{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/arxiv-2606-29567","title":"SurrogateShield: Beyond Redaction for High-Utility, Privacy-Preserving LLM Interactions","arxiv_id":"2606.29567","date":"2026-06-28","proceeding":null,"authors":["Sherwin Vishesh Jathanna"],"abstract":"LLM-based assistants transmit user queries verbatim to third-party API endpoints that lie outside the user's audit or control. When those queries contain personally identifiable information (PII), the data persists on remote infrastructure subject to breach, subpoena, or policy change. Placeholder redaction (the prevailing mitigation) suppresses PII at the cost of semantic coherence, producing structurally degraded queries and correspondingly degraded responses. We present SurrogateShield, a client-side proxy that substitutes detected PII with locally generated, type-consistent surrogate values prior to transmission and restores originals in the response. No real PII crosses the network boundary. Detection runs through a three-stage cascade (PatternScan, EntityTrace, and ContextGuard) covering 22 PII types and quasi-identifier combinations grounded in Sweeney's k-anonymity framework. Surrogate-to-original mappings are sealed in an AES-256-GCM encrypted per-conversation ShadowMap that never leaves the device. Evaluations on a 1,124-query corpus demonstrate that the cascade reliably detects PII, achieving an overall F1 score of 98.87%. Surrogate substitution substantially outperforms placeholder redaction in semantic utility, yielding a 13.26 pp improvement in BERTScore (roberta-large), from 81.59% to 94.85%. Within this corpus, the local pipeline restricted real PII transmission across all tested query types; in a 100-query adversarial trial, a prompted LLM adversary recovered no original values from surrogate-substituted messages.","url_abs":"https://arxiv.org/abs/2606.29567","url_pdf":"https://arxiv.org/pdf/2606.29567","source":{"archive":null,"snapshot":"2025-07-28","note":"not in the Papers with Code archive (frozen at the snapshot)","row_kind":"graph","title_abstract_authors_date":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)"},"code_links":[],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":null,"atlas_url":"https://app.syntology.ai/?focus=2606.29567","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2606.29567"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/sherwinvishesh/SurrogateShield","reach":null}],"summary":{"ran":1,"ran_draft_wrong":6,"ran_violates":2,"unverified":3},"by_repo_kind":{"found_in_text":{"samples":12,"ran":9,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"dd4adff666d413c9","entry":"QuasiIdMatch","repo":"sherwinvishesh/SurrogateShield","repo_kind":"found_in_text","path":"python-library/surrogateshield/core/detection/pipeline.py","file_url":"https://github.com/sherwinvishesh/SurrogateShield/blob/HEAD/python-library/surrogateshield/core/detection/pipeline.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"dd4adff666d413c9"}},{"code_sha256_prefix":"0031a3b84bb488ce","entry":"_all_sub_clauses","repo":"sherwinvishesh/SurrogateShield","repo_kind":"found_in_text","path":"python-library/surrogateshield/core/detection/pipeline.py","file_url":"https://github.com/sherwinvishesh/SurrogateShield/blob/HEAD/python-library/surrogateshield/core/detection/pipeline.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"0031a3b84bb488ce"}},{"code_sha256_prefix":"7fe9469eb2b677b7","entry":"_contains_entity","repo":"sherwinvishesh/SurrogateShield","repo_kind":"found_in_text","path":"python-library/surrogateshield/core/detection/pipeline.py","file_url":"https://github.com/sherwinvishesh/SurrogateShield/blob/HEAD/python-library/surrogateshield/core/detection/pipeline.py","link_basis":"first_harvest_node","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"7fe9469eb2b677b7"}},{"code_sha256_prefix":"b6a9c9b1919a38af","entry":"_deduplicate_person_components","repo":"sherwinvishesh/SurrogateShield","repo_kind":"found_in_text","path":"python-library/surrogateshield/core/detection/pipeline.py","file_url":"https://github.com/sherwinvishesh/SurrogateShield/blob/HEAD/python-library/surrogateshield/core/detection/pipeline.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"b6a9c9b1919a38af"}},{"code_sha256_prefix":"bd858304a45e93bd","entry":"_detect_structural_orgs","repo":"sherwinvishesh/SurrogateShield","repo_kind":"found_in_text","path":"python-library/surrogateshield/core/detection/pipeline.py","file_url":"https://github.com/sherwinvishesh/SurrogateShield/blob/HEAD/python-library/surrogateshield/core/detection/pipeline.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"bd858304a45e93bd"}},{"code_sha256_prefix":"bf4cf35a0f0a56c3","entry":"_is_proper_capitalized","repo":"sherwinvishesh/SurrogateShield","repo_kind":"found_in_text","path":"python-library/surrogateshield/core/detection/pipeline.py","file_url":"https://github.com/sherwinvishesh/SurrogateShield/blob/HEAD/python-library/surrogateshield/core/detection/pipeline.py","link_basis":"first_harvest_node","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"bf4cf35a0f0a56c3"}},{"code_sha256_prefix":"5e055523fa9d559b","entry":"_reclassify_email_username_orgs","repo":"sherwinvishesh/SurrogateShield","repo_kind":"found_in_text","path":"python-library/surrogateshield/core/detection/pipeline.py","file_url":"https://github.com/sherwinvishesh/SurrogateShield/blob/HEAD/python-library/surrogateshield/core/detection/pipeline.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"5e055523fa9d559b"}},{"code_sha256_prefix":"436ab3e7c0faef8e","entry":"_reclassify_location_orgs","repo":"sherwinvishesh/SurrogateShield","repo_kind":"found_in_text","path":"python-library/surrogateshield/core/detection/pipeline.py","file_url":"https://github.com/sherwinvishesh/SurrogateShield/blob/HEAD/python-library/surrogateshield/core/detection/pipeline.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"436ab3e7c0faef8e"}},{"code_sha256_prefix":"e0af88246f42930d","entry":"mask_spans","repo":"sherwinvishesh/SurrogateShield","repo_kind":"found_in_text","path":"python-library/surrogateshield/core/detection/pipeline.py","file_url":"https://github.com/sherwinvishesh/SurrogateShield/blob/HEAD/python-library/surrogateshield/core/detection/pipeline.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"e0af88246f42930d"}},{"code_sha256_prefix":"3d01b0e5fd58bc20","entry":"_TaggedList","repo":"sherwinvishesh/SurrogateShield","repo_kind":"found_in_text","path":"python-library/surrogateshield/core/detection/pipeline.py","file_url":"https://github.com/sherwinvishesh/SurrogateShield/blob/HEAD/python-library/surrogateshield/core/detection/pipeline.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"3d01b0e5fd58bc20"}},{"code_sha256_prefix":"1b2334c96fdbb862","entry":"_filter_topical_geo_entities","repo":"sherwinvishesh/SurrogateShield","repo_kind":"found_in_text","path":"python-library/surrogateshield/core/detection/pipeline.py","file_url":"https://github.com/sherwinvishesh/SurrogateShield/blob/HEAD/python-library/surrogateshield/core/detection/pipeline.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"1b2334c96fdbb862"}},{"code_sha256_prefix":"e9a0763bb9752e7a","entry":"run_cascade","repo":"sherwinvishesh/SurrogateShield","repo_kind":"found_in_text","path":"python-library/surrogateshield/core/detection/pipeline.py","file_url":"https://github.com/sherwinvishesh/SurrogateShield/blob/HEAD/python-library/surrogateshield/core/detection/pipeline.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"e9a0763bb9752e7a"}}]},"arxiv_metadata":{"licence":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)","fields":["title","abstract","authors","date"],"primary_category":"cs.CL","source":"arxiv_2026.jsonl"},"syntology_extracted_results":{"kind":"leaderboard_placements","source":"Syntology's leaderboard-shaped extractor over the paper's own arXiv-HTML tables: a model pointed at a cell, the number was read from that cell and checked against the board's metric, dataset, split and scale, and an independent check accepted the entry; not reviewed by the paper's authors or the archive's editors","extractor_model":"global.anthropic.claude-sonnet-4-5-20250929-v1:0","verifier_model":null,"prompt_sha":"fa63d4bb9d755694","coverage":{"sentence":"Syntology has checked 6,795 of the 9,581 papers on this site that are newer than the archive; results from the others appear after they are checked.","papers_newer_than_archive":9581,"papers_checked":6795},"entries":[],"not_placed":{"boards":0,"rejected_by_independent_check":0,"refused_by_a_rule":0,"check_did_not_answer":0,"proposed_without_a_cell":0,"declined_by_site":0}}}