ViKernel embeds kill switch and policy circuits directly into AI model weights

A security layer built into the parameters

According to dev.to, VIDRAFT has released ViKernel, a system it describes as a Weight-Native OS: a security layer whose control logic is encoded into the weights of a language model rather than running as an external wrapper, prompt filter or inference-time proxy. The approach has been demonstrated on VIDRAFT's own roughly 27 billion parameter model and, according to the company, has also been applied to external model families including Google's Gemma and Alibaba's Qwen — suggesting existing models can be adapted, though the exact process has not been publicly detailed.

The architecture borrows from hardware design. VIDRAFT describes weight-level analogues of CPU, NPU and memory circuits: discrete functional units baked into the parameter space. Policy enforcement, boot-time integrity checking, audit logging, PII masking and the kill switch all live in this embedded control plane. The story was originally reported by AI타임스 on 3 November 2026.

An asymmetric kill switch

The kill switch is intentionally asymmetric. Any party can trigger a halt, but resuming operation requires a valid digital signature from a pre-approved operator. While halted, the model refuses all task execution regardless of the content or persuasiveness of incoming requests — the dev.to write-up likens it to an industrial emergency stop that bypasses the machine's own control logic.

Policy enforcement follows the same pattern. When the model attempts to invoke a tool, a dedicated rule circuit separate from the language model's reasoning decides whether that call is permitted. Because the decision path does not route through the LLM's token generation, a cleverly crafted prompt cannot talk the policy layer into approving a blocked action.

VIDRAFT reports that 100% of dangerous tool calls were blocked in internal testing, and that there were zero cases where linguistic persuasion changed a policy decision. Worth noting: all performance figures come from the company's own disclosures.

Arithmetic inside the weights

To support in-weight computation, VIDRAFT implemented a vector arithmetic unit inside the weight space. After adding this unit, the company reports the internal policy-decision stage became roughly 21 times faster under identical test conditions. As dev.to is careful to clarify, that figure covers only the security policy-decision stage, not end-to-end inference throughput for the language model.

As a proof of weight-native computation, the system multiplied two 300-digit integers to produce a correct 600-digit result using only the in-weight circuit, with no external compute path involved.

Governance context and the demo's limits

VIDRAFT participates in South Korea's Ministry of Science and ICT cybersecurity-focused AI foundation model program, and handles safety evaluation for the national security AI project K-MISOS within a NAVER Cloud-led consortium.

A public demo is available on Hugging Face, presented as a Windows-style desktop environment where visitors can observe kill switch activation, restart with the signature requirement illustrated, policy verdicts on tool calls, PII masking behavior and audit log output. There is a significant caveat: the demo replays pre-recorded responses generated by the real system; it is not a live sandbox where you can probe the in-weight circuit directly. Independent verification of real-time circuit execution would require deeper integration than the demo environment provides. No public GitHub repository, installable package or API endpoint has been announced.

Why it matters

Most production AI safety today runs outside the model — system prompts, classifier heads and API-layer filters that can, in principle, be bypassed, misconfigured, or in agentic and self-improving systems potentially modified by the AI itself. ViKernel's central bet is that enforcement embedded in the weights, in a circuit the model's own forward pass cannot reach, produces a tamper-resistant control surface even against a model capable of rewriting external code. The asymmetric kill switch — anyone can stop, only authorized keys can restart — is also a plausible governance primitive for high-stakes deployments.

The open question is verification. The reported results are striking, but the public demo is pre-recorded and the numbers are self-reported rather than independently audited. Until third parties can run the in-weight circuit live, ViKernel is best read as a serious, well-contextualized proposal for model control — and a clear signal of where AI security engineering is heading.