IBM adds LLMON markup to Granite 4.1 to cut prompt injection attacks

A prompt sent to a language model mixes two things in the same text. The rules you want it to follow, and the data it should read. An attacker who can put text into the data can try to write new rules into it. That data can be a user comment, an email, or a web page an agent fetches. This is called indirect prompt injection. It is the main reason an agent that reads the open web is hard to trust.

IBM's new language, LLMON, tries to fix the mix. LLMON uses six reserved special tokens as its tags. The model sees structure in its own vocabulary. It does not see characters a user can type. The team released it in two preview models on Hugging Face. The models are granite-4.1-3b-llmon-preview and granite-4.1-8b-llmon-preview.

What LLMON does

LLMON stands for LLM Object Notation. The blog post names three problems it is meant to solve. Prompt injection. Ambiguous structure that small models struggle with. And the limits of JSON for a language model, since JSON was written for parsers.

The blog's authors are Abraham Daniels, Basel Shbita, Chad DeLuca, Dan Gutfreund, Michael Hind, Shub A, and ten more co-authors. The language uses XML-style tags. But each tag is a single reserved token added to the tokenizer. A block of data cannot contain a tag, because the tag is not a character sequence the user can write. The template renders LLMON on its own when a developer calls the standard apply_chat_template() function in Python.

The numbers IBM states

The headline figure in the blog is from the OPI benchmark. OPI scores a model on how often it ignores an injected instruction hidden in data. IBM says the LLMON models avoid 95 percent more attacks than the best open-source model tested. It says they avoid 47 percent more attacks than the best frontier model tested. Both figures are IBM's own, measured on IBM's own models. The team says the attack success rate drops to near zero on LLMON.

The blog reports results on two more injection benchmarks, ASB and StruQ. It says they show the same pattern. It states that the LLMON models keep the standard benchmark scores of the Granite 4.1 Instruct models.

Where the boundary sits

Prompt injection is not a solved problem. Most defences today sit around the model. A filter on the input. A filter on the output. A smaller model that reads the response for signs of a jailbreak. Those defences all run on text, so an attacker's text can argue with them.

LLMON tries a different move. It puts the boundary between instructions and data inside the token stream. A user who can only write characters cannot forge a reserved token. So the model sees the difference between rule and data at a level the attacker cannot reach.

The weakness, for now, is that LLMON only runs on two Granite preview models. An agent built on Claude, GPT or Gemini cannot use it. And OPI, ASB and StruQ are IBM's own test sets. A real agent reads text written by users IBM has never seen. The honest read is that the idea looks promising on the benchmark. A team that already runs Granite in production has a new option to test on its own traffic.

Source

• LLMON: An LLM-Native Markup Language, now in Granite 4.1 3B and 8B, IBM Granite on Hugging Face
• LLMON GitHub repository, Generative Computing