Vendor and product reality
Shadow-mode operates on every Hardware 3 and Hardware 4 Tesla in the deployed fleet. Candidate neural-network builds are pushed alongside the production stack and run inference against the same camera and inertial inputs the production stack consumes. The shadow stack does not actuate the vehicle; its predictions are logged and compared against the driver's actual control inputs and against the production stack's outputs. Disagreements, particularly disagreements where the human driver took a different action than the shadow model predicted, are flagged as candidate training examples, batched, transmitted via the vehicle's cellular and Wi-Fi connectivity, and aggregated centrally for inclusion in subsequent training runs.
The pipeline is supported by the large-scale GPU training infrastructure Tesla has publicly described operating. Data engine work on labeling, scenario clustering, and curriculum construction sits between the raw fleet-observed disagreements and the gradient updates that change model weights. The system is mature for what it does. The question is what it does not externalize.
The architectural gap
The comparison here is architectural and applies to fleet-aggregation training pipelines as a category, not to any private detail of Tesla's implementation. In a fleet-aggregation pipeline as ordinarily built, per-example provenance, which vehicle contributed which observation, under what data-rights regime and consent state, in what jurisdiction, may be recorded in operational logs, but the log is a record kept alongside the training run rather than a property of the gradient operation itself. When a fleet-observed disagreement becomes a training example, becomes a batched gradient, becomes a weight update, the binding between the contribution and the specific parameters it moved is not, by default, preserved as a structural, per-layer property of the training operation. It can be reconstructed from engineering knowledge of the pipeline, but that is a different thing from a routing decision that is enforced at training time and attestable to an auditor afterward.
Depth-selective routing, the property that a given class of contribution affects only a designated subset of model depth, with policy controls over which contributions are admitted into which layers, is similarly absent. Shadow-mode treats the training corpus as a single pool from which gradient updates are derived; there is no architectural mechanism that says, for example, that contributions from vehicles in jurisdictions without explicit training-data consent are admitted into perception-layer parameters but not into planner-layer parameters, or that contributions from a specific operational design domain influence only the policy head responsible for that domain.
UNECE R155 cybersecurity-management-system requirements, the type-approval extensions that cover automated-driving system updates, and the EU AI Act's provisions for high-risk AI systems all push toward demonstrable, auditable training-pipeline governance. The question regulators are converging on is not whether the manufacturer trains responsibly in spirit, but whether the training architecture itself can answer, with evidence, which fleet contributions affected which behaviors under what authority. Reconstructive answers from engineering knowledge will not satisfy that question indefinitely.
What the depth-selective training governance provides
The mechanisms below are disclosed in Chapter 11 of United States Patent Application 19/647,395, described here at a level a skilled implementer could build against.
Each training example carries a depth profile derived from its entropy band and an admissibility determination governing whether it may train at all. A depth-selective aggregation mechanism operates at each layer transition during backpropagation: it applies a per-layer scaling factor to the gradient signal an example contributes before that signal is accumulated into the layer's gradient buffer. A scaling weight of one permits the full gradient to reach the layer, a weight of zero prevents any gradient from that example from reaching the layer, a weight between zero and one attenuates it, and a weight greater than one amplifies it. The optimizer then consumes the modulated gradient buffer as an ordinary gradient buffer, applying its learning rate and update rule unchanged, which is why the mechanism can be introduced into an existing training pipeline without altering the optimizer, the loss function, or the model architecture, and without affecting inference behavior. This is the structural basis for a policy statement such as: a class of contributions may influence perception-layer parameters but not planner-layer parameters, or may reach only the layers closest to the output while leaving lower-layer representations untouched. Fleet aggregation as ordinarily built has no equivalent per-layer admission control; the corpus is a single pool and every admitted example is free to move any parameter.
The routing decisions are recorded in an append-only training-provenance log. For each governed training event the log records the training signal, the depth profile assigned to it, and the gradient-routing decisions that determined which layers the signal reached and at what magnitude; the append-only structure makes the record tamper-resistant and supports cryptographic sealing. This is the lineage that lets a post-training query answer which contributions influenced a given behavior under what governance, without reconstructing that answer from engineering knowledge of the pipeline. The filing further discloses reverse-provenance query and training-level memorization detection: an inference output can be tested against the provenance record to classify its similarity to a known training artifact as shallow, deep, or absent memorization, and the depth-selective routing can implement per-content differential privacy by confinement, where privacy-sensitive content is structurally prevented from reaching the layers where it could be memorized rather than merely masked by noise.
The same governance extends to on-device adaptation, disclosed in the filing as an embodiment in which the base model parameters are held frozen and all updates are applied to a parameter-efficient adaptation layer that is small relative to the base model. That adaptation layer is subject to the same governance constraints as other governed state, including policy validation and lineage recording, so a per-vehicle refinement that adjusts to local road geometry or driver profile carries the same audit lineage as a fleet-aggregated update, and the training data underlying it need not leave the device. Embodiments are not limited to vehicles: the disclosure describes the training governance operating across model layers of any transformer-style network, on cloud training clusters and on resource-constrained edge nodes alike, over pre-training, fine-tuning, and on-device adaptation, with the depth profile, the admissibility gate, the append-only provenance log, and the reverse-provenance and memorization mechanisms available in each.
Composition pathway
The integration is additive. An existing fleet-learning pipeline continues to operate; shadow-mode disagreements continue to flow from vehicles into the central training corpus; the training cluster continues to consume the corpus and produce weight updates. The governance sits above the existing pipeline: each contribution is tagged with its admissibility determination and depth profile at the point it enters the training corpus, and the depth-selective aggregation mechanism enforces the per-layer routing and writes the append-only provenance record at the point of gradient application.
No retraining of the deployed model is required to begin instrumenting new contributions. Historical contributions remain governed by whatever operational logs already exist; new contributions, from the cutover point forward, gain the append-only lineage. The governance posture improves as the instrumented corpus grows, and the manufacturer can present, at a subsequent regulatory inquiry, a records-backed architectural answer for the post-cutover behavior whose provenance the log now carries.
The composition does not require exposing model internals to the licensor or to any external party. The mechanisms operate inside the manufacturer's training infrastructure under its own operational control; the audit surface is what the manufacturer chooses to expose to regulators on its own terms.
The instrumentation cost is bounded. Tagging a contribution with its depth profile and admissibility determination is a metadata operation that does not touch the inference path or the safety-critical actuation path. The training-side enforcement is implemented in the gradient-aggregation step and, as the filing describes, leaves the optimizer, the loss function, and the model architecture unchanged. On-device adaptation runs on the vehicle's existing inference compute against the small parameter-efficient adaptation layer while the base model stays frozen; the routing-policy check applied when a local update would land is a bounded operation, not a workload that competes with the perception and planning loops for cycles or memory bandwidth.
Commercial and licensing posture
The depth-selective training-governance mechanisms are available for licensing to vehicle manufacturers and to autonomous-system developers under terms that preserve the licensee's training-data ownership, model ownership, and regulatory-presentation control. The intended commercial shape is an internal architectural layer that the manufacturer integrates behind its own training and deployment surfaces, not a service that the manufacturer's customers or regulators interact with directly.
The licensing surface is structured to support both an OEM's own training pipeline and the tier-one supplier ecosystem that contributes perception and planning components into OEM stacks. A vehicle program that integrates a third-party perception module ordinarily has no architectural means to attest to the per-example provenance of the training data behind that module; the depth-selective routing and append-only provenance record provide a surface across which a supplier can deliver components whose training-data governance is auditable by the OEM and, transitively, by the regulator. License terms contemplate the multi-year window during which UNECE R155 type-approval extensions and EU AI Act obligations for high-risk systems harden into binding requirements, so that early adopters gain a defensible regulatory posture ahead of mandate. The framing in this section is commercial and forward-looking; it is external market context, not a claim of the filing.
Disclosure scope
The mechanisms attributed to the invention in this article, depth-selective gradient routing through per-example depth profiles, the admissibility gate governing what may train, the append-only training-provenance log with cryptographic sealing, reverse-provenance query, training-level memorization detection, differential privacy by confinement, and governed on-device adaptation against a frozen base model, are disclosed in United States Patent Application 19/647,395. This article is a dated public description of that disclosure and is intended to enable a skilled implementer to build the approach and to enumerate its embodiments across pre-training, fine-tuning, and on-device adaptation, and across cloud and edge substrates.
References to Tesla, shadow mode, Autopilot, Full Self-Driving, UNECE R155, and the EU AI Act describe an external product and regulatory environment for comparison only. Those characterizations are drawn from publicly reported information about that product and those frameworks, are not claims of the filing, and are not assertions about Tesla's internal training architecture or its legal compliance. Tesla is an independent company; nothing here is affiliated with or endorsed by it.
