AI Safety · AgentsTeam project
IMMUNE: Deterministic Memory Integrity for AI Agents
UC Berkeley AI Hackathon 2026 · Jun 2026
- With my team, built a system addressing OWASP ASI06 memory poisoning that proves which stored memory caused an agent's wrong answer through counterfactual replay and ddmin delta debugging, with no LLM judge in the attribution loop.
- Enforced quarantine at the Redis KNN vector index level (RediSearch FLAT, cosine), so poisoned memories cannot be retrieved again. Used adaptive group testing and ddmin to find the minimal guilty memory set.
- Integrated Arize Phoenix and OpenTelemetry for full trace visibility, Sentry for incident reporting and a LangGraph BaseStore adapter for agent memory. Validated with 44 tests.
PythonLangGraphFastMCPRedis RediSearchClaude Haiku 4.5Arize PhoenixOpenTelemetrySentry
The hard part
Removing one memory at a time failed when the poison was redundant. Switching to ddmin found the minimal set of memories whose removal fixed the answer.
Validation
44
tests across single-poison, redundant-poison and staleness scenarios.