A label for every part of the prompt
LLMON gives prompt components explicit structural labels and bindings. The models are trained to respect those boundaries; the format does not enforce compliance. Each component is wrapped in its own block, the delimiters are reserved tokens rather than ordinary punctuation, and every block carries a short unique ID. An exec block at the end of the turn then states which instruction to run, which blocks count as its input, and where the answer goes. Anything not named in that block is present in context but unbound, and the models were trained, partly on decoy blocks planted for exactly this purpose, to leave unbound material alone.
The idea is not new in spirit. Developers have tried XML tags, delimiters and instruction hierarchies for years. What IBM has done here is move the convention into the tokenizer and the training run, so the boundary is part of the model's vocabulary rather than a formatting habit a prompt hopes the model will respect. That is a real design difference, and it is also the limit of what the launch proves: the format exists, the checkpoints are downloadable, and the rest rests on IBM's measurements.
One benchmark, one kind of attack
On OPI, the result IBM reports is large. The previews avoided 47% more attacks than the best frontier model in its test set and 95% more than the best open-source model, and IBM says ASB and StruQ point the same way. Read the scope before the size. OPI places an injection inside the data of classic NLP tasks. It is, by the blog's own description, a test of static indirect injection: a hostile instruction planted in material the model is asked to process. The blog adds that adaptive attacks, the kind that develop across many turns of a conversation, are a separate problem the team is still working on.
These static tests do not establish resistance to adaptive, multi-turn attacks; IBM says it is still working on that problem. IBM also ran the evaluation and chose the comparison set, and the blog does not name the frontier model its 47% is measured against, which prevents readers from identifying that baseline from the post alone.
What parity costs
The launch says the safety gain comes "while maintaining general capability relative to Granite 4.1 Instruct models," and the blog says the models perform "on par." The 8B model card, to its credit, prints the table that lets a reader check. Some rows support the claim: MMLU is effectively level, BigCodeBench is well ahead, and the safety rows improve. Others do not. GPQA drops from 41.96 to 35.05. CRUXEval-O drops from 47.63 to 36.88. DeepMind Math drops from 80.07 to 70.86, Minerva Math from 80.10 to 72.20, and MMLU-Pro from 55.99 to 53.11. The card itself frames parity as "the objective of LLMON training," which is a more careful sentence than the blog's summary of it. On the 8B card, a team swapping that checkpoint in for the standard instruct model would be trading measurable reasoning and math performance for the injection resistance. That may be the right trade in a RAG pipeline or a tool-using agent, and teams should test it on their own workloads. It is not a free one, and the price is listed only in the table, not in the headline.
The sentence that governs the rest
The most useful line in the release is in the model card's limitations. The privilege rule, the thing that makes data read as data instead of orders, "is a learned behavior, not an enforced guarantee." It reduces the chance of a planted instruction being followed; it does not eliminate it, and IBM tells users not to rely on it as the only defense for an agent with access to sensitive systems.
That sentence is honest, and it sets the correct size for the story. LLMON is an experimental approach with a plausible mechanism, open weights, and vendor-reported results that warrant independent testing. It is not a solved injection problem, and IBM, read in full rather than in summary, does not quite claim that it is.
Sources
- [1] IBM Granite team, "LLMON: An LLM-Native Markup Language, now in Granite 4.1 3B and 8B" (Hugging Face blog, November 12, 2026)Read source
- [2] IBM Granite, model card: granite-4.1-8b-LLMON-preview (Hugging Face, released November 12, 2026; evaluation table and limitations)Read source