TL;DR: A new paper, co-authored by ETH Zürich, Google DeepMind, and IBM, offers six tested design patterns for defending LLM agents against prompt injection attacks. It doesn’t rely on fragile filtering or clever prompt tweaks. Instead, it shows how to reshape the architecture itself so that malicious instructions buried in untrusted content never get anywhere near tools that can take action. The authors analyze ten real-world systems and demonstrate how these patterns can isolate risky inputs before they cause damage. For anyone building or deploying tool-using LLMs, this is essential reading.
The big picture
Today, language alone can compromise systems. A well-placed instruction in a PDF or email (no malware, no exploit) can quietly redirect an LLM agent to transfer funds, spill data, or write dangerous code. The security failure isn’t in the model itself. It’s in how systems trust the model’s output and wire it into tools that take real-world actions.
This paper goes straight to the architectural heart of that problem. Instead of trying to teach models to spot malicious input, the authors propose something more effective: structure the system so that untrusted language can’t reach anything dangerous in the first place. That principle drives six architecture-level design patterns that contain prompt injection by design, not by luck. Each is grounded in practical systems, not thought experiments, and together they form a powerful toolkit for LLM safety.
Key takeaways:
• Six reusable patterns for isolating untrusted inputs: Action-Selector, Plan-Then-Execute, LLM Map-Reduce, Dual LLM, Code-Then-Execute, and Context Minimisation
• Each one prevents raw user or third-party content from directly influencing sensitive tool interfaces
• Complex agents often need more than one pattern in combination to resist real-world prompt injection attempts
• The authors tested these patterns across ten domains, from software engineering to healthcare assistants
• Strong system boundaries proved more effective than relying on the model to detect attacks
• Narrow-scope agents with clear trust boundaries are far more defensible than general-purpose ones
Why I think this is important:
I think that the paper authors correctly reframe the jailbreak problem. The LLM security conversation has been stuck on detection: prompts, red teaming, adversarial inputs. But prompt injection is a system design issue, not just a model issue. The moment you wire language into tools, you’ve created a high-risk interface, and this work shows how to contain that risk before it becomes a breach.
What’s powerful here is that the defenses aren’t theoretical. They align neatly with the tools we already use in engineering: sandboxes, queues, layered execution, compartmentalization. You don’t need a new model or a bleeding-edge framework, you only need a clearer boundary between reasoning and doing. These patterns make that boundary enforceable.
And perhaps most importantly, this kind of architectural thinking is exactly what regulators and auditors are starting to demand. Whether you’re facing internal risk reviews or preparing for AI compliance mandates, these designs offer protection bundled with proof. They give security teams a vocabulary and structure to explain – and defend – the choices they’ve made.
A final thought
This research moves us past the illusion that clever prompt engineering alone can secure LLM agents. What we need now, besides better prompts, are first and foremost better walls.