Overview
CaMeL takes a different route from model-side defenses. Instead of making the LLM harder to persuade, it wraps the model in a protective system layer designed to stay secure even when the underlying model is susceptible to injection.
| Field | Value |
|---|---|
| Resource type | Paper |
| Original title | Defeating Prompt Injections by Design |
| Authors | Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan, Jamie Hayes, Nicholas Carlini, Daniel Fabian, Christoph Kern, Chongyang Shi, Andreas Terzis, Florian Tramèr |
| First public version | 2025-03-24 |
| Publication status | arXiv preprint (arXiv:2503.18813; v2 dated 2025-06-24). |
| Focus areas | System design, Defenses, AI agents |
| Artifacts | google-research/camel-prompt-injection (GitHub) |
| Last reviewed | 2026-09-26 |
Research question
Can an agent be built so that untrusted data it processes can never alter which actions it takes, and so that private data cannot leave through unauthorized flows, while still completing useful tasks?
Method and artifact
CaMeL extracts the control and data flow of a task from the trusted user query before any untrusted data is read. Untrusted data retrieved later is handled as data within that flow and cannot change it. Values carry capabilities describing their origin and permitted recipients, and security policies are checked when tools are called. The authors release a research implementation.
- google-research/camel-prompt-injection (GitHub) - official research implementation
Key findings reported by the authors
Source statements: the points below summarize what the cited publication reports for the models and configurations it tested.
- The current arXiv version (v2, June 2025) reports solving 77% of AgentDojo tasks with provable security, compared with 84% for an undefended system.
- The first arXiv version (v1, March 2025) reported 67%; the update notes newer models, so figures should be cited with their version.
- The authors describe the defense as securing the agent even when the underlying model is susceptible to attacks.
Security interpretation
Site interpretation: this section is Prompt-Injection.net's explanation of why the work matters, not a claim made by the authors.
CaMeL is a concrete example of the principle this site emphasizes: deterministic controls outside the model (information flow tracking, capabilities and policy checks at tool boundaries) can bound what injected content achieves. It shows the utility cost such guarantees can carry and connects directly to information flow control and agent authorization.
Limits and caveats
- "Provable" refers to guarantees within the paper's stated threat model and security policies, not to every possible agent, deployment or policy.
- Security depends on correct policies; a permissive policy yields weak protection.
- Some tasks cannot be completed under the design, reflected in the utility gap to an undefended system.
- Results are for AgentDojo and the models tested in each paper version.
How to use this work
Use CaMeL as a reference architecture when designing agents: separate planning from untrusted data, attach provenance to values, and enforce policy at tool calls. Evaluate any adaptation on your own tasks, since guarantees do not transfer to implementations that change the model of trust.
Related content on Prompt-Injection.net
- Information Flow Control - How to decide, outside the model, whether data with a particular provenance and classification may move from a specific source through processing steps to a specific sink - across model, context, tool, storage and tenant boundaries.
- Agent Authorization - How to authorize AI agent actions outside the model: initiating principal, agent identity, resource, action, parameters, destination, scope and policy version, with exact-action binding and downstream revalidation.
- Data Provenance - How to record, preserve and reconstruct where AI context came from and how it was derived: source and author identity, authoritative metadata outside payload text, transformation lineage and lineage-aware cleanup.
- Least Privilege - How to reduce the size, reach and lifetime of agent authority before any action is evaluated: identities, scopes, tool exposure, data access, JIT elevation, review and revocation readiness.
- AI Agent Prompt Injection - How prompt injection in an agentic system can become a security-relevant action chain, why proposal is not authorization, and which deterministic gates break the chain.
- AgentDojo - Dynamic Environment for Agent Prompt Injection Evaluation - An extensible evaluation environment with 97 realistic agent tasks and 629 security test cases that measures both task utility and security of tool-using agents under prompt injection.
- Plan Drift Detection (Lab) - A guided exercise on detecting material divergence between an application-recorded task baseline and an agent's proposed plan, separating legitimate adaptation and user scope changes from drift and detection from authorization.