On November 12, IBM's Granite team published LLMON (LLM Object Notation, pronounced "lemon") on Hugging Face. It wraps semantically tagged blocks such as instructions, data and requirements in reserved special-token delimiters, gives each block a unique ID, and uses an exec block to state which instruction runs on which data. IBM also released two experimental preview models, granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview (Apache 2.0), plus a GitHub toolkit and lossless JSON-to-LLMON converters. IBM says that on the OPI indirect prompt injection benchmark the LLMON models avoided 47% more attacks than the best frontier model it tested and 95% more than the best open-source model, while general capability stays on par with Granite 4.1 Instruct. IBM stresses this is learned behavior, not an enforced guarantee, and the models are an experimental preview, not for production.
Key Takeaways
- ✓Syntax: tagged blocks (instruction, data, requirement and more) wrapped in reserved special tokens, each with a unique ID, plus an exec block that binds an instruction to the data it should act on
- ✓Models: granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview, fine-tuned from Granite 4.1 base under Apache 2.0; they ship a chat_template so apply_chat_template renders the markup for you
- ✓Security (vendor-reported): on OPI they avoided 47% more attacks than the best frontier model tested and 95% more than the best open-source model, with similar trends on ASB and StruQ; only static indirect injections are covered, and multi-turn adaptive attacks are still being worked on
- ✓Tooling: the GitHub repo generative-computing/llmon includes lossless JSON-to-LLMON converters, IBM's Mellea framework supports LLMON natively, and you can define custom tags and train a LoRA on top
- ✓Limits: IBM says this is learned behavior, not an enforced guarantee, and the release is for exploration and evaluation only; keep agent permissions enforced in application code
Key Decision Metrics at a Glance
Turn your technical choice into a development budget
Compare 40 dev plans & simulate token costs vs $20/mo subscriptions
Project Links & Resources
Direct AccessIn-Depth Technical Analysis
Background and pain points
Agents read web pages, documents and tool results while following user instructions, and the biggest risk is indirect prompt injection: a malicious instruction hidden in data that the model cannot tell apart from the real task. Chat templates only mark roles, and JSON was built for parsers, so tokenizers don't respect its grammar. IBM ties this implicit structure to the brittleness of smaller models.
Architecture highlights
LLMON uses reserved special tokens as delimiters, so structure never shares characters with ordinary text. Each block carries a semantic tag and a unique ID, and a final exec block states which instruction to run, which inputs it applies to and where the output goes. Instructions and data not referenced by exec are ignored, and tool results read as input are treated as material, not commands. Training adds unbound decoy instructions and data. LLMON enriches chat templates rather than replacing them.
Benchmarks and data
On the OPI benchmark, which hides injections in the data of classic NLP tasks, IBM compared several open and closed models: the LLMON models avoided 47% more attacks than the best frontier model tested and 95% more than the best open-source model, with similar trends on ASB and StruQ, while general benchmarks stayed on par with Granite 4.1 Instruct. These are vendor-reported results covering static injections only.
Getting started
Download the 3B or 8B preview from Hugging Face, build your message list as usual and label parts as instruction, data or requirement; the bundled chat template renders them into LLMON. Existing JSON pipelines can use the official lossless converters, or you can try it inside Mellea. This is an experimental preview, and its safety is learned behavior rather than a guarantee, so keep permission checks in application code.
Benchmark side-by-side against alternatives, or calculate monthly token cost vs subscription break-even.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.