What happened
IBM’s announcement describes LLMON, or LLM Object Notation, as a way to make the structure and meaning of model context explicit. A typical prompt can combine instructions, prior turns, retrieved documents, tool responses, user data, and output constraints. LLMON marks semantically distinct parts with tags wrapped in reserved special-token delimiters. It can nest structures, and unique block IDs let an execution block identify which instruction applies to which data and requirements, and where the output belongs.
The release includes two experimental preview models derived from Granite 4.1 base checkpoints: granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview. IBM also released a GitHub repository with a toolkit, example workflows, and templates. The company says the models ship with their own chat template, so applications can continue to construct a messages list and call apply_chat_template; the template renders the messages into LLMON. In IBM’s example, instruction, data, and requirements become separately addressable blocks, then an execution block binds those components to an assistant output.
The format is intended to distinguish commands from material the model should read. IBM says that an instruction reached through the execution block is authoritative, while documents, tool results, and other data are inputs rather than commands. Components not referenced by that block are intended to be ignored. IBM emphasizes that this is a learned behavior, not an enforced guarantee. It also says LLMON does not replace chat templates: it adds semantic structure within and across the roles those templates already represent.
For evaluation, IBM compared the previews with open- and closed-source models on the OPI benchmark, which places indirect injections inside data for classic NLP tasks and uses several attack strategies. IBM defines robustness as one minus attack success rate. The announcement says LLMON “practically eliminates” the problem on that benchmark, avoids 47% more attacks than the best frontier model IBM tested, and avoids 95% more than the best open-source model it tested. It reports similar trends on ASB and StruQ. IBM says general-capability results across standard benchmark categories are on par with Granite 4.1 Instruct.
IBM says developers can try the format in Mellea, which has native support that automatically LLMONizes calls. Its converters can translate existing JSON to LLMON and back without loss; developers can also define their own tags and tune a LoRA adapter. The announcement describes training from Granite 4.1 base checkpoints, re-serialized instruction-tuning data, decoy unbound instructions and data, five sequential GRPO stages, and a final DPO stage using a thousand on-policy preference pairs built from responses to injection attempts.
What the archive adds
New Runtime’s earlier coverage of Granite Speech 5.0 on 2026-10-21 and Granite-TTM-R3 on 2026-11-08 covered other IBM model releases, not LLMON or prompt-injection defenses. This is a new fact about IBM’s model work, rather than a continuation of those products.
Trend signal
This does not yet fit a pattern New Runtime tracks. LLMON’s explicit, addressable structure may be relevant to the broader design of model interfaces, but IBM’s announcement alone does not establish a durable industry shift or an interoperability standard. Its reported robustness gains are a company evaluation of particular models and benchmarks, not evidence that a general runtime security boundary has moved.
Why now
IBM frames LLMON as an answer to context that mixes instructions with retrieved documents, tool outputs, and user data—materials that can carry indirect prompt injections. The release pairs the new representation with preview models and converters, making it possible to test the approach within existing chat-template and JSON-based workflows rather than waiting for a new application interface.
Why it matters
Indirect prompt injection is difficult to address with wording alone when an application puts trusted instructions and untrusted content into one context. LLMON proposes making that distinction legible to the model: a retrieved passage is input, while an execution block specifies the instruction to carry out. If the reported behavior holds in a team’s own workloads, that could reduce one class of failures without requiring a wholesale redesign of its message pipeline.
The operational distinction matters. IBM describes a learned privilege rule, not a sandbox or an access-control mechanism. LLMON cannot by itself prevent a tool from performing an unauthorized action, ensure that a model correctly classifies every block, or establish that a production system is safe. Teams should keep authorization and tool permissions outside the model, and treat benchmark gains as a reason to run their own adversarial tests—not as a replacement for them.
The format also introduces an integration decision. Applications must represent the relevant components as named parts and use the template or converters correctly. For Granite users, IBM says no conversion pipeline is required if they name turn parts such as instruction, data, and requirement; deeper conversion can preserve structured JSON as typed blocks. The useful comparison is therefore not only model scores, but whether the extra structure is practical and improves results on the documents, tools, and attack patterns a team actually encounters.
Limits and uncertainty
IBM labels both models experimental previews. Its announcement describes benchmark results but does not establish independent replication or how the reported gains transfer to production applications. The cited evaluations concern static indirect prompt injections; IBM says it is still working on adaptive attacks that unfold over multiple chat turns. The claimed instruction/data separation is learned behavior rather than an enforced guarantee, so teams still need external permission checks and testing. Performance and robustness may also depend on how applications construct and render LLMON blocks.
Skill to build now
If your team uses Granite 4.1 3B or 8B in a retrieval or tool workflow, build a small regression set this week: include trusted instructions, benign retrieved content, and documents containing adversarial commands. Run the current model and an LLMON preview against the same cases, score whether the injected instruction is followed, and separately verify that valid requests still work. Keep tool authorization enforced outside the model.
Reader takeaway
LLMON is IBM’s attempt to make the boundary between an instruction and the data it operates on explicit in a model’s context. The early results are promising for static prompt-injection tests, but the previews do not turn that representation into a security guarantee. Treat the release as a concrete experiment: test it against your own workflows and keep runtime permissions independent of the model.