🔍 Read the full analysis: Granite 4.1 Adds LLMON Support To Its 3B And 8B Models on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
IBM has released experimental preview versions of its Granite 4.1 3B and 8B models trained to read and generate LLM Object Notation, a format for labeling instructions, data and output requirements. IBM reports lower success rates for indirect prompt injection on some benchmarks, but the supplied announcement does not identify the tests or provide scores for independent review.
IBM has released experimental preview versions of its Granite 4.1 3B and 8B models trained to read and generate LLM Object Notation (LLMON), a format that labels instructions, data and output requirements in a model’s context. IBM says the approach reduced indirect prompt-injection success on some benchmarks, but the announcement supplied here does not name the tests or provide results that would allow readers to assess the claim.
The preview models are named granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview. IBM says they are derived from Granite 4.1 base models and trained to process LLMON, which uses reserved special-token delimiters to mark labeled spans. The labels can identify instructions, data and requirements, while unique IDs and an execution block can connect a particular instruction to the data it should act on.
IBM says the format is meant to make boundaries clearer when a model receives a mixture of application instructions, documents, user content and tool responses. The company reports that indirect prompt injections embedded in user data are “mostly ignored” by LLMON models, and that attack success rates fall to “nearly zero” on some benchmarks. IBM also says the models maintain general capability relative to Granite 4.1 Instruct. These are company-reported findings; the provided source includes no benchmark names, scores, test setup, sample sizes or independent evaluation.
IBM says it is also releasing a GitHub repository containing a toolkit, workflow examples and templates. The source material does not provide a repository link, release date or license. IBM describes LLMON as an addition to chat templates, rather than a replacement: role labels still distinguish system, user and assistant messages, while LLMON labels parts of the content within those messages.
LLMON: Markup for Clearer Model Context
IBM has released experimental Granite 4.1 preview models trained to read and generate LLM Object Notation. The format labels instructions, data and output requirements so their relationships are clearer to a model.
How LLMON works
Reserved delimiters mark context spans and can link an instruction to the data it should act on.
Mark instructions, data and output requirements within a message.
Unique IDs and execution blocks can associate an instruction with its intended payload.
LLMON adds structure within messages; it does not replace chat templates.
What developers can explore
IBM says the release includes tools and examples for trying LLMON in existing workflows.
Granite 4.1 3B and 8B
Experimental models trained to consume and generate LLMON.
Converters and templates
IBM says the toolkit includes workflow examples and converters for JSON and LLMON.
Adapt the format
Developers can define custom tags; Mellea is cited as having native LLMON support.
Promising claim, limited evidence
The announcement describes lower indirect prompt-injection success on some benchmarks and says general capability is maintained relative to Granite 4.1 Instruct.
- Attacks hidden in user data are “mostly ignored.”
- Attack success falls to “nearly zero” on some benchmarks.
- General capability is maintained against Granite 4.1 Instruct.
- Benchmark names, protocols or numerical scores.
- Sample sizes, comparison conditions or independent evaluation.
- Evidence across varied models and deployment settings.
A New Layer for Prompt Boundaries
Prompt injection is a risk for applications that pass retrieved documents, user-provided text or tool outputs to a language model alongside instructions. If the model treats hostile text inside that content as a command, it may act against the application’s intended directions. LLMON’s proposal is to label those content types explicitly and link instructions to the data they govern, giving the model additional structure to follow.
If IBM’s results hold across varied systems and real deployment conditions, the format could give developers another technique to test when building model-based applications. It does not, on the evidence provided, establish that prompt injection is solved or that LLMON will work across other model families. The preview status and missing evaluation details mean developers will need to test it against their own data, tools and threat scenarios rather than rely on the reported benchmark claim alone.
Products Worth Considering
Bose QuietComfort Headphones – Wireless Bluetooth Over-Ear Noise Cancelling Headphones, Petal Pink Limited Edition
Sony WH-1000XM6 Wireless Noise-Canceling Headphones, Black
Apple Watch Series 10 GPS 46mm with Silver Aluminum Case and Blue Cloud Sport Loop
As an affiliate, we earn on qualifying purchases.
How LLMON Fits Existing Prompts
IBM characterizes LLMON as an XML-like format whose boundaries use reserved special tokens distinct from the text inside them. It argues that JSON was designed for software parsers, not causal language models that generate text one token at a time; in IBM’s account, structural characters can also appear in ordinary content, and nested structures can require models to track relationships across long spans. The supplied material does not offer comparative test results showing how LLMON performs against JSON or other structured-prompting approaches.
The format is intended to work alongside existing chat templates. IBM says it is providing converters to translate between JSON and LLMON without loss, and points to Mellea as a framework with native LLMON support for model calls. Developers can define custom structures and tags; IBM also describes using LoRA fine-tuning on the preview models to teach them those structures. The source gives no adoption figures or commitments from developers.
““For some benchmarks, attack success rates drop to nearly zero.””
— IBM, in its LLMON announcement
Benchmark Scope Remains Unclear
The source does not identify the benchmarks behind the reported near-zero attack success rates, define what counts as a successful attack, or give numerical results. It also does not specify comparison models, test conditions or how IBM measured general capability against Granite 4.1 Instruct. The scale and scope of the reported results cannot be assessed from the material supplied, and there is no independent evaluation cited.
Other details are also absent: the release date, repository link and model license are not provided. The announcement does not establish how the models perform across languages, long contexts, varied tools or production settings, or whether the approach introduces trade-offs in routine tasks. IBM calls the models experimental previews; the evidence presented does not show that LLMON prevents prompt injection generally or performs equally well with other model families.
Independent Tests Will Matter
Developers can evaluate the preview models and toolkit through IBM’s release channels, subject to availability and licensing terms; the supplied source does not specify those details. A clearer assessment will depend on publication of the benchmark names, protocols, numerical comparisons and capability results, followed by independent replication.
For teams considering LLMON, the next practical step is to test it in workflows that reflect their own documents, tools and threat conditions, while checking both injection resistance and ordinary task performance. The source does not announce a date for further results, a general-availability plan or support for additional model sizes, so those developments remain unconfirmed.
Key Questions
Which models did IBM release?
IBM announced experimental previews named granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview, derived from Granite 4.1 base models.
What is LLMON?
LLM Object Notation is a format that uses reserved special-token boundaries and labels to distinguish instructions, data and output requirements within a model’s context.
Does IBM’s announcement prove LLMON prevents prompt injection?
No. IBM reports lower indirect prompt-injection success on some benchmarks, but the supplied material does not name the benchmarks or provide scores, test methods or independent validation.
Is LLMON meant to replace chat templates?
No. IBM describes LLMON as an addition to chat templates: role labels identify system, user and assistant messages, while LLMON adds labels for content and relationships within those messages.
When can developers access the models, and what are the terms?
The source describes the models as experimental previews and says IBM is releasing a toolkit repository, but it does not provide a release date, repository link or model license.
Primary source: Hugging Face · via ThorstenMeyerAI.com
