IBM released experimental Granite 4.1 3B and 8B LLMON models on November 12, testing whether a more explicit prompt structure can help models distinguish legitimate instructions from hostile text inside documents or tool responses.
IBM’s announcement describes LLMON, short for LLM Object Notation, as markup built around reserved structural tokens. Separately identified blocks contain instructions, data and requirements; an execution block connects the task to the inputs it should use.
IBM reports stronger resistance on benchmarks of static indirect prompt injection, alongside broadly comparable general capabilities to Granite 4.1 Instruct. These are IBM’s reported results; work on adaptive attacks across multiple conversation turns continues.
A learned boundary still needs safeguards
The 3B model card makes the limitation explicit: this separation is learned behavior, so malicious instructions embedded in inputs can still succeed. IBM warns against relying on it as the sole protection for agents accessing sensitive systems.
For developers, the immediate use is evaluation with the supplied chat template. IBM labels the release an experimental preview for exploration, rather than production use.
Chart: IBM Granite. Results reflect IBM’s static OPI benchmark evaluation, not guaranteed protection in deployment.
