LLMON: An LLM-Native Markup Language, now in Granite 4.1 3B and 8B

IBM's Granite team released two experimental preview models, 3B and 8B parameters, trained on a new markup it calls LLMON, short for LLM Object Notation. The idea is simple to state: instead of flattening instructions, documents, tool output and constraints into one long string, every piece gets a labeled block, and a separate execution block says which instruction runs on which data.

The reason that matters is prompt injection. When an agent reads a web page or a tool response, a hidden command in that data can hijack it. IBM says its LLMON models mostly ignore those planted instructions, with attack success on some benchmarks dropping to nearly zero, while general capability stays on par with the regular Granite 4.1 Instruct models.

We like this one, and not just because it is clever. The industry has spent two years asking models to behave safely while feeding them context that gives them no reliable way to tell a command from a quotation. IBM's argument is that JSON was built for parsers, not for language models, and that a quote mark inside a document and a quote mark closing a field look identical to a model. That is a real design flaw, and fixing the format instead of bolting on another filter is the right instinct.

The headline claim is strong. On the OPI benchmark, IBM reports its previews avoided 47% more attacks than the best frontier model it tested and 95% more than the best open-source model, with similar trends on ASB and StruQ. If that holds up under outside testing, it is one of the more meaningful security results we have seen for small, cheap models, which are exactly the ones companies want to run inside agents at scale.

Now the caveats, and IBM states several of them itself. These are static injection benchmarks. Adaptive attacks that unfold over many turns are still being worked on. The privilege rule, where executed instructions are authoritative and everything else is just material to read, is a learned behavior, not an enforced guarantee. And the models are labeled an experimental preview, not for production. A learned defense can be learned around, and we would not want any team treating this as a security boundary yet.

There is also an adoption question. LLMON adds reserved special tokens to the tokenizer, so its benefits live inside models trained for it. That makes it a format bet as much as a model release. Our read is that the concept, explicit separation of instruction and data at the token level, is likely to outlast this particular syntax. Whether the industry converges on IBM's version or something similar is the open question.

Where this leads if it scales is encouraging: agents that can read untrusted email, web pages and tool results without treating them as orders. That is a precondition for useful automation, and we would rather see labs compete here than on another leaderboard.

The release includes the granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview models, a GitHub toolkit with lossless JSON-to-LLMON converters, native support in IBM's Mellea library, and an attention visualization demo on Hugging Face Spaces. IBM says the models were post-trained from Granite 4.1 base checkpoints on a re-serialized instruction corpus that included deliberately unbound decoy instructions, followed by several GRPO reinforcement stages and a final DPO stage built on the model's own responses to injection attempts. A ScienceWorld demo shows teams defining their own tag vocabulary and tuning a LoRA adapter on top.