IBM ships Granite 4.1 LLMON previews built around an LLM-native markup language

IBM's Granite team released two experimental preview models on November 12: granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview, both derived from Granite 4.1 base checkpoints and trained to read and write a markup language called LLMON. The release also ships a GitHub repository containing a toolkit, workflow examples and templates.

The problem it targets is the shape of a model's context. Over a long trajectory the window fills with a system prompt, past turns, instructions that act on retrieved documents, tool responses, output constraints and reasoning chains. Most of that structure is either implicit to the model or encoded in formats like JSON that were designed for parsers rather than causal language models, where a quotation mark inside a document and a quotation mark that closes a field are the same token. Small models are brittle in exactly these places, and the missing structure is what prompt injection exploits.

LLMON stands for LLM Object Notation and is pronounced lemon. It is an XML-like markup whose delimiters are reserved special tokens rather than characters, so structure and content occupy different parts of the vocabulary. Tags state what each span means, nesting is declared locally instead of tracked across long spans, unique IDs let an instruction point at data anywhere in the context, and an exec block at the bottom declares which instruction to run, which data it operates on and which block receives the output.

It enriches chat templates rather than replacing them. Developers build the same messages list and call apply_chat_template as usual; the difference is that a turn can name its parts and mark each one exec: True or False. Parts marked True are bound into the exec block, while parts marked False still appear in the context but are referenced by nothing.

The headline result is on indirect prompt injection. On the OPI benchmark, which hides an injected instruction inside the data of classic NLP tasks, the authors report that the LLMON previews avoid 47% more attacks than the best frontier model they tested and 95% more than the best open-source model, with similar trends on ASB and StruQ. Non-LLMON models, they write, carry out the injected instruction with high probability.

The team says the safety gain does not come at the expense of general capability: across standard benchmark categories the LLMON models perform on par with Granite 4.1 Instruct, so teams already experimenting with Granite 4.1 3B or 8B can swap in the preview without a conversion pipeline. The caveat is scoped, though. These benchmarks test static indirect injection, and the authors say they are still working on adaptive attacks that unfold over many chat turns.

Training explains where the behaviour comes from. The models start from Granite 4.1 base checkpoints rather than the released instruct models, so LLMON is learned during post-training. A conventional instruction-tuning corpus is re-serialized so every prompt component becomes its own addressable block, then augmented with decoy instructions and data blocks that sit in the context but are deliberately left unbound. Five sequential GRPO stages follow, spanning multi-domain reasoning, RLHF, knowledge calibration and math, and a final DPO stage uses a thousand on-policy preference pairs built from the model's own responses to injection attempts.

The authors are explicit about the boundary: an instruction reached through the exec block is authoritative while anything reached as input is material to read, and that is a learned behaviour rather than an enforced guarantee. Alongside the previews they published lossless JSON-to-LLMON converters, example notebooks, a ScienceWorld demo that fine-tunes a LoRA against a custom vocabulary, and native support in Mellea. As a release explicitly labelled preview, it reads as a direction of travel: move context structure out of the model's guesswork and into the application's explicit declaration.