LLM Map-Reduce Isolation
Process each untrusted document in its own sealed sub-agent and merge only structured outputs, so an injection in one document cannot steer the processing of others.
Problem
Shared-context document processing makes one poisoned document toxic to the entire batch: the injection can instruct the model to mislabel, exfiltrate, or skip other documents. Differs from map-reduce in being motivated specifically by adversarial isolation, not by parallelism.
Solution
Spawn one sub-agent per untrusted document. Each sub-agent has a fresh context with only its single document and the task instructions. Outputs are schema-checked (typed extraction, structured-output) before reaching the reducer. The reducer only sees the structured outputs, never the raw documents. An injection in document A cannot reach the sub-agent processing document B. Pair with action-selector-pattern, dual-llm-pattern, context-minimization.
When to use
- Batch document processing where any document could be attacker-controlled.
- Per-document outputs reducible to a typed schema.
- Cost budget permits per-document model calls.
Open the full interactive page →
Diagram, neighbourhood map, code examples, related patterns and full provenance.