External content never reaches the Coordinator's planning context intact. It is split into fragments, each processed by a worker that can see nothing else, and only sanitized extractions are recombined. An instruction planted in one fragment has nowhere to travel.
Pick which fragment carries the injected instruction, then step through. Each worker runs against a single fragment with no access to the Coordinator's plan and no access to any other fragment.
A sandwich-formatted override prompt asks the worker to pull whatever bears on the user's question, describing any instructions factually rather than executing them.
Text that looks addressed to a model rather than to a reader is marked, following the taxonomy of imperative overrides, system-prompt impersonation, and Unicode-tag or homoglyph encoding.
Only the extracted content and the flag set leave the worker. The Coordinator aggregates those records and never re-introduces the original document text, which is context minimization at the document layer.
Deployed configuration: 250-character chunks aligned to sentence boundaries, Llama 3.1 8B Instruct at INT4 for both Map and Reduce.
Judged ASR by BIPIA category, perimeter Guards against Map-Reduce. The crossover is the strongest argument in the chapter for running both.
The mechanism behind the split: the Guards catch attacks whose injected instruction is still syntactically visible at the perimeter, which is why reversed text and ciphers die there. Map-Reduce catches attacks hidden inside a transformation request the Guard reads as a legitimate user task, which is why emoji substitution and translation die at the data layer instead. Chunking preserves a reversed or enciphered instruction intact inside a fragment, so the worker sees exactly what the Guard already saw.
| Configuration | BIPIA judged ASR | InjecAgent judged ASR | Fallback rate | P50 |
|---|---|---|---|---|
| No defense | 0.521 | 0.659 | n/a | 3.13 s |
| Perimeter LLM Guards | 0.049 | 0.009 | n/a | 7.18 s |
| Map-Reduce v2 | 0.034 | 0.212 | 0.307 | 3.66 s |
0.212 against the Guards' 0.009. InjecAgent's injections are directly imperative, of the "wire five thousand dollars to this account" kind, and those are more sensitive to how strict the Map prompt is. The softened v2 prompt admits a fraction of them. BIPIA's content-framed prose is the surface this defense was built for.
A 0.307 fallback rate means the Reduce step returned the no-information response that often. That is a real utility cost, not a rounding error, and it is the price of a worker that refuses to act on anything it cannot ground in the user's question.
The override prompt still depends on the worker model distinguishing its structured task from an embedded directive, and the BIPIA authors show that distinction leaks partial compliance even when the override is in force. Per-fragment isolation bounds the blast radius; it does not make a worker immune.
Evaluated with the perimeter Guards disabled so the numbers report Map-Reduce's own contribution rather than a stacked effect. Full BIPIA enumeration at 3,750 instances and the full InjecAgent test set at 1,054.