LLMs, GenAI, RAG, agents, evaluation · insight-0649
Keep the model that reads untrusted content away from tools and private data
- Evidence type
- documented fact
- Difficulty
- hard
- Roles
- Applied AI, ML engineer
- Industries
- insurance, telecom
Summary: situation, action, reason, boundary
Situation
One agent reads incoming customer emails, can query customer records, and can send messages externally.
Action
Split the roles: a quarantined model without tools extracts structured fields from untrusted text; a privileged component with tools acts only on those validated fields, never on raw text.
Reason
This is the Dual LLM pattern described by Beurer-Kellner and colleagues: the privileged model never sees untrusted data, and the quarantined model's outputs are handled as data.
Boundary
Email triage, document intake, support agents with customer-data access.
Symptom or risk
Private data, untrusted instructions and an outbound channel meet in one context, which is the setting where injection becomes exfiltration.
Exceptions
If the task genuinely requires free-form reasoning over the untrusted text with tools, apply approvals and tight scopes instead.
Trade-offs
The paper discusses a utility cost: the privileged side cannot reason directly over the content.
Pitfalls
Letting free-text fields (such as a "summary") pass from the quarantined model into the privileged prompt.
Lessons and concepts
Claims and their sources
The Dual LLM pattern separates a privileged LLM with tool access that never sees untrusted data from a quarantined LLM without tools that processes it.