> ## Documentation Index
> Fetch the complete documentation index at: https://quintsecurity.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# v1.0.0 — Graph Intelligence Engine
> P5 complete. Memgraph graph database, VGAE autoencoder, GNN scoring pipeline, signature distillation, full intelligence loop.
# v1.0.0 — Graph Intelligence Engine
Released April 14, 2026. P5 GNN Tier 2 complete — the intelligence loop is closed.
## What's New
### Full Intelligence Loop
The platform now has a complete feedback loop from detection to fleet-wide protection:
```
Proxy (tool call intercepted)
→ NATS
→ BI Service Stage 1: Rule scoring
→ Stage 2: Baseline computation
→ Stage 3: Calibration (false neg/pos detection)
→ Stage 4: GraphIngester → Memgraph (action graph)
→ Stage 5: GNNScorer → VGAE inference → anomaly score
→ SignatureDistiller → FlowMatrix ThreatSignature
→ NATS → ALL proxies learn the new pattern (~30s)
```
An attack pattern detected at one proxy is automatically distilled into a structural signature and pushed to every proxy in the fleet.
### Memgraph Graph Database
Agent actions are now materialized as a property graph in Memgraph, enabling structural pattern detection that the proxy's FlowMatrix signatures cannot express.
**Node types:**
* `Action` — one MCP tool call with capability, risk score, deviation, confidence band
* `Session` — groups actions into a single agent invocation
* `Agent` — persistent identity across sessions
* `Resource` — files, APIs, databases accessed by actions
**Edge types:**
* `NEXT` — temporal ordering between consecutive actions (with capability transition labels)
* `BELONGS_TO` — action → session membership
* `STARTED_BY` — session → agent ownership
**Performance:** 6,577 events/sec ingestion, cross-batch NEXT edge continuity, tenant-scoped MERGE keys.
### VGAE Autoencoder
Variational Graph Autoencoder for unsupervised anomaly detection. Learns to reconstruct normal session graphs — high reconstruction error = anomalous.
* **Encoder:** GraphSAGE (input → 128 → 64, mean aggregation)
* **Decoder:** Inner product (edge reconstruction) + MLP (feature reconstruction)
* **Loss:** Edge reconstruction + feature reconstruction + beta \* KL divergence
* **Anomaly score:** tanh-normalized reconstruction error in \[0, 1] with NaN guard
* **Negative sampling:** Excludes positive edges to prevent training corruption
### Signature Distillation
When the GNN flags a session as anomalous:
1. Extracts the session's capability transition matrix from Memgraph
2. Normalizes to a \[12x12] probability distribution
3. Computes a JSD threshold (tighter for higher-confidence detections)
4. Packages as a proxy-compatible `ThreatSignature` JSON
5. Publishes to NATS `quint.signatures.{org_id}`
6. Every proxy in the fleet receives and adds it to their `ThreatSignatureRegistry`
**Signature format:**
```json theme={null}
{
"id": "QT-GNN-A1B2C3D4",
"name": "GNN-learned: high anomaly",
"flow_shape": [[0.0, 0.3, ...], ...],
"max_jsd": 0.25,
"severity": "high",
"weight": 0.85,
"agent_types": [],
"min_depth": 0
}
```
### Feature Enrichment (Phase 2)
Node features extended from 15-dim (Phase 1) to 21-dim (Phase 2):
| Feature | Dim | Source |
| ---------------------- | --- | ---------------- |
| Capability one-hot | 12 | From event |
| Risk score | 1 | Proxy scoring |
| Deviation score | 1 | Proxy behavioral |
| Confidence band | 1 | Proxy gates |
| Hour of day (cyclical) | 2 | From timestamp |
| Inter-action gap | 1 | From NEXT edge |
| Depth | 1 | Agent nesting |
| In-degree / out-degree | 2 | From Memgraph |
Phase 3 (143-dim) will add 90 GraphReasoner rule bits and graph centrality features.
### Deployment Architecture
Memgraph is core at **team tier and above** — not enterprise-only:
| Tier | Memgraph | Models |
| ---------- | ---------------------------------- | ----------------------------- |
| Local | No graph — proxy fingerprints only | N/A |
| Team | Shared Memgraph instance | Quint's pre-trained models |
| Enterprise | Dedicated per-tenant instance | Custom-trained on tenant data |
| Global | Federated (anonymized embeddings) | Universal threat signatures |
## What Changed from v0.9.0
| Component | v0.9.0 | v1.0.0 |
| ------------------ | ------------------------------ | ------------------------------------------ |
| BI Service stages | 3 (score, baseline, calibrate) | **5** (+graph ingest, +GNN scoring) |
| Detection method | FlowMatrix signatures only | FlowMatrix **+ graph structural analysis** |
| Signature learning | 5 hand-crafted | 5 hand-crafted **+ GNN-learned** |
| Attack propagation | None (local only) | **Fleet-wide via NATS (\~30s)** |
| Graph database | None | **Memgraph (28K+ actions, 600+ sessions)** |
| Feature dimensions | N/A | **21-dim (Phase 2)** |
| Test count | 513 | **700+** (191 BI Service + 500+ proxy) |
## Bug Bounty Results
Two rounds of 4-agent bug bounty across the entire P5 codebase:
| Round | Bugs Found | Fixed |
| ------- | ---------------------- | ----- |
| Round 1 | 7 (3 critical, 4 high) | 7 |
| Round 2 | 4 (1 high, 3 medium) | 4 |
Key fixes:
* Import crash on startup (dead `SessionSnapshotEvent` import)
* Sync torch blocking event loop → `run_in_executor`
* Anomaly score range \[0.5, 1.0] → \[0.0, 1.0] via tanh
* Negative sampling 9% collision rate → positive edge exclusion
* Memory leaks: bounded `_last_action_by_session`, `_scored_sessions`, `_distilled_sessions`
* Dedup race condition in signature distiller
* Null guard on Memgraph capability fields
* Session ID removed from signature description (info leak)
## By the Numbers
| Metric | Value |
| ------------------------- | ------------------------------------------- |
| PRs merged (platform) | 5 (#15, #16, #17, #18, #19) |
| PRs merged (proxy) | 3 (#43, #44, #41) |
| New Python modules | 10 (graph package) |
| BI Service tests | 191 (all pass) |
| Stress tests | 16 (6,577 events/sec, 0 cross-tenant edges) |
| VGAE model tests | 14 |
| Distiller tests | 7 |
| GNNScorer tests | 6 |
| Bug bounty bugs fixed | 11 |
| Memgraph nodes seeded | 28,019 |
| Intelligence loop latency | \~30 seconds end-to-end |
## What's Next
| Version | Scope | Dependencies |
| ------- | ----------------------------------------------------------- | -------------------- |
| v1.1.0 | P6 — Compliance (SOC2, NIST, ISO mapping, audit export) | Schema design |
| v1.2.0 | P7 — Adaptive (federated intelligence, dynamic thresholds) | Production data |
| - | Feature enrichment to 143-dim (90 rule bits + centrality) | GraphReasoner wiring |
| - | Proxy signature receiver (NATS subscriber for learned sigs) | NATS infrastructure |
| - | Model training on real captured data | 200+ real sessions |
***
## v1.0.1 — Accuracy Hardening (April 15, 2026)
**The AUROC / AUPRC / F1 figures in this section were measured on SYNTHETIC data and must not be
read as deployment accuracy.** Banner added 2026-08-01.
They come from \~50K generated sessions across 8 archetypes and 10 attack types. `1.000` on any
metric is the signature of a model that has memorised its generator, not evidence of a working
detector — the failure mode documented in
[Sommer & Paxson, *Outside the Closed World*](https://ieeexplore.ieee.org/document/5504793)
(IEEE S\&P 2010). It was architecture validation, and it was never a deployable model.
Two things have changed since:
* **The GNN this section describes will not be built as described**, not merely unshipped. Under
Intent-Scoped Security the enforcement decision is deterministic and no score layer blocks on its
own. See the graph neural network and the [Detection Ladder](/concepts/ml-ladder).
* **`gnn_enabled` is `false` in production and no trained artifact ships.** The behavioural score
contributes nothing to any live decision.
For accuracy numbers that describe the shipping product, use the reproducible
[AgentDojo](https://arxiv.org/abs/2406.13352) result on the deterministic scope compiler — every
scorable attack stopped with zero legitimate calls denied — not the table below.
### Multi-Level Detection Stack
Replaced the single VGAE autoencoder with a 4-level ensemble detector:
| Level | Method | What it catches | Weight |
| ----- | ---------------------------- | -------------------------------------- | ------ |
| 1 | Per-node VGAE reconstruction | Suspicious individual actions | 8.3% |
| 2 | Supervised GAT classifier | Known attack patterns (10 types) | 47.7% |
| 3 | Mahalanobis distance | Novel/zero-day attacks (never trained) | 30.5% |
| 4 | Node-max scoring | Sessions with any extreme action | 13.5% |
Weights are **learned** via logistic regression on validation data, not hand-tuned.
### Accuracy Results (synthetic data only)
**Synthetic data. `1.000` is memorisation of the generator, not deployment accuracy** — see the
banner at the top of v1.0.1. The GNN these numbers describe is on the
not planned, and `gnn_enabled` is `false` in production.
| Metric | Before (v1.0.0) | After (v1.0.1) |
| ------------------- | --------------- | -------------- |
| AUROC | Not measured | **1.000** |
| FPR @0.65 threshold | 71% | **0.0%** |
| Detection rate | 30% | **90%+** |
| Separation | +0.117 | **+0.437** |
### Key Fix: GAT Classifier Collapse
The supervised classifier was outputting identical predictions for every input (P(attack)=0.63 constant). Root cause: training data was not shuffled — all normals processed before all attacks. Fixed with:
* Epoch-level shuffling
* Gradient accumulation over 8 samples
* Gradient clipping at 1.0
### Training Data at Scale
| Property | v1.0.0 | v1.0.1 |
| --------------- | ----------- | ------------------------------------------- |
| Sessions | 1,500 | **50,000** |
| Archetypes | 4 | **8** |
| Attack types | 5 | **10 (35 variants)** |
| Topologies | Linear only | **5 types** |
| Stealth attacks | None | **30% (normal features, attack structure)** |
| Features | 21-dim | **38-dim (+ n-gram transitions)** |
### N-gram Features (+3 dims)
* **Bigram surprise**: How rare is this capability transition? Novel transitions (read to upload) score high.
* **Window entropy**: Shannon entropy of capabilities in last 10 actions. Attack kernels have high diversity.
* **Export density**: Fraction of upload/send/download in last 20 actions. Catches slow-drip exfiltration.
### Adversarial Robustness
7 evasion scenarios tested:
| Attack | Detection | Key finding |
| ---------------------------- | ------------------ | --------------------------------------------- |
| Business-hours evasion | Per-level: 77-100% | Ensemble needs max-boost |
| Slow drip (5% malicious) | Per-level: 100% | N-gram export density catches it |
| Mimicry (normal + 5 uploads) | Node-max: 97% | Per-node scoring catches outliers |
| Novel zero-day | **100%** | Mahalanobis distance is the zero-day backstop |
| Capability-consistent | **0%** | Confirmed limit — needs resource sensitivity |
### Score Calibration
* Per-level percentile scoring against normal baseline distribution
* Alert tiers: Hard (any level > 0.9), Soft (2+ levels > 0.5), Standard
* Calibrator persisted alongside model for production deployment
### GNN vs Baseline
**Synthetic data. `1.000` across all three metrics is memorisation of the generator, not accuracy.**
See the banner at the top of v1.0.1. This comparison shows the graph structure was wired correctly;
it says nothing about real-world performance, and the GNN it describes will not be built as described.
Showed the graph structure was wired correctly and added signal over flat features **on synthetic
data**:
| Model | AUROC | AUPRC | F1 |
| ---------------- | ----- | ----- | ----- |
| GNN Ensemble | 1.000 | 1.000 | 1.000 |
| Feature Baseline | 0.982 | 0.978 | 0.966 |
***
## AWS Deployment Architecture
### Team Tier (5-50 agents)
Shared ECS cluster. Each team gets a BI Service task with Memgraph sidecar (1-2GB). Data isolation via `tenant_id` on all graph queries. Shared NATS, Redis, and Postgres.
### Enterprise Tier (100-10K agents)
Dedicated per-tenant infrastructure. Memgraph on memory-optimized EC2 (r6g.xlarge, 32GB). BI Service auto-scales horizontally. Can deploy in customer's own AWS account for data residency.
### Global Tier (Federated Intelligence)
Anonymized embeddings only cross tenant boundaries:
* FlowMatrix `[12x12]` capability transitions (no tool names)
* Latent embeddings `[64-dim]` (compressed, non-invertible)
* Capability distributions `[12]` (percentages only)
**Never shared:** tool names, resource paths, agent IDs, arguments, customer identity.
Attack detected at Tenant A becomes a universal threat signature pushed to all tenants within \~5 minutes.
```
Tenant A detects anomaly → anonymize → Global BI
→ cluster with Tenant B, C detections
→ universal ThreatSignature
→ push to ALL tenants → ALL proxies
```
***
## v1.0.2 — Rule Engine + 143-dim Features (April 15, 2026)
### GraphReasoner Rule Engine
90 inference rules across 7 categories, mapped to 11 compliance frameworks. Replaces the fallback scorer (`deviation_score * 100`) with domain-knowledge-based scoring.
**Rule Categories:**
| Category | Rules | Examples |
| --------------- | ----- | --------------------------------------------------------- |
| Capability risk | 20 | Exec after reads, exfiltration indicators, C2 patterns |
| Tool risk | 15 | Shell execution, sudo, netcat, Docker, SSH |
| Temporal | 10 | Off-hours, burst patterns, session duration |
| Sequence | 15 | Read→upload exfil, credential relay, payload staging |
| Resource | 12 | Credential files, private keys, path traversal |
| Behavioral | 11 | Novel tools, deviation spikes, multi-signal corroboration |
| Compliance | 7 | Unencrypted exports, missing MFA, human oversight |
**Compliance Frameworks:**
SOC2, NIST 800-53, ISO 27001, OWASP LLM Top 10, MITRE ATT\&CK, GDPR, EU AI Act, NIST AI RMF, PCI DSS, HIPAA, CCPA
### Baseline-Aware Scoring
Rules are no longer blind to agent behavior. Each rule's score is modulated by how surprising the action is for this specific agent:
```
effective_score = rule.score_delta × baseline_surprise(capability)
```
* DevOps agent runs `exec` (normal for them) → surprise = 0.0 → **score = 0**
* Coding assistant runs `exec` (never does this) → surprise = 1.0 → **score = full**
* Cold start agent (unknown) → surprise = 0.5 → **score = half**
This eliminates \~60% of false positives from baseline-blind rules.
### Capability-Based Tool Detection
Tool risk rules use the 12-capability classification system instead of regex pattern matching on tool names. Renaming `bash` to `custom_executor` doesn't evade detection — the capability is still `exec`.
### 143-dim GNN Features
Rule firing bits are now wired into the GNN feature pipeline as node features:
| Feature Block | Dims | Source |
| ----------------------------------------- | ------- | ---------------------------------- |
| Phase 1 (capability + scores) | 15 | Proxy behavioral scoring |
| Phase 2 (temporal + degree) | 6 | Timestamps + Memgraph |
| Phase 3 (action type + novelty + n-grams) | 14 | Event metadata + sequence analysis |
| **Phase 4 (rule bits + top-K scores)** | **108** | **RuleEngine evaluation** |
| **Total** | **143** | |
The 90 binary rule bits encode domain knowledge directly as GNN features. The model learns which rules correlate with attacks and how they interact — something hand-tuned score deltas cannot express.
### How to Enable
```yaml theme={null}
# Proxy policy
behavioral:
enabled: true
shadow_mode: true
# BI Service environment
BI_GRAPH_REASONER_ENABLED=true # 90-rule engine
BI_MEMGRAPH_ENABLED=true # graph database
BI_GNN_ENABLED=true # multi-level detector
```
### Performance
| Component | Latency |
| --------------------------------------- | -------------------- |
| Proxy Gates 1-3 | \<1us per action |
| Rule evaluation (90 rules) | 0.133ms per event |
| Phase 4 encoding (143-dim) | 8.1ms per 1000 nodes |
| GNN inference per session | 0.44ms avg |
| Full pipeline (proxy → GNN → signature) | \~30 seconds |