SurrogateShield

SurrogateShield is a privacy-preserving proxy for large language models that keeps your personal data on your device. It detects sensitive information in your messages, swaps it for realistic fake stand-ins before anything is sent to the AI, and restores your real values in the reply, so you can use cloud LLMs without handing over your private data.

Every time you paste something genuinely useful into ChatGPT or Claude, a resume, a medical note, a customer email, you are also quietly handing over names, addresses, and account numbers to someone else's server. That is the uncomfortable tradeoff behind cloud AI, and SurrogateShield was built to erase it. It is a privacy-preserving proxy that sits between you and any large language model and makes sure your personal information never actually leaves your device. It intercepts every message before it is sent, finds the sensitive details inside, and swaps them for realistic fake stand-ins, so the model receives text that reads perfectly naturally but contains none of your real data. When the reply comes back, your original values are quietly restored, and every cryptographic step happens locally on your own machine. ### SentinelLayer: finding what is sensitive The hard part is reliably spotting what counts as private, and SurrogateShield does it with a three-stage cascade called SentinelLayer. It opens with fast pattern matching for structured data, Social Security numbers, emails, phone numbers, credit cards, crypto wallets, and API keys, backed by real validators like the Luhn check so it does not trip on random-looking numbers. Anything the patterns cannot catch is handed to a spaCy language model that recognizes people, organizations, and places, and the genuinely uncertain cases go to a lightweight DistilBERT model that reviews them and picks up whatever the earlier stages missed. Three passes, each catching what the last one could not. ### Believable stand-ins, locked to your device Once the sensitive pieces are located, a generator built on Faker replaces each one with a believable substitute of the same kind: a fake name still looks like a name, and a fake SSN still passes a format check, which is what keeps the message coherent enough for the model to actually help. The mapping between each real value and its stand-in is kept in an encrypted store using AES-256-GCM, tied to a secret that exists only on your device, so even the lookup that reverses the swap is something no server ever sees. ### Privacy without being clumsy What makes SurrogateShield thoughtful rather than heavy-handed is that it protects you without breaking the answer. If you ask something like good restaurants near my address, it nudges the house number slightly instead of erasing the location entirely, so the response stays genuinely useful. It also understands that privacy leaks are not always obvious: it warns you when a combination of small, innocent-looking details, a zip code, a birthday, and a gender for instance, could still be enough to identify you even when no single piece of data looks personal on its own. ### Drop-in, and benchmarked The whole pipeline ships as a small Python library that drops into any application through a five-function API, and it works the same whether you are calling Claude, GPT, Gemini, or a fully offline local model. It is not just a demo, either: SurrogateShield is backed by a research paper that benchmarks it against Microsoft Presidio, showing it protects data just as well while preserving far more of the original meaning, which is the entire point of swapping data instead of simply deleting it.

At a glance

Timeline: Jun 2026
Type: Open-Source Library & Research

Technologies

Python
spaCy (en_core_web_lg)
distilbert-NER
PyTorch
Faker
AES-256-GCM / HKDF (cryptography)
rapidfuzz
ChromaDB
sentence-transformers
Microsoft Presidio

Links

Machine-readable version of this page: https://www.sherwinvishesh.com/project/surrogateshield.md | site index: https://www.sherwinvishesh.com/llms.txt