Tokenkeep Epistemic

Roll back RAG poisoning across vector stores, tickets and git.

Deleting the poisoned doc doesn't delete the poison. Tokenkeep Epistemic tracks AI agent data lineage, attributing everything an agent writes to what it read, so a prompt-injection or data-poisoning incident can be traced and reversed across every system it reached.

Your agent reads a poisoned chunk. It writes a ticket and then a patch. CI re-indexes that patch into your vector store. By the time anyone notices, the bad idea lives in four places and cites none of them. Epistemic keeps the lineage that lets you unwind it.

  1. Poison plantedA chunk in your vector store carries an injected instruction.
  2. LaunderedThe agent writes it into a ticket, then a commit. Signed DERIVED_FROM edges are recorded as it goes.
  3. ResurrectedCI re-indexes the commit. Delete the original chunk and the poison still answers queries.
  4. Phase 1 · SeverThe causal cone is quarantined and its vectors deleted, then counted again. The step fails closed if any remain.
  5. Phase 2 · RevertTainted commits are reverted deepest-first: git revert if untouched since, AST excision if not. Unrelated content stays put.
  6. Residual scanThe rollback only closes once a scan for renamed near-copies comes back clean.

Deterministic attribution

Each write is scored against what the agent read, using 128-permutation MinHash over shingles plus AST identifier overlap. Prose tickets attribute to code through their backticked spans. The verdict is integer-exact and seeded, with no floats and no randomness.

Signed lineage

Every agent commit carries an HMAC-signed Epistemic-Parents trailer bound to its tree. An audit checks every trailer against the graph and reports missing, unsigned or reweighted edges.

No resurrection

Taint propagates at write time, inside the same transaction. If a CI re-index draws from a quarantined commit, the new chunk is born quarantined, whatever order the edges arrive in.

Phase order, enforced

Code can't be reverted until retrieval has been severed and verified. Phase 2 requires a receipt that only a confirmed Phase 1 can mint, and the type system enforces it.

Confidence tiers

Every tainted commit gets a path confidence. Certain paths auto-revert, likely ones open a revert PR for review, and weak ones are flagged without being touched. Humans stay in the loop where it matters.

Surgical, not blunt

Naive session taint throws out everything an agent touched. In our SynthLaunder benchmark, causal attribution quarantines 10× fewer innocent artifacts, with false quarantines under 1.5% and causal-cone recall of at least 95%.

Integrations

Where it plugs in

  • Agents: an attribution engine built for the MCP tool-call path, reading evidence on every retrieval and attributing on every write
  • Vector stores: Qdrant severance with verified deletes, plus Pinecone delete payloads
  • Git: signed trailers, a plan executor that refuses a dirty tree, and AST excision for Rust
  • CI indexers: an explicit re-index API, so derived chunks inherit taint

Pilot

Tokenkeep Epistemic

Design partners

  • Deployed alongside your agent stack and RAG pipeline
  • A lineage graph and trailer audit across your repos
  • A tabletop poisoning exercise, run end to end on your infra
  • Rollback runbooks with tiered human review
Join the pilot

Questions security teams ask

What is RAG poisoning?

RAG poisoning means planting content in a retrieval source, such as a vector store, wiki or ticket tracker, so that an AI agent retrieves it and acts on it. The planted content is often an indirect prompt injection or a subtly wrong instruction. The damage comes later: the agent writes the idea into tickets and code, and CI re-indexes that output back into the store.

Why isn't deleting the document enough?

By the time the poison is found, agents have rewritten it in their own words. The paraphrases are new artifacts with new embeddings and no link back to the source. Deleting the original chunk leaves every derivative in place, and the next CI re-index can bring the content back. Epistemic records those derivations as signed DERIVED_FROM edges as they happen, so the full set of descendants (the causal cone) is known.

How is this different from blocking prompt injection?

Input filters try to stop poison getting in, and no filter catches everything. Epistemic is the recovery layer for what gets through: it finds what was contaminated, takes it out of retrieval, reverts the code, and proves nothing is left. It works alongside your prevention controls, not in place of them.

Does it use an LLM to decide what to roll back?

No. Attribution uses seeded MinHash and AST identifier overlap with an integer-exact threshold, so the same inputs always produce the same verdict and every decision can be audited. Uncertain paths go to human review instead of being reverted automatically.

Start here

Find out what breaks before your users do.

Planning a PQC migration, or running agents against production context? Tell us your stack. We'll show you the blast radius.

or email