Swap your SSN for a fake one before the LLM sees it

What it does It sits between you and an LLM API (Claude, Gemini, ChatGPT, or offline via Ollama) as a privacy proxy. Detected personal data — names, SSNs, addresses, credit cards, API keys, crypto wallets — is replaced with type-consistent surrogates: fake names look like names, fake SSNs pass format checks. A ResolvePass restores the originals in the model’s response, so the conversation reads normally while the provider only ever sees the masked text.

The interesting bit The surrogate-to-original mapping lives in an AES-256-GCM encrypted ShadowMap, and detection is a layered cascade — regex patterns first, then a DeBERTa PII tagger, then spaCy — where each stage reads the text with earlier findings already masked out, so stages don’t fight over the same span. There’s also an “Attacker Experiment” that simulates an informed adversary intercepting sanitised traffic and counting what it can recover.

Key highlights

• On the sealed test-3 benchmark of real chat messages: 0.8% of 3,677 personal values leaked, vs 9.1% for GLiNER-PII and 31.6% for Microsoft Presidio
• Service-query intelligence: “restaurants near X” gets minimal address fuzzing instead of full replacement, so answers stay useful
• Quasi-identifier warnings when combos like ZIP+DOB+gender risk re-identification (Sweeney k-anonymity)
• Privacy-aware RAG: documents anonymised before indexing, surrogates used in all vector store operations
• Ships as a standalone Python library (surrogateshield) with no dashboard dependency, plus a PII Finder mode that makes zero API calls

Caveats

• The default balanced preset downloads ~565 MB of DeBERTa tagger weights on first use (SHA-256 pinned); the classic preset is the fallback for machines that can’t fetch them
• The README itself notes it trailed the competition in a few places, with details deferred to a one-line Limitations section
• Detection presets (balanced, strict, fast, classic) trade coverage for speed, so results depend on which you pick

Verdict Worth a look if you’re building chatbots or RAG pipelines that touch real user data and must not leak it upstream. If you just need a one-off regex scrubber, it’s heavier machinery than you need — but that’s exactly the point.