Search papers, labs, and topics across Lattice.
This paper introduces SurrogateShield, a client-side proxy that replaces personally identifiable information (PII) in user queries with type-consistent surrogate values before they are sent to third-party APIs, ensuring that no real PII is transmitted. The method employs a three-stage detection cascade that achieves an impressive F1 score of 98.87% across 22 PII types, while significantly enhancing semantic coherence compared to traditional placeholder redaction. Evaluations indicate a substantial improvement in response quality, with BERTScore increasing from 81.59% to 94.85% due to the effective surrogate substitution approach.
SurrogateShield not only prevents PII leakage but also enhances the semantic quality of LLM responses, outperforming conventional redaction methods.
LLM-based assistants transmit user queries verbatim to third-party API endpoints that lie outside the user's audit or control. When those queries contain personally identifiable information (PII), the data persists on remote infrastructure subject to breach, subpoena, or policy change. Placeholder redaction (the prevailing mitigation) suppresses PII at the cost of semantic coherence, producing structurally degraded queries and correspondingly degraded responses. We present SurrogateShield, a client-side proxy that substitutes detected PII with locally generated, type-consistent surrogate values prior to transmission and restores originals in the response. No real PII crosses the network boundary. Detection runs through a three-stage cascade (PatternScan, EntityTrace, and ContextGuard) covering 22 PII types and quasi-identifier combinations grounded in Sweeney's k-anonymity framework. Surrogate-to-original mappings are sealed in an AES-256-GCM encrypted per-conversation ShadowMap that never leaves the device. Evaluations on a 1,124-query corpus demonstrate that the cascade reliably detects PII, achieving an overall F1 score of 98.87%. Surrogate substitution substantially outperforms placeholder redaction in semantic utility, yielding a 13.26 pp improvement in BERTScore (roberta-large), from 81.59% to 94.85%. Within this corpus, the local pipeline restricted real PII transmission across all tested query types; in a 100-query adversarial trial, a prompted LLM adversary recovered no original values from surrogate-substituted messages.
