IBM on November 12 released two experimental Granite 4.1 models, 3B and 8B, that use a markup language called LLMON and that IBM says cut static indirect prompt injection to near zero on some benchmarks.\n\nIndirect prompt injection hides malicious instructions in data a model reads, such as a retrieved document or tool output. IBM says LLMON addresses this by marking which text is an instruction and which is data. The results come from IBM's own announcement on Hugging Face1, which includes no independent test results.\n\nThe checkpoints are granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview. IBM fine-tuned them from Granite 4.1 base models rather than the released instruct models. The company said they are an experimental preview, "ready for exploration and evaluation but not for production."\n\nPrompt injection has been studied as a general problem. A USENIX Security 2024 paper4 formalised the attacks and benchmarked 10 defences across 10 models and 7 tasks. It does not cover LLMON. IBM's post says structure in model context is often implicit or encoded in formats such as JSON, which were not designed for language models. It argues that a quotation mark inside a document and one that closes a JSON field are the same token to a model.\n\n## How LLMON works\n\nLLMON replaces character delimiters with six reserved special tokens installed in the tokenizer. According to the language README5, they are <|open|>, <|close|>, <|open_end|>, <|self_close|>, <|.|> and <|:|>. Components such as instructions and data are tagged and given two-character IDs. A final "exec" block names which instruction to run, which inputs it uses and where the output goes. Unreferenced content is meant to be ignored.\n\nIBM trained the models on a conventional instruction-tuning corpus re-serialised into LLMON, with added decoy instructions left unbound. Five GRPO reinforcement-learning stages followed, then a DPO stage on a thousand on-policy preference pairs built from the models' responses to injection attempts.\n\nThe GitHub repository2 holds converters that translate between JSON and LLMON, which IBM describes as lossless. The Mellea library has native LLMON support.\n\n## What IBM reports\n\nOn the OPI benchmark, which places injections in the data of classic NLP tasks, IBM said that "LLMON practically eliminates the problem on this benchmark, avoiding 47% more attacks relative to the best frontier model that we tested, and 95% more than the best open-source model." Those are relative gains over the best-performing model in each comparison group. The post text gives no absolute attack success rates and does not name the models tested. IBM said it saw similar trends on the ASB and StruQ benchmarks. It also said the LLMON models perform on par with Granite 4.1 Instruct models across standard benchmark categories.\n\nIBM set limits on the claim. The benchmarks test only static indirect injections, which it said the instruction/data separation directly addresses. It is working on adaptive attacks that unfold over many chat turns. The post also says the privilege rule is "a learned behavior, not an enforced guarantee."\n\nIBM also showed a custom tag vocabulary on the ScienceWorld text-based benchmark, tuning a LoRA adapter on an LLMON model. The post reports no scores for that demonstration. It asks users to report findings in GitHub Discussions.