Experimental Granite 4.1 models with the new LLMON markup language against prompt injection attacks
The preview models granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview have been released, trained on the new LLMON format, which explicitly separates instructions from data and, according to the source, reduces the success rate of indirect prompt injection attacks to nearly zero.
LLMON (LLM Object Notation) has been introduced – a markup language designed directly for language models, rather than for parsers like JSON. Structure within it is not expressed through common characters (curly braces, quotation marks) but through dedicated special tokens, which according to the source allows the model to better distinguish structure from content and avoids the need to track nesting depth across long stretches of context. Individual blocks (instructions, data, requests) have unique IDs and can be explicitly bound to a specific instruction, similar to a function call with arguments in a programming language.
Two experimental preview models derived from the base Granite 4.1 models were trained on this format: granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview. A GitHub repository with an LLMON toolkit was also published, including tools for lossless conversion between JSON and LLMON as well as sample templates and workflows. LLMON does not replace chat templates but extends them with explicit labeling of meaning and relationships between individual parts of a message.
According to the source, models trained on LLMON ignore instructions hidden in user data (indirect prompt injection), with the success rate of such attacks dropping to nearly zero on some benchmarks, while ordinary instruction-tuned models are highly susceptible to being exploited this way. According to the source, this is achieved while maintaining general capabilities comparable to the Granite 4.1 Instruct models. The Mellea tool also has native support for LLMON, automatically converting LLM calls into the LLMON format.
The rest of the article, including further technical details of the format, was not available. See the source article for details.
Why it matters
For developers who feed untrusted input (documents, tool outputs, user data) into LLM applications, this represents a concrete defense against indirect prompt injection – an attack where the malicious instruction is hidden in the data rather than in the prompt. Thanks to the explicit separation of instructions from data and the binding of an instruction to specific data, the model, according to the source, largely ignores such hidden commands.
Two audiences, two different impacts
What this means
For individuals
Developers working with Granite models can try the preview models and the accompanying toolkit (including a JSON→LLMON converter) to reduce the risk of prompt injection in their own LLM applications.
For a business
Companies running LLM applications that process untrusted external data (documents, tool outputs, user-submitted content) gain an available option to reduce the risk of successful indirect prompt injection attacks, which is relevant for the security and compliance of deployed AI systems.
Risks and complianceCheck the original
Event sources
clearly official source · 1 publisher, 0 independent. We count feeds from the same owner only once.