🔍 Read the full analysis: Could LLMON Change How AI Models Work With Markup? on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
IBM has released experimental preview versions of its Granite 4.1 3B and 8B models trained to read and generate LLM Object Notation, or LLMON. IBM says the format can lower indirect prompt-injection success on some benchmarks while preserving general capability, but the announcement provides no benchmark details or independent results.
IBM has released experimental preview models Granite 4.1 3B LLMON and Granite 4.1 8B LLMON, trained to read and generate LLM Object Notation (LLMON), a markup format that labels instructions, data and output requirements in a model’s context. IBM says the format reduced indirect prompt-injection success on some benchmarks while preserving general capability, but the announcement does not name those benchmarks or provide scores, leaving the scope of the security claim unclear.
The preview models are derived from IBM’s Granite 4.1 base models and are named granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview. IBM also says it is releasing a GitHub repository with a toolkit, workflow examples and templates. The supplied announcement does not include a release date, repository link or model license.
LLMON marks spans of text with reserved special-token delimiters and labels such as instruction, data or requirement. It can assign unique IDs to spans and use an execution block to link an instruction to the particular payload it should act on. IBM’s stated aim is to help models distinguish task instructions from text found in documents, user input or tool responses.
IBM reports that LLMON models “mostly ignore” indirect prompt injections hidden in user data and that attack success rates fall to “nearly zero” on some benchmarks. It also says general capability is maintained relative to Granite 4.1 Instruct. These are company-reported findings: the source does not provide benchmark names, numerical results, test conditions, sample sizes or independent evaluation.
LLMON: Markup for Clearer Model Context
IBM has released experimental Granite 4.1 preview models trained to read and generate LLM Object Notation. The format labels instructions, data and output requirements so their relationships are clearer to a model.
How LLMON works
Reserved delimiters mark context spans and can link an instruction to the data it should act on.
Mark instructions, data and output requirements within a message.
Unique IDs and execution blocks can associate an instruction with its intended payload.
LLMON adds structure within messages; it does not replace chat templates.
What developers can explore
IBM says the release includes tools and examples for trying LLMON in existing workflows.
Granite 4.1 3B and 8B
Experimental models trained to consume and generate LLMON.
Converters and templates
IBM says the toolkit includes workflow examples and converters for JSON and LLMON.
Adapt the format
Developers can define custom tags; Mellea is cited as having native LLMON support.
Promising claim, limited evidence
The announcement describes lower indirect prompt-injection success on some benchmarks and says general capability is maintained relative to Granite 4.1 Instruct.
- Attacks hidden in user data are “mostly ignored.”
- Attack success falls to “nearly zero” on some benchmarks.
- General capability is maintained against Granite 4.1 Instruct.
- Benchmark names, protocols or numerical scores.
- Sample sizes, comparison conditions or independent evaluation.
- Evidence across varied models and deployment settings.
How LLMON Could Mark Prompt Boundaries
LLMON addresses a recurring risk in systems that combine application instructions with retrieved documents, user-provided material and tool outputs. A model that treats hostile text inside a document as an instruction may act against the application’s intended task. IBM’s proposal is to make the intended boundaries more explicit by labeling each kind of content and linking instructions to the data they govern.
If the reported results hold in broader testing, the format could give developers another technique for reducing indirect prompt-injection risk. That would matter in applications where a model processes material it did not write, such as search results or uploaded files. But markup is not proof that a model will reliably follow the boundaries, and the supplied evidence does not establish protection across different applications or threat conditions.
For teams evaluating the previews, the practical question is whether LLMON improves security in their own workflows without degrading ordinary task performance. That requires testing with representative inputs and attack scenarios, rather than assuming the company’s benchmark claims apply to every deployment.
Products Worth Considering
Samsung Odyssey G9 QD-OLED 49 Dual QHD Curved Gaming Monitor
LG UltraGear 32-inch Curved QHD Gaming Monitor (2560×1440, 180Hz, 1ms, 1000R, HDR10)
DJI Mini 4 Pro Fly More Combo with DJI RC 2
As an affiliate, we earn on qualifying purchases.
LLMON Adds Labels Within Chat Messages
LLMON is intended to supplement, not replace, chat templates. Role labels still distinguish system, user and assistant messages; LLMON adds structure within those messages to show which spans are instructions, data or other requirements. IBM describes the format as XML-like, with boundaries marked by reserved special tokens distinct from the text they contain.
IBM argues that common JSON structures were designed for software parsers and can be challenging for causal language models generating text one token at a time. It points to structural characters that can also occur in ordinary content and to the need to track nested relationships. The company says LLMON labels spans locally and supports nested structures. It also says converters can translate between JSON and LLMON without loss, though the supplied material includes no comparative test results for that claim.
The announcement also points to Mellea, which IBM says has native LLMON support for applying the format to model calls. Developers can define custom tags and structures; IBM describes using LoRA fine-tuning on the preview models to teach them those structures. The source gives no usage figures, adoption commitments or comparison with other structured-prompting methods.
““For some benchmarks, attack success rates drop to nearly zero.””
— IBM, in its LLMON announcement
Benchmark Scope Remains Unreported
The announcement does not say which benchmarks produced the reported security results, how many tests were run, what counted as a successful attack or how the preview models compared numerically with other models. It also does not explain how IBM measured whether general capability was maintained relative to Granite 4.1 Instruct. Without those details or independent testing, the results’ scale and applicability cannot be assessed.
Other open questions include the models’ behavior across languages, long contexts and real tool use, and whether LLMON works equally well with models outside the Granite family. The supplied source also lacks the release date, repository link and licensing terms. IBM calls the models experimental previews; the material does not show that LLMON prevents prompt injection generally or that it has been validated in deployment.
Independent Tests Will Set the Scope
Developers can assess the previews and toolkit through IBM’s release channels, once availability and licensing details are clear. A stronger evaluation would publish benchmark names, attack definitions, test protocols, numerical comparisons and capability results, then invite independent replication.
For now, teams considering the format can compare it with their existing prompt and security practices using their own data and threat scenarios. Further evidence would need to show whether the reported gains persist across models and routine workloads, and whether any performance trade-offs emerge. No additional release or evaluation date is specified in the supplied announcement.
Key Questions
What is LLMON?
LLM Object Notation is a markup format that labels spans in a model’s context, such as instructions, data and output requirements. IBM says it uses reserved special-token boundaries and can link instructions to the data they apply to.
Which models did IBM release?
IBM announced experimental previews named granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview, derived from Granite 4.1 base models.
Has IBM shown that LLMON prevents prompt injection?
No. IBM reports lower indirect prompt-injection success on some benchmarks, but the supplied announcement gives no benchmark names, scores or independent evaluation. It does not establish that LLMON prevents prompt injection in general.
Does LLMON replace JSON or chat templates?
IBM describes LLMON as an addition to chat templates, not a replacement. It says converters can translate between JSON and LLMON, but the source provides no comparative results validating the claimed translation behavior.
When can developers access the models and what are the license terms?
The supplied source says IBM is releasing a GitHub repository with a toolkit, examples and templates, but it provides no repository link, release date or model license. Those details remain unclear.
Primary source: Hugging Face · via ThorstenMeyerAI.com
