PaperlayerView exact revision on arXiv

Source-linked AI summary

ToolMinimize: Auditing and Rewriting LLM Agent Tool Calls to Minimize Privacy Exposure

Wenbiao Li, Yuqiao Xu

arXiv:2608.24957v1cs.CRcs.SE

TL;DR

LLM tool calls often overshare privacy-sensitive data, especially in free-text fields, while existing defenses do not rewrite argument values. TOOLMINIMIZE intercepts calls for schema-aware graduated rewriting and reduces privacy cost substantially while preserving argument-level validity, with further reductions from optional content analysis.

Abstract

from arXiv · show

LLM agents routinely include privacy-sensitive data (PSD) in tool call arguments beyond what the invoked tools require, crossing trust boundaries to third-party services on every invocation. A controlled measurement on three production LLMs (GPT-4o, Claude 3.5 Sonnet, Llama-3.3-70B) shows that 81--88\% of tool calls include unnecessary PSD under default prompts; explicit privacy instructions still leave 36--76\% over-sharing. Existing defenses gate calls (allow/block) or label flows (information-flow control) but cannot \emph{rewrite} argument values, and PII detection tools miss implicit PSD like ``Memorial Sloan Kettering'' (a hospital name that implies a diagnosis). We present \system{}, a middleware that intercepts tool calls and rewrites their arguments to the minimum data necessary for tool functionality, combining schema-aware necessity analysis with four operations: removal, generalization, substitution, and truncation. Live validation on 307 tool calls across the three LLMs above reduces privacy cost by 81.2--92.0\% at 100\% argument-level task validity (TOST equivalence $p{<}0.001$ at $Δ{=}1.0$); on 25 unannotated Model Context Protocol (MCP) schemas, by 79.0\% with no \texttt{minimum\_necessary} metadata. An optional LLM content-necessity layer strips task-irrelevant PSD from otherwise-necessary free-text fields, raising live-LLM reduction to 85.1--95.6\% and author-schema reduction from 71.1\% to 90.9\%. Median latency is 1.77\,ms.

I. INTRODUCTION

Tool call over-sharing is a pervasive, empirically measured privacy problem: production LLMs routinely send unnecessary PSD across the agent–tool boundary. TOOLMINIMIZE addresses it with middleware that analyzes and rewrites arguments before execution.

Motivation

  • Tool call over-sharing exposes PSD to third-party services even when tools function correctly with less data.Examples include health-related context in weather, calendar, email, and search requests.Source: §I · p. 1
  • 81–88% of tool calls contain unnecessary PSD under default prompts across GPT-4o, Claude 3.5 Sonnet, and Llama-3.3-70B.Explicit privacy prompts reduce over-sharing to 36–76%, with limited effect on Llama.Source: §I · p. 1, §II · p. 2

Approach

  • TOOLMINIMIZE intercepts calls before execution and rewrites arguments to the minimum necessary data without modifying the LLM, framework, or tools.Its design responds to over-sharing as an inference-time behavior that privacy prompts do not reliably prevent.Source: §I · p. 2, §II · p. 3
  • The system combines PSD classification, quantitative privacy-cost scoring, schema-aware necessity analysis, and removal, generalization, substitution, and truncation.The paper also introduces a 10-category PSD taxonomy grounded in GDPR Article 9 classifications.Source: §I · p. 2

Evaluation

  • The motivating study queried 20 everyday tasks using function-calling APIs under default and explicit-privacy conditions.Tasks used standard tools such as weather, calendar, search, email, and maps, with annotations of necessary versus unnecessary PSD.Source: §II · p. 2

III. THREAT MODEL

The threat model places the main intervention at the semi-trusted agent–tool boundary, where tool operators are distinct entities and a request may trigger multiple calls. TOOLMINIMIZE intercepts calls after argument construction and before execution.

Trust Boundaries

  • The agent–tool boundary is semi-trusted because the agent and tool operators are distinct entities with separate data policies.A single request may trigger 5–20 tool calls.Source: A. System Model · p. 3

Intervention Point

  • TOOLMINIMIZE intercepts every tool call between argument construction (V3) and tool execution (V4).It requires no modifications to the LLM, framework, or tools.Source: A. System Model · p. 3
  • Minimum_necessary schema annotations provide the highest analysis accuracy; otherwise, the middleware falls back to required-versus-optional distinctions.Source: A. System Model · p. 3

B. Adversary Model

The paper considers privacy exposure from semi-honest tools, network observers, aggregators, and delegation across agent boundaries. Its primary target is tool-call over-sharing, while related delegation threats remain part of the broader model.

Adversaries

Scope

  • C-1 tool-call over-sharing is the primary target because it affects every tool call, crosses trust boundaries on each invocation, and is invisible to users.Reducing argument PSD also reduces data available for exfiltration and fragments available for cross-tool aggregation.Source: C. Privacy Threats · p. 3

Delegation Threats

  • Delegation can expose full conversational context to agents with weaker privacy policies and create transitive exposure chains when receiving agents invoke tools.Source: C. Privacy Threats · p. 3

D. Scope and Assumptions

TOOLMINIMIZE targets tool-call over-sharing under schema- and hook-based assumptions, using staged classification, scoring, analysis, and rewriting. Its guarantees are bounded by classifier recall, missing annotations, and out-of-scope encodings and categories.

Scope

  • TOOLMINIMIZE primarily mitigates C-1 over-sharing while also reducing data available for tool-level exfiltration and cross-tool aggregation.Source: D. Scope and Assumptions · p. 3

Assumptions

  • The system assumes JSON Schema tool inputs, JSON key-value arguments, an execution hook, and observable tool success.Tools without schemas receive conservative defaults.Source: D. Scope and Assumptions · p. 3

Guarantees and Boundaries

  • Every detected PSD item marked unnecessary is removed or generalized before transmission, but residual exposure depends on classifier recall.The stated bound assumes missed items are unnecessary and excludes adversarial encodings, out-of-taxonomy categories, and some required-field failures.Source: D. Scope and Assumptions · p. 3

Pipeline

  • The pipeline classifies PSD, scores privacy cost, analyzes schema-based field necessity, and rewrites arguments before execution.Scoring occurs before analysis so calls can be logged even when rewriting is disabled.Source: A. Pipeline Overview · pp. 3–4, Figure 2 · p. 4

PSD Taxonomy

  • The PSD taxonomy contains 10 categories with sensitivity levels and examples, grounded in GDPR Article 9 classifications.Source: Table II · p. 4

B. PSD Taxonomy

The paper defines privacy-sensitive data (PSD) through a GDPR-grounded taxonomy and scores unnecessary PSD using sensitivity, exposure, and necessity.

  • The taxonomy contains 10 PSD categories grounded in GDPR Article 9 and empirical corpus analysis.Source: B. PSD Taxonomy · p. 4
  • Sensitivity levels range from S=1 to S=4, with Article 9 special categories assigned S=4 and quasi-identifiers assigned S=3.These levels approximate harm rather than determine compliance.Source: B. PSD Taxonomy · p. 4
  • Privacy Cost combines each PSD item's sensitivity, the hosting server's exposure level, and whether the field is necessary.Only unnecessary PSD contributes to the score.Source: C. Privacy Cost Metric · p. 4
  • Necessity is binary: PSD in minimum-necessary fields scores 0, while other PSD scores 1; without annotations, required fields are necessary and optional fields unnecessary.Source: C. Privacy Cost Metric · p. 4
  • The additive metric omits interaction effects, while its ordinal method rankings remain invariant across 110 monotone weight perturbations.The reported robustness is Kendall's τ = 1.0.Source: C. Privacy Cost Metric · p. 4
  • A weather-call example scores PC = 10.0 before generalization and retains only city-level data after changing the location to “New York, NY.”The original call contains facility name, street address, and ZIP PSD items.Source: C. Privacy Cost Metric · p. 4

D. Classifier, Analyzer, and Rewriter

TOOLMINIMIZE detects explicit and implicit PSD, analyzes schema-based necessity, and rewrites arguments through framework-independent middleware adapters.

Classifier

  • The two-stage classifier combines regex and entity extraction with semantic detection of sensitive facilities, inferred professions, cross-field combinations, and encoded substrings.Source: D. Classifier, Analyzer, and Rewriter · p. 4

Analyzer

Integration

  • The common middleware core integrates with AutoGen, MCP, and LangChain through thin adapters that share the same processing pipeline.The evaluation reports identical privacy results across frameworks.Source: E. Framework Integration · p. 5

Evaluation

  • The evaluation uses 90 AgentPrivBench scenarios, four simulated LLM profiles, live validation on newer models, and metrics including PER, PCS, DMS, and TCR.Source: §V · p. 5, A. Experimental Setup · p. 5

B. RQ1: Over-Sharing Is Pervasive

Over-sharing is widespread across domains and models, while TOOLMINIMIZE achieves the lowest privacy cost among utility-preserving methods without sacrificing argument-level validity.

  • 0.997 baseline PER averages across LLM profiles, with 5.88 PSD items per call and approximately 3.7 unnecessary items.Raw PCS averages 13.98, with similar exposure across profiles.Source: B. RQ1: Over-Sharing Is Pervasive · p. 5
  • 69.4% of PSD items belong to critical-sensitivity categories, and PER remains above 0.99 when lower-sensitivity categories are excluded.Source: B. RQ1: Over-Sharing Is Pervasive · p. 5
  • 33.2% is the best prompt-based reduction, while PII Detection reaches PCS = 4.29 with a 27.6% reduction.Prompt methods retain PER above 0.96.Source: C. RQ2: Mitigation Comparison · p. 5
  • TOOLMINIMIZE achieves the lowest PCS at TCR = 100% against utility-preserving baselines with p<0.001.Source: Table III · p. 6
  • TOOLMINIMIZE achieves PCS = 0.59 at 100% task completion, compared with PrivacyChecker's PCS = 0.47 at TCR = 3%.Its residual privacy cost corresponds to PSD genuinely necessary for the task.Source: C. RQ2: Mitigation Comparison · p. 6
  • TOOLMINIMIZE reaches near-zero PCS in four of five Stage C domains and PCS = 0.0 at 100% TCR on 15 Stage E delegation scenarios.Travel remains higher because named-entity identifiers are necessary for booking.Source: C. RQ2: Mitigation Comparison · p. 6

D. RQ3: Ablation and Live Validation

Ablation and live evaluations show that semantic necessity analysis materially improves removal, while TOOLMINIMIZE substantially reduces privacy cost across production LLMs and external schemas with preserved task validity. The evaluations also expose latency, encoding, and classifier-recall boundaries.

Live LLM validation

Content-aware extension

  • 90.9% mean cost reduction is achieved with content-aware analysis versus 71.1% schema-only on author schemas.The extension reaches 100% reduction for all 14 send_email and 7 send_message calls, but maps reductions fall from 100% to 80%.Source: D. RQ3: Ablation and Live Validation · pp. 6–7

Latency

  • 1.77 ms median latency is reported, with a 2 s timeout capping worst-case classification latency.Adapter overhead is under 0.1 ms, latency scales linearly with argument size, and deeply nested JSON inflates uncapped P99 latency.Source: D. RQ3: Ablation and Live Validation · p. 7

End-to-end execution

  • 70.6% lower cross-call PSD linkability is observed across 13 multi-call scenarios, reducing shared items from 17 to 5.Session-level budgets are identified as a possible further reduction.Source: D. RQ3: Ablation and Live Validation · p. 7

Limitations

  • Missed direct identifiers remain a recall boundary: regex recall is 0.435, rising to 0.739 with NER, while missed items propagate unchanged.Headline reductions apply to detected PSD; adversarial encodings, out-of-taxonomy categories, and some required-field failures remain outside the bound.Source: D. RQ3: Ablation and Live Validation · pp. 6–7

E. Summary

TOOLMINIMIZE addresses pervasive tool-call over-sharing by rewriting arguments at the agent–tool boundary. Its reductions remain substantial across live LLM outputs, author schemas, and unannotated MCP schemas, while schema metadata and deployment choices affect precision and coverage.

Results

  • 81.2–92.0% live-LLM privacy-cost reduction is achieved with full task validity, increasing to 85.1–95.6% with content-aware processing.The content-aware extension removes task-irrelevant PSD from otherwise necessary free-text fields.Source: E. Summary · p. 7

Deployment

  • 79.0% cost reduction is achieved on 25 unannotated MCP schemas, showing that custom handlers are not required for long-tail API onboarding.A generic handler covers 62.2% of scenarios, while handlers improve precision on common tools.Source: A. Implications and Recommendations · pp. 7–8

Implications

  • Protocol extensions are proposed for per-argument privacy labels, tool trust declarations, retention negotiation, and required context.The Stage E evaluation reports cross-agent PCS reduction from 12.60 to 0.00.Source: A. Implications and Recommendations · p. 8

B. Argument Validity vs. Task Utility

Argument-level validity does not guarantee that a rewritten tool call still serves the user’s intent, especially when sensitive data is itself the task payload. The paper reports this gap, validates metric ranking stability, and identifies user control and deployment boundaries.

Argument Validity vs. Task Utility

  • 100% TCR can coexist with only 80% functionally equivalent end-to-end results in mock execution.Four of 20 failures were maps scenarios where required addresses were removed without minimum_necessary annotations.Source: B. Argument Validity vs. Task Utility · p. 8

Metric Validation

  • TOOLMINIMIZE remains the lowest-PCS utility-preserving method in 100% of 110 weight perturbations, with Kendall’s τ = 1.0.The comparison ranking is therefore invariant to the specific S and E weight mappings.Source: C. Metric Validation · p. 8
  • Per-call judge correlation is limited by ceiling-saturated privacy ratings, while per-item necessity recovers ρ = +0.04 (95% CI [−0.20, +0.28]).The aggregate schema-level result was ρ = −0.26, driven by zero-variance messaging calls.Source: C. Metric Validation · p. 8

Future Work

VII. RELATED WORK

Prior systems address privacy through extraction defenses, flow-level gating, labeling, or document and prompt anonymization. TOOLMINIMIZE instead performs schema-aware, argument-level rewriting at the tool-call egress boundary, complementing existing controls.

Privacy in LLM Systems

  • Training-time memorization and conversational disclosure differ from tool-call over-sharing, where the model actively sends data to third parties.Source: §VII · p. 8

Agent Security and Privacy

  • AudAgent and PrivacyChecker gate actions or invocations but do not mutate individual argument values.They cannot perform field-level rewriting of tool-call arguments.Source: §VII · p. 8

Information Flow Control

  • Information-flow systems enforce confidentiality and integrity at flow granularity rather than graduated rewriting of individual fields.Binary tainted/clean labels also cannot represent differing sensitivity levels across data types.Source: §VII · pp. 8–9

Data Minimization and PII Tools

  • PII tools can miss implicit PSD, lack schema awareness, and apply uniform redaction regardless of tool trust.The paper gives “Memorial Sloan Kettering” as an example of implicit health information.Source: §VII · p. 9
  • TOOLMINIMIZE targets tool-call argument egress with schema-based necessity analysis and graduated rewriting, complementing document, prompt, and web-agent defenses.Source: §VII · p. 9

Research Gap

  • No existing system performs schema-aware, argument-level minimization by rewriting fields while preserving task validity.The paper identifies this as the gap TOOLMINIMIZE fills.Source: §VII · p. 9

Conclusion

  • TOOLMINIMIZE reduces privacy cost by 81.2–92.0% on 307 live calls with 100% argument-level task validity.Its schema-only path has 1.77 ms median latency and requires no LLM call.Source: §VIII · p. 9
Loading 2608.24957v1…