Prompt Injection Design Patterns: Architectural Defenses for Agents
Six named architectural patterns — Action-Selector, Plan-Then-Execute, LLM Map-Reduce, Dual LLM, Code-Then-Execute, Context-Minimization — plus Google DeepMind's CaMeL, that structurally constrain what an agent can do with untrusted data instead of just filtering it.
Checklists and runtime filters reduce prompt-injection risk; they do not structurally prevent it. A checklist item can be skipped and a classifier can be evaded. This page covers a different layer: architectural patterns that constrain what an agent's design can even do with untrusted data, so a successful injection still cannot reach a sensitive action. Use one of these when the blast radius is high — irreversible actions, a browsing agent inside an authenticated session, or any tool call with real-world side effects.
Key facts
- Six reusable patterns for isolating untrusted content from an agent's tool-calling surface — Action-Selector, Plan-Then-Execute, LLM Map-Reduce, Dual LLM, Code-Then-Execute, and Context-Minimization — were systematized in a 2025 cross-vendor paper co-authored by researchers from IBM, Invariant Labs, ETH Zurich, Google, and Microsoft.
- The oldest and most-cited of the six, Dual LLM, was proposed by Simon Willison in April 2023: a privileged LLM that holds tool access never sees untrusted content directly; a quarantined LLM parses that content and can only hand back opaque references.
- Google DeepMind and ETH Zurich's CaMeL (SaTML 2026) goes further than a prompting pattern: it extracts an explicit control-flow/data-flow program from the trusted request, then attaches capabilities to every value so untrusted data can never redirect which code runs.
- None of these patterns claim to fully solve prompt injection — they trade some of an agent's free-form flexibility for a structural guarantee, and that tradeoff has a measured cost: CaMeL's own reported result is 77% of AgentDojo tasks solved with provable security, versus 84% for an undefended baseline.
- These patterns are complementary to, not a replacement for, the controls in /resources/agentic-security-checklist and the runtime filters in /resources/agent-guardrails — architecture reduces what an injection can reach; guardrails and checklists reduce how often one succeeds in the first place.
The six patterns
| Pattern | Core idea | What it rules out |
|---|---|---|
| Action-Selector | The model picks from a fixed, closed set of predefined actions/tool calls, like an LLM-modulated switch statement | Constructing a novel or parameterized tool call from untrusted text |
| Plan-Then-Execute | The model generates the full plan of tool calls before any untrusted data is ingested | Injected content encountered mid-execution altering which actions still run |
| LLM Map-Reduce | Untrusted content is processed one item at a time by an isolated "map" LLM call; only the extracted, sanitized outputs reach the privileged "reduce" context | A single untrusted document directly steering the agent's overall reasoning |
| Dual LLM | A privileged LLM (has tool access, never sees untrusted data) delegates parsing of untrusted content to a quarantined LLM (sees the data, has no tool access); results pass back only as opaque references | The LLM that reads attacker-controlled text ever being the one that calls a tool |
| Code-Then-Execute | The model emits code rather than direct tool calls; the code is constrained/reviewed before running | Untrusted data flowing anywhere except through vetted, inspectable operations |
| Context-Minimization | Trim the context window down to the minimum a given step actually requires | Untrusted text sitting in context long enough to influence unrelated later steps |
CaMeL: capabilities and provable data flow
"Defeating Prompt Injections by Design" (Debenedetti, Shumailov, Fan, Hayes, Carlini, Fabian, Kern, Shi, and Tramèr — Google DeepMind, Google, and ETH Zurich; SaTML 2026) introduces CaMeL, a system layer that stays secure even when the underlying model is susceptible to injection. CaMeL parses the user's trusted request into an explicit control-flow/data-flow program up front, so untrusted tool outputs can populate data in that program but can never alter which code path executes. Every value is additionally tagged with a capability, so a policy engine can block an unauthorized data flow — e.g. an email's contents reaching a send-message call — even if the model was tricked into requesting it. Code and evaluation harness are released under Apache-2.0 as a research artifact, not a maintained product.
What these patterns cost you
Every pattern above trades away some of the open-ended autonomy that makes agents useful. Action-Selector and Plan-Then-Execute both sacrifice the ability to improvise mid-task in response to what a tool call returns. Dual LLM adds a second model call and an indirection layer for every piece of untrusted content. CaMeL's reported 77%-vs-84% AgentDojo gap is a concrete, disclosed instance of this tax, not an outlier — treat any pattern here as a deliberate capability-for-guarantee trade, matched to how much blast radius the task actually carries, not applied uniformly to every agent you build.
For the checklist of complementary controls across every threat surface (not just prompt injection), see /resources/agentic-security-checklist. For the runtime input/output/action filters that sit alongside these architectural patterns, see /resources/agent-guardrails. For a concrete account of why architecture matters most where the blast radius is highest, see /resources/agentic-browsers and /resources/computer-use-browser-automation. For how these patterns interact with orchestrator/worker and other multi-agent topologies, see /resources/multi-agent-orchestration-patterns.
Verified sources
- CaMeL code repository (fetched directly — Apache-2.0, author list, dual-LLM/capability architecture description): https://github.com/google-research/camel-prompt-injection
- "Defeating Prompt Injections by Design" (arXiv:2503.18813) — WebSearch-corroborated (2+ agreeing sources: floriantramer.com's publication listing and a MIT CSAIL course reading-list mirror of the PDF, plus the Hugging Face papers page) for the SaTML 2026 venue and the 77%/84% AgentDojo figures; the arxiv.org abstract page itself returned HTTP 403 this session: https://arxiv.org/abs/2503.18813
- Simon Willison, "The Dual LLM pattern for building AI assistants that can resist prompt injection" (April 2023) — WebSearch-corroborated (2+ agreeing sources describing the same privileged/quarantined/orchestrator design), simonwillison.net itself returned HTTP 403 this session: https://simonwillison.net/2023/Apr/25/dual-llm-pattern/
- "Design Patterns for Securing LLM Agents against Prompt Injections" (arXiv:2506.08837, June 2025) — WebSearch-corroborated (2+ agreeing sources, including Simon Willison's own repost naming the same six patterns and co-author institutions), not fetched directly this session: https://arxiv.org/abs/2506.08837