FlagThis

Abstract

In a language model, instructions and data share one token stream, so nothing inside the models generation can keep untrusted text from steering it. We develop a trust model that places the authority to act outside the model, in code: a sources standing, not its content, decides which operation runs and whether it acts. A lower-trust source may inform an answer but not override a higher one. An unmodified model runs inside a deterministic pipeline that ranks inputs by source integrity, and a fixed non-model monitor provably chooses the operation and any outside action from trusted inputs alone. We can measure but not prove the pipelines resistance to injection; we prompt-tune it and report the rate. On a one-shot held-out set with an unmodified Gemma 4 26B model, passivation and a wrapper (the cascade) raise the genuine-leak defended rate from 27% to 94% at roughly a 4% clean-quality cost ( _Q_ rel=0 _._ 96). Under adaptive red-teaming the proved boundary holds unconditionally, and the measured defense stays at 87%. The cascade also attributes a lower-trust sources fact rather than dropping it, raising attribution from 0% to 92%, and follows the higher-trust source on a conflict.