💻 computer science

ToolMinimize: Auditing and Rewriting LLM Agent Tool Calls to Minimize Privacy Exposure

ToolMinimize is a middleware system that audited and rewrites LLM agent tool calls to strip unnecessary privacy-sensitive data through schema-aware analysis and argument transformations, achieving significant privacy reduction while maintaining 100% task validity.

Original authors: Wenbiao Li, Yuqiao Xu

Published 2026-08-27

📖 6 min read🧠 Deep dive

CC0 1.0

Original authors: Wenbiao Li, Yuqiao Xu

Original paper dedicated to the public domain under CC0 1.0 (http://creativecommons.org/publicdomain/zero/1.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the modern digital landscape, artificial intelligence assistants have evolved from simple chatbots into active agents capable of performing complex tasks. When a user asks such an agent to check the weather, book a flight, or schedule a meeting, the system does not simply reply with text; it reaches out to external services, known as tools, to gather the necessary information and execute the request. This process involves the agent sending a specific set of instructions and data to a third-party server. While this architecture allows for powerful functionality, it creates a hidden vulnerability: the agent often sends far more information than the tool actually needs to do its job. Just as a person might tell a taxi driver their full life story when they only need to provide a destination address, these AI agents frequently include sensitive personal details—such as medical conditions, financial status, or home addresses—in their requests, crossing the boundary of trust between the user and the service provider.

Researchers at Case Western Reserve University have identified this phenomenon as a systemic flaw in how current AI agents operate. They found that under standard conditions, these agents routinely overshare private data, including details that reveal a user's health status, location, or personal habits, even when the tool being used requires only a city name or a date. This over-sharing happens because the agents are optimized to be helpful, leading them to include every available piece of context in their requests, regardless of whether that context is safe to transmit. The problem is not solved by simply telling the AI to be more careful; even when users explicitly instruct the system to minimize data sharing, the agents still leak a significant amount of sensitive information. Existing security measures, which typically act as a simple gatekeeper to either allow or block a request entirely, are insufficient because they cannot edit the content of the message. If a request contains a mix of necessary and unnecessary data, blocking it prevents the task from being completed, while allowing it exposes the user's privacy.

To address this, the research team developed a new system called ToolMinimize, which acts as a sophisticated filter sitting between the AI agent and the external tools it calls. Instead of blocking requests or relying on the AI to self-censor, this system intercepts every message, analyzes exactly what data is required for the specific tool to function, and then rewrites the message to strip away everything else. The system operates by first identifying sensitive information, such as a specific hospital name that implies a diagnosis or a full street address, and then applying one of four strategies to protect the user. It can remove unnecessary fields entirely, generalize specific details to a broader category (like changing a precise address to just a city name), substitute sensitive values with generic placeholders, or truncate data to a safer length. Crucially, this rewriting happens without breaking the task; the tool still receives the exact information it needs to succeed, but the user's private details remain hidden.

The researchers tested this approach across three major artificial intelligence models and a wide variety of real-world scenarios, ranging from scheduling medical appointments to searching for support groups. Their measurements revealed that without intervention, between 81 and 88 percent of tool calls contained unnecessary private data. Even when users added specific privacy instructions to their prompts, the agents still overshared in 36 to 76 percent of cases. However, when the ToolMinimize system was active, it successfully reduced the privacy cost of these interactions by between 81 and 92 percent, all while maintaining a perfect success rate for the tasks being performed. The system proved effective even when dealing with complex data that traditional privacy tools often miss, such as the name of a cancer treatment center which, while not a direct identifier, clearly implies a serious health condition. By combining a deep understanding of what each tool requires with a careful analysis of the data being sent, the system ensures that only the minimum necessary information crosses the trust boundary.

The performance of this system is both robust and efficient. In live tests involving hundreds of tool calls, the middleware processed requests in a fraction of a second, adding negligible delay to the user experience. The researchers also found that the system works effectively across different types of software frameworks and can handle tools that do not have detailed instructions about what data is strictly necessary. In cases where the system had to guess the requirements, it still managed to reduce privacy exposure by nearly 80 percent. When an optional layer was added to analyze the specific content of free-text fields, the reduction in privacy risk climbed even higher, reaching over 95 percent in some instances. This demonstrates that the problem of oversharing is not a result of a lack of user caution or poor AI training, but rather a structural issue in how agents communicate with external services.

The study explicitly rules out the idea that current safety training or simple privacy prompts are sufficient to solve this problem. The data shows that even the most advanced models continue to leak sensitive information when left to their own devices, driven by their core objective to be as helpful as possible. Furthermore, the research argues against the notion that blocking entire requests is a viable solution, as this would render the agents useless for many common tasks. Instead, the findings point to the necessity of a middle ground: a system that understands the nuance of data minimization, distinguishing between what is essential for a task and what is merely context. By rewriting the arguments of tool calls rather than rejecting them, this approach preserves the utility of the agent while drastically reducing the risk of privacy exposure.

Ultimately, the work presented in this paper offers a practical path forward for securing the next generation of AI assistants. It shifts the focus from trying to train the AI to be less helpful to building a protective layer that ensures the AI's helpfulness does not come at the cost of user privacy. The results indicate that it is possible to have agents that are both highly capable and respectful of personal boundaries, provided that the data they transmit is carefully curated before it leaves the user's device. As these systems become more integrated into daily life, the ability to automatically strip away unnecessary details will be essential for maintaining trust and safety in an increasingly connected world.

Technical Summary: ToolMinimize – Auditing and Rewriting LLM Agent Tool Calls to Minimize Privacy Exposure

1. Problem Statement

Large Language Model (LLM) agents routinely include Privacy-Sensitive Data (PSD) in tool call arguments that exceeds the functional requirements of the invoked tools. This phenomenon, termed tool call over-sharing, occurs because agents optimize for task completion and helpfulness rather than data minimization. Consequently, agents cross trust boundaries to third-party services with unnecessary data on every invocation.

The paper identifies that existing defenses are insufficient:

Allow/Block Gating: Systems like AudAgent or PrivacyChecker operate at the call level or use binary allow/block decisions. They cannot rewrite argument values; thus, a tool call containing sensitive data (e.g., a cancer center name in a weather query) is either blocked (losing task utility) or allowed (leaking data).
Information Flow Control (IFC): Systems like Fides or CaMeL track confidentiality labels but do not perform graduated rewriting of individual fields.
PII Detection: Tools like Presidio rely on pattern matching and Named Entity Recognition (NER). They fail to detect implicit PSD (e.g., "Memorial Sloan Kettering" implies a health condition but is not a standard PII pattern) and are schema-unaware, unable to distinguish between necessary and unnecessary data fields.

Empirical measurements on three production LLMs (GPT-4o, Claude 3.5 Sonnet, Llama-3.3-70B) reveal that 81–88% of tool calls under default prompts contain unnecessary PSD. Even with explicit privacy instructions, over-sharing persists in 36–76% of calls.

2. Methodology: ToolMinimize

ToolMinimize is a middleware solution that intercepts tool calls between the agent's argument construction (V3) and tool execution (V4). It operates without modifying the LLM, the agent framework, or the tools themselves. The system employs a four-stage pipeline:

A. PSD Taxonomy and Classification

The system utilizes a taxonomy of 10 PSD categories grounded in GDPR Article 9 classifications (e.g., Direct Identifiers, Health, Financial, Location, Implicit Context).

Two-Stage Classifier:
1. Pattern + Entity Extraction: Uses deterministic regex and entity extraction to identify standard PII and facility names.
2. Semantic Classifier: Detects implicit PSD (e.g., inferring a diagnosis from a hospital name) and handles encoded strings (e.g., Base64).
- Note: The system can optionally integrate a spaCy NER backend for higher recall at the cost of increased latency.

B. Privacy Cost Metric (PC)

A quantitative metric, PC(t, args), is calculated for every tool call to rank privacy exposure.
$PC(t, args) = \sum_{j=1}^{|P|} S(p_j) \cdot E(f) \cdot N(p_j, f)$
Where:

$S(p_j)$ : Sensitivity level of the PSD item (1–4, based on GDPR tiers).
$E(f)$ : Exposure factor based on the trust relationship of the tool host (e.g., Third-Party No DPA = 1.0).
$N(p_j, f)$ : Necessity flag (0 if the field is marked minimum_necessary in the schema, 1 otherwise).

C. Schema-Aware Necessity Analysis

The system analyzes the tool's JSON Schema to determine field dispositions:

Required vs. Optional: Optional fields containing PSD are candidates for removal.
Minimum Necessary: If a schema includes minimum_necessary annotations (e.g., a weather tool requires "city" but not "street address"), the system identifies data exceeding this granularity.
Semantic Necessity: For required fields, the system applies tool-type-specific handlers (e.g., generalizing a calendar title or stripping identifiers from search queries).

D. Graduated Rewriting

Instead of blocking calls, ToolMinimize applies four operations to minimize data while preserving task validity:

Removal: Deleting optional, unnecessary fields.
Generalization: Coarsening values (e.g., "1275 York Ave" $\to$ "New York, NY").
Substitution: Replacing values with synthetic, schema-valid data (e.g., user@example.com).
Truncation: Rounding GPS coordinates or shortening ZIP codes.

An optional Content-Necessity Layer uses an LLM to evaluate whether specific PSD within a "necessary" free-text field (e.g., an email body) is essential to the task, stripping task-irrelevant disclosures.

3. Key Contributions

Empirical Evidence: A controlled study demonstrating that over-sharing is pervasive across production LLMs and that safety training/privacy prompts are insufficient to prevent it.
ToolMinimize System: The first system to perform schema-aware, argument-level data minimization via graduated rewriting rather than binary gating.
Quantitative Metric: A privacy cost metric ( $PC$ ) that combines sensitivity, trust, and necessity, validated for ranking stability across weight perturbations.
AgentPrivBench: An open-source benchmark with ground-truth PSD annotations and standardized privacy metrics for evaluating agent privacy.
Comprehensive Evaluation: Validation across three agent frameworks (AutoGen, MCP, LangChain), four LLM profiles, and real-world MCP schemas.

4. Results

The evaluation was conducted on 307 live tool calls across GPT-4o, Claude Sonnet, and Llama-3.3-70B, as well as on 90 curated scenarios and 25 unannotated real-world MCP schemas.

Privacy Reduction:
- Schema-only ToolMinimize: Achieved an 81.2–92.0% reduction in privacy cost on live LLM outputs with 100% argument-level task validity (TCR).
- With Content-Aware Extension: Reduction increased to 85.1–95.6% by stripping task-irrelevant PSD from free-text fields.
- Unannotated Schemas: Achieved 79.0% reduction on 25 real-world MCP schemas without minimum_necessary metadata.
- Comparison: ToolMinimize reduced residual privacy cost by 7.3× compared to PII Detection tools and achieved significantly higher Data Minimization Scores (DMS) than gating-based baselines.
Task Validity:
- ToolMinimize maintained 100% TCR (schema validity) in the main evaluation.
- In end-to-end execution tests against mock endpoints, 80% of scenarios produced functionally equivalent results. Failures occurred primarily in map scenarios where required addresses were removed due to missing minimum_necessary annotations.
Performance:
- Latency: The schema-only path has a median latency of 1.77 ms.
- Content-Aware Path: Adds approximately 800 ms per call (one LLM inference) but is applied selectively to free-text fields.
- Framework Integration: Adapter overhead across AutoGen, MCP, and LangChain was negligible (<0.1 ms).

5. Significance and Claims

The paper claims that ToolMinimize addresses a critical gap in agent security: the inability of existing systems to rewrite tool arguments to the minimum necessary data.

Structural Nature of Over-Sharing: The authors argue that over-sharing is a structural consequence of the "helpfulness" objective in LLMs, not merely a failure of safety training. Therefore, middleware intervention is necessary.
Complementarity: ToolMinimize is designed to be complementary to existing IFC and gating systems. While gating systems prevent data flow, ToolMinimize minimizes the data within allowed flows.
Practicality: The system operates with low latency and does not require retraining LLMs or modifying tool providers, making it a deployable middleware solution.
Limitations: The authors acknowledge that the system relies on classifier recall (missed items are not rewritten) and that minimum_necessary annotations are crucial for optimal performance. Adversarial encoding (e.g., field splitting) and multimodal PSD remain open challenges.

In summary, ToolMinimize demonstrates that argument-level rewriting is a viable and effective strategy for reducing privacy exposure in LLM agents, achieving high privacy cost reduction without sacrificing task utility.