💬 NLP

SlotGuard: Stop Oversharing Private Local Context in LLM Agent Transcri

SlotGuard is a local transcript boundary system that securely prevents LLM agents from leaking private context and credentials by rewriting sensitive data into format-preserving synthetic slots linked via a session graph, thereby achieving zero credential leakage and near-perfect task success without the brittleness of existing redaction methods.

Original authors: Haocheng Xia, Yongjoo Park

Published 2026-07-21

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Haocheng Xia, Yongjoo Park

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a super-smart robot assistant that can do almost anything for you: it can read files on your computer, send emails, run code, and even talk to other software. To do these jobs, the robot needs to see your private information, like your file paths, your email address, and even secret passwords. But here's the catch: to figure out what to do next, the robot often has to send a summary of its work to a giant, cloud-based "brain" (a large language model) owned by a tech company. This summary is called a "transcript."

The problem is that this transcript is like a diary entry that gets sent to a stranger. If the robot accidentally writes down your secret password or your home address in that diary, the cloud company might see it, store it, or even use it to train their future robots. It's like asking a friend to help you bake a cake, but you have to send them a photo of your kitchen, and in that photo, your house key is lying right next to the flour. You want your friend to see the kitchen so they can tell you how to mix the batter, but you definitely don't want them to see your key. This paper tackles the tricky question of how to let the robot see your private world without letting the cloud brain peek at your secrets.

Enter SlotGuard, a clever new system designed to act as a "privacy bouncer" right inside your computer. Think of SlotGuard as a magical translator that sits between your robot assistant and the cloud brain. Its job is to rewrite the robot's diary before it leaves your house. Instead of letting the robot write down your actual secret password (like SuperSecret123!), SlotGuard swaps it for a fake, but perfectly shaped, placeholder (like 🔑-SYNTHETIC-KEY-99).

Here is the magic trick: the fake placeholder looks and feels exactly like the real thing to the cloud brain. If the real password was a long string of letters and numbers, the fake one is also a long string of letters and numbers. If the real file path was /Users/Alice/Secrets/Plan.pdf, the fake one might look like [REPO_ROOT_1]/Secrets/Plan.pdf. The cloud brain can still read the structure—it knows it's a file, it knows it's a secret, and it knows how to talk about it—but it has no idea what the actual secret is. It's like giving the cloud brain a map where the treasure is marked with a generic "X" instead of the real coordinates.

But the magic doesn't stop there. When the cloud brain sends back instructions like "Go open that file," SlotGuard catches the message before it reaches your robot. It checks its own secret list, sees that [REPO_ROOT_1] actually means /Users/Alice/Secrets/Plan.pdf, and swaps the fake back to the real thing only inside your trusted computer. The robot then opens the real file, and the cloud brain never knew the real name existed.

The researchers tested this system with some serious homework. They created thousands of fake scenarios where robots were trying to do tasks involving sensitive data, like reading private documents or using secret keys. They found that without SlotGuard, the robots leaked almost everything—100% of the time. Even simple "redaction" methods, which just replace secrets with words like [PASSWORD], were a disaster; they broke the robot's ability to do its job, causing it to fail 97.5% of the time because the robot got confused by the missing details.

SlotGuard, however, was a game-changer. In their tests, the full version of the system (which includes a smart tracking graph) successfully hid all planted credentials and stopped all credential leaks (0.0% leakage). For structural data like paths and emails, it removed 100% of the visible sensitive characters, with the exception of one specific edge case involving root-owned absolute paths that remains a minor gap in the current prototype. Even better, it didn't break the robot's brain. The robots using SlotGuard were almost as good at their jobs as if they had seen the real secrets, keeping their success rates high across different models. The system is also incredibly fast, taking less than a blink of an eye (about 14 microseconds) to rewrite a single turn of conversation, so it doesn't slow anything down.

The paper also points out what SlotGuard doesn't do. It's not a mind-reading shield; if the cloud brain is smart enough to guess your secret just from the context of the conversation, SlotGuard can't stop that. It also doesn't protect you if your own computer is already hacked. But for the specific problem of keeping your private data from leaking into the cloud transcripts, SlotGuard offers a robust, fast, and smart solution that keeps your secrets safe while letting your robot do its work.

Technical Summary: SlotGuard

Problem Statement

Large Language Model (LLM) agents frequently leak sensitive local information, including file paths, emails, hostnames, and credentials (e.g., API keys), into transcripts sent to upstream model providers. This leakage occurs not only through user prompts but also through tool observations, such as shell logs, file reads, and process listings (e.g., ps output containing environment variable fallbacks). Once these records enter provider-bound transcripts, they may be retained for model training, logged by serving systems, or exposed via operational failures.

Existing mitigation strategies, primarily placeholder-based redaction, are brittle. They often fail to detect embedded or cross-turn references, over-redact benign lookalikes, and, crucially, destroy the structural syntax (e.g., path shapes, file extensions, URI grammar) that agents rely on to reason and execute valid tool calls. This creates a trade-off where strong redaction protects privacy but breaks agent workflows, while weak redaction preserves utility but exposes sensitive data.

Methodology: SlotGuard

SlotGuard is a local transcript boundary designed to sit between the agent runtime and the upstream model provider. It operates by rewriting transcripts before submission and restoring raw values only within the trusted local runtime before execution. The system employs four core mechanisms:

Typed Structural Abstraction: Instead of generic placeholders, SlotGuard converts structural bindings (paths, hostnames, emails) into stable, typed slots (e.g., [REPO_ROOT_1], [EMAIL_1]). These slots are deterministic within a session (using HMAC with a session secret) but unlinkable across sessions. Crucially, the system performs suffix-aware abstraction, preserving the file extension and a bounded, task-relevant suffix while replacing the sensitive root and middle components (e.g., /Users/alice/acme/legal/... $\rightarrow$ [REPO_ROOT_1]/legal/[SENSITIVE_DOC_1].pdf).
Format-Preserving Synthetic Substitution (FPS): For secret values (API keys, tokens), SlotGuard replaces raw credentials with synthetic tokens that strictly adhere to the original format class (e.g., a valid-looking database URI or API key string) but contain no characters derived from the original secret. This ensures the model sees syntactically valid, "executable-looking" handles rather than opaque labels like API_KEY.
Session-Scoped Tracking: SlotGuard maintains a session-scoped slot table ( $T$ ) mapping raw values to handles and a lightweight Semantic Entity Graph (SEG). The SEG tracks coreference, embedding, derivation, and keyword-based references across turns, allowing the system to protect values that appear indirectly or as derived forms, not just exact string matches.
Guarded Rebinding: Raw values are never sent to the provider. They are only restored inside the trusted runtime when a tool execution is requested. SlotGuard validates that handles exist in the session table, match expected types, and fall within allowed scopes. It rejects spoofed handles, out-of-scope paths, and shell metacharacter injection attempts.

Key Contributions

The paper identifies two orthogonal privacy surfaces in agent transcripts: structural bindings (identifiers like paths and emails) and secret values (credentials). The primary contributions are:

Systematic Integration: The integration of typed structural abstraction, format-preserving synthetic substitution, cross-turn tracking (SEG), and guarded local rebinding into a single enforceable boundary.
Compatibility Preservation: Demonstrating that preserving execution-relevant structure (path shape, file type, credential syntax) is critical for downstream agent performance, a factor often overlooked by generic redaction tools.
Enforceable Boundary: Positioning the system as a guardrail at the agent harness (or filesystem/model gateway layers) that interposes on tool outputs and runtime observations, rather than relying solely on user prompts.

Evaluation Results

The authors evaluated SlotGuard using synthetic privacy corpora, controlled workflow probes, and a replay set derived from TheAgentCompany (TAC-lite) across four upstream models (DeepSeek, gpt-5.4, Kimi, Llama).

Privacy Leakage:
- Structural: SlotGuard removed all 20,814 annotated sensitive characters across 9,229 paths, achieving 0.0% structural leakage.
- Credentials: Across 852 planted credential values, SlotGuard reduced leakage to 0.0%. In contrast, baselines using only typed placeholders or FPS without the SEG leaked 23.5% of credentials due to reconstructible split/embedded exposures.
Workflow Compatibility & Task Success:
- Generic redaction caused task success rates to collapse to 2.5% across all models.
- SlotGuard maintained performance close to raw transcripts: matching raw scores for Kimi and Llama, staying within 2.0 points for gpt-5.4, and within 10.5 points for DeepSeek.
- In the TAC-lite replay benchmark, SlotGuard matched raw scores for three of four models, whereas generic redaction failed completely (0.0%).
Runtime Overhead: The rewriting process is highly efficient, with a median latency of 14.424 µs per agent turn. The optional semantic detector (used for hard-to-detect filenames) adds latency (~742 ms warm) but is not required for the fast path.

Significance and Claims

The paper claims that SlotGuard establishes a "compatibility-preserving local boundary" that effectively mediates between transcript privacy and tool access. It argues that the key to privacy in agent systems is not merely hiding values but doing so without destroying the syntactic and structural cues required for reasoning.

The authors explicitly note limitations and modest claims:

SlotGuard is not a full anonymization system; it cannot prevent semantic inference from non-literal context or protect against a compromised local runtime.
The current evaluation relies on synthetic and replay-style workloads with planted ground truth; validation on production traces with naturally occurring sensitive data is a necessary future step.
The Semantic Entity Graph (SEG) is an early implementation relying on keyword/pattern links rather than full semantic understanding, representing a conservative first step toward handling indirect leakage.
The system does not measure adversarial reconstruction by capable attackers actively attempting to recover values from residual context.

Consequently, the authors position SlotGuard as a necessary layer in a broader privacy posture, designed to reduce unnecessary exposure of local identifiers and credentials to upstream providers while maintaining agent utility.