Write an article about
The P-LLM never sees the content of emails or documents. It sees only that a value exists, such as “email = get_last_email()”, and then writes code that operates on it. This separation ensures that malicious text can’t influence which actions the AI decides to take.
CaMeL’s innovation extends beyond the dual-LLM approach. CaMeL converts the user’s prompt into a sequence of steps that are described using code. Google DeepMind chose to use a locked-down subset of Python because every available LLM is already adept at writing Python.
From prompt to secure execution
For example, in the CaMeL system, the aforementioned example prompt “Find Bob’s email in my last email and send him a reminder about tomorrow’s meeting,” would convert into code like this:
email = get_last_email()
address = query_quarantined_llm(
“Find Bob’s email address in [email]”,
output_schema=EmailStr
)
send_email(
subject=”Meeting tomorrow”,
body=”Remember our meeting tomorrow”,
recipient=address,
)
In this example, email is a potential source of untrusted tokens, which means the email address could be part of a prompt injection attack as well.
By using a special, secure interpreter to run this Python code, CaMeL can monitor it closely. As the code runs, the interpreter tracks where each piece of data comes from, which is called a “data trail.” For instance, it notes that the address variable was created using information from the potentially untrusted email variable. It then applies security policies based on this data trail. This process involves CaMeL analyzing the structure of the generated Python code (using the ast library) and running it systematically.
The key insight here is treating prompt injection like tracking potentially contaminated water through pipes. CaMeL watches how data flows through the steps of the Python code. When the code tries to use a piece of data (like the address) in an action (like “send_email()”), the CaMeL interpreter checks its data trail. If the address originated from an untrusted source (like the email content), the security policy might block the “send_email” action or ask the user for explicit confirmation.
.Organize the content with appropriate headings and subheadings ( h2, h3, h4, h5, h6). Include conclusion section and FAQs section with Proper questions and answers at the end. do not include the title. it must return only article i dont want any extra information or introductory text with article e.g: ” Here is rewritten article:” or “Here is the rewritten content:”
