Personal AI Firewall

Inspiration

AI agents are becoming personal assistants that read our email, browse the web, and open our bank statements. Their usefulness comes from access to sensitive data, and that same access is their biggest weakness. We noticed that almost every project today builds the agent itself, while the security layer sitting in its path is neglected. The few projects that do add protection rely on static rules, which become outdated the moment a new attack appears. We wanted to build the missing layer: a firewall made for personal AI agents, designed with Indian users in mind.

What it does

Personal AI Firewall sits between an AI agent and the outside world and protects the user's data at every step.

• Policy Engine: Users write rules in plain language, such as "Never send my bank balances to any external tool." Nemotron Ultra compiles each rule into a structured policy, validated with Pydantic, checked for conflicts with Z3, and versioned with one-command rollback.
• Data Guardian: A three-layer detector finds sensitive data using checksum-validated recognizers (Aadhaar via Verhoeff, PAN, IFSC, UPI, Luhn), Presidio NER with Hindi and Hinglish support, and a Nemotron Nano context check. It then redacts, tokenizes (with a local Fernet-encrypted vault), or replaces values with realistic fake ones, while tracking lineage.
• Action Gate: Every tool call receives a risk score. Low-risk calls pass, medium-risk calls are logged, high-risk calls require human approval with a clear explanation, and critical calls trigger a kill switch.
• Living Red-Team and Self-Healing Loop: A Nemotron attacker keeps inventing new injection and exfiltration attacks. When one bypasses the firewall, a defender proposes a patch, and the patch is merged only if it passes a regression gate on previous attacks, false-positive rate, and latency.
• Isolation and Audit: Agents run in separate contexts inside an OpenShell sandbox with explicit tool allowlists. All decisions go into an append-only, SHA-256 hash-chained SQLite log that stores no raw sensitive data.

How we built it

• Language and API: Python 3.11, FastAPI, and uvicorn, with an MCP Python SDK integration and an OpenAI-compatible reverse proxy so most agent frameworks can plug in.
• Models: Nemotron Ultra, Super, and Nano served through Nebius Token Factory. Ultra handles policy compilation and defender patches, Super handles attack generation, and Nano handles high-volume classification.
• Detection and policy: Presidio with custom Indian recognizers, regex with checksums, YAML and Pydantic policies, and Z3 conflict checks.
• Storage: SQLite for audit logs, policies, and lineage, with FAISS or sqlite-vec for attack memory.
• Frontend: React, Vite, Tailwind, and Recharts, with live updates over Server-Sent Events.
• Deployment and testing: Docker Compose locally, Nebius Serverless Endpoint for the firewall API, Serverless Jobs for red-team runs, and a pytest-based regression gate in CI. We also use garak for a baseline vulnerability scan.

Team split: Sudiksha built the intelligence, data, and platform layer (Data Guardian, Policy Engine, Red-Team loop, LLM layer, audit log, vault, demo agent, dashboard, and DevOps). Vedant built the enforcement layer (proxy and interception, Action Gate, and sandboxing).

Challenges we ran into

• Ambiguity in sensitive data: A 10-digit number may be an account number in a bank statement but harmless elsewhere. We solved this with a layered design that applies cheap deterministic checks first and uses an LLM only for unclear cases.
• Hindi and Hinglish text: Standard PII tools are weak on mixed-language input, so we wrote custom recognizers and dedicated test cases.
• Safe self-healing: An automatically patched system can easily become over-blocking or slow. The regression gate ensures that every patch keeps old attacks blocked, keeps false positives low, and stays within the latency budget.
• Honest evaluation: A system that learns from its own attacks will score well on them. We therefore keep held-out public benchmarks separate and report both block rates openly.
• Never executing LLM output directly: All model-generated policies pass through strict schema validation first.

Accomplishments that we're proud of

• A self-healing loop that improves the firewall from every successful attack, without sacrificing usability.
• India-specific detection with checksum validation that works on Hindi and Hinglish content.
• Transparent evaluation, with separate reporting for held-out and self-generated attacks.
• A privacy-preserving, tamper-evident audit trail that remains searchable.
• A live before-and-after demo showing a protected agent under attack.

What we learned

• Layering cheap, deterministic checks before expensive model calls improves both cost and explainability.
• Security tooling earns trust only when it explains its decisions, which is why approval prompts and lineage tracking matter.
• Automated defense needs guardrails of its own, such as regression gates and honest benchmarking.
• Matching each Nemotron model to the right task conserves credits and latency.

What's next

• Full formal verification of policies beyond conflict and shadowed-rule detection.
• Support for more Indian languages and more document types.
• Deeper multi-agent collusion defenses.
• Optional integration with NeMo Guardrails and broader agent framework support.
• Packaging the firewall as a simple install for everyday users.

Built with

Python, FastAPI, Nemotron (Ultra, Super, Nano), Nebius Token Factory, MCP, OpenShell, Presidio, Z3, Pydantic, SQLite, FAISS, Fernet, garak, React, Vite, Tailwind, Recharts, Docker

Built With

• base
• custom
• fastapi
• lucide
• next.js
• pydantic
• python
• react
• recharts
• regex
• sha-256
• sqlite
• tailwind
• verhoeff
• yaml