure. That placement is the whole point. What reaches the model is only the protected representation, so every downstream component, every log, cache, trace, metadata record, and fabric hop, only ever handles the transformed form.

Two things follow, and both matter to an accrediting official.

This is an architectural property, not a runtime policy. The protection does not depend on every downstream component behaving correctly. A misconfigured log, a compromised monitoring agent, a container escape, or a zero day in the serving stack yields protected representations and nothing else. The readable data was never present to take. That is a stronger audit posture than controls that depend on attestation, credentials, or administrator discipline holding up under pressure.

It is verifiable by the government. A security team can intercept traffic with and without SGT and compare what reaches the model. Without SGT, mission data is visible in the clear. With SGT, only protected representations are present, and nearest-token analysis confirms the original content is not recoverable. That evaluation does not require trusting a vendor attestation or an infrastructure operator’s assurance.

To be precise about what SGT is not: it is not encryption, and it replaces nothing in the current stack. It sits upstream of gateways, guardrails, identity controls, and network segmentation, and it reduces the consequence of any one of them failing. It complements confidential computing rather than competing with it. Confidential computing protects the execution environment inside a hardware-rooted boundary. SGT protects the application-layer surfaces outside that boundary and the parts of a cluster that extend past it. Programs running both get the strongest combined posture.

Why NVIDIA Nemotron Matters Here

NVIDIA Nemotron 3 is an open-weight model family released under a license that permits government customization and on-premises deployment. Open weights matter to the Department for three reasons: the model can run inside a government-controlled environment, it can be tuned on mission data, and the government is not dependent on a single vendor’s hosted endpoint for a mission-critical capability.

Protopia AI built SGT for Nemotron 3 Super and Nemotron 3 Nano Omni in collaboration with NVIDIA. The model itself is not retrained and its weights are unchanged. The SGT is trained so that Nemotron reads the protected representation natively.

Two points bear directly on Department programs:

Fine-tuned models stay protected. A command that tunes NVIDIA Nemotron on its own mission data can tune the SGT alongside it. The customized model still runs on shared infrastructure with the same property.

Multimodal is covered. Nemotron 3 Nano Omni handles vision and text in a single model, so the same protection applies to imagery and video. That is the piece most ISR-adjacent programs have not been able to solve.

What This Changes, and What It Does Not

What does change. Much of the policy governing what data can run on what infrastructure rests on a technical assumption: that data submitted for processing is present in readable form on that infrastructure, and therefore that the infrastructure must be accredited to the sensitivity of the data. SGT removes that assumption for the inference path. The shared infrastructure processes protected representations and never holds the readable content.

What does not change today. SGT is not accredited as a cross domain solution. It does not move data between security domains, it does not change the classification of anything, and it does not alter the authorization boundary a program operates under. Every deployment sits inside existing accreditation rather than around it. SGT does not modify the model and does not redesign the serving stack. It is a pre-processing step at ingress, which keeps the integration surface small, but the responsible authorizing official always makes the accreditation call.

That is a different technical premise than the one much of the current policy was written against. Whether it justifies revisiting how shared capacity is accredited, at what impact level a given workload can be placed, and what the cross domain community treats as a controlled transfer, is a government determination. Those questions belong to the accrediting officials, the Service CIOs, and the cross domain policy community, not to a vendor.

Protopia AI’s position is that the questions are worth asking, that the underlying property is testable, and that the government should test it directly before deciding what it changes. We will support that evaluation on government terms and with government-run measurement.

What Changes for the Program

Placement stops being driven by data sensitivity. The same workflow can run on installation compute, in a government-operated shared cloud, in a sovereign region, or in a hybrid split. The decision becomes cost, capacity, and latency to the edge rather than what each environment is cleared to touch.

The isolation tax comes down. Workloads that required their own carve-out can share capacity with everything else, moving utilization back toward what the investment was planned around. Where the government consumes capacity it does not operate, it stops paying the dedicated-tenancy premium for isolation.

Speed to capability improves. A new mission use case does not require a new enclave, a new hardware buy, and a fresh accreditation timeline before an analyst sees value.

Evidence

• A U.S. Air Force software engineering group has completed user acceptance testing of Stained Glass Transform.
• SGT for NVIDIA Nemotron is documented in NVIDIA NIM and available for early access.
• HPE Services has integrated Protopia AI SafeCLAW into the NVIDIA OpenShell agentic runtime, turning the architecture into a delivered service model.
• Protopia AI holds a position on the Missile Defense Agency SHIELD Multiple Award IDIQ, Tranche 2.
• Accuracy is retained to within 99 percent of the base model. Latency overhead is under 1 percent.

How to Buy It

• SBIR Phase III. Prior SBIR work can support sole-source Phase III award without further competition, which is the fastest path for programs with a validated requirement.
• MDA SHIELD MA-IDIQ. Available to eligible programs as a competed vehicle.
• Through an integrator. SGT is delivered inside HPE and other partner service models, which suits programs already buying AI infrastructure as a managed capability.
• Licensing. Priced per user, per model, as a percentage of the underlying model software cost.

Next Step

If your command is holding mission data back from shared AI capacity, the fastest way to test whether that constraint still applies is a traffic interception comparison on your own workload. Your security staff evaluates the result directly. It produces evidence rather than a briefing.