IBM's Granite LLMON Models Block 47% More Prompt Injection Attacks

IBM's Granite team released two experimental language models on November 12, 2026, that avoided 47% more prompt injection attacks than the best frontier model it tested on the OPI benchmark. The 3B and 8B previews, Granite-4.1-3B-LLMON-preview and Granite-4.1-8B-LLMON-preview, are trained to separate trusted instructions from untrusted data — the core weakness behind most attacks on AI agents that read documents or call tools.

The stakes are straightforward. Indirect prompt injection hides a malicious instruction inside a retrieved document, a tool response or user-supplied data, and the model obeys it as if the attacker wrote the prompt. As companies wire language models into retrieval pipelines and agent workflows, that attack surface keeps growing. IBM's answer is not a filter bolted on top; it's a model that learns where instructions legitimately come from.

What is LLMON and how does it work?

LLMON — short for LLM Object Notation, pronounced "lemon" — is an XML-like markup language for describing prompt structure to a model. Instructions, documents, tool definitions, requirements and responses each occupy an individually addressable block. An execution block names which instruction to run, which inputs and requirements apply, and where the answer should go. Anything left unbound stays in context without being called.

The mechanism is essentially privilege separation, borrowed from how operating systems treat code differently from data. The models treat instructions reached through an execution block as authoritative, while material reached as input gets read rather than obeyed. Structural delimiters are reserved special tokens, and each two-character block ID comes from a fixed single-token set, so an address always costs two tokens.

Developers don't have to write this markup by hand. They can name parts of an ordinary messages list and call apply_chat_template, and the bundled template renders LLMON while preserving the familiar system, user and assistant roles. The accompanying LLMON repository supplies lossless JSON conversion, chat-rendering utilities and examples, plus a linked attention demonstration that visualizes how attention spreads across instruction, input and unbound blocks.

The research builds on the LLMON language paper, first submitted on March 23, 2026. The takeaway: LLMON turns prompt structure into something the model can explicitly parse, instead of hoping it infers trust from context.

How were the models trained?

A post-training paper, submitted October 28, 2026, describes a 4.6-billion-token structured corpus spanning general instruction data, retrieval-augmented generation and tool calling. Distractor examples add competing instructions and irrelevant data that stay unreferenced, while the target response remains unchanged — teaching the model to ignore instructions that arrive as input.

Both preview models were fine-tuned from Granite 4.1 base checkpoints, not from the released instruct models. The approach uses supervised fine-tuning and reinforcement learning without modifying the model architecture.

The recipe runs five sequential reinforcement-learning stages covering multi-domain reasoning, human-feedback alignment, knowledge calibration and math. Direct preference optimization follows on 1,000 preference pairs generated from the model's own responses to injection attempts. The resulting privilege rule comes from that learned layout, not from an added guardrail.

How much do the attacks actually drop?

The numbers are the strongest part of the release. The post-training paper reports attack success rates across indirect-injection evaluations falling from 53%–100% down to 0.02%–5.6%, while general capabilities held up.

IBM measures robustness on OPI as one minus attack success rate — the share of attacks where the model does not carry out the injected instruction. OPI places injections in the data of classic NLP tasks, which is closer to real retrieval and tool-use conditions than a synthetic attack suite.

There's a clear limit, though. The announced benchmark comparisons cover static indirect injections, not adaptive attacks that develop over multiple chat turns, which IBM says remain an active area of work. The headline figure is real, but it describes one class of attacker.

What happens to general capabilities?

The 8B model card frames parity with Granite 4.1 Instruct as the goal for general tasks, and the results are mixed:

• GPQA: 35.05 for the preview versus 41.96 for the instruct model
• DeepMind Math: 70.86 versus 80.07
• BigCodeBench: 44.04 versus 35.00 — the preview wins here
• MMLU: 74.20 versus 73.84

So the security training costs some reasoning and math performance, gains some coding performance, and roughly holds knowledge benchmarks. That pattern positions the release as a test of structured prompting and injection resistance, not a uniform capability upgrade.

Can developers adapt it?

LLMON extends beyond the default vocabulary. IBM demonstrates custom tags and adapter fine-tuning on ScienceWorld reference trajectories, with the trained model playing held-out games and writing its next action in the new vocabulary.

Mellea, a higher-level library, automatically converts its model calls to LLMON, so application users never see the underlying markup. That matters for adoption: a security mechanism that requires every developer to learn a new notation tends not to get adopted.

Both models carry an Apache 2.0 license, and IBM intends them for exploration and evaluation, not production. The release gives developers a concrete way to measure how explicit execution binding behaves in retrieval and tool-using workflows.

Should anyone deploy this as their defense?

Not alone. For sensitive deployments, the open question is whether the learned privilege rule holds beyond the reported tests. The model cards caution that it is not an enforced guarantee and should not be an agent's sole defense — a learned rule can fail in ways a hard architectural constraint would not.

That caution frames the real significance of the release. IBM has shown that injection resistance can be trained into open-weights models and measured on a public benchmark, dropping attack success rates by orders of magnitude in static tests — but whether the learned privilege rule survives adaptive, multi-turn attackers is the question the next round of research will have to answer.