🔍 Read the full analysis: Why LLMON Is Designed As An LLM-Native Markup Language on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
IBM has released experimental preview versions of its Granite 4.1 3B and 8B models trained to read and generate LLM Object Notation, or LLMON. IBM says the format lowered indirect prompt-injection success on some benchmarks while maintaining general capability, but the announcement provides no benchmark names, scores or independent evaluations.
IBM has released experimental preview models Granite 4.1 3B LLMON and Granite 4.1 8B LLMON, trained to read and generate LLM Object Notation (LLMON), a format that marks instructions, data and output requirements in a model’s context, as detailed in the original analysis. IBM says the format reduced indirect prompt-injection success on some benchmarks, but its announcement does not identify those tests or provide scores, leaving the scope of the security claim unclear.
The models, named granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview, are derived from Granite 4.1 base models. IBM also says it is releasing a GitHub repository with a toolkit, workflow examples and templates for applying the format. The supplied announcement does not give a release date, repository link or model license.
LLMON uses reserved special-token delimiters to identify labeled spans, including instructions, data and requirements. It can assign unique IDs to those spans and use an execution block to connect a particular instruction with the payload it should act on. IBM’s stated goal is to make those relationships explicit, so text inside a document, tool response or other user-provided content is less likely to be treated as an instruction for the current task.
IBM says indirect prompt injections hidden in user data are “mostly ignored” by LLMON models and that attack success rates fall to “nearly zero” on some benchmarks. The company also says general capability is maintained relative to Granite 4.1 Instruct. These are company-reported results: the supplied material does not name the benchmarks, explain the test setup or provide numerical comparisons.
LLMON: Markup for Clearer Model Context
IBM has released experimental Granite 4.1 preview models trained to read and generate LLM Object Notation. The format labels instructions, data and output requirements so their relationships are clearer to a model.
How LLMON works
Reserved delimiters mark context spans and can link an instruction to the data it should act on.
Mark instructions, data and output requirements within a message.
Unique IDs and execution blocks can associate an instruction with its intended payload.
LLMON adds structure within messages; it does not replace chat templates.
What developers can explore
IBM says the release includes tools and examples for trying LLMON in existing workflows.
Granite 4.1 3B and 8B
Experimental models trained to consume and generate LLMON.
Converters and templates
IBM says the toolkit includes workflow examples and converters for JSON and LLMON.
Adapt the format
Developers can define custom tags; Mellea is cited as having native LLMON support.
Promising claim, limited evidence
The announcement describes lower indirect prompt-injection success on some benchmarks and says general capability is maintained relative to Granite 4.1 Instruct.
- Attacks hidden in user data are “mostly ignored.”
- Attack success falls to “nearly zero” on some benchmarks.
- General capability is maintained against Granite 4.1 Instruct.
- Benchmark names, protocols or numerical scores.
- Sample sizes, comparison conditions or independent evaluation.
- Evidence across varied models and deployment settings.
Why Explicit Prompt Boundaries Matter
LLMON addresses a security problem in systems that combine application instructions with retrieved documents, user submissions and tool outputs. If a model mistakes hostile text embedded in that material for an instruction it is meant to follow, it may act against the application’s intent. Labeling the different parts of a prompt and binding an instruction to its relevant data offers developers another approach to managing that risk.
The practical value remains unproven beyond IBM’s reported tests. If the results hold across varied systems and real workloads, LLMON could give developers a useful method for clarifying how models should interpret mixed inputs. But a format alone does not establish that prompt injection is prevented, and teams would still need to test it against their own data, tools and threat conditions. Preview status and missing evaluation details mean the announcement is not enough to judge real-world protection or possible trade-offs in routine tasks.
Products Worth Considering
Apple Watch Series 12 GPS 42mm Smartwatch
Amazon Kindle Paperwhite (12th Generation, 2024), 16GB, 7-Inch Display, Raspberry
Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite
As an affiliate, we earn on qualifying purchases.
How LLMON Fits Existing Prompts
IBM describes LLMON as XML-like, with structural boundaries marked by reserved special tokens rather than ordinary text characters. The company argues that common JSON structures were designed for software parsers, not language models generating text one token at a time. It says braces, quotation marks and nesting can be harder for models to track, particularly smaller ones. The supplied material does not include comparative testing to establish that LLMON performs better than JSON or other structured-prompting approaches.
LLMON is intended to add structure within chat templates, not replace the role labels that distinguish system, user and assistant messages. IBM says it is providing converters to translate JSON to LLMON and back without loss, and points to native support in Mellea. Developers can define custom structures and tags; IBM also describes using LoRA fine-tuning on the preview models to teach them those structures. The announcement gives no adoption figures or commitments from developers.
““For some benchmarks, attack success rates drop to nearly zero.””
— IBM, in its LLMON announcement
What the Security Tests Do Not Show
The announcement does not name the benchmarks, report numerical results, define what counts as an attack success or describe the test conditions. It also does not specify the comparison models or how IBM measured general capability against Granite 4.1 Instruct. Without those details or independent evaluation, readers cannot determine how broadly the reported results apply.
It remains unclear how the format performs across different model families, languages, long contexts and deployment settings with real tool use, or whether it brings trade-offs in ordinary tasks. The supplied material also does not establish when the previews and toolkit became available or what licensing terms apply. IBM’s description of the models as experimental previews does not establish that LLMON prevents prompt injection in general.
Evidence Needed From Preview Testing
Developers can assess the preview models and toolkit through IBM’s release channels, subject to availability and licensing terms. A clearer assessment will depend on IBM publishing the benchmark names, protocols, scores and capability comparisons behind its claims. Independent replication and testing across varied applications would help establish whether the results extend beyond the conditions IBM evaluated.
For now, teams considering LLMON will need to evaluate it against their own workflows and risks. The announcement does not specify a further release milestone or timeline for expanded results, so broader performance evidence and deployment experience remain the next developments to watch.
Key Questions
What is LLMON?
LLM Object Notation is a markup format that uses reserved special-token delimiters to label instructions, data and output requirements in a model’s context. It can also connect an instruction to the data it applies to.
Which models did IBM release?
IBM announced experimental previews named granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview, derived from Granite 4.1 base models.
Does IBM’s announcement prove LLMON prevents prompt injection?
No. IBM reports lower attack success on some benchmarks, but the supplied announcement does not name the tests, provide scores or include independent evaluation. The results do not establish general protection.
Does LLMON replace JSON or chat templates?
IBM says LLMON is intended to add structure within chat templates, not replace role labels. It also says it is providing converters between JSON and LLMON, though the announcement does not provide comparative test results.
What remains unknown about the previews?
The supplied material does not specify the release date, repository link or license. It also leaves the benchmark methods and results, performance in deployment, and compatibility with other model families unclear.
Primary source: Hugging Face · via ThorstenMeyerAI.com
