Privileged/Quarantined Dual-LLM Architecture: Structural Prompt Injection Defense That Prevents Untrusted Data from Reaching Decision-Making Models

Aktagon Signals·medium signalXBlueskyLinkedInCopy link

A formal design pattern from Aktagon's agent security guide splits agent systems into a Privileged LLM (receives instructions, has tool access, never sees untrusted data) and a Quarantined LLM (processes untrusted content, has no tool access). The Privileged LLM makes decisions; the Quarantined LLM summarizes external inputs into a sanitized handoff format. This structural separation means even a fully compromised untrusted data source cannot escalate to tool invocation.