S-12Dual-LLM / Quarantined Reader

/security/dual-llm

The model that holds the tools never reads untrusted text; a quarantined model with no tools reads it and returns only a symbolic handle.

Key insight

Every other defense tries to stop the model from being persuaded. This one accepts that it will be, and arranges for the persuaded model to hold no authority — the deciding model plans over handles to text it never saw.

Failure mode

Letting the quarantined output back into the privileged context “just this once”. One inlined summary and the boundary is gone; the whole value was that the text never crossed.

S-12Dual-LLM / Quarantined Reader

Elsewhere in the atlas