LLMON: Granite 4.1 3B and 8B Strengthen Anti-Injection

Two Granite 4.1 models are being previewed with LLMON markup, a format designed to clarify instructions, data, and requirements in the context of LLMs. The promoters announce net gains against indirect prompt injections across several benchmarks, while maintaining comparable performance to instruct models. Lossless conversion tools to and from JSON accompany the launch.

Measured Gains Against Injections, with a Defined Scope

The designers indicate that LLMON models avoid 47% more attacks than the best tested state-of-the-art model on OPI and 95% more than the best open-source model. They report similar trends on the ASB and StruQ benchmarks. The evaluation was conducted on OPI, using several attack strategies, with robustness defined as 1 minus the success rate of attacks, meaning the proportion of attacks where the model does not execute the injected instruction. The cited datasets examine static indirect injections. The team specifies that they are working to strengthen defenses against multi-turn adaptive attacks. According to the promoters, non-LLMON models execute injected instructions with a high probability, while for certain benchmarks, success rates drop to nearly zero with LLMON.

Immediate Implementation in an Existing Chat Flow

The LLMON previews come with a chat model that allows the use of a message list and apply_chat_template as usual. It is sufficient to name the parts of the exchange, such as instruction, data, and requirements; the chat model renders these elements into LLMON blocks. No conversion pipeline is required for this mode. Native support is already present in Mellea, which automatically LLMONizes its calls. Converters and notebooks ensure lossless translations between JSON and LLMON, and the library preserves internal structures as a JSON document in individually addressable blocks.

What LLMON Markup Changes in Context

LLMON formalizes a markup language to explicitly expose structure and semantics to the model. Meaningful tags, surrounded by reserved delimiters, describe unambiguous schemas and nesting. Unique identifiers link instructions and targeted data. Element types, such as instructions, data, and requirements, are marked for use by the application and the model. In an exchange, each part can be named and marked exec True or False; an execution block then associates instruction and data, while the other elements remain in context without reference. The designers claim that this separation reduces the absorption of off-topic content and limits the impact of hidden malicious instructions, asserting that it is no longer necessary to force JSON outputs. It is possible to define custom structures and tags and adjust a LoRA to interpret them.

Why JSON Struggles with Language Models

JSON targets parsers rather than causal models: the grammar is not imposed by the tokenizer, and the structure relies on characters that can appear in ordinary text. For a model, a quote is a quote, whether it closes a field or appears in a document, and escape rules remain statistical patterns. The depth of nesting, counted by brackets, is presented as problematic for transformers over long distances. In contrast, LLMON adopts an XML-like markup with reserved delimiters, tags declared at the beginning of intervals, explicit boundaries, and localized nesting to avoid distant tracking. Tools ensure lossless conversions between JSON and LLMON.

Two Preview Models and a Toolkit

Two variants derived from Granite 4.1 are offered in preview: granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview. They come with a GitHub repository containing tools and examples. The promoters claim that these models offer overall performance comparable to Granite 4.1 Instruct, and that replacing the current 3B or 8B with the LLMON previews should maintain this level while increasing resistance to injections.

Training Choices and Learning Signals Used

The models start from the base checkpoints of Granite 4.1, with LLMON behavior learned in post-training rather than an imposed chat format. Six dedicated delimiters, added to the tokenizer as reserved tokens, bound the tags and allow for nesting and anchoring. The instruction fine-tuning corpus has been re-serialized into addressable blocks with, for each exchange, an execution block naming the instruction, its inputs, and the output destination. The task mixing replicates that of a classic instruct (chat, multi-turn, RAG, tool call), which, according to the team, maintains performance close to conventional approaches. Decoys, present but unlinked, force the model to follow the execution block and ignore the rest.

The Targeted Problem: A Rich but Exploitable Context

The context of a language model aggregates system prompts, dialogue histories, instructions applied to retrieved documents, tool responses, user data, output constraints, and reasoning chains. This richness, often implicit or encoded in formats poorly suited for LLMs, is presented by its designers as a source of fragility and an attack surface via injections hidden in the data. Indirect prompt injection consists precisely of burying a malicious instruction within these payloads. The strict separation between instructions and data emphasized by LLMON directly targets this vector.