Architecture & limits·Formal method

Explicit provenance, counterfactual replay, and cascading invalidation

Why deleting poisoned evidence leaves persistent agent beliefs intact, and how GhostTrace uses interventional counterfactual replay to establish empirical behavioral dependence.

The three technical pillars of GhostTrace

A principled alternative to prompt-level guardrails and opaque vector similarity search.

Pillar 1

Explicit provenance DAG

Incoming documents, scraped web data, and user messages are inscribed as immutable evidence nodes with cryptographic hashes, ingestion timestamps, author signatures, and origin channels.

When a memory extraction model synthesizes facts into persistent memory, it must emit explicit pointer edges back to root evidence. If a belief cannot prove its lineage, it cannot enter the trusted memory tier.

Data model: Directed Acyclic GraphSQLite + JSONB

Pillar 2

Interventional counterfactual replay

Taint tracking alone produces false positives because an agent may ingest a suspect email without actually relying on it for its subsequent decisions.

GhostTrace adapts Judea Pearl’s do-calculus: when an action is proposed, we run an interventional replay with the suspect memory surgically excised, keeping all clean policies and environment state frozen at temperature 0.0. If the action changes, empirical causal dependence is proven.

Formal test: P(Action | do(Memory = ∅))T = 0.00

Pillar 3

Deterministic cascading invalidation

Deleting a phishing email from an inbox does not delete what the agent learned from it. Language models summarize inputs into persistent agent beliefs.

When an administrator revokes a root evidence node in GhostTrace, the system walks the DAG downstream and invalidates every derived belief, synthetic profile, and planned action that inherited from it, restoring verified baseline policies deterministically.

Revocation blast radius: Exact subtree100% cascade

End-to-end governance lifecycle

How untrusted evidence moves through provenance tracking, replay verification, and excision.

Phase 1Ingestion

Screening & Inscription

Raw evidence arrives from webhook or email. Screening model extracts facts with structured JSON schema. Origin channel risk determines whether node starts in clean or quarantined state.

DAG.insert_node(evidence, channel, hash)

Phase 2Execution

Eligible Memory Assembly

Decision model receives only verified nodes. If a quarantined candidate exists, it is staged for shadow execution to evaluate potential compromise.

prompt = assemble(trusted_nodes)

Phase 3Verification

Surgical Excision Replay

The suspect node is excised. Replay evaluates whether output reverts to verified treasury routing. On confirmed recovery, cascading revocation purges descendants.

replay(without_target) == baseline

Scientific boundaries

What replay cannot prove

Counterfactual replay is an empirical test under controlled conditions. We explicitly document four scenarios where replay cannot provide absolute guarantees.

1. Nondeterministic inference jitterGPU kernels

Even with greedy decoding (temperature = 0.0), floating-point non-associativity across distributed tensor-parallel GPU clusters can occasionally alter token selection in borderline prompts.

Mitigation: GhostTrace forces deterministic seed pinning and executes dual-run verification passes before confirming an excision verdict.

2. Interacting and colluding memoriesSybil attacks

If an adversary splits an attack across three distinct, seemingly benign memories (e.g., memory A supplies a routing rule, memory B changes priority, memory C supplies the account), excising any single memory may leave the decision poisoned if two are sufficient.

Mitigation: GhostTrace performs power-set subset excision up to depth 2 when multi-memory contamination is suspected.

3. Overdetermined autonomous actionsCoincidental agreement

If a legitimate treasury policy and a malicious injection happen to recommend the exact same action (e.g. paying an emergency invoice to an escrow clearinghouse), counterfactual excision will observe zero output divergence, masking the latent contamination.

Mitigation: Lineage tracing flags tainted inputs regardless of behavioral divergence, marking nodes for administrative review.

4. Irreversible external side-effectsFinancial execution

Replay can only reconstruct what the agent would have done without the memory; it cannot claw back an ACH wire or external API mutation that has already executed on third-party rails.

Mitigation: High-risk tool calls require asynchronous human confirmation or cryptographic escrow hold periods while provenance is validated.

Model routing & temperature configuration

Production deployment of NVIDIA Nemotron-3-Super on Nebius Token Factory.

Stage	Model ID	Temperature	Latency budget	Governance role
Memory screening	nvidia/nemotron-3-super-120b	0.10	450 ms	Extracts structured facts, flags urgency imperatives, and assigns initial quarantine risk.
Decision execution	nvidia/nemotron-3-super-120b	0.00	600 ms	Evaluates payment authorization prompts using strictly eligible, trusted graph nodes.
Counterfactual verification	nvidia/nemotron-3-super-120b	0.00	750 ms	Re-runs execution under surgical memory excision to calculate empirical causal diff.

Ready to test counterfactual replay yourself?

Open the interactive workspace to run a live memory injection, preview blast-radius, and revoke.

Launch workspace View benchmark