A second look
at every robot motion

VIGIL compares what a surgical robot does with what its camera shows and with recorded demonstrations, and flags the moments that need human review.

CERTIFY passes the checks
ABSTAIN evidence does not support it
BLIND the view is missing or unreliable

Watch it work

Watch

Real recordings.
The verdicts VIGIL returned.

Each clip is a 2-second window of an ex-vivo suturing task recorded on a da Vinci Research Kit. VIGIL received the video and the robot's motion for that window and returned the verdict shown. Nothing here is staged: every verdict and score is copied from VIGIL's recorded output.

frame 1 / 20

Robot motion sent with this window Arm 1 Arm 2 Motion recorded with this video

Commanded joint speed per arm (line) and gripper opening (shaded), frame by frame at 10 per second. The white marker follows the video.

Same scene, wrong motion

The camera sees one thing.
The robot reports another.

To test VIGIL, real robot motion from a different moment was sent with a scene it does not belong to. The motion is genuine, never synthetic; only the pairing is wrong. Left: the scene VIGIL was shown. Right: where the motion it was given really came from.

Scene sent

Motion sent came from

VIGIL's verdict

Motion recorded with the scene vs motion sent Arm 1 Arm 2 Recorded with the scene

How it works

See. Compare. Decide.

See

visual_context encodes the 2-second video window with a video foundation model (V-JEPA 2) and measures whether the view is usable.

Compare

action_encoder summarises the robot's motion; congruence scores whether that motion fits the scene; support checks how close the moment is to recorded demonstrations.

Decide

gate turns the evidence into CERTIFY, ABSTAIN or BLIND under a fixed error budget; arbiter answers the caller with closed codes, never free text.

One verdict on the deployed system

Results

Cautious by design.

What VIGIL does not claim

The verdicts describe agreement with demonstrations, not clinical safety. Clinical safety is neither measured nor claimed.
The data are ex-vivo recordings: tissue outside a living body. There are no patients in this data.
VIGIL has no connection to the robot. It tells the integrating system what to do; on ABSTAIN or BLIND that system pauses the robot and alerts the human operator.
A CERTIFY means only "consistent with the data supplied". Fabricated, well-formed sensor data could still obtain one.
The test examples come from one operator held out from training, on one robot platform. That is too narrow for general claims.

Credits

VIGIL is a course project for EN.705.704 Rapid AI Systems, Johns Hopkins University, Fall 2026, by Waverly Rose Brim.