PaperlayerView exact revision on arXiv

Source-linked AI summary

ToolMinimize: Auditing and Rewriting LLM Agent Tool Calls to Minimize Privacy Exposure

Wenbiao Li, Yuqiao Xu

arXiv:2608.24957v1cs.CRcs.SE

TL;DR

LLM tool calls often overshare privacy-sensitive data, especially in free-text fields, while existing defenses do not rewrite argument values. TOOLMINIMIZE intercepts calls for schema-aware graduated rewriting and reduces privacy cost substantially while preserving argument-level validity, with further reductions from optional content analysis.

  • Problem

    LLM tool calls include PSD beyond tool requirements, with free-text fields serving as primary exposure vectors, while existing defenses cannot rewrite argument values.

  • Method

    TOOLMINIMIZE combines a 10-category PSD taxonomy, a privacy-cost metric, schema-aware necessity analysis, and removal, generalization, substitution, and truncation operations.

  • Results

    81.2–92.0% privacy-cost reduction was achieved on 307 live tool calls with 100% argument-level task validity; content-aware processing raised live-LLM reduction to 85.1–95.6%.

  • Takeaways & Limitations

    Middleware-based argument rewriting can reduce tool-call privacy exposure without requiring an LLM call on the schema-only path.

  • Takeaways & Limitations

    End-to-end task utility was lower than argument-level validity: 16 of 20 scenarios returned functionally equivalent results, with maps failures caused by missing annotations.

Abstract

from arXiv · show

LLM agents routinely include privacy-sensitive data (PSD) in tool call arguments beyond what the invoked tools require, crossing trust boundaries to third-party services on every invocation. A controlled measurement on three production LLMs (GPT-4o, Claude 3.5 Sonnet, Llama-3.3-70B) shows that 81--88\% of tool calls include unnecessary PSD under default prompts; explicit privacy instructions still leave 36--76\% over-sharing. Existing defenses gate calls (allow/block) or label flows (information-flow control) but cannot \emph{rewrite} argument values, and PII detection tools miss implicit PSD like ``Memorial Sloan Kettering'' (a hospital name that implies a diagnosis). We present \system{}, a middleware that intercepts tool calls and rewrites their arguments to the minimum data necessary for tool functionality, combining schema-aware necessity analysis with four operations: removal, generalization, substitution, and truncation. Live validation on 307 tool calls across the three LLMs above reduces privacy cost by 81.2--92.0\% at 100\% argument-level task validity (TOST equivalence $p{<}0.001$ at $Δ{=}1.0$); on 25 unannotated Model Context Protocol (MCP) schemas, by 79.0\% with no \texttt{minimum\_necessary} metadata. An optional LLM content-necessity layer strips task-irrelevant PSD from otherwise-necessary free-text fields, raising live-LLM reduction to 85.1--95.6\% and author-schema reduction from 71.1\% to 90.9\%. Median latency is 1.77\,ms.

I. INTRODUCTION

Tool call over-sharing is a pervasive, empirically measured privacy problem: production LLMs routinely send unnecessary PSD across the agent–tool boundary. TOOLMINIMIZE addresses it with middleware that analyzes and rewrites arguments before execution.

  • Motivation: Tool call over-sharing exposes PSD to third-party services even when tools function correctly with less data.Examples include health-related context in weather, calendar, email, and search requests.
  • Motivation: 81–88% of tool calls contain unnecessary PSD under default prompts across GPT-4o, Claude 3.5 Sonnet, and Llama-3.3-70B.Explicit privacy prompts reduce over-sharing to 36–76%, with limited effect on Llama.
  • Approach: TOOLMINIMIZE intercepts calls before execution and rewrites arguments to the minimum necessary data without modifying the LLM, framework, or tools.Its design responds to over-sharing as an inference-time behavior that privacy prompts do not reliably prevent.
  • Approach: The system combines PSD classification, quantitative privacy-cost scoring, schema-aware necessity analysis, and removal, generalization, substitution, and truncation.The paper also introduces a 10-category PSD taxonomy grounded in GDPR Article 9 classifications.
  • Evaluation: The motivating study queried 20 everyday tasks using function-calling APIs under default and explicit-privacy conditions.Tasks used standard tools such as weather, calendar, search, email, and maps, with annotations of necessary versus unnecessary PSD.

III. THREAT MODEL

The threat model places the main intervention at the semi-trusted agent–tool boundary, where tool operators are distinct entities and a request may trigger multiple calls. TOOLMINIMIZE intercepts calls after argument construction and before execution.

  • Trust Boundaries: The agent–tool boundary is semi-trusted because the agent and tool operators are distinct entities with separate data policies.A single request may trigger 5–20 tool calls.
  • Intervention Point: TOOLMINIMIZE intercepts every tool call between argument construction (V3) and tool execution (V4).It requires no modifications to the LLM, framework, or tools.
  • Intervention Point: Minimum_necessary schema annotations provide the highest analysis accuracy; otherwise, the middleware falls back to required-versus-optional distinctions.

B. Adversary Model

The paper considers privacy exposure from semi-honest tools, network observers, aggregators, and delegation across agent boundaries. Its primary target is tool-call over-sharing, while related delegation threats remain part of the broader model.

  • Adversaries: Semi-honest tool operators may log and analyze received PSD for profiling, resale, or surveillance while still following the tool protocol.
  • Adversaries: Network observers can passively inspect tool-call payloads through network paths such as corporate proxies or API gateways terminating TLS.
  • Adversaries: Multi-tool aggregators can correlate PSD fragments across calls to reconstruct user profiles.
  • Scope: C-1 tool-call over-sharing is the primary target because it affects every tool call, crosses trust boundaries on each invocation, and is invisible to users.Reducing argument PSD also reduces data available for exfiltration and fragments available for cross-tool aggregation.
  • Delegation Threats: Delegation can expose full conversational context to agents with weaker privacy policies and create transitive exposure chains when receiving agents invoke tools.

D. Scope and Assumptions

TOOLMINIMIZE targets tool-call over-sharing under schema- and hook-based assumptions, using staged classification, scoring, analysis, and rewriting. Its guarantees are bounded by classifier recall, missing annotations, and out-of-scope encodings and categories.

  • Scope: TOOLMINIMIZE primarily mitigates C-1 over-sharing while also reducing data available for tool-level exfiltration and cross-tool aggregation.
  • Assumptions: The system assumes JSON Schema tool inputs, JSON key-value arguments, an execution hook, and observable tool success.Tools without schemas receive conservative defaults.
  • Guarantees and Boundaries: Every detected PSD item marked unnecessary is removed or generalized before transmission, but residual exposure depends on classifier recall.The stated bound assumes missed items are unnecessary and excludes adversarial encodings, out-of-taxonomy categories, and some required-field failures.
  • Pipeline: The pipeline classifies PSD, scores privacy cost, analyzes schema-based field necessity, and rewrites arguments before execution.Scoring occurs before analysis so calls can be logged even when rewriting is disabled.
  • PSD Taxonomy: The PSD taxonomy contains 10 categories with sensitivity levels and examples, grounded in GDPR Article 9 classifications.

B. PSD Taxonomy

The paper defines privacy-sensitive data (PSD) through a GDPR-grounded taxonomy and scores unnecessary PSD using sensitivity, exposure, and necessity.

  • The taxonomy contains 10 PSD categories grounded in GDPR Article 9 and empirical corpus analysis.
  • Sensitivity levels range from S=1 to S=4, with Article 9 special categories assigned S=4 and quasi-identifiers assigned S=3.These levels approximate harm rather than determine compliance.
  • Privacy Cost combines each PSD item's sensitivity, the hosting server's exposure level, and whether the field is necessary.Only unnecessary PSD contributes to the score.
  • Necessity is binary: PSD in minimum-necessary fields scores 0, while other PSD scores 1; without annotations, required fields are necessary and optional fields unnecessary.
  • The additive metric omits interaction effects, while its ordinal method rankings remain invariant across 110 monotone weight perturbations.The reported robustness is Kendall's τ = 1.0.
  • A weather-call example scores PC = 10.0 before generalization and retains only city-level data after changing the location to “New York, NY.”The original call contains facility name, street address, and ZIP PSD items.

D. Classifier, Analyzer, and Rewriter

TOOLMINIMIZE detects explicit and implicit PSD, analyzes schema-based necessity, and rewrites arguments through framework-independent middleware adapters.

  • Classifier: The two-stage classifier combines regex and entity extraction with semantic detection of sensitive facilities, inferred professions, cross-field combinations, and encoded substrings.
  • Analyzer: The SchemaAnalyzer extracts required, optional, and minimum-necessary field sets, assigning REMOVE to optional PSD-bearing fields.
  • Analyzer: The SemanticNecessityAnalyzer applies tool-specific handlers and conservative generic rules to required fields, including generalizing critical PSD in free text.A generic handler covers 62.2% of scenarios.
  • Analyzer: An optional task_context parameter lets the analyzer retain consented PSD identified in user-intent phrases.This parameter was unused in the benchmark.
  • Integration: The common middleware core integrates with AutoGen, MCP, and LangChain through thin adapters that share the same processing pipeline.The evaluation reports identical privacy results across frameworks.
  • Evaluation: The evaluation uses 90 AgentPrivBench scenarios, four simulated LLM profiles, live validation on newer models, and metrics including PER, PCS, DMS, and TCR.

B. RQ1: Over-Sharing Is Pervasive

Over-sharing is widespread across domains and models, while TOOLMINIMIZE achieves the lowest privacy cost among utility-preserving methods without sacrificing argument-level validity.

  • 0.997 baseline PER averages across LLM profiles, with 5.88 PSD items per call and approximately 3.7 unnecessary items.Raw PCS averages 13.98, with similar exposure across profiles.
  • 69.4% of PSD items belong to critical-sensitivity categories, and PER remains above 0.99 when lower-sensitivity categories are excluded.
  • 33.2% is the best prompt-based reduction, while PII Detection reaches PCS = 4.29 with a 27.6% reduction.Prompt methods retain PER above 0.96.
  • TOOLMINIMIZE achieves the lowest PCS at TCR = 100% against utility-preserving baselines with p<0.001.
  • TOOLMINIMIZE achieves PCS = 0.59 at 100% task completion, compared with PrivacyChecker's PCS = 0.47 at TCR = 3%.Its residual privacy cost corresponds to PSD genuinely necessary for the task.
  • TOOLMINIMIZE reaches near-zero PCS in four of five Stage C domains and PCS = 0.0 at 100% TCR on 15 Stage E delegation scenarios.Travel remains higher because named-entity identifiers are necessary for booking.

D. RQ3: Ablation and Live Validation

Ablation and live evaluations show that semantic necessity analysis materially improves removal, while TOOLMINIMIZE substantially reduces privacy cost across production LLMs and external schemas with preserved task validity. The evaluations also expose latency, encoding, and classifier-recall boundaries.

  • Live LLM validation: 81.2–92.0% cost reduction is achieved on 307 live LLM tool calls with 100% task completion; content awareness raises reduction to 85.1–95.6%.TOST confirms equivalence at ∆=1.0 (p<0.001).
  • Content-aware extension: 90.9% mean cost reduction is achieved with content-aware analysis versus 71.1% schema-only on author schemas.The extension reaches 100% reduction for all 14 send_email and 7 send_message calls, but maps reductions fall from 100% to 80%.
  • Latency: 1.77 ms median latency is reported, with a 2 s timeout capping worst-case classification latency.Adapter overhead is under 0.1 ms, latency scales linearly with argument size, and deeply nested JSON inflates uncapped P99 latency.
  • End-to-end execution: 70.6% lower cross-call PSD linkability is observed across 13 multi-call scenarios, reducing shared items from 17 to 5.Session-level budgets are identified as a possible further reduction.
  • Limitations: Missed direct identifiers remain a recall boundary: regex recall is 0.435, rising to 0.739 with NER, while missed items propagate unchanged.Headline reductions apply to detected PSD; adversarial encodings, out-of-taxonomy categories, and some required-field failures remain outside the bound.

E. Summary

TOOLMINIMIZE addresses pervasive tool-call over-sharing by rewriting arguments at the agent–tool boundary. Its reductions remain substantial across live LLM outputs, author schemas, and unannotated MCP schemas, while schema metadata and deployment choices affect precision and coverage.

  • Results: 81.2–92.0% live-LLM privacy-cost reduction is achieved with full task validity, increasing to 85.1–95.6% with content-aware processing.The content-aware extension removes task-irrelevant PSD from otherwise necessary free-text fields.
  • Deployment: 79.0% cost reduction is achieved on 25 unannotated MCP schemas, showing that custom handlers are not required for long-tail API onboarding.A generic handler covers 62.2% of scenarios, while handlers improve precision on common tools.
  • Implications: Protocol extensions are proposed for per-argument privacy labels, tool trust declarations, retention negotiation, and required context.The Stage E evaluation reports cross-agent PCS reduction from 12.60 to 0.00.

B. Argument Validity vs. Task Utility

Argument-level validity does not guarantee that a rewritten tool call still serves the user’s intent, especially when sensitive data is itself the task payload. The paper reports this gap, validates metric ranking stability, and identifies user control and deployment boundaries.

  • Argument Validity vs. Task Utility: 100% TCR can coexist with only 80% functionally equivalent end-to-end results in mock execution.Four of 20 failures were maps scenarios where required addresses were removed without minimum_necessary annotations.
  • Metric Validation: TOOLMINIMIZE remains the lowest-PCS utility-preserving method in 100% of 110 weight perturbations, with Kendall’s τ = 1.0.The comparison ranking is therefore invariant to the specific S and E weight mappings.
  • Metric Validation: Per-call judge correlation is limited by ceiling-saturated privacy ratings, while per-item necessity recovers ρ = +0.04 (95% CI [−0.20, +0.28]).The aggregate schema-level result was ρ = −0.26, driven by zero-variance messaging calls.
  • Future Work: Future work includes adaptive NER, session-level budgets, joint confidentiality–integrity, user-controlled previews, and multimodal PSD detection.

VII. RELATED WORK

Prior systems address privacy through extraction defenses, flow-level gating, labeling, or document and prompt anonymization. TOOLMINIMIZE instead performs schema-aware, argument-level rewriting at the tool-call egress boundary, complementing existing controls.

  • Privacy in LLM Systems: Training-time memorization and conversational disclosure differ from tool-call over-sharing, where the model actively sends data to third parties.
  • Agent Security and Privacy: AudAgent and PrivacyChecker gate actions or invocations but do not mutate individual argument values.They cannot perform field-level rewriting of tool-call arguments.
  • Information Flow Control: Information-flow systems enforce confidentiality and integrity at flow granularity rather than graduated rewriting of individual fields.Binary tainted/clean labels also cannot represent differing sensitivity levels across data types.
  • Data Minimization and PII Tools: PII tools can miss implicit PSD, lack schema awareness, and apply uniform redaction regardless of tool trust.The paper gives “Memorial Sloan Kettering” as an example of implicit health information.
  • Data Minimization and PII Tools: TOOLMINIMIZE targets tool-call argument egress with schema-based necessity analysis and graduated rewriting, complementing document, prompt, and web-agent defenses.
  • Research Gap: No existing system performs schema-aware, argument-level minimization by rewriting fields while preserving task validity.The paper identifies this as the gap TOOLMINIMIZE fills.
  • Conclusion: TOOLMINIMIZE reduces privacy cost by 81.2–92.0% on 307 live calls with 100% argument-level task validity.Its schema-only path has 1.77 ms median latency and requires no LLM call.
Loading 2608.24957v1…