{
  "id": "dual-llm-pattern",
  "code": "PTL-0161",
  "term": "Dual LLM Pattern",
  "aliases": [
    "privileged and quarantined LLM",
    "CaMeL"
  ],
  "category": "security",
  "definition": "The dual LLM pattern defends against prompt injection by splitting work between a privileged model, which sees only trusted input and can use tools, and a quarantined model, which processes untrusted content but has no tool access, with ordinary code passing references between them.",
  "description": "The privileged model never reads untrusted text directly, so instructions hidden in that text cannot trigger its tools. CaMeL extends the idea by having the privileged model write a program whose data flows are tracked and checked against security policies. These designs give security guarantees by construction rather than by training, at the cost of flexibility.",
  "example": null,
  "broader": [],
  "narrower": [],
  "related": [
    "prompt-injection",
    "indirect-prompt-injection",
    "lethal-trifecta",
    "spotlighting",
    "instruction-hierarchy"
  ],
  "introduced": 2023,
  "added": "2026-10-10",
  "sources": [
    {
      "title": "The Dual LLM pattern for building AI assistants that can resist prompt injection",
      "authors": "Willison",
      "year": 2023,
      "url": "https://simonwillison.net/2023/Apr/25/dual-llm-pattern/"
    },
    {
      "title": "Defeating Prompt Injections by Design",
      "authors": "Debenedetti et al.",
      "year": 2025,
      "url": "https://arxiv.org/abs/2503.18813"
    },
    {
      "title": "Design Patterns for Securing LLM Agents against Prompt Injections",
      "authors": "Beurer-Kellner et al.",
      "year": 2025,
      "url": "https://arxiv.org/abs/2506.08837"
    }
  ],
  "url": "https://protologue.com/t/dual-llm-pattern/",
  "citation": "Protologue. (2026). Dual LLM Pattern. In Protologue: A Taxonomy of Prompting and LLM Techniques (v1.4.0, PTL-0161). https://protologue.com/t/dual-llm-pattern/"
}