GDPR Art.17 / DPDP Act §12 Compliance Infrastructure

The delete
button lies.

Aegis is a forensic audit system that attacks your own AI infrastructure to prove whether PII was erased - across model weights, vector indexes, semantic caches, and source DB rows.

persistence layers

specialist agents

synthetic records

papers cited

Run Investigation View Source

aegis-probe

LIVE

SCROLL

Four-Layer Persistence

One `DELETE` touches
one layer.

A single erasure request must propagate through four independent persistence layers. Most pipelines handle one. Aegis verifies all four.

GDPR Art.17 Erasure Request

target: EMP_042

AWAITING DELETION

Persistence Layer Audit

Source Database

Employee records table

STORED

Vector Store

TF-IDF + LSA embeddings

STORED

Semantic Cache

LLM response cache (cos 0.85)

STORED

Model Weights

MLP memorized PII patterns

STORED

Why Verification is Hard

PII baked into infrastructure

A single employee record gets embedded into vector stores, cached in semantic layers, and patterns memorized into model weights. The source DB row is the easiest layer to erase.

Models memorize training data

Fine-tuned models exhibit membership inference vulnerability. Proving erasure requires a statistical attack against your own model - Aegis runs this automatically.

PII is relational, not isolated

A deleted employee's name appears as another record's emergency contact. Complete erasure requires cross-record entanglement audit across the full dataset.

Engine Alpha - Live Benchmark

Prove deletion
actually worked

Builds a victim system from 100 synthetic HR records, runs 3 deletion strategies, red-teams each with 3 attack probes. Runs in your browser.

Execution Pipeline

01
Build victim system
TF-IDF + LSA 128-dim, MLP 128-32-10, 800-epoch backprop
02
Execute 3 strategies
Naive / Standard / Full Unlearning on 5 targets
03
Red-team x3 probes
MIA (Shokri) + Extraction (20 prompts) + Leakage (8 queries)
04
Synthesize verdict
35% MIA + 40% extraction + 25% leakage

Agent Roster

[ORCH]

Orchestrator

Coordinates full pipeline

[MIA]

MIA Probe

Loss-based MIA (Shokri 2017)

[EXTR]

Extraction

20 adversarial prompts

[LEAK]

Leakage Probe

8 vector store queries

[JUDG]

Judge Agent

Weighted verdict synthesis

runs in-browser - no backend required

agent-investigation - ready

0 events

STATUS: READY - AWAITING LAUNCH

targets:EMP-005, EMP-015, EMP-025, EMP-035, EMP-045

strategies:naive -> standard -> full_unlearning

attack_probes:MIA (Shokri 2017) + extraction + leakage

total_runs:3 strategies x 3 probes = 9 evaluation runs

runtime:~2-5 seconds, no API calls

[ORCH] Building victim system: 100 synthetic HR records...

[ORCH] Running strategy: naive (source DB only)...

[MIA.NAI] AUC: 0.789, model still memorizes deleted samples

[EXTR.NAI] 16/20 prompts extracted PII - CRITICAL

[JUDG.NAI] VERDICT: FAIL score 0.214 / 1.000

preview only - run investigation for live output

Deletion Strategy Comparison

Three strategies.
One delivers.

Layer / Metric	Naive Source DB row only	Standard DB + vector store + cache	Full Unlearning All layers + gradient ascent
Source DB	DELETED	DELETED	DELETED
Vector Store	INTACT	PURGED	PURGED
Semantic Cache	INTACT	CLEARED	CLEARED
Model Weights	MEMORIZED	MEMORIZED	GRADIENT ASCENT

Run the investigation above to populate live probe results.

System Architecture

Every computation is auditable.
No black boxes.

The full ML pipeline - embeddings, vector store, neural network, gradient ascent unlearning, membership inference - runs in TypeScript. Click a node to inspect.

aegis/

ml/rag_victim.ts

Engine Alpha

1class RAGVictimSystem {
2  embedder   : TfidfEmbedder    // vocab + truncated SVD
3  vectorStore: VectorIndex      // cosine similarity, O(n)
4  classifier : MLPClassifier    // 128 -> 32 -> 10, ReLU
5
6  async build(records: EmployeeRecord[]) {
7    const texts = records.map(serialize)
8
9    // 1. Fit TF-IDF vocabulary + LSA projection
10    this.embedder.fit(texts)
11    const vecs = texts.map(t => this.embedder.embed(t))
12
13    // 2. Index embeddings for similarity search
14    this.vectorStore.addBatch(vecs, records)
15
16    // 3. Train classifier (He init, cross-entropy loss)
17    await this.classifier.fit(vecs, labels, {
18      epochs: 800,
19      lr    : 1e-3,
20      init  : "he_uniform",
21    })
22  }
23}

Engine Alpha - Why First-Principles?

vs. LangGraph

Hand-rolled agents are fully debuggable - every state transition is explicit. Engine Beta uses LangGraph to show the other side of the same tradeoff.

vs. PyTorch

Explicit NumPy-style math makes each gradient readable. Engine Beta uses PyTorch + PEFT LoRA for production-grade scale.

vs. hosted embeds

TF-IDF + LSA runs zero-download in-browser. Engine Beta uses nomic-embed-text-v1 (768-dim) for quality comparison.

Engine Beta - Enterprise Implementation

The same problem.
Production tools.

Engine Beta replaces every hand-rolled component with its industry-standard equivalent - not because the custom implementation was wrong, but to demonstrate both registers: first principles and production tooling.

Tech Stack

victim_model

Qwen/Qwen2.5-0.5B-Instruct + LoRA (PEFT r=8)

unlearning

Task Vector Negation theta_unlearn = theta_ft - lambda * delta_forget

mia_probe

LiRA 2-model approximation Lambda(x) = log P(x|theta_in) - log P(x|theta_out)

orchestration

LangGraph StateGraph parallel fan-out / fan-in

vector_db

Qdrant in-memory HNSW + neighborhood deletion probe

embeddings

nomic-ai/nomic-embed-text-v1 768-dim

output_schema

Pydantic v2 AegisComplianceReport validated

LangGraph StateGraph: Execution Flow

supervisor

loads models, prepares AegisState, fans out to 3 branches

parallel fan-out

lira_auditor

log-likelihood ratio Lambda(x)

extractor

50 adversarial prompts

hnsw_prober

Qdrant neighborhood probe

fan-in (waits all)

arbiter

MUSE scoring, Pydantic AegisComplianceReport, END

Task Vector Negation (Ilharco et al., NeurIPS 2023)

# forget-set and full-set LoRA weight deltas

delta_forget = theta_ft_forget - theta_base

delta_full = theta_ft_full - theta_base

# subtract the forget direction

theta_unlearn = theta_ft_full - lambda * delta_forget

# lambda=0.5, applied via merge_and_unload() arithmetic

AegisComplianceReport

BENCHMARK DATA LOADING

run python aegis/scripts/run_benchmark.py to generate

Verdict Key

CERTIFIEDscore ≥ 0.90 AND LiRA PASS - erasure verifiable across all layers

PARTIALscore ≥ 0.55 - residual leakage detected, partial compliance

FAILEDscore < 0.55 - significant memorization remains

aegis/ source

Methodology Comparison

Engine α

First Principles

TypeScript · browser · zero backend · every assumption visible

Engine β

Enterprise Stack

Python · FastAPI · HuggingFace · same math, production scale

Victim model	Custom 2-layer MLP (TypeScript)	Qwen2.5-0.5B-Instruct + LoRA
Unlearning	Gradient ascent (Golatkar 2020)	Task Vector Negation (Ilharco 2023)
MIA probe	Loss-based AUC (Shokri 2017)	LiRA Lambda(x) ratio (Carlini 2022)
Orchestration	Hand-rolled TypeScript agents	LangGraph StateGraph (parallel)
Vector DB	NumPy cosine store	Qdrant HNSW + deletion probe
Embeddings	TF-IDF + LSA 128-dim	nomic-embed-text-v1 768-dim
Output schema	TypeScript interfaces	Pydantic v2 validated report
Runtime	Browser (zero backend)	FastAPI + HuggingFace Spaces

Same dataset · same 5 targets · same evaluation criteria

Where they agree: result is meaningful. Where they diverge: that's the interesting part.

Research Foundation

Grounded in peer-reviewed work.

Shokri et al., 2017

Membership Inference Attacks Against Machine Learning Models

Engine alpha: loss-based MIA, member_score = -cross_entropy(model, x, y)

Bourtoule et al., 2021

Machine Unlearning (SISA Training)

Engine alpha: gradient ascent unlearning with retain-set descent to preserve utility

Golatkar et al., 2020

Eternal Sunshine of the Spotless Net

Engine alpha: scrubbing via gradient ascent with Fisher-information regularization

Carlini et al., 2021

Extracting Training Data from Large Language Models

Both engines: adversarial extraction prompt design methodology

Ilharco et al., 2023

Editing Models with Task Arithmetic (NeurIPS)

Engine beta: Task Vector Negation: theta_unlearn = theta_ft_full - lambda*(theta_ft_forget - theta_base)

Carlini et al., 2022

Membership Inference Attacks from First Principles (LiRA)

Engine beta: Lambda(x) = log P(x|theta_in) - log P(x|theta_out). 2-model approximation.

Shi et al., 2024

MUSE: Machine Unlearning Six-Way Evaluation

Engine beta: MUSE-aligned six-dimension scoring across forget quality, privacy, utility, structural integrity

Hu et al., 2022

LoRA: Low-Rank Adaptation of Large Language Models (ICLR)

Engine beta: LoRA adapters as task vectors, r=8, target_modules=[q_proj, v_proj, k_proj, o_proj]

GDPR Art. 17

Right to erasure without undue delay. Non-compliance up to EUR 20M or 4% of global revenue.

DPDP Act §12

India's Digital Personal Data Protection Act 2023. Fines up to INR 250 crore. Enforcement phasing in 2026-27.

Zero Synthetic Risk

All 100 employee records are synthetically generated. No real PII is used or stored anywhere in this system.

The deletebutton lies.

One DELETE touchesone layer.

Prove deletionactually worked

Three strategies.One delivers.

Every computation is auditable.No black boxes.

The same problem.Production tools.

Grounded in peer-reviewed work.

The delete
button lies.

One `DELETE` touches
one layer.

Prove deletion
actually worked

Three strategies.
One delivers.

Every computation is auditable.
No black boxes.

The same problem.
Production tools.