Built on the ACFA paper · arXiv:2607.10305 · coordinator-free Byzantine aggregation →

Your distributed compute forks silently across heterogeneous hardware. Memora forces bit-exact consensus.

A Byzantine-fault-tolerant state layer for large-scale federated learning and edge/defence swarms. Fixed-point Strong Eventual Consistency replaces non-deterministic IEEE-754 aggregation, so heterogeneous nodes — ARM, x86, GPU — never silently diverge, even under partition, jamming, or adversarial poisoning. Architected for 50k+ nodes; bit-exact by construction.

50,000 free sandbox tokens to live-test your nodes · exact Q16.16 integer math · ARM and x86 resolve to the identical bytes · large aggregate state offloads to R2 or shards across rooms

The silent fork

Aggregate float tensors across heterogeneous hardware and the result silently forks.

IEEE-754 reduction order is not deterministic across architectures — the same federated update, Krum selection, or mean computed on ARM, x86, or different GPUs can land on a different byte sequence or select a different index. No software patch fixes it; the fix is an exact-arithmetic boundary. And on a network partition a key-value store forks silently and never tells you. There is no mathematical guardrail for shared distributed state.

Memora is that guardrail.

# federated aggregation in float32 — same updates, different silicon
model = np.mean([n.update for n in nodes])
# ARM root a91f4c...   x86 root 4c02e1...   // IEEE-754 reduces in a different order — silently forked

# Memora — exact Q16.16 integer multi-Krum
db.submit_tensor("model", [n.update for n in nodes])
> db.get("model")
root 0bf8038db4421365   // every node byte-identical (SEC)

Near-zero friction

Three lines. Under three seconds to first sync.

1

Install

One pre-compiled Rust wheel. No C-extensions, no NumPy, no build step.

pip install memora-swarm
2

Paste your key

One key, the whole engine — CRDT, E4 trust and ACFA conviction. 50,000 free sandbox tokens to live-test your nodes.

import memora_swarm as memora
db = memora.Blackboard("./swarm.memora",
  node_id="node_12", api_key="opti_sk_...")
3

Synced

Background delta-sync via the nearest region. "Synced" prints in under 3 seconds.

db.connect("swarm_001")
# → Synced ✓

Integrations

Memora secures any stateful payload — FL model updates, drone telemetry, LLM contexts, or vector embeddings.

Already on a framework? Keep the code you have. Each package is a live-tested adapter that routes your framework's shared state through Memora's Byzantine-fault-tolerant engine — and pulls in memora-swarm automatically. One command, everything installed.

LangChain

pip install memora-langchain

A drop-in BaseChatMessageHistory. Shared, poison-resistant chat history for RunnableWithMessageHistory — concurrent writers merge, no turns lost.

MemoraChatMessageHistoryView on PyPI →

CrewAI

pip install memora-crewai

Hands your crew remember_shared / recall_shared plus Byzantine-robust crew_vote / crew_consensus — one rogue agent can't skew the vote or corrupt the memory.

MemoraCrewMemory.tools()View on PyPI →

Microsoft AutoGen

pip install memora-autogen

Implements the autogen_core.memory.Memory protocol. Give every agent on a team one MemoraMemory on the same room and they reason over one trusted, shared context.

MemoraMemoryView on PyPI →

On a custom or unsupported framework? The integration source and getting-started examples show the raw pattern to adapt in a few lines.

Three layers · one full service

Every key gets all three. The same math ships to our cloud and on-prem to you — unchanged.

L1
OR-Set CRDT + delta-state
Conflict-free JSON beliefs. Never forks.
Included
L2
Epistemic layer · drift + human-in-the-loop
Is this value believable now? Drift detection, derived-fact self-repair, and escalation to a human when it can't self-certify — agreement never promotes to authority.
Included
L3
ACFA Q16.16 multi-Krum + G-Set
Byzantine-robust tensors; auto-ban equivocators.
Included

Shield · live conviction

When an agent equivocates, the math convicts its key — permanently, and anyone can verify the proof.

round 1  · 5 agents submit signed tensors
         · resolved root  0bf8038db4421365   byte-identical across the swarm
         · node_5 signs TWO conflicting round-1 tensors  ⚠ equivocation
         · self-authenticating G-Set conviction proof forms automatically
         · convicted set = [node_5]   → excluded from aggregation
         · clean resolved root  0bf8038db4421365   (honest state intact)
round 2  · node_5 re-signs on the same key  →  rejected — the conviction proof is durable

No coordinator. No human in the loop. The conviction proof is a mathematical object anyone can verify — powered by the same Q16.16 kernel in the ACFA paper.

In the wild · 2026

The documented attacks, incidents, and regulations Memora closes.

Multi-agent security is now its own discipline — memory poisoning, self-replicating AI worms, rogue agents, and cascading inter-agent failure. Each item below is a real, published source. Memora is the memory-integrity layer that neutralises the shared-state half of the problem.

OWASP ASI06 · 2026

State Vector Tampering

A single poisoned write silently corrupts every agent that reads shared memory — and, unlike a one-shot prompt injection, it persists across sessions. Agent Security Bench measured an 84% average attack success rate; MINJA reports >95% injection success against production agents.

How Memora closes it: Every write is Ed25519-signed and attributable to a node; the OR-Set CRDT cannot fork, and ACFA multi-Krum rejects poisoned contributions from the agreed state. Geometric outliers are filtered; values within the honest statistical spread are bounded, not eliminated (see paper §7.1).
Source: OWASP Top 10 for Agentic Applications (2026)
Federated learning · model poisoning

Gradient / Update Poisoning

In federated or multi-node training, a malicious client submits crafted gradient or model updates to skew the aggregated model — and floating-point aggregation can itself fork the result across heterogeneous silicon before any attacker acts.

How Memora closes it: ACFA multi-Krum rejects updates outside the honest geometric spread, G-Set Exclusion convicts an equivocating key, and Fixed-Point Integer Arithmetic (Q16.16) makes the aggregate byte-identical across ARM, x86, and GPU — no silent fork.
Source: ACFA — coordinator-free Byzantine aggregation (arXiv:2607.10305)
Incident · Morris-II worm

Self-replicating prompt worms & cascading failure

A zero-click adversarial prompt cascades across a multi-agent network — each infected agent's output is trusted as the next agent's input, turning one compromise into a swarm-wide breach (OWASP ASI08).

How Memora closes it: One compromised agent is mathematically unable to move the agreed aggregate. The cascade is contained — blast radius bounded to the attacker's own node, which is then convicted.
Source: Morris-II, Cornell Tech / IBM
OWASP ASI10 · 2026

Byzantine Endpoint Equivocation

An agent that double-signs or acts maliciously inside the swarm is still treated as a trusted peer by every other agent.

How Memora closes it: G-Set equivocation proofs convict a double-signing key automatically and evict it from the aggregate — a self-authenticating proof, durable across restarts, that anyone can verify.
Source: OWASP GenAI Security Project
Root cause · inter-agent trust

“Internal agent comms are trusted”

Multi-agent systems are built assuming messages between agents are secure and trustworthy — the exact assumption inter-agent attacks and AI worms exploit (OWASP ASI07).

How Memora closes it: Memora removes the assumption entirely: no write is trusted on faith — each is signed, verified, and Byzantine-tolerated before it is allowed to touch shared state.
Source: Multi-Agent Risks from Advanced AI (arXiv:2502.14143)
Regulation · EU AI Act

Art. 12 & 13 — traceability & tamper-proof logging

From 2 August 2026, high-risk AI must automatically log agent identity and every action with cryptographic tamper-evidence and output verification. Non-compliance: up to €35M or 7% of global turnover.

How Memora closes it: Every op is signed, attributable to a node, and exactly replayable from an append-only log with byte-identical roots — a compliance-grade, tamper-evident audit trail by construction.
Source: EU AI Act, Articles 12 & 13

Memora contains, attributes, and evicts — it does not replace input filtering at the model boundary. It is the layer that makes a compromised agent unable to fork, poison, or silently corrupt the rest.

Sandbox-first. One full service.

Every node gets the whole engine — CRDT, E4 trust, and ACFA Byzantine conviction. Live-test on real nodes with 50,000 free sandbox tokens, then move to production.

Full engine, no feature gates
Validate on real nodes — no card
Hosted Sandbox
50,000free tokens
  • ·The full three-layer engine: CRDT + E4 + ACFA
  • ·Unlimited nodes, no feature gates
  • ·50,000 free sandbox tokens on signup
  • ·Test consensus, partition recovery, Byzantine conviction against the live relay
Get your sandbox key
Deploy the native engine
On-Prem / Air-Gapped
Enterprise
  • ·Native memora-core inside your perimeter — edge, HPC, sovereign
  • ·Air-gapped operation; no data leaves your network
  • ·SSO, dedicated support, custom SLAs
  • ·Licence + technical briefing
Request a technical briefing

A sandbox token is a semantic op — a put or a tensor submission, never keepalive, sync, or reads. Idle swarms cost nothing. Continued hosted use beyond the sandbox is metered per op; see pricing details. Production workloads that need air-gapped, edge, or sovereign deployment run the native engine on-prem.