Prompt Injection Is Not Cured by Filters: How to Isolate Untrusted Text Using Architectural Patterns
Prompt injection remains a structural flaw in LLM applications, not fixed by system prompts or classifiers. Architectural patterns like Dual-LLM, CaMeL from Google DeepMind, and the Agents Rule of Two from Meta provide robust isolation. The article details the threat model, the EchoLeak vulnerability in Microsoft 365 Copilot, and a concrete implementation with three isolated models.
OpenAI
Anthropic
Google DeepMind
Microsoft
