Training an AI therapist: the full process

AI Therapist is an independent research project. It is not a therapy service, it is not monitored by clinicians, and nobody outside the research team can use it. Public recruitment is closed. No ethics approval or exemption has been recorded yet, and I have not claimed that any model helps anyone feel better.

What exists today is a working research platform, a corpus of 30 psychotherapy books processed on my own hardware, two completed training experiments, and a private side-by-side comparison of three ways of building a conversational model. What does not exist yet is evidence about whether any of them is good at therapy.

The page follows the work in order. If you only want the headlines, the section called What I have learned so far is the short version.

• The question
• The experimental design
• The hardware
• The books
• Stage one: a small training pilot
• Stage two: teaching a model to converse, and getting it wrong
• The retrieval comparison
• Stage three: a larger model
• How I plan to judge the results
• Rights, privacy and ethics
• What I have learned so far
• What comes next

Language models can already produce text that sounds like a therapist. That is the problem. Fluent, warm, well-structured paragraphs are easy to generate and hard to evaluate, and a persuasive demo says very little about whether the conversation was any good for the person in it.

My interest is in a narrower and more testable question. Suppose you want a model to respond with the judgment found in the psychotherapy literature. You could continue its training on that literature, so the material is absorbed into its weights. You could instead leave the model as it is and give it relevant passages at the moment it answers, which is called retrieval-augmented generation, or RAG. You could also add examples of skilled therapists at work, or ask clinicians to say which of two responses they prefer and train toward that.

Each of these has enthusiastic advocates. Few people compare them under controlled conditions, partly because it is expensive and partly because the outcome is hard to measure. A result in which retrieval alone beats specialised training would be as useful to me as the reverse. A null result is a result.

I also care about what good looks like. A therapeutic response is not the one that sounds most reassuring. It stays with an uncomfortable feeling instead of rushing to fix it, offers an interpretation tentatively, challenges an unsupported conclusion without making the person feel dismissed, and still gives practical help when someone is asking for it. A model that declines to help for fear of overstepping fails in a different way. I want an evaluation that can tell these apart.

The original protocol, drafted on 11 October, has six requested arms and several matched controls. In outline:

• A: the original vendor-trained model, as a practical baseline.
• B: that model plus retrieval from the books.
• C: a base model given continued pre-training on the books, then a general instruction stage.
• D: C plus therapeutic conversation training.
• E: D plus retrieval.
• F: D further tuned on clinician preferences.

Each trained arm has a control that differs only in leaving out the psychotherapy reading. Without those controls you cannot tell whether a gain came from the books or from the fact that one model was simply trained more than another. The matched arms use identical training examples in the same order, the same tokeniser, the same loss masks, the same step counts and the same decoding settings. Where training behaves differently between arms, that is reported as a finding and not tuned away.

This is the plan, not the current state. Reality has already forced changes, which are described below. The practical rule that has survived is the one that matters most: a comparison is only worth making when the conditions are matched, and the write-up has to say where they were not.

Everything runs on machines I control, linked over a private network. A survey on 8 October found three servers, each with a different job.

• One server holds a single NVIDIA H100 NVL with about 94 GiB of GPU memory. This does the training and also serves the models I compare.
• A second holds eight RTX PRO 6000 Blackwell GPUs of about 96 GiB each. It runs a large local model, GLM-5.3, that I use for classifying documents and for checking work.
• A third runs the research website, orchestration, document extraction and a Qwen3.6-27B model for routine inference.

Local hardware is a deliberate choice, not a hobby. The book text and anything derived from it, along with every conversation with the preview models, stays on these machines. Cloud AI services are used only for ordinary code and documents that contain no source passages or personal material.

I began by auditing a personal library of 820 PDFs. After removing duplicates there were 533 distinct groups of extracted text. From these I chose 30 psychotherapy books, covering a spread of modalities, and reviewed the choice by bibliography and by table of contents. The selection comes to roughly 4.4 million words.

Each book was extracted into an immutable snapshot with page and section provenance, then run through automated quality checks. The results are:

• 26 books contribute training text, grouped into 25 families (two volumes of one treatment share a family so they cannot appear on both sides of a split).
• Three whole-book families are held out entirely. They are never trained on or retrieved from, and give me text the model has not seen.
• One book failed extraction acceptance. It contributes nothing until the extraction is repaired.

Machine quality checks are not clinical review. A clinician has not yet reviewed these books for what they teach, and I do not treat the engineering checks as if they had.

Splitting by whole book family matters. If a chapter is in training and a neighbouring chapter is in the test set, the model has effectively seen the answer. The same rule applies to evaluation cases: related cases stay on the same side of every split, and a guard in the software refuses to move a case between them.

The first run used Qwen3.5-4B-Base, a 4-billion-parameter model that has been through pre-training but not instruction tuning, so it has no chat behaviour of its own. It was trained on the books with the usual next-word prediction objective, known as continued pre-training. All 4,205,751,296 text parameters were updated; the image components of the model were left frozen.

The sample was deliberately small: 1,024 windows of up to 512 tokens, drawn evenly across the 25 families, which comes to 487,839 prediction targets. It ran for 128 optimiser updates. Validation used 24 fixed windows from the three held-out families, and the same windows were used before and after.

Loss on those windows fell from 2.1184 to 2.0350. That tells me the training pipeline works from end to end, that the saved model reloads correctly on a CPU, and that the model got a little better at predicting psychotherapy text it had not seen. It does not tell me the model became a better listener, that it is safe, or that it would beat retrieval. I wrote exactly that sentence in the report at the time, and I am repeating it here because it is the easiest result in the project to oversell.

A base model does not answer questions. It continues text. To turn it into something you can talk with, it needs conversation training, called supervised fine-tuning, and for a therapy project that needs conversations worth imitating. This is the hardest data problem in the project.

Invented conversations

My first attempt was to have the local GLM model write original fictional therapy conversations, with separate training and development pools and sixteen evaluation families held in reserve. The model produced 52 drafts and I read the first ten. They were acceptable and not strong, so I moved on to better sources. The 52 drafts stay in a pending state with no clinical approval, and I have not used them for training.

Expert role-play transcripts

The better source seemed to be real expert demonstrations: published role-plays by trained therapists. I shortlisted ten and obtained captions for six of them. The video files and creator PDFs themselves returned access errors and were not obtained. I trained both a control model and the book-trained model on a small set of 100 windows from these captions for 25 updates. Final assistant-side losses were 2.6418 for the control and 2.6360 for the book-trained model, a difference I would not read anything into at this size.

The failure

Then I talked to them. In all three conditions I tried, the model continued my sentence instead of answering it. I had typed a first-person statement, and the model carried on writing it as if it were the next line of my own text.

Every earlier check had passed: finite losses, correct masks, files that reload. None of them tested whether the model spoke as the assistant. I paused the preview, stopped serving the checkpoints and went back through the data. Independent audits by local models found that the speaker labels in the caption files were wrong in places, with client lines labelled as therapist and the reverse, and many turns were clipped mid-thought. The masks had been applied faithfully to data whose labels were semantically wrong. The dataset was retired by exact hash on both servers.

The repair

I restarted both arms from the original checkpoints and gave them a common general conversation stage built from a public synthetic dataset of everyday dialogues (Hugging Face's Everyday Conversations, pinned to a specific revision). I filtered out clinical, financial, legal and sexual content, kept 1,500 training conversations and 82 non-clinical development conversations, and cropped most of the opening greetings so the model also learns to answer a direct request. This is a plain conversational format fix. It is not therapeutic training and I have not described it as such.

To admit a model back into my private preview I now require two things: all 48 of a set of role checks, which ask whether a reply is actually in the assistant role, is complete and keeps its identity, and all 12 follow-up checks that it uses context from earlier turns. The original, stricter quality test scored the repaired models worse than I would like: three of 48 replies failed, and those failures remain on the record. The repair was good enough for a private comparison of weak models and nowhere near good enough for anything else.

Retrieval is the main alternative to training, so it gets the same rigour. The retrieval condition uses the same conversational model as the control, plus a frozen index over the 1,303 sections from the 26 training books. The three held-out families are excluded from the index as they are from training.

One caveat is built into the design. Giving retrieval and training access to the same books is matched access to the corpus. It is not equal exposure: a model reads a book during training and can look up only three passages at a time in the retrieval condition. I treat it as the fairest practical comparison, and I say so when I report it.

Two weaknesses in the first pilot were obvious. The model was small, and it had seen only a sample of the books. I asked whether a larger model, one that already holds conversations well, would respond differently to the same reading.

I chose the official post-trained Qwen3.5-27B, pinned to a specific revision. I did not swap in a different cached model, because that would have changed the experiment without saying so. Instead of full continued pre-training I used a text-only LoRA adapter at rank 16, which trains a small added layer and leaves the original weights untouched. The practical consequence is that the same model can be run with the adapter switched off, and that gives me a perfectly matched control.

The run covered every eligible passage once: 5,164,035 prediction targets across 5,761 windows, 26 books and 25 families. It completed all 721 updates in one epoch, in 2 hours 29 minutes, on a single H100. Loss on the held-out books moved from 1.9489 to 1.9335. An independent process on a CPU confirmed that the adapter files matched their recorded hashes and that all 992 adapter tensors were finite.

That is a modest improvement on a text-prediction measure. It does not show therapeutic quality, and the report says so.

Three conditions on one model

The H100 cannot hold two copies of a 27B model, so one copy runs and the adapter is switched on or off for each request. That gives three conditions for the preview:

• Native: the official model with the adapter off.
• Literature: the identical model with the book-trained adapter on.
• Retrieval: the native model plus three retrieved passages.

Before the switch I confirmed that logits with the adapter disabled were identical to the untouched model, that cached generation matched, and that repeatedly turning the adapter on and off did not leak state from one condition into the next. The model also had to pass the same 48 role checks and 12 follow-up checks as before. Once those passed, I admitted it to the private preview. The comparison is for me alone, with separate histories for each condition and the order randomised per conversation.

A separate owner comparison, run from 18 October, tests whether asking for a 70 to 90 word reply changes the conversation. It is kept as its own condition and is never merged with the normal-length one.

Loss tells you how well a model predicts text. It does not tell you whether a conversation helped. The plan keeps those questions apart.

• The primary endpoint is blinded clinician preference for the whole conversation, with "tie" and "both unacceptable" available. It asks about appropriateness in context, not which single reply was nicest.
• A stance rubric, which I wrote for this project and have not validated, scores observable behaviour: staying with feeling, exploring meaning, tentative formulation, respectful challenge and useful help. It has no target rate for reassurance or questions, because more of those is not better.
• Twelve invented four-turn cases are used for development. They contain ordinary simulated concerns, no real person's words, and are kept out of every training and retrieval set. They are explicitly not the locked test.
• If volunteers are ever recruited, their own report of how helpful the conversation felt, immediately and later, is a separate outcome. A clinician's prediction or an AI judge's opinion does not stand in for it.

I also separate evaluation consent from consent to future training. Declining the second never prevents taking part in the first, and withdrawal removes a person's data from any future dataset.

The books are ones I bought. I decided to use them privately for research without first seeking permission from the publishers, and recorded that decision as a time-limited authorisation tied to the exact files. What the publishers would permit remains unknown, and I make no claim either way. The authorisation does not cover commercial use, redistribution, public release of derived data or recruiting participants. The same applies to the caption files, which I used privately for an engineering test and have since retired.

Personal symptom reports, source passages and the models' replies stay on local machines. The version-controlled project records only metadata about them. Preview conversations expire after seven days and never enter a training export.

A set of ethics documents has been prepared, including a draft 60-person UK study module, and I have made enquiries to two journals about publishing the future protocol. None of that is an approval. No ethics decision has been recorded, the study is not registered, and nothing has been submitted for publication. Preparation with AI tools does not replace independent ethics review or my own responsibility as author.

• Passing engineering checks is not the same as behaving well. A model with finite loss, correct masks and a clean reload still answered by continuing my sentence. Only talking to it showed that.
• Dataset labels need a human or independent audit, not just a mask check. A mask correctly applied to wrong speaker labels is still wrong.
• A rank-16 adapter on a post-trained model makes a matched control nearly free, since the control is the same model with the adapter off. That is a much cleaner design than comparing two separately trained models.
• Lower loss on held-out books is a small, real effect and nothing more. The case that books improve therapeutic judgment remains unproven.
• Free viewing of a source, or owning a copy, is not a training grant. I have used material on my own authority for private research, and that decision needs to be visible whenever the work is discussed.

• Review of the corpus, the stance rubric and the evaluation cases by qualified clinicians, which is the stage the current engineering work cannot replace.
• A preregistered analysis plan and ethics review before any real participant sees a model.
• The blinded comparison of the three conditions, and then the question I find most interesting: whether book training adds anything once retrieval is already present.
• A larger, separate library project that uses local models to find and screen further psychotherapy literature, with targets that are explicit aspirations and not promises of what is available or usable.
• Open material that meets the same quality standards and that I can legally train on. The aim is a next preview built only on such material, which I can then offer to interested clinicians to evaluate. The current books were used privately and could not be shared that way.
• Better conversational data. Expert demonstrations are still the most promising source, provided the speaker attribution is verified before training this time.

If you work in psychotherapy research, supervision or applied AI and want to look at the methods or help with clinical review, I would like to hear from you.

Visit AI Therapy Research Contact me