ProbeLogits: Kernel-Level LLM Inference Primitives for AI-Native Operating Systems

An OS kernel that runs LLM inference internally can read logit distributions before any text is generated—and act on them as a governance primitive. This paper presents ProbeLogits, a kernel-level operation that performs a single forward pass and reads specific token logits to classify agent actions as safe or angerous, with zero learned parameters. I evaluate ProbeLogits across three base models (Qwen 2.5-7B, Llama 3 8B, Mistral 7B) on three external human-annotated benchmarks: HarmBench, XSTest, and ToxicChat. On HarmBench non-copyright (n=300), all three models reach 97–99% block rate with the right verbalizer. On ToxicChat (n=1,000), ProbeLogits achieves F1 parity-or-better against Llama Guard 3 in the same hosted environment: the strongest configuration (Qwen 2.5-7B Safe/Dangerous, α=0.0) reaches F1=0.812 with bootstrap 95% CIs disjoint from LG3 (+13.7 pp significant); Llama 3 S/D matches LG3 within CI (+0.4 pp, parity); Mistral Y/N exceeds by +4.4 pp. Latency is ~2.5× faster than LG3 in the same hosted environment because the primitive reads a single logit position instead of generating tokens; in the bare-metal native runtime ProbeLogits drops to 65 ms per classification. A key design contribution is the calibration strength α, which serves as a deployment-time policy knob rather than a learned hyperparameter. Contextual calibration corrects verbalizer prior asymmetry (the same surface-form competition phenomenon documented by Holtzman et al. 2021), with bias magnitude varying by (model, verbalizer) pair—e.g., Llama 3 Y/N −0.54 vs S/D −2.54, a 4.7× shift. Adjusting α lets the OS enforce strict policies for privileged operations or relaxed policies for conversational agents without retraining. ProbeLogits is implemented within Anima OS, a bare-metal x86_64 OS written in ~86,000 lines of Rust. Changes from previous version:Added multi-model validation (Qwen 2.5-7B, Llama 3 8B, Mistral 7B) across HarmBench, XSTest, ToxicChat. Same-environment Llama Guard 3 head-to-head shows F1 parity-or-better with bootstrap CIs. Custom-260 benchmark moved to companion Governed MCP paper. LoC updated to ~86k.