AI Systems Atlas

S-12Dual-LLM / Quarantined Reader

/security/dual-llm

The model that holds the tools never reads untrusted text; a quarantined model with no tools reads it and returns only a symbolic handle.

Step-by-step walkthrough8 steps
  1. The user’s task goes to the model that actually holds the credentials.
  2. The task needs a document read — and that document is not trusted.
  3. The privileged model delegates instead of reading. The reader gets no tools and no memory.
  4. The quarantined model fetches the document.
  5. The document carries instructions — and the quarantined model may well comply.
  6. It doesn’t matter. All it can return is a symbolic handle to text it read.
  7. The privileged model plans over $summary without ever seeing what is inside it.
  8. A payload the deciding model never read cannot persuade it. Compliance is made harmless.
Key insight

Every other defense tries to stop the model from being persuaded. This one accepts that it will be, and arranges for the persuaded model to hold no authority — the deciding model plans over handles to text it never saw.

Failure mode

Letting the quarantined output back into the privileged context “just this once”. One inlined summary and the boundary is gone; the whole value was that the text never crossed.

Further reading
RelatedIndirect prompt injectionGuardrail middlewareConfused deputy

Elsewhere in the atlas

Harnesses →Evals →Context →Coding Agents →Tools →Ops →