CaMeL Reference Implementation: A Capability-Based Architecture for Defeating Prompt Injection
The CaMeL reference implementation is a research artifact developed collaboratively by Google, Google DeepMind, and ETH Zurich. It provides a capability-based architecture designed to mitigate prompt injection vulnerabilities in large language model (LLM) agents. By separating control flow from untrusted data and enforcing security policies within an interpreter, CaMeL establishes a protective layer around LLMs, ensuring their secure operation even when processing untrusted inputs. This implementation is not an officially supported Google product and is intended solely for reproducing the results outlined in the accompanying research paper.
The project was introduced in March 2025 with the publication of the paper Defeating Prompt Injections by Design (arXiv:2503.18813). The paper details how CaMeL extracts control and data flows from trusted queries, preventing untrusted data from influencing program execution. Additionally, it employs a capability-based system to restrict unauthorized data exfiltration, enforcing security policies during tool invocation. The architecture achieves a 77% task success rate with provable security in the AgentDojo benchmark, compared to 84% for undefended systems, demonstrating its effectiveness without significantly compromising performance.
The implementation is released under the Apache 2.0 license, a permissive open-source license that allows for broad use, modification, and distribution. It is written in Python and serves as a runtime defense mechanism, functioning as an agent runtime firewall to protect LLM-based systems against prompt injection attacks.
How It Works
CaMeL operates by explicitly separating control flow from untrusted data. This separation ensures that untrusted inputs cannot alter the execution logic of the system. The architecture enforces security policies through a capability-based model, where access to tools or sensitive operations is restricted unless explicitly permitted by predefined rules. This approach prevents malicious actors from manipulating the LLM’s behavior or extracting private data through unauthorized channels.
The system relies on an interpreter that processes queries while maintaining strict boundaries between trusted control structures and untrusted data inputs. When an LLM agent interacts with external tools or APIs, CaMeL verifies compliance with security policies before allowing execution.
The reference implementation includes a modular design, allowing users to integrate different LLM providers and models. It supports customization through configuration files, such as the .env file for API keys and the models.py file for defining supported model names and their identifiers. This flexibility enables researchers and practitioners to test CaMeL with various models, including those from OpenAI, while adhering to the architecture’s security principles.
Use Cases
By deploying CaMeL, organizations can mitigate the risk of prompt injection attacks, which could otherwise lead to data leaks, unauthorized actions, or system compromises.
The implementation is designed to be compatible with the AgentDojo benchmark, a framework for evaluating LLM agents in adversarial settings. Researchers can use CaMeL to test the resilience of their systems against prompt injection attacks, comparing performance metrics such as task success rates and security guarantees. The reference code also serves as a foundation for further experimentation, allowing developers to explore alternative security policies or optimization techniques.
For example, financial institutions or healthcare providers deploying LLM-powered tools could use CaMeL to enforce strict access controls and prevent malicious inputs from exploiting vulnerabilities. However, users should be aware that the current implementation is a research artifact and may contain bugs or incomplete security guarantees.
Separation of Control Flow and Untrusted Data
CaMeL’s core innovation lies in its ability to isolate control flow from untrusted data. This separation is achieved through an interpreter that parses queries into structured components, ensuring that only trusted instructions dictate program execution. Untrusted inputs are treated as data and cannot influence the logic or flow of operations, thereby neutralizing prompt injection attacks that rely on manipulating the LLM’s behavior.
Capability-Based Security Policies
The architecture employs a capability system to enforce fine-grained access controls. Each tool or operation requires explicit authorization before execution, and capabilities are bound to specific security policies. This granular control prevents unauthorized data exfiltration and limits the potential damage from compromised inputs.
Compatibility with Multiple LLM Providers
The reference implementation supports integration with various LLM providers, including OpenAI and other third-party APIs. Users can extend the supportedmodelnames variable in models.py to include additional models, provided they adhere to the expected interface. Special handling is included for OpenAI’s reasoning models, which are stored separately in the oaithinkingmodels variable.
Command-Line Interface for Testing and Evaluation
The primary command, uv run --env-file .env main.py MODELNAME, allows users to specify a model and configure additional parameters such as attack modes, reasoning efforts, and token budgets. Optional flags like --run-attack enable adversarial testing, while --replay-with-policies demonstrates the system’s enforcement of security policies. Detailed help is available via uv run main.py --help, covering all supported arguments and their purposes.
Integration with AgentDojo for Benchmarking
The implementation includes tools for evaluating performance in the AgentDojo benchmark, a standardized framework for testing LLM agents under adversarial conditions. Users can assess CaMeL’s effectiveness by comparing task success rates between defended and undefended systems. The paper reports that CaMeL achieves a 77% success rate with provable security, closely matching the 84% rate of undefended systems, indicating that security enhancements come with minimal performance overhead.
Development and Testing Infrastructure
While the implementation is not officially supported, these tools help maintain a functional and maintainable codebase for research purposes.
Limitations and Warnings
The CaMeL reference implementation is explicitly labeled as a research artifact and is not intended for production use. The authors warn that the interpreter may contain bugs, such as uncaught exceptions or incomplete security guarantees. Users are advised to exercise caution when deploying CaMeL in high-stakes environments and to report issues through the project’s GitHub repository. Additionally, the project is ineligible for Google’s Open Source Software Vulnerability Rewards Program, reflecting its experimental status.