IBM's Granite LLMON Models Block 47% More Prompt Injections

IBM's new language models avoided 47% more prompt-injection attacks than the best frontier model it tested, according to the company's own benchmark results released November 12, 2026. The two experimental releases, Granite-4.1-3B-LLMON-preview and Granite-4.1-8B-LLMON-preview, are trained to tell trusted instructions apart from untrusted data. Both carry an Apache 2.0 license, and IBM says they are for exploration and evaluation, not production.

The release builds on the LLMON language paper, first submitted March 23, 2026. IBM fine-tuned the previews from Granite 4.1 base checkpoints rather than the released instruct models.

What does LLMON actually change?

LLMON stands for LLM Object Notation, pronounced "lemon." It is an XML-like markup language that describes prompt structure to a model. Instructions, documents, tool definitions, requirements and responses each occupy an individually addressable block. An execution block specifies which instruction to run, which inputs apply and where the answer goes. Content left unbound stays in context but nothing calls it.

The target is indirect prompt injection, where a malicious instruction hides inside a retrieved document, tool response or user-supplied data. The models treat instructions reached through an execution block as authoritative. Material reached as input gets read, not obeyed.

The design keeps costs predictable. Structural delimiters are reserved special tokens, and each two-character block ID comes from a fixed single-token set, so an address always costs two tokens.

Developers do not have to write the markup by hand. They can name parts of an ordinary messages list and call apply_chat_template; the bundled template renders LLMON while keeping the familiar system, user and assistant roles. The LLMON repository supplies lossless JSON conversion, chat-rendering utilities and examples. A linked attention demonstration shows how attention spreads across instruction, input and unbound blocks.

How was the resistance trained?

A post-training paper, submitted October 28, 2026, describes a 4.6-billion-token structured corpus covering general tasks, retrieval-augmented generation and tool-calling data. Distractor examples add competing instructions and irrelevant data that stay unreferenced, while the target response remains unchanged. The approach uses supervised fine-tuning and reinforcement learning without touching the model architecture.

Training runs five sequential reinforcement-learning stages: multi-domain reasoning, human-feedback alignment, knowledge calibration, and math. Direct preference optimization follows on 1,000 preference pairs generated from the model's own responses to injection attempts. The privilege rule emerges from this learned layout, not from an added guardrail.

IBM measures robustness on the OPI benchmark as one minus attack success rate — the share of attacks where the model does not execute the injected instruction. The post-training paper reports attack success rates falling from 53%–100% to 0.02%–5.6% across indirect-injection evaluations, while general capabilities held. The comparisons cover static injections only; adaptive attacks across multiple chat turns remain open work.

What happens to general capability?

The 8B model card sets parity with Granite 4.1 Instruct as the goal, and the results are mixed. GPQA scores 35.05 for the preview versus 41.96 for instruct. DeepMind Math runs 70.86 versus 80.07. BigCodeBench flips the pattern at 44.04 versus 35.00, and MMLU is nearly even at 74.20 versus 73.84. The release is best read as a test of structured prompting and injection resistance, not a uniform upgrade.

LLMON also adapts to domain vocabularies. IBM demonstrates custom tags and adapter fine-tuning on ScienceWorld reference trajectories, with the trained model playing held-out games and writing its next action in the new vocabulary. A higher-level library, Mellea, converts its model calls to LLMON automatically, so application users never see the markup.

The release gives developers a concrete way to measure explicit execution binding in retrieval and tool-using workflows. For sensitive deployments, the open question is whether the learned privilege rule holds beyond the reported tests — the model cards caution it is not an enforced guarantee and should not be an agent's sole defense.