How does an LLM run such that the host can't see the content?