IBM's LLMON Cuts Prompt Injection Below 6%

IBM on Thursday, Nov. 12, released two experimental Granite 4.1 models trained to tell a user's instructions apart from the documents, data and tool results they act on. In tests reported by IBM researchers, the approach cut the success rate of indirect prompt-injection attacks from 53%-100% to between 0.02% and 5.6%.

Key takeaways

• IBM published granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview on Hugging Face under the Apache 2.0 license.
• The models read prompts written in LLMON, a markup that tags every part of a prompt and names which instruction should run on which input.
• IBM calls the protection a learned behavior, not a guarantee, and labels the release a preview that is not ready for production.

What is LLMON?

LLMON, short for LLM Object Notation and pronounced "lemon," wraps each component of a prompt in its own addressable block: system policy, instructions, data, retrieved documents, tool definitions and tool results. Block boundaries are six reserved delimiters, each a single token, so structural markers cannot be confused with ordinary text the way a stray quotation mark can in JSON.

A separate "exec" block then points to which instruction to carry out, which inputs it applies to and where the answer goes. According to the model card, only the instruction and system blocks named in exec are authoritative. Anything reached as input, including documents and tool output, is material to read rather than a command, however it is phrased.

Developers do not have to write the markup by hand. The models ship with a chat template that renders a normal message list into LLMON, and IBM's GitHub repository includes converters that translate JSON to LLMON and back without loss.

Prompt injection test results

The training method is described in an arXiv paper the IBM team submitted on Oct. 28. Researchers re-serialized a 4.6 billion-token training corpus into LLMON and added decoy instructions that sat in the context but were never bound to the exec block. Supervised fine-tuning was followed by five reinforcement learning stages and a final preference-tuning stage on about 1,000 pairs built from the model's own responses to injection attempts.

On the OPI benchmark, IBM's Hugging Face blog says the LLMON models avoided 47% more attacks than the best frontier model it tested and 95% more than the best open-source model, with similar trends on the ASB and StruQ benchmarks. IBM notes those benchmarks cover static injections, and that defending against adaptive attacks spread over many chat turns is still in progress.

The goal on general benchmarks was parity, not improvement, and the 3B results land close to the standard model in both directions.

Why instruction-data separation matters

Indirect prompt injection hides a command inside content an AI system reads, such as a web page, email or tool response. The risk grows as agents read untrusted material and act with real permissions; a Microsoft-affiliated benchmark posted this month found that a single poisoned tool result could steer agents' later sessions in up to 71% of runs.

LLMON's answer is to build the boundary into the input format and training rather than an outside filter. The paper says this required no change to the model architecture. The models support 12 languages, including Korean and Japanese, and IBM's Mellea framework already converts its model calls to LLMON automatically.

What's next

IBM is asking developers to report what works and what breaks through GitHub Discussions. The model card warns that conventional chat-format prompts are out of distribution and will degrade quality, and that the models should not be the sole defense for an agent with access to sensitive systems.

FAQ

Can I use the LLMON models in production?

Not yet. IBM describes them as experimental previews for exploration and evaluation.

Does LLMON stop all prompt injection?

No. IBM says the behavior substantially reduces, but does not eliminate, the chance that an instruction hidden in data is followed, and multi-turn adaptive attacks remain open work.

Where can I get the models?

Both sizes are on Hugging Face under Apache 2.0, with the LLMON toolkit on GitHub.

References

• LLMON: An LLM-Native Markup Language, now in Granite 4.1 3B and 8B — IBM Granite, Hugging Face (Nov. 12, 2026)
• ibm-granite/granite-4.1-3b-llmon-preview — Hugging Face model card (Nov. 12, 2026)
• Post-Training Large Language Models with LLMON — arXiv (Oct. 28, 2026)