ViKernel: VIDRAFT's Weight-Native LLM OS with Built-In Compute Circuits and a Kill Switch

TL;DR: VIDRAFT has open-demoed ViKernel, an "LLM OS" that embeds computation circuits and security controls directly into model weights — not as an external wrapper. It enables verifiable arithmetic inside the model and ships a hardware kill switch that requires a signed operator key to restart. If you care about auditable, controllable AI systems, this architecture is worth watching.

What it is

ViKernel is VIDRAFT's implementation of what they call a Weight-Native OS (운영체제) — a system where the operating-system primitives (CPU-equivalent logic, NPU-equivalent logic, RAM/ROM-equivalent memory circuits) are encoded directly into LLM weights rather than bolted on as external middleware or guardrail layers.

Key distinguishing properties:

• In-weight computation: Arithmetic circuits live inside the model's weights and are executed on GPU/NPU hardware at inference time.
• In-weight security controls: Integrity checking, policy enforcement, audit logging, and a kill switch are implemented as weight-level logic, not as a separate orchestration layer.
• Portability across model families: VIDRAFT reports having transplanted the circuit logic into models beyond their own — including weight-compatible implementations targeting the Gemma (Google) and Qwen (Alibaba) model families.
• Signed restart requirement: Once the kill switch halts execution, the model cannot resume without a cryptographically signed operator key — making accidental or unauthorized resumption structurally difficult.

VIDRAFT is a Seoul AI Hub resident startup founded by CEO Minsik Kim, and also participates in the K-MYTHOS national security-focused AI development consortium led by NAVER Cloud.

How it works

The conceptual architecture maps familiar OS abstractions onto neural network weights:

At inference time, when the LLM receives a task requiring computation (e.g., multi-digit arithmetic), it delegates to the internal circuit rather than attempting to generate the answer autoregressively token-by-token. The circuit executes on the underlying GPU/NPU and returns a verified result that the model incorporates into its response.

For security, ViKernel performs an integrity check at startup. If the model weights have been modified, the system refuses to run. During operation, every policy decision (allow or block a task) is written to an audit log designed to resist tampering. If a kill switch signal is issued, execution halts and cannot be re-initiated without a valid signed operator credential.

VIDRAFT plans to integrate ViKernel's internal control plane with AX-RAY, their external AI risk diagnostics tool, creating a combined pipeline where external vulnerability scanning feeds into in-model behavioral controls.

Benchmarks & results

VIDRAFT has publicly reported one concrete result:

• On their 27-billion-parameter proprietary model, ViKernel's embedded arithmetic circuit correctly multiplied two 300-digit numbers, producing an approximately 600-digit result. The result was verified against an independent calculator.

No benchmark suite scores, latency numbers, or comparative accuracy figures against baseline LLMs are cited in the source coverage at this time. Qualitatively, the claim is that offloading computation to in-weight circuits produces exact results for tasks where autoregressive generation is inherently error-prone (long-form arithmetic being the canonical example).

How to try it

A demo is publicly available on Hugging Face. It lets you interact with:

• The kill switch mechanism
• The policy engine (task allow/deny)
• PII masking
• Audit log output

⚠️ Important caveat: The Hugging Face demo uses pre-recorded responses generated by the actual ViKernel OS and plays them back — it does not run live inference. VIDRAFT acknowledges this explicitly.

No public model weights, GitHub repository, pip package, or OpenAI-compatible API endpoint has been announced as of the source date (2026-11-11). To find the demo, search for VIDRAFT or ViKernel on huggingface.co.

FAQ

Q: Why embed OS logic in weights rather than using an external orchestration layer like a tool-calling framework?
A: External guardrails can be bypassed, stripped, or fail silently if the model is re-deployed without them. By encoding control logic into the weights themselves, ViKernel makes the security posture inseparable from the model artifact. Modifying weights to remove the controls would trigger the integrity check and halt execution.

Q: Can ViKernel circuits be transplanted into any open-weight model?
A: VIDRAFT reports successful transplantation into models from the Gemma and Qwen families in addition to their own model. However, no general tooling or methodology for doing this yourself is publicly available yet — it appears to be a research capability rather than a released SDK.

Q: Is the kill switch a software flag or something deeper?
A: Based on the source, it is implemented at the weight level as part of the in-model OS. Crucially, resuming a halted model requires a signed operator key, implying a cryptographic verification step — not simply a configuration toggle that can be flipped in a prompt or environment variable.

Q: What is the relationship to K-MYTHOS?
A: K-MYTHOS is a South Korean government-backed consortium for security-specialized AI development, led by NAVER Cloud. VIDRAFT's role within it is AI safety diagnostics and evaluation using their AX-RAY technology, with plans to connect AX-RAY's external risk scanning to ViKernel's internal enforcement layer.

Originally reported by IT조선 (2026-11-11) — source article.