IBM's Granite team has published LLMON, a markup language for language models, on the Hugging Face blog, together with two experimental models trained to read and write it: granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview. A GitHub repository with a toolkit, workflow examples and templates comes with them.
What LLMON does
IBM's argument is that a model's context holds many kinds of material: system prompts, earlier turns, retrieved documents, tool output, output constraints and reasoning. Most of that structure is implicit or squeezed into formats such as JSON, which were built for parsers. IBM links this to brittleness in smaller models and to prompt-injection exposure.
LLMON marks each component with a meaningful tag. The delimiters are reserved special tokens in the vocabulary, so structure and ordinary text never share characters. Each block gets a short unique ID, and an execution block at the end states which instruction to run, which data it applies to, which requirements constrain it and where the answer goes. Content outside that execution block is still visible to the model but is treated as unreferenced material.
The preview models ship with their own chat template. You build the usual list of messages, name the parts of a turn (instruction, data, requirement) and flag each as executed or not. The template renders the markup. IBM also provides converters that turn JSON into LLMON and back without loss.
The security claim
Indirect prompt injection hides a malicious instruction inside content the model is asked to process, such as a retrieved document or a tool response. IBM tested on the OPI benchmark, which plants injections in the data of standard NLP tasks. By its account, the other models it tried, open and closed, carried out injected instructions with high probability. The LLMON models avoided 47% more attacks than the best frontier model tested and 95% more than the best open-source model. IBM reports similar trends on the ASB and StruQ benchmarks.
There are limits. These benchmarks cover static injections, and IBM says attacks that unfold across many chat turns are still being worked on. It also describes the privilege rule (execution-block instructions are authoritative, input is only material) as learned behavior and not an enforced guarantee.
Capability and training
IBM says general performance stays on par with the Granite 4.1 Instruct models across standard benchmark categories. The models start from Granite 4.1 base checkpoints. Training re-serializes an ordinary instruction-tuning corpus into LLMON and adds decoy instructions and data that are left unbound. Reinforcement learning follows in five GRPO stages and a final DPO stage on a thousand preference pairs built from the model's own responses to injection attempts.
Teams can also define their own tags and tune a LoRA adapter on top. IBM demonstrates this on the ScienceWorld benchmark and points to a second notebook for tool-calling agents. Mellea, IBM's related project, supports LLMON natively.
Status
IBM describes the release as an experimental preview for exploration and evaluation, not for production, and asks for feedback in GitHub Discussions.