protologue

Dual LLM Pattern

Also called privileged and quarantined LLM, CaMeL.

The dual LLM pattern defends against prompt injection by splitting work between a privileged model, which sees only trusted input and can use tools, and a quarantined model, which processes untrusted content but has no tool access, with ordinary code passing references between them.

Description

The privileged model never reads untrusted text directly, so instructions hidden in that text cannot trigger its tools. CaMeL extends the idea by having the privileged model write a program whose data flows are tracked and checked against security policies. These designs give security guarantees by construction rather than by training, at the cost of flexibility.

Sources

  1. Willison (2023). The Dual LLM pattern for building AI assistants that can resist prompt injection.
  2. Debenedetti et al. (2025). Defeating Prompt Injections by Design.
  3. Beurer-Kellner et al. (2025). Design Patterns for Securing LLM Agents against Prompt Injections.

Cite this entry

Protologue. (2026). Dual LLM Pattern. In Protologue: A Taxonomy of Prompting and LLM Techniques (v1.4.0, PTL-0161). https://protologue.com/t/dual-llm-pattern/

BibTeX
@misc{protologue_dual_llm_pattern,
  title = {Dual LLM Pattern},
  author = {{Protologue}},
  year = {2026},
  howpublished = {Protologue: A Taxonomy of Prompting and LLM Techniques, v1.4.0},
  note = {Entry PTL-0161},
  url = {https://protologue.com/t/dual-llm-pattern/}
}

Markdown JSON