5K

LLM Map-Reduce Pattern

Processes each untrusted document in its own sandboxed LLM call with a constrained output, then aggregates the results with deterministic code

emerging Updated 2026-10-13 By Nikola Balic (@nibzard) Based on Luca Beurer-Kellner et al. (2025)
View .md Edit on GitHub
Add to Pack
or

Saved locally in this browser for now.

Cite This Pattern
APA 
Nikola Balic (@nibzard) (2026). LLM Map-Reduce Pattern. In *Awesome Agentic Patterns*. Retrieved October 14, 2026, from https://agentic-patterns.com/patterns/llm-map-reduce-pattern
BibTeX 
@misc{agentic_patterns_llm-map-reduce-pattern,
  title = {LLM Map-Reduce Pattern},
  author = {Nikola Balic (@nibzard)},
  year = {2026},
  howpublished = {\url{https://agentic-patterns.com/patterns/llm-map-reduce-pattern}},
  note = {Awesome Agentic Patterns}
}

Use when

  • Many untrusted documents feed one decision
  • One malicious item must not influence results for other items
  • Items are independent and each gets a constrained answer

Avoid when

  • Decision needs context across items
  • Only a few trusted items to process

Problem

When many untrusted documents are processed in a single reasoning context, one malicious item can influence global conclusions. This creates cross-document contamination where a single poisoned input affects unrelated items and final decisions.

Solution

Adopt a map-reduce workflow:

  • Map: Spawn lightweight, sandboxed LLMs—each ingests one untrusted chunk and emits a constrained output (boolean, JSON schema, enum).
  • Reduce: Aggregate validated summaries via deterministic code (count, filter, majority-vote) or a privileged LLM that sees only sanitized fields.

Isolation is the core control: each map worker handles one item with constrained output contracts, so contamination cannot spread laterally. The reducer consumes validated summaries only, which preserves scalability and reduces injection blast radius.

results = []
for doc in docs:
    ok = SandboxLLM("Is this an invoice? (yes/no)", doc)
    results.append(ok)
final = reduce(results)  # no raw docs enter this step

How to use it

File triage, document summarization, resume filters, code migration verification—any N-to-1 decision where each item's influence should stay local.

Best fit when: N ≥ 10 items, processing time > 30s/item, items are independent, and aggregation is needed. These thresholds are practitioner heuristics for when the orchestration overhead pays off, not guidance from the source paper.

Trade-offs

  • Pros: A malicious item can't taint others; scalable parallelism; smaller contexts reduce cost.
  • Cons: Requires strict output validation; extra orchestration overhead; loses cross-item context.

References

  • Beurer-Kellner et al., §3.1 (3) LLM Map-Reduce — HTML full text, Section 3.1.
  • Dean & Ghemawat (2008). MapReduce: Simplified Data Processing on Large Clusters.