---
title: "LLM Map-Reduce Pattern"
summary: "Processes each untrusted document in its own sandboxed LLM call with a constrained output, then aggregates the results with deterministic code"
status: "emerging"
category: "Orchestration & Control"
url: "https://agentic-patterns.com/patterns/llm-map-reduce-pattern"
source: "https://arxiv.org/abs/2506.08837"
authors: ["Nikola Balic (@nibzard)"]
tags: ["map-reduce","sub-agents","isolation","untrusted-data"]
signals: ["Many untrusted documents feed one decision","One malicious item must not influence results for other items","Items are independent and each gets a constrained answer"]
anti_signals: ["Decision needs context across items","Only a few trusted items to process"]
updated_at: "2026-10-13"
---

# LLM Map-Reduce Pattern

> Processes each untrusted document in its own sandboxed LLM call with a constrained output, then aggregates the results with deterministic code

## Use when

- Many untrusted documents feed one decision
- One malicious item must not influence results for other items
- Items are independent and each gets a constrained answer

## Avoid when

- Decision needs context across items
- Only a few trusted items to process

## Problem

When many untrusted documents are processed in a single reasoning context, one malicious item can influence global conclusions. This creates cross-document contamination where a single poisoned input affects unrelated items and final decisions.

## Solution

Adopt a **map-reduce workflow**:

- **Map:** Spawn lightweight, *sandboxed* LLMs—each ingests one untrusted chunk and emits a constrained output (boolean, JSON schema, enum).
- **Reduce:** Aggregate validated summaries via deterministic code (count, filter, majority-vote) or a privileged LLM that sees only sanitized fields.

Isolation is the core control: each map worker handles one item with constrained output contracts, so contamination cannot spread laterally. The reducer consumes validated summaries only, which preserves scalability and reduces injection blast radius.

```pseudo
results = []
for doc in docs:
    ok = SandboxLLM("Is this an invoice? (yes/no)", doc)
    results.append(ok)
final = reduce(results)  # no raw docs enter this step
```

## How to use it

File triage, document summarization, resume filters, code migration verification—any N-to-1 decision where each item's influence should stay local.

Best fit when: N ≥ 10 items, processing time > 30s/item, items are independent, and aggregation is needed. These thresholds are practitioner heuristics for when the orchestration overhead pays off, not guidance from the source paper.

## Trade-offs

* **Pros:** A malicious item can't taint others; scalable parallelism; smaller contexts reduce cost.
* **Cons:** Requires strict output validation; extra orchestration overhead; loses cross-item context.

## References

* Beurer-Kellner et al., §3.1 (3) LLM Map-Reduce — [HTML full text, Section 3.1](https://arxiv.org/html/2506.08837v3).
* Dean & Ghemawat (2008). MapReduce: Simplified Data Processing on Large Clusters.

- Primary source: https://arxiv.org/abs/2506.08837
- Foundational MapReduce: https://doi.org/10.1145/1327452.1327492