G5 · Context minimization

Principle

Once the model has chosen its action, everything no longer useful is removed from its context, the initial request included. Later steps no longer see the text where an injection could have slipped in. The injection surface shrinks at each step.

The problem it solves

A booby-trapped instruction slipped into the request or into some data stays in the context and keeps influencing every later step.

When to use it

• The pipeline chains a choice step, then steps that no longer need the initial request.
• As a complement to another pattern of the family (G1, G4), to shrink the injection surface further.

When to avoid it

• Later steps need the request to stay faithful to the user’s intent: removing it can degrade usefulness.

Synonyms by vendor

• Context-Minimization (Beurer-Kellner et al. (2025))

Neighbouring patterns

• G1 · Action selector
• G4 · Dual LLM (and CaMeL)
• G2 · Plan before untrusted contact
• D1 · Compaction
• D5 · Context-isolation subagent

Sources

• Design Patterns for Securing LLM Agents against Prompt Injections — Beurer-Kellner et al. (14 auteurs), arXiv, 2025-06