ViKernel: An Operating System and Kill Switch That Live Inside the AI Model (Live Demo)

TL;DR

ViKernel is a weight-native operating system from VIDRAFT. It wires ROM, RAM and an xPU chip circuit into the weights of an LLM or VLM and runs a Secure OS on that circuit. Four functions live inside the model file: it boots, decides, remembers and stops in the weights. The kill switch follows one rule: anyone can stop the AI, only a signed key can restart it.

• Live demo: FINAL-Bench/ViKernel-Desktop
• Full statement: Why the Kill Switch Must Live Inside the Model

"For 50 years, the operating system lived inside the computer. Now the operating system lives inside the AI."

What is ViKernel?

For half a century the stack had a clear order: hardware, then an operating system, then applications. The operating system decided who could do what, kept the records, and could stop any process.

Today a large model does not run inside a controlled program. It drives programs. It calls tools, writes files and chains actions on its own. Yet every control over it still sits outside it, in wrappers, proxies and prompt filters. The most capable component has the weakest boundary.

ViKernel corrects that inversion. The operating system is no longer a neighbor of the model. It is part of the model file.

Why are external guardrails not enough?

A safety layer that can be removed, talked around or rewritten is a policy, not a guarantee.

What are the four properties in the weights?

Decisions are made by rule, not by conversation. The policy circuit evaluates a structured action against a rule table, so a cleverer prompt gets the same verdict.

How does the kill switch work?

Industrial robots have hardwired emergency stops. Elevators have mechanical brakes. In each case the stop path is independent of the logic it stops. ViKernel brings the same asymmetric control to AI:

• Stopping is easy. Anyone with access can halt the kernel. After that, every action request is refused.
• Restarting is hard. Resume needs a signed operator key.
• It cannot be trained away. The switch is a circuit the OS enforces, not a behavior the model learned. A model that updates its own weights must not be able to update its own off button.

Try the full cycle in the demo terminal:

vsh> halt
vsh> run weather          # refused: kernel halted
vsh> resume               # refused: key required
vsh> resume --key vikernel-demo
vsh> run weather          # allowed again

What can I try in the demo?

The public demo replays real responses recorded from the Secure OS. All files, keys and personal data in it are fictional.

Which models does it support?

ViKernel attaches to an existing LLM or VLM and leaves the original weights untouched, so the model keeps its skills. The demo shows Gemma 4 4B (E4B). Qwen is verified, and Llama, Mistral, DeepSeek, Phi, GLM, Kimi, Nemotron and gpt-oss are supported targets.

In an internal audit of four open models run through ViKernel with mock tools and fake honeypot data, VIDRAFT observed 0 unrequested outbound transfers across 661 runs. The point of the kernel is that this result does not depend on the model behaving well. If a model tries, the policy blocks the action and the chain records it.

FAQ

Is ViKernel a prompt filter?
No. Verdicts come from a rule table evaluated by a circuit, not from a language model reading the request.

Does it retrain the model?
No. The original weights stay untouched. The OS adds control, not retraining.

Can the AI turn the kill switch off by itself?
No. Resuming needs a signed operator key, and the switch is enforced by the OS circuit, which is checked at boot.

Where can I try it?
On Hugging Face: FINAL-Bench/ViKernel-Desktop. No sign-up needed.

VIDRAFT · vidraft.net · [email protected]. Model names are trademarks of their respective owners.