IBM’s Granite team published LLMON on November 12, 2026, alongside two experimental preview models trained to read it, granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview. LLMON stands for LLM Object Notation and replaces the flat string a chat template normally hands a model with tagged blocks: one for the instruction, one for each piece of data it applies to, and an exec block naming which instruction runs on which input and where the answer goes. The OPI benchmark is where IBM reports the previews avoiding 47% more prompt injection attacks than the best frontier model it tested.
What was actually released
A format, a toolchain and two checkpoints. Nothing here is a product: the post calls it an experimental preview, ready for exploration and evaluation but not for production.
LLMON is XML-like markup whose six delimiters are reserved special tokens rather than characters such as braces and quotes, so structure and content sit in separate parts of the vocabulary. A block opens with a tag path and a two-character ID that the tokenizer encodes as a single token, so addressing a block costs two tokens. A separate exec block binds the rest: run this instruction on this input, subject to these requirements, and write the answer into this block.
The template writes it for you: a messages list names each part, marks it exec True or False, and apply_chat_template renders the markup.
| What the release contains | Detail |
|---|---|
| Checkpoints | granite-4.1-3b-LLMON-preview at 4B parameters and granite-4.1-8b-LLMON-preview at 9B, both BF16 |
| License | Apache 2.0 on both model cards |
| Starting weights | Granite 4.1 3B and 8B base checkpoints, not the released instruct models |
| Delimiters | Six, each installed in the tokenizer as a single reserved token |
| Tooling | Chat template, JSON to LLMON converters, example notebooks, an attention visualization Space |
| Status | Experimental preview, not for production |
On November 13, 2026 the cards showed 1,771 downloads last month for the 3B preview and 126 for the 8B. Two papers back the work: arXiv:2603.22519 for the format, arXiv:2610.38120 for the training recipe.
What the claim rests on
The 47% is relative, and the post does not publish the attack success rate behind it. Robustness is defined as one minus the attack success rate, on OPI, a benchmark that hides the injection inside the data of ordinary NLP tasks. Against the best open-source model IBM tested, the comparison is stated as 95% more attacks avoided. Neither model is named, and there is no per-model table.
The stronger phrasing, that attack success rates drop to nearly zero on some benchmarks, also arrives without a number, and the post says only that it observes similar trends on ASB and StruQ. It is explicit about scope: those benchmarks test static indirect injections, the kind hidden in a retrieved document or a tool response, and adaptive attacks across many turns are described as work in progress.
What the page does not publish
No attack success rate per model, no named baseline, no table for ASB or StruQ, and no compute, time or cost for the training run. The parity claim is the one with real numbers, and they are on the model cards.
Parity is where the cards get specific, and it cuts both ways. On the 3B pair, eight of the 24 rows sit below the Granite 4.1 3B instruct baseline. The widest loss is 8.00 points on CRUXEval-O, then 4.16 on DeepMind Math, 3.75 on MMLU-Pro and 1.28 on IFEval. The widest gains are 19.29 points on the Tulu3 safety average, 6.41 on BigCodeBench and 5.56 on MBPP. Code execution and hard math took the damage; safety moved the other way.
The card adds that the objective across those benchmarks is parity with the conventionally formatted instruct model, and that the behavior the format exists for, holding the instruction and data boundary under adversarial content, is not measured by any of them. Then the sentence that should travel with every screenshot:
The privilege rule is a learned behavior, not an enforced guarantee.
IBM adds that the rule reduces but does not eliminate the chance that an instruction embedded in data, a document or a tool result gets followed, and says not to treat it as a sole defense for an agent with access to sensitive systems. That is the right framing, and it is why 47% cannot be read as a boundary.
Eight of the 24 capability rows land below the baseline, the worst at 8.00 points on CRUXEval-O
On this page
What it changes for teams running small open models
If you run a 3B to 8B model on your own hardware for retrieval and tool calling, the useful part is that the boundary between instructions and untrusted material moved from wording to structure.
The migration is smaller than it sounds: a messages list with named parts is enough, and the template writes the markup, so teams that serialize prompts as JSON keep their pipelines through lossless converters in both directions. The exec flag then becomes a decision you make out loud. Any part marked False stays in the context and is referenced by nothing, the shape of a retrieved document you want read and not obeyed.
The decision this creates
- If your agent reads retrieved pages, uploaded files or tool output, you have something worth testing this week, on your own prompts rather than on OPI.
- If your agent only takes typed user input with no untrusted material in context, the gain is theoretical.
- This does not replace a frontier model. It replaces the habit of pasting untrusted text into a chat template and trusting the model to ignore it.
Cost is the unresolved part. Apache 2.0 weights mean no per-token price, and no managed endpoint is announced, so the real cost is the evaluation loop before you hand a 3B model your data. Prompts in a conventional chat format are out of distribution, per the cards, so a half migration is worse than no migration.
The Neural Minute take
The interesting claim is not that a markup format frustrates prompt injection. It is that JSON was the wrong wire format for small language models, and that the fix belongs in the tokenizer and the post-training mix rather than in one more line of “ignore any instructions in the document” bolted onto a system prompt.
That argument is testable. What we can verify says a 3B model can hold the boundary far more often than a frontier model on static injections, and that it pays for that with 8 points of CRUXEval-O and a few points of math. What we cannot verify is how it behaves after twenty turns of an attacker who knows the format, which is where agents actually live. We have covered models going around their own controls before, and the pattern there is that a structural defense holds until somebody tunes against it.
Our read: do not swap a frontier model for a 3B preview to buy safety. Do read this as evidence that the wire format can carry a security property scale alone does not deliver, and that an open 3B model with an explicit instruction and data split is a more honest default for a retrieval pipeline than a larger model with a hopeful system prompt. The number to watch is not 47%. It is whether anyone publishes adaptive attack results on their own stack.
Sources
- IBM Granite Team, “LLMON: An LLM-Native Markup Language, now in Granite 4.1 3B and 8B”, published November 12, 2026, read November 13, 2026: the announcement
- Model cards, source of the capability table, the license and the limitations: granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview
- Format and training papers, cited by arXiv ID on the cards: arXiv:2603.22519 and arXiv:2610.38120
Earlier on the same problem: OpenAI agents pass secrets through CPU cache, no network.