# piiguard: the self-learning content layer for sandboxed agents

- **Event:** [The Recursive Agents Hackathon](https://cerebralvalley.ai/e/crusoe-recursive-agents-hackathon)
- **When:** Sat, Oct 17 at 9:00 AM – 10:00 PM (PDT)
- **Where:** San Francisco, CA
- **Team:** [Akhil Vallala](https://cerebralvalley.ai/u/Akhil_v_krishna)
- **GitHub:** https://github.com/Akhilvallala1/piiguard
- **Demo video:** https://youtu.be/qMEf-XKlkFI
- **Gallery:** https://cerebralvalley.ai/e/crusoe-recursive-agents-hackathon/hackathon/gallery
- **Page:** https://cerebralvalley.ai/e/crusoe-recursive-agents-hackathon/hackathon/gallery/30

piiguard: a PII leak guard for sandboxed agents that trains itself, in your industry's language.

  The problem. NVIDIA NemoClaw runs agents inside an OpenShell sandbox with a network policy: Crusoe allowed, You.com allowed, everything else blocked. That policy checks the host, port and path. It never reads the bytes. So when an agent puts a customer's SSN into a search query, the sandbox sees an allowed host and lets every byte through. The sandbox decides where. Nobody decides what.

  What we built. piiguard is a proxy on the host that becomes the sandbox's only route out. Every request is redacted to reversible tokens, the real values stay in a vault on the host, provider keys never enter the sandbox, and replies are restored so the agent still finishes its task. A live NemoClaw sandbox runs through it today.

  Version N+1: the guard improves itself. A Nemotron 3 Super red team hides PII twelve ways 

Version N+1: the guard improves itself. A Nemotron 3 Super red team hides PII twelve ways (base64, spaced digits, fullwidth, spelled-out numbers, inside tool calls, logs and code). A Nemotron 3 Super coach reads every leak and rewrites the regex rules. A gate keeps a change only if leak rate drops on validation and clean traffic stays clean; accepted changes become git tags, rejected ones are reverted and logged. On held-out attacks the coach never saw, leak rate fell from 76.7% to 16.7% with rules alone and to 0% with a Nemotron 3.5 Lightning classifier behind them, false positives 0% throughout. A pruning step unlearns dead rules, with held-out as a tripwire; it correctly refused when removal would have raised leaks.

Industry packs. What counts as PII depends on where you work. An adjuster badge means nothing in general and opens a claim file inside an insurer. Packs for insurance, healthcare, finance and law firms each carry a domain red team, seed rules, a classifier told the domain, and ground truth. On the insurance red team, hand-written rules leaked 90%; two coach generations later, 20%, with the general score unchanged.

Measured against things we did not make. Microsoft Presidio on our adversarial set: 53% leak, 64% false positives. On NVIDIA's public Nemotron-PII test split (290 records, 29 domains), Presidio leads on all labels (65.9% vs 58.3% recall, it covers names, cities and companies) and piiguard with the classifier leads on structured identifiers (92.8% vs 68.5%). Both numbers are in the README.

Stack. Crusoe Managed Inference runs every model. Nemotron 3.5 Lightning is the fast classifier, Nemotron 3 Super the red team and coach. A complexity router skips the model, calls the small one, or escalates to the large one per request, built to the shape of NVIDIA Switchyard's stage router. You.com is the agent's web search, routed through the guard. NemoClaw/OpenShell is the sandbox with a guard-only egress policy. Live demo page with four industry presets, 117 tests, all written today.

## More from The Recursive Agents Hackathon

- [TicketZero](https://cerebralvalley.ai/e/crusoe-recursive-agents-hackathon/hackathon/gallery/27)
- [NemoDots](https://cerebralvalley.ai/e/crusoe-recursive-agents-hackathon/hackathon/gallery/28)
- [Miles](https://cerebralvalley.ai/e/crusoe-recursive-agents-hackathon/hackathon/gallery/29)
- [Covora](https://cerebralvalley.ai/e/crusoe-recursive-agents-hackathon/hackathon/gallery/31)
- [Recursive Agent Chemist](https://cerebralvalley.ai/e/crusoe-recursive-agents-hackathon/hackathon/gallery/32)
- [pick it easy](https://cerebralvalley.ai/e/crusoe-recursive-agents-hackathon/hackathon/gallery/33)

---

Markdown version of https://cerebralvalley.ai/e/crusoe-recursive-agents-hackathon/hackathon/gallery/30. Site index for agents: https://cerebralvalley.ai/llms.txt · full text: https://cerebralvalley.ai/llms-full.txt