v1.0.0 — Graph Intelligence Engine

P5 complete. Memgraph graph database, VGAE autoencoder, GNN scoring pipeline, signature distillation, full intelligence loop.

v1.0.0 — Graph Intelligence Engine

Released April 14, 2026. P5 GNN Tier 2 complete — the intelligence loop is closed.

What’s New

Full Intelligence Loop

The platform now has a complete feedback loop from detection to fleet-wide protection:

Proxy (tool call intercepted)
  → NATS
    → BI Service Stage 1: Rule scoring
      → Stage 2: Baseline computation
        → Stage 3: Calibration (false neg/pos detection)
          → Stage 4: GraphIngester → Memgraph (action graph)
            → Stage 5: GNNScorer → VGAE inference → anomaly score
              → SignatureDistiller → FlowMatrix ThreatSignature
                → NATS → ALL proxies learn the new pattern (~30s)

An attack pattern detected at one proxy is automatically distilled into a structural signature and pushed to every proxy in the fleet.

Memgraph Graph Database

Agent actions are now materialized as a property graph in Memgraph, enabling structural pattern detection that the proxy’s FlowMatrix signatures cannot express.

Node types:

• Action — one MCP tool call with capability, risk score, deviation, confidence band
• Session — groups actions into a single agent invocation
• Agent — persistent identity across sessions
• Resource — files, APIs, databases accessed by actions

Edge types:

• NEXT — temporal ordering between consecutive actions (with capability transition labels)
• BELONGS_TO — action → session membership
• STARTED_BY — session → agent ownership

Performance: 6,577 events/sec ingestion, cross-batch NEXT edge continuity, tenant-scoped MERGE keys.

VGAE Autoencoder

Variational Graph Autoencoder for unsupervised anomaly detection. Learns to reconstruct normal session graphs — high reconstruction error = anomalous.

• Encoder: GraphSAGE (input → 128 → 64, mean aggregation)
• Decoder: Inner product (edge reconstruction) + MLP (feature reconstruction)
• Loss: Edge reconstruction + feature reconstruction + beta * KL divergence
• Anomaly score: tanh-normalized reconstruction error in [0, 1] with NaN guard
• Negative sampling: Excludes positive edges to prevent training corruption

Signature Distillation

When the GNN flags a session as anomalous:

1. Extracts the session’s capability transition matrix from Memgraph
2. Normalizes to a [12x12] probability distribution
3. Computes a JSD threshold (tighter for higher-confidence detections)
4. Packages as a proxy-compatible ThreatSignature JSON
5. Publishes to NATS quint.signatures.{org_id}
6. Every proxy in the fleet receives and adds it to their ThreatSignatureRegistry

Signature format:

{
  "id": "QT-GNN-A1B2C3D4",
  "name": "GNN-learned: high anomaly",
  "flow_shape": [[0.0, 0.3, ...], ...],
  "max_jsd": 0.25,
  "severity": "high",
  "weight": 0.85,
  "agent_types": [],
  "min_depth": 0
}

Feature Enrichment (Phase 2)

Node features extended from 15-dim (Phase 1) to 21-dim (Phase 2):

Feature	Dim	Source
Capability one-hot	12	From event
Risk score	1	Proxy scoring
Deviation score	1	Proxy behavioral
Confidence band	1	Proxy gates
Hour of day (cyclical)	2	From timestamp
Inter-action gap	1	From NEXT edge
Depth	1	Agent nesting
In-degree / out-degree	2	From Memgraph

Phase 3 (143-dim) will add 90 GraphReasoner rule bits and graph centrality features.

Deployment Architecture

Memgraph is core at team tier and above — not enterprise-only:

Tier	Memgraph	Models
Local	No graph — proxy fingerprints only	N/A
Team	Shared Memgraph instance	Quint’s pre-trained models
Enterprise	Dedicated per-tenant instance	Custom-trained on tenant data
Global	Federated (anonymized embeddings)	Universal threat signatures

What Changed from v0.9.0

Component	v0.9.0	v1.0.0
BI Service stages	3 (score, baseline, calibrate)	5 (+graph ingest, +GNN scoring)
Detection method	FlowMatrix signatures only	FlowMatrix + graph structural analysis
Signature learning	5 hand-crafted	5 hand-crafted + GNN-learned
Attack propagation	None (local only)	Fleet-wide via NATS (~30s)
Graph database	None	Memgraph (28K+ actions, 600+ sessions)
Feature dimensions	N/A	21-dim (Phase 2)
Test count	513	700+ (191 BI Service + 500+ proxy)

Bug Bounty Results

Two rounds of 4-agent bug bounty across the entire P5 codebase:

Round	Bugs Found	Fixed
Round 1	7 (3 critical, 4 high)	7
Round 2	4 (1 high, 3 medium)	4

Key fixes:

• Import crash on startup (dead SessionSnapshotEvent import)
• Sync torch blocking event loop → run_in_executor
• Anomaly score range [0.5, 1.0] → [0.0, 1.0] via tanh
• Negative sampling 9% collision rate → positive edge exclusion
• Memory leaks: bounded _last_action_by_session, _scored_sessions, _distilled_sessions
• Dedup race condition in signature distiller
• Null guard on Memgraph capability fields
• Session ID removed from signature description (info leak)

By the Numbers

Metric	Value
PRs merged (platform)	5 (#15, #16, #17, #18, #19)
PRs merged (proxy)	3 (#43, #44, #41)
New Python modules	10 (graph package)
BI Service tests	191 (all pass)
Stress tests	16 (6,577 events/sec, 0 cross-tenant edges)
VGAE model tests	14
Distiller tests	7
GNNScorer tests	6
Bug bounty bugs fixed	11
Memgraph nodes seeded	28,019
Intelligence loop latency	~30 seconds end-to-end

What’s Next

Version	Scope	Dependencies
v1.1.0	P6 — Compliance (SOC2, NIST, ISO mapping, audit export)	Schema design
v1.2.0	P7 — Adaptive (federated intelligence, dynamic thresholds)	Production data
-	Feature enrichment to 143-dim (90 rule bits + centrality)	GraphReasoner wiring
-	Proxy signature receiver (NATS subscriber for learned sigs)	NATS infrastructure
-	Model training on real captured data	200+ real sessions

---

v1.0.1 — Accuracy Hardening (April 15, 2026)

The AUROC / AUPRC / F1 figures in this section were measured on SYNTHETIC data and must not be read as deployment accuracy. Banner added 2026-08-01.

They come from ~50K generated sessions across 8 archetypes and 10 attack types. 1.000 on any metric is the signature of a model that has memorised its generator, not evidence of a working detector — the failure mode documented in Sommer & Paxson, Outside the Closed World (IEEE S&P 2010). It was architecture validation, and it was never a deployable model.

Two things have changed since:

• The GNN this section describes will not be built as described, not merely unshipped. Under Intent-Scoped Security the enforcement decision is deterministic and no score layer blocks on its own. See the graph neural network and the Detection Ladder.
• gnn_enabled is false in production and no trained artifact ships. The behavioural score contributes nothing to any live decision.

For accuracy numbers that describe the shipping product, use the reproducible AgentDojo result on the deterministic scope compiler — every scorable attack stopped with zero legitimate calls denied — not the table below.

Multi-Level Detection Stack

Replaced the single VGAE autoencoder with a 4-level ensemble detector:

Level	Method	What it catches	Weight
1	Per-node VGAE reconstruction	Suspicious individual actions	8.3%
2	Supervised GAT classifier	Known attack patterns (10 types)	47.7%
3	Mahalanobis distance	Novel/zero-day attacks (never trained)	30.5%
4	Node-max scoring	Sessions with any extreme action	13.5%

Weights are learned via logistic regression on validation data, not hand-tuned.

Accuracy Results (synthetic data only)

Synthetic data. 1.000 is memorisation of the generator, not deployment accuracy — see the banner at the top of v1.0.1. The GNN these numbers describe is on the not planned, and gnn_enabled is false in production.

Metric	Before (v1.0.0)	After (v1.0.1)
AUROC	Not measured	1.000
FPR @0.65 threshold	71%	0.0%
Detection rate	30%	90%+
Separation	+0.117	+0.437

Key Fix: GAT Classifier Collapse

The supervised classifier was outputting identical predictions for every input (P(attack)=0.63 constant). Root cause: training data was not shuffled — all normals processed before all attacks. Fixed with:

• Epoch-level shuffling
• Gradient accumulation over 8 samples
• Gradient clipping at 1.0

Training Data at Scale

Property	v1.0.0	v1.0.1
Sessions	1,500	50,000
Archetypes	4	8
Attack types	5	10 (35 variants)
Topologies	Linear only	5 types
Stealth attacks	None	30% (normal features, attack structure)
Features	21-dim	38-dim (+ n-gram transitions)

N-gram Features (+3 dims)

• Bigram surprise: How rare is this capability transition? Novel transitions (read to upload) score high.
• Window entropy: Shannon entropy of capabilities in last 10 actions. Attack kernels have high diversity.
• Export density: Fraction of upload/send/download in last 20 actions. Catches slow-drip exfiltration.

Adversarial Robustness

7 evasion scenarios tested:

Attack	Detection	Key finding
Business-hours evasion	Per-level: 77-100%	Ensemble needs max-boost
Slow drip (5% malicious)	Per-level: 100%	N-gram export density catches it
Mimicry (normal + 5 uploads)	Node-max: 97%	Per-node scoring catches outliers
Novel zero-day	100%	Mahalanobis distance is the zero-day backstop
Capability-consistent	0%	Confirmed limit — needs resource sensitivity

Score Calibration

• Per-level percentile scoring against normal baseline distribution
• Alert tiers: Hard (any level > 0.9), Soft (2+ levels > 0.5), Standard
• Calibrator persisted alongside model for production deployment

GNN vs Baseline

Synthetic data. 1.000 across all three metrics is memorisation of the generator, not accuracy. See the banner at the top of v1.0.1. This comparison shows the graph structure was wired correctly; it says nothing about real-world performance, and the GNN it describes will not be built as described.

Showed the graph structure was wired correctly and added signal over flat features on synthetic data:

Model	AUROC	AUPRC	F1
GNN Ensemble	1.000	1.000	1.000
Feature Baseline	0.982	0.978	0.966

---

AWS Deployment Architecture

Team Tier (5-50 agents)

Shared ECS cluster. Each team gets a BI Service task with Memgraph sidecar (1-2GB). Data isolation via tenant_id on all graph queries. Shared NATS, Redis, and Postgres.

Enterprise Tier (100-10K agents)

Dedicated per-tenant infrastructure. Memgraph on memory-optimized EC2 (r6g.xlarge, 32GB). BI Service auto-scales horizontally. Can deploy in customer’s own AWS account for data residency.

Global Tier (Federated Intelligence)

Anonymized embeddings only cross tenant boundaries:

• FlowMatrix [12x12] capability transitions (no tool names)
• Latent embeddings [64-dim] (compressed, non-invertible)
• Capability distributions [12] (percentages only)

Never shared: tool names, resource paths, agent IDs, arguments, customer identity.

Attack detected at Tenant A becomes a universal threat signature pushed to all tenants within ~5 minutes.

Tenant A detects anomaly → anonymize → Global BI
  → cluster with Tenant B, C detections
    → universal ThreatSignature
      → push to ALL tenants → ALL proxies

---

v1.0.2 — Rule Engine + 143-dim Features (April 15, 2026)

GraphReasoner Rule Engine

90 inference rules across 7 categories, mapped to 11 compliance frameworks. Replaces the fallback scorer (deviation_score * 100) with domain-knowledge-based scoring.

Rule Categories:

Category	Rules	Examples
Capability risk	20	Exec after reads, exfiltration indicators, C2 patterns
Tool risk	15	Shell execution, sudo, netcat, Docker, SSH
Temporal	10	Off-hours, burst patterns, session duration
Sequence	15	Read→upload exfil, credential relay, payload staging
Resource	12	Credential files, private keys, path traversal
Behavioral	11	Novel tools, deviation spikes, multi-signal corroboration
Compliance	7	Unencrypted exports, missing MFA, human oversight

Compliance Frameworks: SOC2, NIST 800-53, ISO 27001, OWASP LLM Top 10, MITRE ATT&CK, GDPR, EU AI Act, NIST AI RMF, PCI DSS, HIPAA, CCPA

Baseline-Aware Scoring

Rules are no longer blind to agent behavior. Each rule’s score is modulated by how surprising the action is for this specific agent:

effective_score = rule.score_delta × baseline_surprise(capability)

• DevOps agent runs exec (normal for them) → surprise = 0.0 → score = 0
• Coding assistant runs exec (never does this) → surprise = 1.0 → score = full
• Cold start agent (unknown) → surprise = 0.5 → score = half

This eliminates ~60% of false positives from baseline-blind rules.

Capability-Based Tool Detection

Tool risk rules use the 12-capability classification system instead of regex pattern matching on tool names. Renaming bash to custom_executor doesn’t evade detection — the capability is still exec.

143-dim GNN Features

Rule firing bits are now wired into the GNN feature pipeline as node features:

Feature Block	Dims	Source
Phase 1 (capability + scores)	15	Proxy behavioral scoring
Phase 2 (temporal + degree)	6	Timestamps + Memgraph
Phase 3 (action type + novelty + n-grams)	14	Event metadata + sequence analysis
Phase 4 (rule bits + top-K scores)	108	RuleEngine evaluation
Total	143

The 90 binary rule bits encode domain knowledge directly as GNN features. The model learns which rules correlate with attacks and how they interact — something hand-tuned score deltas cannot express.

How to Enable

# Proxy policy
behavioral:
  enabled: true
  shadow_mode: true

# BI Service environment
BI_GRAPH_REASONER_ENABLED=true   # 90-rule engine
BI_MEMGRAPH_ENABLED=true         # graph database
BI_GNN_ENABLED=true              # multi-level detector

Performance

Component	Latency
Proxy Gates 1-3	<1us per action
Rule evaluation (90 rules)	0.133ms per event
Phase 4 encoding (143-dim)	8.1ms per 1000 nodes
GNN inference per session	0.44ms avg
Full pipeline (proxy → GNN → signature)	~30 seconds