How do CaMeL-style information-flow controls go beyond the Dual-LLM pattern?

## Dual-LLM, briefly Dual-LLM is the ancestor of this family. You run two model instances with different privilege. The **privileged** one sees the user's request and can call tools; it never sees attacker-influenceable text. The **quarantined** one sees untrusted content but has no tools. When the privileged side needs untrusted data processed, it dispatches to the quarantined side and receives back a handle — `$VAR_1` — that it can pass around without ever reading. Strict data formatting on the quarantined output keeps the handle from smuggling instructions. This buys a real property: injected text has no route into the reasoning that chooses actions. ## Where Dual-LLM stops It is a *containment* pattern, not an *authorisation* one. Once `$VAR_1` exists, nothing in the design constrains its use. If the orchestrating program says `send_email(to=$VAR_2, body=$VAR_1)` and `$VAR_2` was extracted from an attacker's message, the attacker chose the recipient without the privileged model ever reading a hostile word. Three concrete gaps follow: - **No provenance.** The system cannot answer "which values in this call touched untrusted data?" - **No policy.** There is no place to state "payroll data may only be sent to internal HR addresses." - **No propagation.** Values derived from a tainted value inherit nothing; concatenate, summarise or re-parse it and the taint disappears. ## What CaMeL adds CaMeL — from the paper *Defeating Prompt Injections by Design* — restructures the same split around a custom interpreter. 1. The **privileged model (P-LLM)** never sees untrusted content. It emits a program in a restricted, side-effect-free Python-like language expressing the whole task. 2. The **quarantined model (Q-LLM)** is used only as a parser: it turns unstructured untrusted text into typed values. It has no tools and cannot cause an action. 3. A **custom interpreter** runs the program. Every value carries a *capability*: its provenance (which sources it derived from) and its readership (who may receive it). Capabilities propagate through operations, so a summary of a tainted document is itself tainted. 4. At each tool call, a **security policy** written in ordinary code checks the capabilities of the arguments against what the tool is about to do. A violation is refused, or escalated to the user. The crucial move is that both the control flow and the data flow are now expressed in a formal language a checker can reason about, instead of living inside the model's head. The published evaluation reports solving a large majority of AgentDojo tasks — roughly three quarters — while holding a provable security property, which is the honest headline: strong guarantees on a *subset* of tasks, not on everything. ## What FIDES adds FIDES approaches the same target from classical information-flow control. Each piece of data carries **confidentiality** and **integrity** labels; the planner is constrained so that untrusted (low-integrity) data cannot influence security-relevant decisions, and confidential data cannot flow to a low-confidentiality sink. Where a task would violate a label, the system can fall back to a restricted operation — for instance letting a model choose among pre-approved options rather than emitting a free value — so that useful work still happens under the constraint. The deterministic label check is the boundary; the model remains a probabilistic component inside it. ## What you give up This is not free, and a good answer says so. - **Policies must be written.** Someone has to state, per tool, what provenance and readership are acceptable. That is real engineering and it drifts. - **Some tasks become impossible without a human.** "Reply to whoever emailed me" is genuinely a case where untrusted data must determine a recipient. Under a label system that requires an explicit user confirmation or a pre-approved recipient set, not a silent allow. - **Expressiveness limits.** The privileged program runs in a restricted language, so agents that need arbitrary dynamic behaviour do not fit cleanly. - **Two model calls plus interpretation** cost latency and tokens. ## When to reach for it Use the cheaper patterns — an absent capability, a frozen plan, isolated map-reduce — when they contain the risk, because they are far less machinery. Reach for information-flow control when the task *genuinely* requires untrusted data to influence a privileged action, and you need to state precisely which influences are acceptable. That is the situation the earlier patterns cannot express and this family can. As of 2026 these systems are research-grade and adopted piecemeal; the interview-relevant point is that they show the direction of travel — from hoping the model resists, to making unsafe flows unrepresentable.