Every Agent Transcript Leaks Secrets by Design. SlotGuard Fixes That.

Every LLM agent that appends tool outputs to a provider-bound transcript is silently exfiltrating local context. File paths, API keys, shell logs, and email addresses flow into the transcript, then leave the local runtime entirely, bound for whatever model API sits upstream. The assumption most teams carry, that placeholder redaction handles this, is wrong by construction: placeholders miss cross-turn references, over-redact benign lookalikes, and strip the structural context agents need to reason correctly.

SlotGuard treats the transcript boundary as a typed, session-aware system rather than a string-replacement pass. Instead of scanning for patterns and swapping them out, SlotGuard rewrites structural bindings as typed slots with suffix-awareness, so a path like /home/user/.ssh/id_rsa becomes a format-preserving synthetic value that the agent can still reason about as a path. A lightweight session graph links cross-turn references, meaning a credential introduced in turn 2 and referenced again in turn 7 gets consistent synthetic substitution rather than two unrelated redactions. Raw values are restored only inside the trusted local runtime, after the provider response arrives. Think of it as a translation layer that speaks two languages: synthetic outward, real inward, with no information crossing the boundary it should not cross.

The numbers are direct. Across 9,229 paths in controlled repository-oriented agent transcripts, SlotGuard removes all 20,814 annotated structurally sensitive characters. Credential leakage drops to 0.0% across 852 planted values. Generic redaction, the approach most teams currently rely on, collapses task success to 2.5% because it destroys reasoning structure. SlotGuard stays close to raw-transcript task success across four upstream models. Transcript rewriting takes a median of 14.424 microseconds per agent turn. For teams shipping agents that touch local filesystems, credentials, or any tool output that contains real paths, the takeaway is direct: the redaction approach you are probably using today breaks agent performance while still leaking data, and a session-graph-aware slot system does not.

We're thinking: We find the 2.5% task-success figure for generic redaction more alarming than the leakage numbers. It means teams who believed they had a privacy mitigation in place have actually traded a security problem for a correctness problem, getting neither. SlotGuard's cross-turn session graph is the structural piece that most placeholder systems skip entirely, and skipping it is not a minor oversight: an API key introduced in one turn and referenced three turns later will survive any single-pass redaction scheme. The practical implication is that agent privacy is not a preprocessing step. It requires a stateful runtime component, and any team that has not built one should assume their current setup is failing on both dimensions.

Key takeaways:

• SlotGuard replaces brittle pattern-matching with typed, suffix-aware slots and a session graph that tracks cross-turn references, keeping synthetic values structurally consistent across the full transcript before anything leaves the local runtime.
• Across 9,229 paths and 852 planted credentials, SlotGuard achieves 0.0% credential leakage and removes all 20,814 sensitive characters at 14.424 µs median per turn; caveat is that evaluation uses controlled repository-oriented transcripts, so coverage on messier production tool outputs remains to be tested.
• Teams building LLM agents that call shell tools, read files, or handle credentials should treat transcript boundary management as a required runtime component, not a preprocessing filter, and evaluate SlotGuard's session-graph approach against whatever placeholder scheme is currently in the stack.

Source: SlotGuard: Stop Oversharing Private Local Context in LLM Agent Transcripts