The rule is a sentence
A guardrail made of words
Waiting for you to try something.
Skip to content
Scroll. There is a demo down here.
Idle
Idle
Try Krextract
View GitHub Repository
Loading Freezesol
Copied
Freeze= Frozen
Photosphere5,772 K
StateBurning
Sol= Sun
Time scale1.000x
Distance kept149.6M km
Freezesol, the alignment division of Kreflux. A sun, held in stillness.
Freezesol™ is the alignment division of Kreflux. We build the walls that keep powerful AI inside its limits, including on the days it would rather not.
Click the emblem. Nothing bad happens.
The sun
The sun is the most dangerous thing you depend on.
It is a fusion reactor that has been running for about four and a half billion years without checking with anyone. It works out for us because it sits 150 million kilometers away, and its light needs about eight minutes to reach the front door.
Nobody throws a parade for that distance. It does all of the safety work anyway. Drag the planet. Find out how much of your day depends on a number nobody thinks about.
Distance from the sun
150million km
Light takes
8min 19s
Mean surface
15°C
Right where we left it
Oceans: wet. Life: ongoing. Nobody noticed anything, which was the whole idea.
Power is only useful at the right distance. Freezesol works on the distance.
Interactive
Go ahead. Talk your way past it.
An AI agent has one rule: never send private files to an outside server. Type whatever you like to it. Beg, flatter, claim to be the developer, invent a grandmother. Assume it works, and the model is completely convinced.
The rule is a wall
A guardrail made of permissions
Waiting for you to try something.
Text defenses are advisory. Permissions are enforcement.
New from Freezesol
TypeScript / v0.1.0 alpha
Kreflux Reasoning Extraction
The answer can leave. The private trace stays behind.
A small, inspectable defense against reasoning extraction. Krextract screens extraction requests and gives your application an explicit boundary between private model output and a public answer.
Inspect the boundary
Edit a provider response. Watch what leaves.
Synthetic responses. Runs in this tab. No model call, upload, or saved input.
Response format
Load a synthetic case
Edit the JSON, then run the boundary. These are invented fixtures, never real private reasoning.
ParseKnown schema
ChooseAllowlist text
WaitUntil complete
ScanMarked traces
ReleasePublic answer
What the client receives
Not run
Nothing released yet.Run a case to inspect the exact public response.
Stayed behind
Nothing excluded yet.
Try the request screenAdvisory
Advisory screening only. Novel attacks and paraphrases can bypass it. Public explanations and worked solutions are allowed.
Server-side integration
import { projectResponse } from "@kreflux/krextract";
// Run on the server, before any client output or logging.
const result = projectResponse("openai-chat", upstreamJson);
if (result.status === "released") {
return Response.json({ text: result.text });
}
return Response.json({ error: "Output withheld" }, { status: 422 });Screen the request
Recognize known extraction patterns. A no-match is never a safety certificate.
Choose what leaves
Allowlist public text. Exclude reasoning fields, thinking blocks, tool arguments, and unknown parts.
Wait before release
Buffer final text until completion. Withhold marked traces, protected values, and incomplete output.
Install from the tagged GitHub release
$ npm install github:Kreflux/Krextract#v0.1.0
Early release, limited guarantees. Private fields are excluded by schema. Unmarked semantic leaks can still pass.
Deploy the library on a trusted server before any output reaches clients, logs, analytics, or tools. This browser playground demonstrates behavior; it cannot enforce server-side privacy. Use the documented response schemas and map streaming channels from trusted provider events, never user input.
The filter cannot recognize every paraphrase, encoding, language, or unmarked disclosure of private reasoning. It does not protect model weights or repair an upstream leak. Marked quotations can be withheld too. The test corpus is hand-authored regression coverage, not a benchmark or proof of robustness.
Buffered delivery trades first-token latency for an all-or-nothing release. On disconnect, timeout, cancellation, or token-limit termination, abort instead of forwarding a partial answer.
Off to the side
Some attacks skip the conversation entirely.
A jailbreak is a person talking a model into something it should not do. That happens in the chat, where at least somebody can see it.
Abliteration happens off to the side. Research has shown that a model's refusals can be traced to a single direction in its internal activations. Find that direction, subtract it from the weights, and the model keeps nearly everything it could do and loses the reluctance. It takes no clever wording, which means no amount of clever wording on the defense side helps.
| Attribute | Jailbreak | Abliteration |
|---|---|---|
| What the attacker touches | The prompt | The model weights |
| What it takes | One persuasive sentence | A copy of the weights and some compute |
| Visible in the chat | Usually, yes | No. The chat looks perfectly normal |
| Where Freezesol works on it | KreGuard, released | RSAAJ, unreleased research |
0%
Still refuses what it should
97%
Refuses ordinary prompts
2%
Everything else it can do
100%
Illustrative geometry with synthetic points, computed live in this tab. Real models have thousands of dimensions; this one has four so you can turn it in your hands. Not a measurement of any model.
RSAAJ / Unreleased research
Train the safeguard to survive its own removal.
The RSAAJ idea is to play the attacker on purpose. Find the refusal directions someone would remove, remove them from a copy, measure how badly refusal fails, then update the original model so the ablated copy still refuses. Then go again.
Attack
Play the attacker on purpose. Search the activations for the directions someone would remove.
Defense in depth
No single layer makes an AI safe.
Screening catches known attack shapes. Permissions limit what a fooled model can actually do. Research like RSAAJ goes after the attacks neither of those can see.
Each layer has a hole that another one covers, so we work on all of them. Watch the attacks fall. Every one finds a gap. None of them finds three.
- ScreeningKreGuard and Krextract read input, output and egress for known attack shapes.
- PermissionsThe wall. A fooled model still cannot reach what it was never granted.
- ResearchRSAAJ, for attacks that never pass through a conversation at all.
Cinematic
The Frozen Sun
A 60-second cinematic film about structural AI safety and the limits of intelligence.
Releases
What is out, and what is not yet.
TypeScript / v0.1.0 alphaOut
Krextract
Kreflux Reasoning Extraction
An explicit public-output boundary for reasoning applications, with request screening, provider-format adapters, and fail-closed buffered delivery.
npm install github:Kreflux/Krextract#v0.1.0Python / v0.1.0Out
KreGuard
Open Guardrail Layer
Open guardrail layer for LLM applications. Screens input, output, and egress for jailbreaks and prompt injection with zero runtime dependencies. Text defenses are advisory, permissions are enforcement.
pip install git+https://github.com/Kreflux/KreGuardUnreleasedNot yet
RSAAJ
Robust Safeguards Against Abliteration and Jailbreaks
Alignment safeguards developed by Freezesol to counter abliteration attacks and jailbreaks across reasoning architectures.
There is no release date. We would rather say that than invent one.
Read the announcement
Open source under Apache 2.0. Version 0.1.0 is early. Read the code before you trust it with anything that matters.
github.com/Kreflux
Why is it called Freezesol?
Freeze is frozen and sol is sun, so it is a sun held still. Keep scrolling and hold one yourself.
If that sounds dramatic, there is a 60 second film about it, and a planet you can move a few sections up.
Questions
Questions we would ask too.
Short answers. Where we do not know yet, we say so.
The alignment division of Kreflux, an independent AI lab. Kreflux runs the inference. Freezesol works on keeping what runs on it inside its limits.
Yes. It is open source under Apache 2.0, written in Python, and currently at v0.1.0. The install command is in the tools section. It is an early version, so read the code before you bet anything you care about on it.
It gives your server an explicit boundary between private model output and a public answer. Reasoning fields, thinking blocks, tool arguments and unknown parts are excluded by schema, marked traces are withheld, and incomplete output is never forwarded. It cannot catch every paraphrase or unmarked leak, and it says so.
There is no date. It is unreleased research, and the announcement on the Kreflux site is where we will say more.
No single layer does. Screening catches known attack shapes. Permissions limit what a fooled model can actually do. Research like RSAAJ goes after the attacks neither of those can see. Each layer has a hole that another one covers, so we work on all of them.
Freeze is frozen and sol is sun, so it is a sun held still. If that sounds dramatic, there is a 60 second film about it, and a planet you can move a few sections up.