G4 · Dual LLM (and CaMeL)
Family: Security by design
A privileged LLM holds the tools without ever seeing untrusted content; a quarantined LLM reads it, with no tools.
Principle
A privileged LLM has tools but never sees untrusted content; a quarantined LLM reads it, with no tools at all. Between them, a software controller, not an LLM, handles symbolic references that the privileged one cites without ever reading their content. CaMeL (Google DeepMind) generalises the idea: a generated program, tracking of data provenance and capability policies.
The problem it solves
An agent that reads untrusted content while holding tools can be hijacked by prompt injection, and no filter reliably prevents it.
When to use it
- The agent has access to sensitive data and to external actions (email, payment, writing): separate these capabilities through the architecture.
- Autonomy is growing and all three properties of the Rule of Two come together (G6).
When to avoid it
- The implementation cost (interpreter, policies to write) is not justified by the risk: layered guardrails (F2) or an action selector (G1) may be enough.
- You count on it against social engineering: the user can copy booby-trapped content, and CaMeL mainly protects control flow and exfiltration.
Synonyms by vendor
- Dual LLM (Simon Willison (2023), Beurer-Kellner et al.)
- Privileged / quarantined LLM (Simon Willison)
- CaMeL (Google DeepMind)
Neighbouring patterns
Sources
- The Dual LLM pattern for building AI assistants that can resist prompt injection — Simon Willison, 2023-04-25
- Design Patterns for Securing LLM Agents against Prompt Injections — Beurer-Kellner et al. (14 auteurs), arXiv, 2025-06
- Defeating Prompt Injections by Design — Debenedetti et al. (Google DeepMind), arXiv, 2025-03
- The lethal trifecta for AI agents: private data, untrusted content, and external communication — Simon Willison, 2025-06-16
Content reviewed on 2026-10-02