🔍 Read the full analysis: How Granite 4.1 3B And 8B Bring LLMON To AI Workflows on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
IBM has released experimental preview versions of Granite 4.1 3B and 8B trained to read and generate LLM Object Notation, a format that labels instructions, data and output requirements. IBM reports lower indirect prompt-injection success on some benchmarks, but the announcement supplied here gives no benchmark names, scores or independent evaluation.
IBM has released experimental preview models Granite 4.1 3B LLMON and Granite 4.1 8B LLMON, trained to read and generate LLM Object Notation (LLMON), a format for labeling instructions, data and output requirements in a model’s context. IBM says the format reduced the success of indirect prompt-injection attacks on some benchmarks while preserving general capability relative to Granite 4.1 Instruct, but the supplied announcement does not identify the tests or provide scores.
The models are derived from Granite 4.1 base models and are named granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview, extending IBM Granite’s model lineup, which also includes time-series models. IBM describes LLMON as a markup format that uses reserved special-token delimiters around labeled spans. Those labels can identify instructions, data and requirements, while unique IDs and an execution block can connect an instruction to the specific content it should act on.
IBM’s stated goal is to make boundaries clearer when a model processes a mix of application instructions, retrieved documents, user-provided material or tool responses. The company says indirect injections embedded in user data are “mostly ignored” by LLMON models and that attack success rates fall to “nearly zero” on some benchmarks. These are company-reported results; the supplied material provides no benchmark names, test setup, scores, sample sizes or independent assessment.
IBM also says it is releasing a GitHub repository containing a toolkit, workflow examples and templates. Its announcement describes converters for translating JSON to LLMON and back, and says the format is intended to enrich, rather than replace, chat templates. The source points to Mellea as having native LLMON support and says developers can define custom structures and tags, including through LoRA fine-tuning on the preview models. It does not provide a repository link, model license or specific availability date.
LLMON: Markup for Clearer Model Context
IBM has released experimental Granite 4.1 preview models trained to read and generate LLM Object Notation. The format labels instructions, data and output requirements so their relationships are clearer to a model.
How LLMON works
Reserved delimiters mark context spans and can link an instruction to the data it should act on.
Mark instructions, data and output requirements within a message.
Unique IDs and execution blocks can associate an instruction with its intended payload.
LLMON adds structure within messages; it does not replace chat templates.
What developers can explore
IBM says the release includes tools and examples for trying LLMON in existing workflows.
Granite 4.1 3B and 8B
Experimental models trained to consume and generate LLMON.
Converters and templates
IBM says the toolkit includes workflow examples and converters for JSON and LLMON.
Adapt the format
Developers can define custom tags; Mellea is cited as having native LLMON support.
Promising claim, limited evidence
The announcement describes lower indirect prompt-injection success on some benchmarks and says general capability is maintained relative to Granite 4.1 Instruct.
- Attacks hidden in user data are “mostly ignored.”
- Attack success falls to “nearly zero” on some benchmarks.
- General capability is maintained against Granite 4.1 Instruct.
- Benchmark names, protocols or numerical scores.
- Sample sizes, comparison conditions or independent evaluation.
- Evidence across varied models and deployment settings.
A New Way to Mark Prompt Boundaries
Prompt injection is a risk for applications that combine trusted instructions with content a model should treat only as data. A document or tool response may contain text phrased as a command; if the model treats it as an instruction, it could act contrary to the application’s intent. LLMON’s proposed contribution is to give models explicit labels and links between instructions and the data those instructions govern.
If the reported results extend beyond the unspecified tests, the format could give developers another design option for reducing risk in retrieval, document-processing and tool-using workflows. It is not evidence that prompt injection has been solved. The previews’ experimental status and the absence of detailed evaluation mean organizations would need to test the models against their own data, tasks and threat conditions before relying on them.
Products Worth Considering
Bose QuietComfort Ultra Earbuds (2nd Gen), Wireless Noise-Cancelling Earbuds with Immersive Audio and Wireless Charging Case, Black
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, IPX4, Black
Samsung Galaxy Tab A11 8.7-Inch Wi-Fi Tablet, 64GB, 4GB RAM, 90Hz, Gray, with 20W Charger
As an affiliate, we earn on qualifying purchases.
How LLMON Fits Existing Workflows
IBM presents LLMON as an alternative to relying on ordinary text or JSON-like structure alone to communicate relationships inside a prompt. The company argues that JSON was designed for software parsers, not language models producing text token by token, and says braces, quotation marks and nested structures can be difficult for models to track. That is IBM’s rationale for the format, not a comparative result established by the supplied announcement.
LLMON is described as XML-like, with special-token boundaries distinct from the text inside labeled spans. It works alongside chat templates: role labels still mark system, user and assistant messages, while LLMON labels the parts within those messages and their relationships. IBM says converters are intended to support existing JSON pipelines. The announcement gives no usage figures, adoption commitments or comparisons with other structured-prompting approaches.
““For some benchmarks, attack success rates drop to nearly zero.””
— IBM, in its LLMON announcement
The Security Evidence Still Lacks Detail
The announcement does not identify the benchmarks behind the reported “nearly zero” attack success rate, define what counts as a successful attack or provide numerical comparisons. It also does not explain how IBM measured general capability against Granite 4.1 Instruct. Without test protocols and scores, readers cannot judge the size or scope of the reported effects, and no independent evaluation is included in the supplied source.
It remains unclear how the method performs across different model families, languages, long contexts and real tool-use settings, or whether it affects routine task performance. The material also omits the models’ release date, licensing terms and the repository link. IBM calls the models experimental previews; the information does not establish that LLMON prevents prompt injection generally or performs equally well outside the tested cases.
What Developers Need to Test
Developers can evaluate the preview models and toolkit through IBM’s release channels, subject to availability and licensing terms. For the reported claims to be assessed more fully, the next useful evidence would include benchmark names, attack definitions, test protocols and numerical comparisons, along with capability results and independent replication.
Organizations considering LLMON can also test it against their own workflows, including the documents, tool outputs and instruction boundaries relevant to their systems. The supplied announcement does not set out a schedule for further results or a general release, so those milestones remain unknown.
Key Questions
What did IBM release?
IBM released experimental previews of Granite 4.1 3B LLMON and Granite 4.1 8B LLMON, models trained to read and generate LLM Object Notation.
What is LLMON designed to do?
LLMON labels spans of a model’s context, such as instructions, data and output requirements, and can link an instruction to the content it applies to. IBM says these explicit boundaries are intended to reduce confusion between instructions and untrusted text.
Did IBM prove that LLMON prevents prompt injection?
No. IBM reports lower indirect prompt-injection success on some benchmarks, including rates described as “nearly zero.” The supplied announcement does not name those benchmarks or provide enough detail to establish the result’s scope, and it does not show that the format prevents attacks in general.
Are the models and toolkit generally available?
The source describes the models as experimental previews and says IBM is releasing a GitHub repository with a toolkit, examples and templates. It does not give a release date, repository link or license, so availability terms cannot be confirmed from the supplied material.
Primary source: Hugging Face · via ThorstenMeyerAI.com
