# SurrogateShield | Sherwin Vishesh Jathanna

> SurrogateShield is a privacy-preserving proxy for large language models that keeps your personal data on your device. It detects sensitive information in your…

Source: https://www.sherwinvishesh.com/project/surrogateshield  
Copyright 2026 Sherwin Vishesh Jathanna. Text may be quoted with attribution. The design and source code are not licensed for reuse.

SurrogateShield is a privacy-preserving proxy for large language models that keeps your personal data on your device. It detects sensitive information in your messages, swaps it for realistic fake stand-ins before anything is sent to the AI, and restores your real values in the reply, so you can use cloud LLMs without handing over your private data.

Every time you paste something genuinely useful into ChatGPT or Claude, a resume, a medical note, a customer email, you are also quietly handing over names, addresses, and account numbers to someone else's server. That is the uncomfortable tradeoff behind cloud AI, and **SurrogateShield** was built to erase it. It is a *privacy-preserving proxy* that sits between you and any large language model and makes sure your personal information never actually leaves your device. It intercepts every message before it is sent, finds the sensitive details inside, and swaps them for *realistic fake stand-ins*, so the model receives text that reads perfectly naturally but contains none of your real data. When the reply comes back, your original values are quietly restored, and every cryptographic step happens locally on your own machine.

### SentinelLayer: finding what is sensitive

The hard part is reliably spotting what counts as private, and SurrogateShield does it with a three-stage cascade called **SentinelLayer**. It opens with *fast pattern matching* for structured data, Social Security numbers, emails, phone numbers, credit cards, crypto wallets, and API keys, backed by real validators like the **Luhn** check so it does not trip on random-looking numbers. Anything the patterns cannot catch is handed to a **spaCy** language model that recognizes people, organizations, and places, and the genuinely uncertain cases go to a lightweight **DistilBERT** model that reviews them and picks up whatever the earlier stages missed. Three passes, each catching what the last one could not.

### Believable stand-ins, locked to your device

Once the sensitive pieces are located, a generator built on **Faker** replaces each one with a believable substitute *of the same kind*: a fake name still looks like a name, and a fake SSN still passes a format check, which is what keeps the message coherent enough for the model to actually help. The mapping between each real value and its stand-in is kept in an encrypted store using **AES-256-GCM**, tied to a secret that exists *only on your device*, so even the lookup that reverses the swap is something no server ever sees.

### Privacy without being clumsy

What makes SurrogateShield thoughtful rather than heavy-handed is that it protects you *without* breaking the answer. If you ask something like *good restaurants near my address*, it nudges the house number slightly instead of erasing the location entirely, so the response stays genuinely useful. It also understands that privacy leaks are not always obvious: it warns you when a combination of small, innocent-looking details, a zip code, a birthday, and a gender for instance, could still be enough to identify you even when no single piece of data looks personal on its own.

### Drop-in, and benchmarked

The whole pipeline ships as a small **Python** library that drops into any application through a *five-function API*, and it works the same whether you are calling Claude, GPT, Gemini, or a fully offline local model. It is not just a demo, either: SurrogateShield is backed by a *research paper* that benchmarks it against **Microsoft Presidio**, showing it protects data just as well while preserving far more of the original meaning, which is the entire point of swapping data instead of simply deleting it.

## At a glance

- **Timeline:** Jun 2026
- **Type:** Open-Source Library & Research

## Technologies

- Python
- spaCy (en\_core\_web\_lg)
- distilbert-NER
- PyTorch
- Faker
- AES-256-GCM / HKDF (cryptography)
- rapidfuzz
- ChromaDB
- sentence-transformers
- Microsoft Presidio

## Categories

- AI/ML

## Links

- [GitHub](https://github.com/sherwinvishesh/SurrogateShield)
- [Website](https://sherwinvishesh.github.io/SurrogateShield/)
- [PyPI](https://pypi.org/project/surrogateshield/)
- [arXiv](https://arxiv.org/abs/2606.29567)