Attack search, protection, and recovery for ontology-grounded agents

Aegis finds the ontology edits that hurt an agent most, chooses which triples to lock against them, and undoes the damage when an attack lands.

$ git clone https://github.com/lamng3/aegis.git && cd aegis
$ uv sync && uv run python examples/attack_and_recover.py
Get started Playground Experiments

Attack, then defend

recorded experiment results

Try it: Drag the sliders: how many edits the attacker gets, and how many triples the defender locks.

edits

locks

Harm runs from 0 to 1 over the ontology's query workload. Top bars: the most harmful chain each search finds. Bottom bars: harm left after the locks, against a two-edit attacker. The numbers come from results/attack_defense/2026-10-18.json; this page computes nothing.

What it does

An agent reads its knowledge graph through an ontology. Aegis treats the ontology like data a database must defend.

PlaygroundAttack a small ontology in the browser: edit it, search for the worst chain, find the damage, and roll back.Getting startedRun the example: attack a small materials ontology, then recover.ConceptsCounterfactual attacks, and the affected area that measures them.Attack searchGreedy, beam, random, and UCT over the tree of edit chains.ProtectionLock the triples that leave the attacker's best response least harmful.RecoveryFind the last healthy state in the log and roll back, keeping honest edits.ExperimentsFour ontologies, with the numbers behind the demo.

What it is

An agent that answers questions over a knowledge graph reads the graph through an ontology. The ontology says which classes a query term covers and which links may be followed, so editing a few ontology triples changes the answers while every fact in the graph stays intact. Aegis studies that threat from both sides.

  • Attack. Given a query workload and a budget of k edits, find the chain that lowers answer quality most. Aegis searches the tree of edit chains with greedy, beam, random, and UCT (a bandit at every node).
  • Protection. Given room to lock M triples, choose the locks that leave the attacker's best response least harmful.
  • Recovery. Every edit is a logged transaction with its undo. Aegis measures what each edit changed, detects the first harmful commit, and rolls back while keeping honest edits.

Pages

Getting startedInstall, attack a toy ontology, roll it back. ConceptsOntology-grounded queries, harm, and the affected area. Attack searchOperators, feasible chains, and UCT. ProtectionLocking triples against a best response. RecoveryTransactions, backends, detection, and repair. ExperimentsWhat each experiment measures and how to rerun it. ReferenceCommands, modules, and extension points.

Install

git clone https://github.com/lamng3/aegis.git
cd aegis
pip install -e ".[dev]"
python examples/attack_and_recover.py

The code is github.com/lamng3/aegis.