# Operationalizing CaMeL: Strengthening LLM Defenses for Enterprise Deployment

arXiv: https://arxiv.org/abs/2505.22852 · HTML: https://mlsanity.com/paper/2505.22852/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security.
- Builds on 12 of its 32 references that are in the map.
- First posted on arXiv 28 May 2025.

## Placed in

- LLM safety and security / [Prompt injection and agent security](https://mlsanity.com/safety/prompt-injection-and-agent-security/)

## Builds on (most cited first, 12 of 12)

- [Training language models to follow instructions with human feedback](https://mlsanity.com/paper/2203.02155/) (2022)
- [ReAct: Synergizing Reasoning and Acting in Language Models](https://mlsanity.com/paper/2210.03629/) (2022)
- [Universal and Transferable Adversarial Attacks on Aligned Language Models](https://mlsanity.com/paper/2307.15043/) (2023)
- [Constitutional AI: Harmlessness from AI Feedback](https://mlsanity.com/paper/2212.08073/) (2022)
- [A Broad-Coverage Challenge Corpus for Sentence Understanding through Inference](https://mlsanity.com/paper/1704.05426/) (2017)
- [Red Teaming Language Models with Language Models](https://mlsanity.com/paper/2202.03286/) (2022)
- [Poisoning Language Models During Instruction Tuning](https://mlsanity.com/paper/2305.00944/) (2023)
- [Alignment, Agency and Autonomy in Frontier AI: A Systems Engineering Perspective](https://mlsanity.com/paper/2503.05748/) (2025)
- [Transforming Cyber Defense: Harnessing Agentic and Frontier AI for Proactive, Ethical Threat Intelligence](https://mlsanity.com/paper/2503.00164/) (2025)
- [Engineering Risk-Aware, Security-by-Design Frameworks for Assurance of Large-Scale Autonomous AI Models](https://mlsanity.com/paper/2505.06409/) (2025)
- [CyberSentinel: An Emergent Threat Detection System for AI Security](https://mlsanity.com/paper/2502.14966/) (2025)
- [The Cyber Immune System: Harnessing Adversarial Forces for Security Resilience](https://mlsanity.com/paper/2502.17698/) (2025)

## Built on by (most cited first, 1 of 1)

- [A Five-Plane Reference Architecture for Runtime Governance of Production AI Agents](https://mlsanity.com/paper/2606.12320/) (2026)

## Abstract (arXiv)

CaMeL (Capabilities for Machine Learning) introduces a capability-based sandbox to mitigate prompt injection attacks in large language model (LLM) agents. While effective, CaMeL assumes a trusted user prompt, omits side-channel concerns, and incurs performance tradeoffs due to its dual-LLM design. This response identifies these issues and proposes engineering improvements to expand CaMeL's threat coverage and operational usability. We introduce: (1) prompt screening for initial inputs, (2) output auditing to detect instruction leakage, (3) a tiered-risk access model to balance usability and control, and (4) a verified intermediate language for formal guarantees. Together, these upgrades align CaMeL with best practices in enterprise security and support scalable deployment.