IBM Releases LLMON Markup Language and Experimental Granite Preview Models to Combat Prompt Injection
IBM releases LLMON, a new markup language using special tokens to separate instructions from data, along with two experimental Granite 4.1 preview models trained to use it for improved prompt injection resistance.
IBM has released LLMON (LLM Object Notation), a new markup language designed specifically for large language models, along with two experimental preview models: granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview. These models are derived from the Granite 4.1 base checkpoints and are trained to consume and generate text marked with LLMON tags.
The core innovation of LLMON is its use of reserved special tokens to explicitly mark structural components like instructions, data, and requirements. Unlike JSON, which relies on characters that can appear in normal text, LLMON uses unique delimiters that allow the model to distinguish between executable commands and passive data payloads. This structural separation aims to mitigate indirect prompt injection attacks, where malicious instructions are hidden within retrieved documents or user data.
According to IBM's internal evaluation on the OPI benchmark, the LLMON models demonstrated significantly higher robustness against static indirect prompt injections compared to other open-source and closed-source models. The company reports that these models avoided 47% more attacks than the best frontier model tested and 95% more than the best open-source model, while maintaining general capability comparable to the standard Granite 4.1 Instruct models.
The release includes a GitHub repository with conversion tools that allow users to translate existing JSON pipelines into LLMON format losslessly. Additionally, IBM provides notebooks demonstrating how to fine-tune LoRA adapters on top of the LLMON models to understand custom domain-specific vocabularies. These are experimental previews intended for research and evaluation, not for production deployment.