TL;DR: CaMeL stops prompt injection through system design, not model smarts. It solves 77% of AgentDojo tasks with provable security. Title: Defeating Prompt Injections by Design URL: Key points ・🧠 The Privileged LLM only writes the plan and never sees untrusted data ・🔒 The Quarantined LLM only parses untrusted data into structure and has no tools ・🏷️ Every value carries a capability for its provenance and allowed readers ・📜 Python security policies check each tool call before it runs ・📊 Zero successful attacks on Claude 3.5 Sonnet, vs. 8 for the next-best defense ・⚖️ Utility goes from 84% to 77%, with about 2.8x the tokens ・🕳️ Side channels such as exceptions and timing remain open problems Building a secure system around an untrusted model looks key for production agents. #PromptInjection# #AIAgents#