🔍 Read the full analysis: LLMON: An LLM-Native Markup Language, Now In Granite 4.1 3B And 8B on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
IBM has released experimental preview models Granite 4.1 3B LLMON and 8B LLMON, trained to read and generate its LLM Object Notation format. IBM reports lower indirect prompt-injection success on some benchmarks, but the supplied announcement gives no benchmark names, scores or independent evaluation.
IBM has released two experimental preview models, Granite 4.1 3B LLMON and Granite 4.1 8B LLMON, trained to read and generate LLM Object Notation (LLMON), a markup format that labels instructions, data and output requirements in a model’s context. IBM says the format can help limit indirect prompt injection by making those relationships explicit, but the original analysis does not provide benchmark details to verify the scale of the reported effect.
The models are derived from Granite 4.1 base models and are named granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview. IBM also says it is releasing a GitHub repository containing a toolkit, workflow examples and templates. The supplied source does not include a repository link, release date or model license.
LLMON uses reserved special-token delimiters to mark labeled spans, including instructions, data and requirements. It can assign unique IDs to those spans and use an execution block to connect an instruction to the payload it should act on. IBM says this structure is meant to help models distinguish the current task’s instructions from unrelated conversation turns, tool outputs or hostile text embedded in user-provided data.
IBM reports that indirect prompt injections hidden in user data are “mostly ignored” by LLMON models and that attack success rates fall to “nearly zero” on some benchmarks. The company also says the models maintain general capability relative to Granite 4.1 Instruct. These are company-reported results: the supplied material names no benchmarks, test conditions, scores, sample sizes or independent evaluations.
LLMON: Markup for Clearer Model Context
IBM has released experimental Granite 4.1 preview models trained to read and generate LLM Object Notation. The format labels instructions, data and output requirements so their relationships are clearer to a model.
How LLMON works
Reserved delimiters mark context spans and can link an instruction to the data it should act on.
Mark instructions, data and output requirements within a message.
Unique IDs and execution blocks can associate an instruction with its intended payload.
LLMON adds structure within messages; it does not replace chat templates.
What developers can explore
IBM says the release includes tools and examples for trying LLMON in existing workflows.
Granite 4.1 3B and 8B
Experimental models trained to consume and generate LLMON.
Converters and templates
IBM says the toolkit includes workflow examples and converters for JSON and LLMON.
Adapt the format
Developers can define custom tags; Mellea is cited as having native LLMON support.
Promising claim, limited evidence
The announcement describes lower indirect prompt-injection success on some benchmarks and says general capability is maintained relative to Granite 4.1 Instruct.
- Attacks hidden in user data are “mostly ignored.”
- Attack success falls to “nearly zero” on some benchmarks.
- General capability is maintained against Granite 4.1 Instruct.
- Benchmark names, protocols or numerical scores.
- Sample sizes, comparison conditions or independent evaluation.
- Evidence across varied models and deployment settings.
A New Format for Prompt Boundaries
LLMON addresses a security problem for systems that combine model instructions with retrieved documents, tool responses and user content. If a model treats text inside a document as an instruction from the application, it may follow directions that were not intended to govern the task. A format that marks the role of each span and binds instructions to relevant data could give models clearer cues about those boundaries.
For developers, the proposal offers another way to structure prompts alongside existing controls such as careful tool permissions, data handling and application-level safeguards. If IBM’s results hold across varied systems and attack patterns, LLMON could help reduce a specific class of prompt-injection risk. The current announcement does not establish that it prevents prompt injection generally, or that the results will carry over to other model families and production settings.
The practical value will depend on evidence beyond the preview release. Teams need to know whether the format changes model behavior on their own documents, tools and threat scenarios, and whether it affects routine task performance. The absence of published figures means readers cannot yet compare the claimed gains with other defenses or judge their size.
Products Worth Considering
Samsung 32-Inch Odyssey G5 QHD 180Hz Gaming Monitor
Kindle Paperwhite Signature Edition 32GB E-Reader, 7-Inch Display, Seaglass Green
Apple Watch SE 3 GPS 44mm Smartwatch
As an affiliate, we earn on qualifying purchases.
How LLMON Structures Model Input
IBM describes LLMON as XML-like, but says its boundaries use reserved special tokens distinct from the text inside them. The format can label spans locally and represent nested structures. IBM argues that common JSON structures were designed for software parsers rather than causal language models generating text one token at a time; in its account, punctuation used for structure can also appear in ordinary content, while nested relationships can be difficult to track over long spans, particularly for smaller models. These are IBM’s design rationale, not comparative findings supplied with the announcement.
LLMON is intended to enrich chat templates, not replace them. Role labels still identify system, user and assistant messages, while LLMON adds labels for content within those messages and relationships between spans. IBM says converters can translate JSON to LLMON and back without loss, supporting teams with existing JSON pipelines.
The source also points to Mellea, which IBM says has native LLMON support for applying the format to model calls. Developers can define custom structures and tags; IBM says LoRA fine-tuning on the preview models can teach them those structures. The announcement provides no usage figures, adoption commitments or comparisons with other structured-prompting approaches.
““For some benchmarks, attack success rates drop to nearly zero.””
— IBM, in its LLMON announcement
Benchmark Scope Remains Unspecified
The supplied announcement does not identify the benchmarks behind the reported “nearly zero” attack success rate, give numerical results or define what counts as a successful attack. It also does not describe the comparison models, test setup or method used to assess general capability against Granite 4.1 Instruct. Without those details or independent testing, the strength and scope of the security claim cannot be assessed.
Other open questions include how the format performs with different languages, long contexts and real tool use, whether it introduces trade-offs in routine tasks, and how well it transfers to models outside the Granite family. The source does not state when the previews and toolkit became available or specify licensing terms. IBM labels the models experimental previews; the supplied information does not establish that LLMON prevents prompt injection in general.
Testing and Evaluation Ahead
Developers can assess the preview models and toolkit in their own workflows, subject to availability and licensing terms in IBM’s release channels. For readers to evaluate IBM’s claims more broadly, the next useful evidence would include named benchmarks, test protocols, numerical comparisons and details on how capability was measured.
Independent replication and testing against varied applications would help show whether the reported results extend beyond IBM’s selected cases. Until those details are available, organizations considering LLMON will need to test it against their own data and threat conditions rather than treat the preview claims as a general security guarantee.
Key Questions
What has IBM released?
IBM has released experimental previews named Granite 4.1 3B LLMON and Granite 4.1 8B LLMON, along with a toolkit, examples and templates that IBM says will be available through a GitHub repository. The supplied source does not give a release date or repository link.
What is LLMON?
LLM Object Notation is a markup format for labeling instructions, data and output requirements within a model’s context. It uses reserved special-token boundaries and can connect a particular instruction to the data it applies to.
Does LLMON prevent prompt injection?
IBM says the models mostly ignore indirect prompt injections in user data and reports attack success rates falling to nearly zero on some benchmarks. The supplied announcement does not provide the benchmark names, scores or independent evaluations, so it does not establish that LLMON prevents prompt injection generally.
How can developers judge the reported results?
Developers can test the preview models against their own workflows and threat conditions. Broader assessment will require benchmark details, numerical results, test protocols and independent replication, none of which are included in the supplied announcement.
Primary source: Hugging Face · via ThorstenMeyerAI.com
