FlexOlmo lets organizations train AI with private data

Ai2 has introduced FlexOlmo, a method for training language models with private data without requiring organizations to hand over their original files. The approach allows hospitals, universities, banks, and public agencies to collaborate on the same model while keeping control of their data.

The idea addresses a specific problem: AI models need large amounts of information, but much of that data cannot be shared publicly because of privacy, intellectual property, or security concerns. With traditional methods, once data enters a training set, removing it or controlling how it is used becomes very difficult.

How FlexOlmo works

Each organization starts with a shared public model and locally trains a specialized module, called an “expert,” using its own data. It then contributes that module to the shared model without sending the original data.

The system combines several of these experts through a mixture-of-experts architecture. A component called a router decides which expert is most useful based on the query and the content domain.

The design also allows experts to be trained independently and at different times. Organizations do not need to coordinate their processes or work from a centralized database.

Those responsible for each dataset can also:

• Turn their contribution on or off whenever they want.
• Decide who can use it and for how long.
• Update the module with new data without retraining the entire model.
• Receive attribution when their data is used during inference, meaning when the model generates a response.

This sets FlexOlmo apart from federated learning between organizations, a technique in which multiple participants train a model in a coordinated way. According to Ai2, FlexOlmo allows organizations to work more independently and asynchronously, with the option to join or leave the system even after training.

What results did it achieve?

In Ai2’s experiments, adding the private modules improved the performance of the original public model. The shared model retained each expert’s specialized capabilities and also benefited from the diversity of the different datasets.

Performance came very close to that of a hypothetical model trained on all the public and private data together. That comparison matters because FlexOlmo aims to approach the benefits of centralizing data without forcing organizations to share it directly.

The proposal is still a line of research, not a guarantee that any dataset can be incorporated without problems. Datasets can have very different distributions, and the experts must learn to coordinate with one another. To address this, each module is trained alongside a frozen copy of the public model, which serves as a shared reference.

Can the private data be recovered?

Sharing a trained module also creates a risk: someone could try to extract information from the original dataset. Ai2 tested an extraction attack on an expert trained on mathematical data for three epochs, in a scenario deliberately chosen to produce some overfitting.

The attack recovered data in 0.7% of cases. For comparison, a model overfit for 100 epochs on a small mathematical subset reached an extraction rate of 60%. The difference suggests that recovering a significant amount of data from a FlexOlmo module may be difficult, although the risk does not disappear.

Organizations that need stricter guarantees could train their experts with differential privacy. This technique adds mathematical protection against identifying or recovering specific examples, and each participant can decide independently whether to use it.

For you, the potential change is easy to understand: an organization could benefit from knowledge held by other institutions without handing over its documents, records, or databases. In healthcare, for example, several hospitals could contribute to a specialized model without pooling their clinical records.

FlexOlmo aims to turn private data into a controllable contribution, not a permanent transfer. The question to watch is whether this model can work at scale and whether its activation, withdrawal, and attribution mechanisms provide enough assurance for sensitive sectors to take part.