🔍 Read the full analysis: A Closer Look At LLMON, The Markup Language In Granite 4.1 on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
IBM has released experimental previews of Granite 4.1 3B and 8B models trained to read and generate LLM Object Notation, or LLMON. IBM says the format lowers indirect prompt-injection success on some benchmarks, but the supplied announcement provides no benchmark names, scores or independent evaluation.
IBM has released experimental previews of Granite 4.1 3B LLMON and Granite 4.1 8B LLMON, models trained to read and generate LLM Object Notation (LLMON), a format that labels instructions, data and output requirements in a model’s context. IBM says the format can reduce the success of indirect prompt-injection attacks on some benchmarks, but the announcement supplied here does not identify those tests or provide results for independent review.
The preview models are derived from IBM’s Granite 4.1 base models and are named granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview. IBM also says it is releasing a GitHub repository containing a toolkit, workflow examples and templates. The source material does not include a repository link, release date or model license.
LLMON places reserved special-token delimiters around labeled spans, such as an instruction, a data payload or a requirement. It can assign unique IDs to those spans and use an execution block to connect an instruction to the data it is meant to act on. IBM’s stated aim is to make those relationships clearer to a model, especially when a prompt combines application instructions with documents, user content or tool responses.
IBM reports that LLMON models “mostly ignore” indirect prompt injections hidden in user data and that attack success rates fall to “nearly zero” on some benchmarks. The company also says the models maintain general capability relative to Granite 4.1 Instruct. These are company-reported results: the supplied material gives no benchmark names, scores, sample sizes, test conditions or independent evaluation.
LLMON: Markup for Clearer Model Context
IBM has released experimental Granite 4.1 preview models trained to read and generate LLM Object Notation. The format labels instructions, data and output requirements so their relationships are clearer to a model.
How LLMON works
Reserved delimiters mark context spans and can link an instruction to the data it should act on.
Mark instructions, data and output requirements within a message.
Unique IDs and execution blocks can associate an instruction with its intended payload.
LLMON adds structure within messages; it does not replace chat templates.
What developers can explore
IBM says the release includes tools and examples for trying LLMON in existing workflows.
Granite 4.1 3B and 8B
Experimental models trained to consume and generate LLMON.
Converters and templates
IBM says the toolkit includes workflow examples and converters for JSON and LLMON.
Adapt the format
Developers can define custom tags; Mellea is cited as having native LLMON support.
Promising claim, limited evidence
The announcement describes lower indirect prompt-injection success on some benchmarks and says general capability is maintained relative to Granite 4.1 Instruct.
- Attacks hidden in user data are “mostly ignored.”
- Attack success falls to “nearly zero” on some benchmarks.
- General capability is maintained against Granite 4.1 Instruct.
- Benchmark names, protocols or numerical scores.
- Sample sizes, comparison conditions or independent evaluation.
- Evidence across varied models and deployment settings.
How LLMON Targets Prompt Injection
The format addresses a recurring risk in systems that retrieve documents, accept user-provided text or call tools. Malicious directions can be embedded in content that an application intends the model to treat as data. If the model mistakes that text for an instruction, it may act outside the application’s intended workflow.
LLMON’s proposed defense is to mark what each span represents and explicitly bind instructions to the relevant data. If the approach performs as IBM reports across varied conditions, it could give developers another way to structure model inputs and reduce some prompt-injection risks. The announcement does not establish that markup alone prevents these attacks; teams would still need to test the models against their own data, tools and threat scenarios.
The preview designation and missing evaluation details limit what can be concluded now. A result on unspecified benchmarks does not show how the format behaves across languages, longer contexts, different applications or models from other providers. Nor does the supplied material quantify possible trade-offs in ordinary tasks.
Products Worth Considering
LG UltraGear 27-inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1, DisplayPort 1.4, Black
Amazon Kindle Scribe Colorsoft 64GB with 11-Inch Color Display and Premium Pen, Graphite
DJI Osmo Pocket 3 Vlogging Camera with 1-Inch CMOS Sensor and 4K/120fps Video
As an affiliate, we earn on qualifying purchases.
Markup Within Existing Chat Prompts
IBM describes LLMON as an XML-like format whose structural boundaries use reserved special tokens distinct from the text inside them. The company argues that conventional JSON structures were designed for software parsers, not language models generating text one token at a time. It says braces, quotation marks and nested relationships can be difficult for models to track, particularly smaller ones. Those are IBM’s design rationale; the announcement does not include a comparative study establishing that LLMON outperforms JSON across tasks.
LLMON is intended to add structure within chat messages, not replace the chat template itself. Role labels still distinguish system, user and assistant messages; LLMON adds labels for content within those messages and the relationships between spans. IBM says it is providing converters for translating JSON to LLMON and back without loss, and points to Mellea as a framework with native support for applying the format to model calls.
Developers can define custom structures and tags, according to IBM. The company also describes using LoRA fine-tuning on top of the preview models to teach them those structures. The source material provides no adoption figures, commitments from other model makers or direct comparison with other structured-prompting methods.
““For some benchmarks, attack success rates drop to nearly zero.””
— IBM, in its LLMON announcement
Benchmark Scope Remains Unspecified
The supplied announcement does not say which benchmarks were used, how an attack success was defined, or what numerical results the models achieved. It also does not identify comparison models, test conditions, sample sizes or the method used to assess general capability against Granite 4.1 Instruct. Without those details, readers cannot judge the scale or scope of the reported improvement.
It remains unclear when the preview models and toolkit became available, what licenses apply, or how the approach performs in deployment conditions involving varied languages, long contexts and real tool use. The material does not show that LLMON prevents prompt injection generally or works equally well with other model families.
Developer Testing and Evaluation
Developers can evaluate the previews and toolkit through IBM’s release channels, subject to availability and licensing terms. For a clearer assessment of the security claims, the next useful evidence would include named benchmarks, test protocols and numerical comparisons, alongside details of how capability was measured.
Independent replication and testing in varied deployment settings would help establish whether the results extend beyond the cases IBM evaluated. Until that evidence is available, organizations considering LLMON will need to test it against their own workflows and should treat the reported reductions as preliminary rather than a general guarantee.
Key Questions
What is LLMON?
LLM Object Notation is a markup format that labels spans of a model’s context, such as instructions, data and output requirements, and can link an instruction to the data it applies to.
Which models did IBM release?
IBM announced experimental previews named granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview, derived from Granite 4.1 base models.
Does LLMON prevent prompt injection?
The supplied announcement does not establish that it prevents prompt injection generally. IBM reports lower attack success on some benchmarks, but does not provide the benchmark names, scores or independent evaluation in the source material.
Where can developers find the toolkit and what license applies?
IBM says it is releasing a GitHub repository with a toolkit, examples and templates. The source material does not provide the repository link, release date or licensing details, so developers will need to check IBM’s release channels.
Primary source: Hugging Face · via ThorstenMeyerAI.com
