# Dual LLM Pattern

> The dual LLM pattern defends against prompt injection by splitting work between a privileged model, which sees only trusted input and can use tools, and a quarantined model, which processes untrusted content but has no tool access, with ordinary code passing references between them.

- Identifier: PTL-0161
- Category: Security & Adversarial Prompting
- Canonical URL: https://protologue.com/t/dual-llm-pattern/
- Also known as: privileged and quarantined LLM, CaMeL
- Introduced: 2023

## Description

The privileged model never reads untrusted text directly, so instructions hidden in that text cannot trigger its tools. CaMeL extends the idea by having the privileged model write a program whose data flows are tracked and checked against security policies. These designs give security guarantees by construction rather than by training, at the cost of flexibility.

## Related terms

- [Prompt Injection](https://protologue.com/t/prompt-injection/)
- [Indirect Prompt Injection](https://protologue.com/t/indirect-prompt-injection/)
- [Lethal Trifecta](https://protologue.com/t/lethal-trifecta/)
- [Spotlighting](https://protologue.com/t/spotlighting/)
- [Instruction Hierarchy](https://protologue.com/t/instruction-hierarchy/)

## Sources

- Willison (2023). The Dual LLM pattern for building AI assistants that can resist prompt injection. https://simonwillison.net/2023/Apr/25/dual-llm-pattern/
- Debenedetti et al. (2025). Defeating Prompt Injections by Design. https://arxiv.org/abs/2503.18813
- Beurer-Kellner et al. (2025). Design Patterns for Securing LLM Agents against Prompt Injections. https://arxiv.org/abs/2506.08837

## Cite this entry

Protologue. (2026). Dual LLM Pattern. In Protologue: A Taxonomy of Prompting and LLM Techniques (v1.4.0, PTL-0161). https://protologue.com/t/dual-llm-pattern/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)