G3 · Isolated map-reduce

Principle

Each untrusted item goes through an isolated LLM instance (map), which can only answer in a constrained format: a boolean, a value from a list. The constrained outputs are then aggregated (reduce). A booby-trapped document does not contaminate the others, and its output stays bounded by the format.

The problem it solves

When an agent reads many documents of unknown origin, a single one can carry an instruction that hijacks the whole processing.

When to use it

• Sorting, filtering or ranking untrusted documents, such as résumé screening: a good trade-off between security and utility.

When to avoid it

• The task requires reasoning across several documents: the constrained output of each instance is too thin. Prefer the dual LLM (G4).
• An instance’s output is free-form: without a constraint, isolation protects much less.

Synonyms by vendor

• LLM Map-Reduce (Beurer-Kellner et al. (2025))

Neighbouring patterns

• G4 · Dual LLM (and CaMeL)
• G2 · Plan before untrusted contact
• G1 · Action selector
• B3 · Parallelization

Sources

• Design Patterns for Securing LLM Agents against Prompt Injections — Beurer-Kellner et al. (14 auteurs), arXiv, 2025-06