The code-then-execute pattern has the privileged model emit a program rather than a sequence of decisions. That program, written in a custom sandboxed domain-specific language, specifies which tools should be called and how their outputs are passed to one another. Because the plan exists as code before anything runs, the language can be designed to permit full data flow analysis — so that data arriving from an untrusted source can be marked as tainted and tracked through the entire process.
As summarized in Design Patterns for Securing LLM Agents against Prompt Injections, the post describes this as an improved version of the Dual LLM Pattern, and attributes it to an earlier paper that the reviewed paper includes among its six. Because that earlier paper is known here only through this post’s account of it, this page does not restate its own title, date or authorship.
Usage
The pattern’s distinguishing feature is the analysis the DSL makes possible. Where the dual LLM pattern keeps untrusted content away from the privileged model by holding it in opaque variables, this pattern additionally lets the system reason about where those values travel: which tool consumes a tainted value, and what it is allowed to do with it. Enforcement therefore happens over a program that can be inspected before execution, rather than over a running conversation.
When It Applies
The pattern applies where the work can be expressed as a program over a fixed tool set, and where someone is prepared to build and maintain the DSL and its analysis — it assumes both a custom language and a sandbox to run it in, which is a substantially larger commitment than the other patterns in the same group. It is misapplied where the tool set or the control flow cannot be pinned down in advance. Its guarantees are bounded by the analysis: data flows the language cannot express, or taints it does not model, are not covered.
It is one of six patterns presented together as trade-offs between an agent’s utility and its resistance to Prompt injection, and the account available here is the reviewer’s rather than the paper’s.
Related Terms
- Dual LLM Pattern — the pattern this one is described as an improvement on
- LLM Map-Reduce Pattern — another of the six, containing untrusted content in sub-agents rather than tracking it through typed data flow
- Sandboxing — the isolation the generated program is executed within
- Design Patterns for Securing LLM Agents against Prompt Injections — the source of this account