GhostTrace

• 

• 

• 

• 

• 

• 

• 

• 

• 

• 

Inspiration

AI agents are becoming increasingly capable of remembering information, using tools and making decisions autonomously. But there is a problem we wanted to explore: what happens when an agent learns something from untrusted evidence?

Deleting the original evidence does not necessarily undo the memories derived from it. Those memories may remain connected to future decisions.

We wanted to build a system that could answer a question beyond simply detecting malicious input:

Can we trace a bad memory back to its source, understand what it influenced, and safely invalidate its downstream effects?

That idea became GhostTrace.

What it does

GhostTrace is an AI memory forensics and governance system. It creates an explicit provenance graph connecting incoming evidence, derived memories and downstream decisions.

Its investigation workflow allows users to:

• Ingest suspicious evidence and screen it using NVIDIA Nemotron.
• Inspect model-assessed risk scores and suspicious markers.
• Trace how evidence produces candidate memories.
• Quarantine untrusted evidence and prevent quarantined memories from entering protected decision contexts.
• Run interventional replay to compare baseline and counterfactual decisions.
• Preview the downstream impact of revocation.
• Invalidate affected memories and inspect the audit trail.

GhostTrace combines model-based screening with deterministic security enforcement. The model evaluates evidence; application-side policies enforce quarantine and isolation.

How we built it

We built GhostTrace using Next.js, React, TypeScript and React Flow for the interactive forensic investigation interface, with Python and FastAPI powering the backend.

The AI inference layer uses NVIDIA Nemotron 3 Super 120B A12B through Nebius Token Factory.

The backend handles evidence ingestion, structured model responses, risk evaluation, provenance relationships, counterfactual replay and cascading revocation.

One important architectural decision was to keep security enforcement independent of successful model extraction. Even when a model cannot produce a valid candidate memory, deterministic trust policies can still quarantine suspicious evidence.

We also implemented explicit provenance relationships so that investigators can inspect where a memory originated and which records depend on it.

Challenges we ran into

One of our biggest challenges was handling structured model responses reliably.

During testing, complex adversarial evidence exposed token truncation and malformed JSON issues. We improved the extraction pipeline with a larger token budget, robust JSON parsing, schema validation and explicit extraction-failure reporting.

Another challenge was separating model-based risk assessment from deterministic security enforcement. A model response should not be the only thing protecting an agent's decision context.

We also had to handle an important scientific limitation: an unchanged counterfactual decision does not prove that a contaminated memory had no influence in every possible situation. GhostTrace therefore reports inconclusive replay results honestly rather than presenting every experiment as successful recovery.

Accomplishments we're proud of

• Integrated NVIDIA Nemotron through Nebius Token Factory.
• Built an interactive evidence-to-memory-to-decision provenance graph.
• Implemented deterministic quarantine and protected decision-context filtering.
• Developed interventional replay with baseline, counterfactual and clean-reference comparisons.
• Implemented revocation previews and cascading memory invalidation.
• Built an auditable investigation workflow.
• Deployed the frontend and backend publicly.
• Verified the production workflow with automated Playwright tests and backend test suites.

What we learned

We learned that building reliable AI systems requires more than getting a model to produce a good response.

Structured output validation, provenance, deterministic enforcement, failure handling and honest evaluation are equally important.

We also learned that counterfactual experiments need careful interpretation. A system should communicate what an experiment actually demonstrated, including when the result is inconclusive.

What's next for GhostTrace

We want to extend GhostTrace into a more general memory governance layer for agentic systems.

Future directions include broader adversarial evaluation, richer provenance analysis, stronger multi-agent memory isolation, more comprehensive audit capabilities and integrations with real agent frameworks.

Our goal is to make agent memory not just persistent, but traceable, governable and safer to use.

Built With

• agentic-ai
• ai-safety
• ai-security
• dagre
• fastapi
• generative-ai
• large-language-models
• nebius-token-factory
• next.js
• nvidia-nemotron
• pytest
• python
• react
• react-flow
• rest-api
• sqlite
• typescript