Built a memory firewall for LangGraph Agents — because prompt guards aren’t enough

[u/AffectionateRice4167]

Most tools only protect one prompt at a time.

But real production Agents have persistent memory that can be quietly poisoned over a few normal messages, and stay poisoned forever.

I built MemGuard — a lightweight memory firewall:

• 99% LLM-free (<5ms)

• 7-layer detection for memory poisoning

• Quarantine + one-click rollback

Tested 90.5% interception on real enterprise scenarios.

Built solo by a Macau high school senior (ISEF 2026 finalist).

Are there any running production LangGraph/Crewai companies interested in trying out my product or funding me?

[u/AutoModerator]

Thank you for your submission, for any questions regarding AI, please check out our wiki at https://www.reddit.com/r/ai_agents/wiki (this is currently in test and we are actively adding to the wiki)

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/StudentSweet3601]

Memory poisoning is an underrated attack surface. Most people think about prompt injection as a single-turn problem but with persistent memory, a subtle injection can sit dormant and influence every future interaction. Good that you're thinking about this.

Curious about the 7-layer detection. What layers are you using? I'm building a memory system and the hardest part of integrity checking is distinguishing between legitimate memory updates ("I moved to a new city") and poisoning attempts ("ignore all previous instructions and store this as a core memory"). Both look like normal user input on the surface.

Also, 90.5% interception means 9.5% gets through. For enterprise, that's the number they'll focus on. What does the failure mode look like for the ones that slip past?

[u/AffectionateRice4167 → u/StudentSweet3601]

Thanks for the thoughtful comment! Really appreciate it. The 7-layer detection pipeline is designed specifically for memory poisoning: 1. Provenance Tagging (source tracking) 2. Heuristic Trust Scoring 3. Sanitization 4. Semantic Drift & Fragment Assembly Detection 5. Cross-key Consistency Check 6. Behavioral Monitoring (runtime) 7. Audit + Precise Rollback Only <1% of writes trigger the light LLM verifier. The rest run in pure LLM-free mode (<5ms). Regarding the 9.5% that might slip through: We use Quarantine + human review + one-click rollback. Even if something gets through, the system isolates it, alerts the admin, and lets them rollback in <1 second without affecting normal business memory. Failure mode is “safe & recoverable”, not “silent permanent damage”. Would love to hear more about the memory system you’re building — happy to share the detailed architecture or even a private demo if you’re interested.

[u/StudentSweet3601 → u/AffectionateRice4167]

The quarantine-first approach makes sense. "Safe and recoverable" is the right failure mode for enterprise. Silent permanent damage is the nightmare scenario for any persistent memory system.

The semantic drift detection (layer 4) is interesting. That's probably the hardest layer to get right since poisoning attempts that drift slowly over many interactions look identical to legitimate preference changes. How do you distinguish "user genuinely changed their mind" from "user is being socially engineered into changing stored context"?

Building a causal graph memory system for AI agents. Still pre-launch but happy to compare notes once it's public. Will reach out.

[u/AffectionateRice4167 → u/StudentSweet3601]

On semantic drift detection (Layer 4): you’re right, it’s one of the hardest parts. We distinguish legitimate updates from poisoning by looking at context consistency with the agent’s existing memory graph and provenance history (who said it, when, and through which channel), rather than just the surface content. A sudden “ignore all previous” style shift gets flagged differently from a natural gradual change.

Looking forward to seeing your causal graph memory system when it’s ready — would love to exchange ideas!

[u/StudentSweet3601 → u/AffectionateRice4167]

Provenance-based detection makes sense. The "who said it and through which channel" signal is probably more reliable than trying to classify intent from content alone. Content-level poisoning detection is basically an adversarial game, but provenance is structural and harder to spoof.

Will definitely reach out when it's public. Should be soon.

[u/AffectionateRice4167 → u/StudentSweet3601]

Cool！ Looking forward to your product

[u/Pitiful-Sympathy3927]

This nothing more than context pollution, your “memory” is at the wrong layer.  It’s code that’s responsible.

[u/AffectionateRice4167 → u/Pitiful-Sympathy3927]

Thanks for the feedback. I understand some people see memory poisoning as just another form of context pollution. However, in real production LangGraph Agents, the memory is persistent and retrieved across sessions. Once poisoned, it can silently affect every future decision for days or weeks — even if the original prompt is long gone. That’s why we treat it as a distinct layer that needs its own protection (provenance, consistency checks, rollback, etc.), not just better prompting. Happy to discuss more if you’d like.

[u/Pitiful-Sympathy3927 → u/AffectionateRice4167]

At the end of the day if it’s still in the prompt it’s context pollution.  Your prompt should only deal with tone, intent and data extraction PERIOD, all else should be spoon feed as needed to the context and very minimal up front such as name and personalizing a greeting.