SlotGuard: Stop Oversharing Private Local Context in LLM Agent Transcri

2026-07-19

AI Summary

This work addresses the critical risk of sensitive data leakage—such as file paths, email addresses, and API credentials—when large language model (LLM) agents upload tool invocation logs to external service providers. To mitigate this, the authors propose a structure-aware local redaction boundary mechanism that employs type- and suffix-aware slot rewriting, format-preserving synthetic value substitution for secrets, and a lightweight session graph to maintain cross-turn references, restoring original data only within trusted execution environments. This approach overcomes key limitations of conventional placeholder-based anonymization, including omissions, over-redaction, and structural corruption. Evaluated on a test set of 9,229 paths, the method completely eliminates 20,814 sensitive characters and achieves 0% leakage across 852 injected credentials, while preserving task success rates nearly equivalent to unredacted transcripts—unlike generic methods, which drop to 2.5%. Median per-turn processing overhead is only 14.424 microseconds.

Abstract

LLM agents can leak privacy (e.g., paths, emails) and credentials (e.g., API keys) as agent observations (e.g., tool outputs, shell logs, and file reads) are appended to provider-bound transcripts. Existing placeholder redaction is brittle: it can miss embedded or cross-turn references, over-redact benign lookalikes, and destroy the structure useful for reasoning. We present SlotGuard, a local transcript boundary that can hide sensitive data while retaining agents' performance. SlotGuard rewrites structural bindings as typed, suffix-aware slots, replaces secrets with format-preserving synthetic values, links cross-turn references with a lightweight session graph, and restores raw values only inside the trusted runtime. On controlled repository-oriented agent transcripts, SlotGuard removes all 20,814 annotated structurally sensitive characters across 9,229 paths and reduces credential leakage to 0.0\% across 852 planted values. It remains close to raw-transcript task success across four upstream models, while generic redaction drops to 2.5\%. Transcript rewriting takes a median of 14.424~$μ$s per agent turn. The code is publicly accessible at https://github.com/illinoisdata/SlotGuard.

Problem

• privacy leakage
• credential exposure
• LLM agent transcripts
• sensitive data redaction
• local context oversharing

Innovation

• SlotGuard
• privacy-preserving LLM agents
• structured redaction
• format-preserving synthesis
• session-aware de-identification