From 6536d61adf80d668d4aebfbcce6c0b272e57de77 Mon Sep 17 00:00:00 2001
From: Ninad Phalak <ninadphalak@gmail.com>
Date: Thu, 3 Sep 2026 21:22:30 -0500
Subject: [PATCH] feat(guardrails): redact the participant name on a message

`name` on a user or assistant turn identifies a person and was going to the
provider intact. The proxy this integrates with already redacts it, so the
integration was the weaker of the two.

On a tool or function turn the same field carries the function's name, which
has to arrive unchanged or the call stops routing. That case is skipped, and
a test asserts the value is never even sent to the shield.
---
 .../llm_shield_proxy/llm_shield_proxy.py      | 13 +++++++++
 .../guardrail_hooks/test_llm_shield_proxy.py  | 28 +++++++++++++++++++
 2 files changed, 41 insertions(+)

diff --git a/litellm/proxy/guardrails/guardrail_hooks/llm_shield_proxy/llm_shield_proxy.py b/litellm/proxy/guardrails/guardrail_hooks/llm_shield_proxy/llm_shield_proxy.py
index 56bee894714..b1ad9563eb2 100644
--- a/litellm/proxy/guardrails/guardrail_hooks/llm_shield_proxy/llm_shield_proxy.py
+++ b/litellm/proxy/guardrails/guardrail_hooks/llm_shield_proxy/llm_shield_proxy.py
@@ -122,6 +122,18 @@ def _collect_content(container: MutableRequest, slots: _SlotSink) -> None:
             _collect(part, "text", slots)
 
 
+def _collect_participant_name(message: MutableRequest, slots: _SlotSink) -> None:
+    """Redacts `name` where it identifies a person, never where it names a function.
+
+    On a user or assistant turn `name` is the participant, which is personal data.
+    On a tool or function turn the same field carries the function's name and has
+    to reach the provider unchanged, or the call no longer routes.
+    """
+    if message.get("role") in ("tool", "function"):
+        return
+    _collect(message, "name", slots)
+
+
 def _collect_tool_arguments(message: MutableRequest, slots: _SlotSink) -> None:
     """Tool arguments carry the values a user asked the model to act on."""
     for tool_call in message.get("tool_calls") or ():
@@ -311,6 +323,7 @@ class LLMShieldProxyGuardrail(CustomGuardrail):
         for message in data.get("messages") or ():
             if isinstance(message, dict):
                 _collect_content(message, slots)
+                _collect_participant_name(message, slots)
                 _collect_tool_arguments(message, slots)
         _collect_responses_fields(data, slots)
         _collect_prompt(data, slots)
diff --git a/tests/test_litellm/proxy/guardrails/guardrail_hooks/test_llm_shield_proxy.py b/tests/test_litellm/proxy/guardrails/guardrail_hooks/test_llm_shield_proxy.py
index bc74b42a0e7..372bb6ed2ab 100644
--- a/tests/test_litellm/proxy/guardrails/guardrail_hooks/test_llm_shield_proxy.py
+++ b/tests/test_litellm/proxy/guardrails/guardrail_hooks/test_llm_shield_proxy.py
@@ -330,6 +330,34 @@ class TestRequestCoverage:
 
         assert data["input"] == ["[EMAIL_1]", "[PHONE_1]"]
 
+    @pytest.mark.asyncio
+    async def test_participant_name_is_redacted(self):
+        """`name` on a user turn identifies a person."""
+        guardrail = _guardrail()
+        mock = _mock_post(guardrail, {"texts": ["hi", "[PERSON_1]"]})
+
+        data = {"messages": [{"role": "user", "name": "Jane Doe", "content": "hi"}]}
+        await guardrail.async_pre_call_hook(user_api_key_dict=None, cache=None, data=data, call_type="completion")
+
+        assert mock.call_args_list[0].kwargs["json"]["texts"] == ["hi", "Jane Doe"]
+        assert data["messages"][0]["name"] == "[PERSON_1]"
+
+    @pytest.mark.asyncio
+    async def test_tool_function_name_is_left_alone(self):
+        """On a tool turn the same field is the function name.
+
+        Redacting it would stop the call routing, so this asserts it is never sent
+        to the shield at all.
+        """
+        guardrail = _guardrail()
+        mock = _mock_post(guardrail, {"texts": ["result"]})
+
+        data = {"messages": [{"role": "tool", "name": "get_weather", "content": "result"}]}
+        await guardrail.async_pre_call_hook(user_api_key_dict=None, cache=None, data=data, call_type="completion")
+
+        assert data["messages"][0]["name"] == "get_weather"
+        assert mock.call_args_list[0].kwargs["json"]["texts"] == ["result"]
+
     @pytest.mark.asyncio
     async def test_every_shape_in_one_request_is_redacted(self):
         guardrail = _guardrail()