Search papers, labs, and topics across Lattice.
This paper introduces ToolMinimize, a middleware that audits and rewrites tool call arguments in LLM agents to minimize the inclusion of privacy-sensitive data (PSD). Through controlled measurements on three production LLMs, it was found that a significant percentage of tool calls (81-88%) included unnecessary PSD, even with explicit privacy instructions, highlighting a critical gap in existing defenses. ToolMinimize effectively reduces privacy exposure by 81.2-92.0% while maintaining 100% task validity, demonstrating a robust solution to a pressing privacy concern in LLM applications.
ToolMinimize slashes privacy exposure in LLM tool calls by up to 92% without sacrificing task validity, addressing a major vulnerability in AI systems.
LLM agents routinely include privacy-sensitive data (PSD) in tool call arguments beyond what the invoked tools require, crossing trust boundaries to third-party services on every invocation. A controlled measurement on three production LLMs (GPT-4o, Claude 3.5 Sonnet, Llama-3.3-70B) shows that 81--88\% of tool calls include unnecessary PSD under default prompts; explicit privacy instructions still leave 36--76\% over-sharing. Existing defenses gate calls (allow/block) or label flows (information-flow control) but cannot \emph{rewrite} argument values, and PII detection tools miss implicit PSD like ``Memorial Sloan Kettering''(a hospital name that implies a diagnosis). We present \system{}, a middleware that intercepts tool calls and rewrites their arguments to the minimum data necessary for tool functionality, combining schema-aware necessity analysis with four operations: removal, generalization, substitution, and truncation. Live validation on 307 tool calls across the three LLMs above reduces privacy cost by 81.2--92.0\% at 100\% argument-level task validity (TOST equivalence $p{<}0.001$ at $\Delta{=}1.0$); on 25 unannotated Model Context Protocol (MCP) schemas, by 79.0\% with no \texttt{minimum\_necessary} metadata. An optional LLM content-necessity layer strips task-irrelevant PSD from otherwise-necessary free-text fields, raising live-LLM reduction to 85.1--95.6\% and author-schema reduction from 71.1\% to 90.9\%. Median latency is 1.77\,ms.
