IBM releases Granite 4.1 3B and 8B LLMON previews to separate instructions from data

IBM has released two experimental preview models, granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview, derived from Granite 4.1 base models and trained to read and write LLMON-marked text. LLMON (LLM Object Notation, pronounced "lemon") is an LLM-native markup language that labels the components of a context with tags. IBM published the announcement on Hugging Face on November 12, 2026, along with a GitHub repo containing a toolkit, example workflows and templates.

What LLMON does

IBM argues that long contexts mix system prompts, conversation turns, retrieved documents, tool responses, output requirements and reasoning chains, and that most of this structure is implicit or encoded in formats such as JSON that were not designed for LLMs. IBM says this is a main reason smaller models are brittle, and that the missing structure can be exploited through prompt injection.

LLMON wraps semantically coherent components in meaningful tags. The delimiters are reserved special tokens, not ordinary characters, so structure and content occupy separate parts of the vocabulary. Each block gets a unique two-character ID. An "exec" block binds a specific instruction to the data it operates on, the requirements that constrain it, and the output block the model fills. IBM compares this to calling a function and passing it arguments.

IBM says the two-character IDs are drawn from a fixed set that the tokenizer encodes as single tokens, so addressing a block always costs two tokens.

Chat template and tooling

LLMON enriches chat templates rather than replacing them. The preview models ship with their own template, and developers call apply_chat_template on a standard messages list. A turn can name its parts (such as instruction, data and requirement) and mark each one exec: True or False. Parts marked True are bound into the exec block. Parts marked False are rendered into the context but referenced by nothing.

Other tooling IBM describes:

• Mellea has native LLMON support and automatically converts its LLM calls to LLMON.
• Converters translate JSON to LLMON and back, which IBM says is lossless.
• Developers can define their own structure and tags and tune a LoRA on top of the LLMON models.

Prompt injection results

IBM evaluated the previews on the OPI benchmark, which places injections in the data of classic NLP tasks using several attack strategies. It reports robustness as 1 minus attack success rate. According to IBM, all non-LLMON models tested are highly susceptible. IBM states that LLMON models avoid 47% more attacks than the best frontier model tested and 95% more than the best open-source model. It says attack success rates on some benchmarks drop to nearly zero, and that it sees similar trends on ASB and StruQ. IBM also claims general capability is maintained relative to Granite 4.1 Instruct models. IBM did not name the comparison models in the portion of the post covering these figures.

IBM notes that these benchmarks test robustness to static indirect prompt injections.

Context window, pricing and training cutoff for the preview models are not stated.

What this means

IBM's approach moves the separation of instructions from data into the model's vocabulary and training, rather than relying on prompt wording or JSON conventions. The reported OPI results are IBM's own, and they cover static indirect injections only, so they do not show how the previews hold up against other attack types. Because the models are labeled experimental previews and tied to LLMON-specific tokens and a custom chat template, adopting them means rendering inputs through that template. The lossless JSON converters and Mellea integration are IBM's answer to the cost of moving existing JSON-based pipelines.