TL;DR
IBM has released two experimental preview models, Granite 4.1 3B and 8B LLMON, trained to read and generate LLM Object Notation. The company says explicit labels linking instructions to relevant data can reduce indirect prompt-injection success on some benchmarks while preserving general capability relative to Granite 4.1 Instruct; benchmark details and broader performance evidence are not included in the supplied announcement.
The preview models are derived from Granite 4.1 base models and are named granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview. IBM also says it is releasing a GitHub repository with a toolkit, workflow examples and templates for using the format. The source material does not give a release date, repository link or model license.
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
LLMON uses reserved special-token delimiters around labeled spans such as instructions, data and requirements. Its design can assign unique IDs to those spans and use an execution block to associate a particular instruction with the payload it should act on. IBM says this explicit separation helps prevent unrelated conversation turns, tool outputs or text embedded in user data from being treated as instructions for the current task.
IBM reports that indirect prompt injections hidden in user data are “mostly ignored” by LLMON models and that attack success rates fall to “nearly zero” on some benchmarks. It also says general capability is maintained relative to Granite 4.1 Instruct models. Those statements are company-reported results: the supplied material gives no benchmark names, test setup, scores, sample sizes or independent evaluation, so the scale and scope of the results cannot be assessed here.
LLMON: Markup for Clearer Model Context
IBM has released experimental Granite 4.1 preview models trained to read and generate LLM Object Notation. The format labels instructions, data and output requirements so their relationships are clearer to a model.
How LLMON works
Reserved delimiters mark context spans and can link an instruction to the data it should act on.
Mark instructions, data and output requirements within a message.
Unique IDs and execution blocks can associate an instruction with its intended payload.
LLMON adds structure within messages; it does not replace chat templates.
What developers can explore
IBM says the release includes tools and examples for trying LLMON in existing workflows.
Granite 4.1 3B and 8B
Experimental models trained to consume and generate LLMON.
Converters and templates
IBM says the toolkit includes workflow examples and converters for JSON and LLMON.
Adapt the format
Developers can define custom tags; Mellea is cited as having native LLMON support.
Promising claim, limited evidence
The announcement describes lower indirect prompt-injection success on some benchmarks and says general capability is maintained relative to Granite 4.1 Instruct.
- Attacks hidden in user data are “mostly ignored.”
- Attack success falls to “nearly zero” on some benchmarks.
- General capability is maintained against Granite 4.1 Instruct.
- Benchmark names, protocols or numerical scores.
- Sample sizes, comparison conditions or independent evaluation.
- Evidence across varied models and deployment settings.
A Structured Approach to Prompt Injection
LLMON targets a practical problem in applications that combine instructions with retrieved documents, user-provided content and tool responses. If a model confuses hostile text inside a document with an instruction from the application, it may follow directions the user or system did not intend. IBM’s proposal is to mark what each span represents and bind instructions to the data they apply to, giving the model more explicit cues about those boundaries.
If the reported benchmark results hold across varied applications, the approach could offer developers another way to reduce prompt-injection risk in systems built around language models. The preview status matters: the announcement’s results are not enough to establish how well the method works beyond the tested cases, how it behaves with different models, or whether it introduces trade-offs in routine tasks. Teams will need evaluation evidence that reflects their own data and threat conditions.
Products Worth Considering
Bose Lifestyle Ultra Soundbar and Ultra Subwoofer Bundle
DJI Mini 4 Pro Fly More Combo with DJI RC 2
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, and IPX4 Water Resistance
As an affiliate, we earn on qualifying purchases.
Why IBM Designed LLMON
IBM argues that common JSON structures were designed for software parsers, not causal language models generating text one token at a time. In its account, braces, quotation marks and other structural characters can also appear in ordinary content, while nesting requires a model to track relationships over long spans. The company says these properties can make structure harder for a model to follow reliably, particularly in smaller models.
LLMON is described as XML-like, but its structural boundaries use reserved special tokens distinct from the text they contain. The format labels spans locally and can express nested structures. IBM says it is providing converters to translate JSON to LLMON and back without loss, to help teams with existing JSON pipelines. LLMON is intended to enrich chat templates, not replace them: role labels still identify system, user and assistant messages, while LLMON adds labels for the parts within those messages and their relationships.
The source also points to Mellea, which it says has native LLMON support that applies the format to model calls. Developers can define custom structures and tags, and IBM describes using LoRA fine-tuning on top of the preview models to teach them those structures. The material does not provide usage numbers, adoption commitments or comparisons with other structured-prompting methods.
““For some benchmarks, attack success rates drop to nearly zero.””
— IBM, in its LLMON announcement
Benchmark Evidence Still Missing
The supplied announcement does not identify the benchmarks behind the “nearly zero” attack success rate, provide numerical results, or explain what counts as an attack success. It also does not specify the comparison models, test conditions or how general capability was measured against Granite 4.1 Instruct. Without those details or independent testing, readers cannot tell how broadly the security claim applies.
It is also unclear from the source when the previews and toolkit became available, what license governs them, or how the models perform in deployment settings with varied languages, long contexts and real tool use. IBM calls the models experimental previews; the material does not establish that the format prevents prompt injection in general or that it will work equally well with other model families.
Testing the Preview Models
Developers can evaluate the preview models and toolkit using their own workflows, subject to availability and licensing details in IBM’s release channels. A useful next step for judging the claims would be publication of benchmark names, test protocols, numerical comparisons and capability evaluations, followed by independent replication.
Further evidence would also show whether LLMON’s explicit structure reduces injection failures across different tasks and models, and whether JSON conversion and custom-tag workflows are practical for existing systems. The announcement does not state a date for a broader release or further results, so the next milestone is not specified.
Where I land
My assessment is that LLMON is a concrete and testable response to a real weakness in how language models handle mixed context: applications often place instructions beside content that should be treated only as data. Making those roles and links explicit is a plausible design improvement, and releasing preview models with tools gives developers a way to examine it.
The strongest counterargument is that structure in the prompt does not by itself prove robust security. Models may still misread boundaries, and a result on a limited benchmark may not carry over to different tasks or adversarial inputs. IBM’s claims about near-zero attack success are promising, but the supplied announcement lacks the details needed to measure their reach.
I would raise my confidence if IBM published reproducible benchmark protocols and results, including comparisons with Granite 4.1 Instruct, and independent teams replicated the findings across varied models and real application workflows. Evidence of consistent security gains without material losses in general capability would shift my view from promising preview to a well-supported method.
Key Questions
What is LLMON?
LLM Object Notation is a markup format that labels parts of a model’s context, including instructions, data and requirements, using reserved special-token delimiters. It can also link an instruction to the specific data it should use.
Which models did IBM release?
IBM announced two experimental previews derived from Granite 4.1 base models: granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview.
Does LLMON replace JSON or chat templates?
IBM says LLMON does not replace chat templates; it adds labels for the meaning and relationships of message components. The company also says its converters can translate JSON to LLMON and back without loss, though the supplied announcement does not include independent validation of that claim.
Does LLMON eliminate prompt injection?
No such guarantee is established in the supplied material. IBM reports that attacks were mostly ignored and success rates fell to nearly zero on some benchmarks, but it does not name those benchmarks or provide the methods and figures needed to judge the scope of the result.
Source: Hugging Face
