IBM Granite ships LLMON, a markup language that teaches small models to ignore prompt injections

📅 November 12, 2026 • AI Automation

November 12, 2026. IBM Granite shipped LLMON — LLM Object Notation, pronounced lemon — a markup language that teaches small models to ignore prompt injections hidden in their own context. The problem is structural: LLMs treat all context tokens uniformly, so system prompts, retrieved documents, tool responses and reasoning chains carry no explicit structure, which makes small models brittle and leaves room for prompt injections hidden in data.
LLMON wraps semantically coherent components in meaningful tags held by reserved special-token delimiters, states data schemas unambiguously and uses unique IDs that point to specific instructions anywhere in the context and bind them to the data they act on, analogous to function calls in programming languages.
Mechanically the format rests on six delimiters, all reserved single tokens, marking tag boundaries and nesting, on two-character block IDs unique per document, and on an execution block in each turn naming which instruction runs, on which inputs, with output going where it is pointed.

Two experimental preview models are already on Hugging Face: granite-4.1-3b-llmon-preview and granite-4.1-8b-llmon-preview, trained from Granite 4.1 base checkpoints to consume and generate LLMON-marked text, and a GitHub repo ships the toolkit, workflows and templates. The headline result: indirect prompt injections hidden in user data are mostly ignored thanks to explicit instruction-data separation, and on some benchmarks attack success rates drop to nearly zero, while regular instruction-tuned models get hijacked with high probability.
The paper (2610.38120) puts numbers on it: post-training two Granite 4.1 base models with LLMON-structured supervision reduces attack success rates on indirect prompt-injection benchmarks from 53-100 percent to 0.02-5.6 percent. On text-level injection, success falls from 100 to 0.1 percent at 3B and from 96.3 to 0.02 percent at 8B, and on agentic injection through tool observations, from 99.2 to 5.6 percent at 3B and from 52.8 to 3.1 percent at 8B.
Training used a structured corpus of 4.6 billion tokens spanning general, RAG and tool-calling data, augmented with distractor-infused variants, including 130000 prompt-injection examples totaling 211 million tokens, via supervised fine-tuning then reinforcement learning. General capability stays on par with the Granite 4.1 Instruct models across standard benchmark categories, so the safety gains do not cost baseline performance.

Adoption is low-friction: the shipped chat template renders LLMON automatically, naming the parts of a turn is enough, converters turn existing JSON into typed addressable blocks without loss, the Mellea framework has native support, and teams can define their own tags and tune a LoRA on top. The authors state the limits clearly: this is an experimental preview and not for production, and direct and multi-turn attacks remain substantially harder, since the strongest gains cover indirect injection.
The model cards list twelve supported languages, including English, German, Spanish, French, Japanese and Arabic. For agent builders the significance is architectural: privilege follows explicit bindings instead of phrasing, so tool responses and retrieved documents are read as data rather than obeyed as instructions, and moving injection defense into the format itself is a concrete engineering answer for agent stacks.

Sources: huggingface.co — arxiv.org — github.com

Continue the conversation: https://t.me/AIAutomationArchitecture · Bluesky