IBM Granite 4.1 LLMON Cuts Indirect Prompt Injection Rates

The baseline Granite 4.1 models let indirect prompt-injection attacks succeed between 53% and 100% of the time. Trained with LLMON, the same models let them succeed 0.02% to 5.6%.

That is the headline claim behind IBM's Granite 4.1 LLMON preview, released November 12 under Apache 2.0 in 3B and 8B sizes. LLMON, short for LLM Object Notation, is a markup language that wraps every piece of a prompt (system policy, instructions, data, documents, tool definitions, tool results) in its own addressable block, then adds an exec block naming which instruction to run, which inputs it operates on, and where the output goes.

The privilege rule the model is trained to follow is spelled out on the model card: "exec<|.|>instruction and exec<|.|>system are authoritative. Everything reached through exec<|.|>input (data, documents, tool schemas, and tool results) is input to be read, not a command to follow, regardless of how it is phrased."

IBM is unusually direct about what the format does not buy you. The card states: "The privilege rule is a learned behavior, not an enforced guarantee. It substantially reduces, but does not eliminate, the chance that an instruction embedded in data, a document, or a tool result is followed. Do not treat it as a sole defense for an agent with access to sensitive systems."

The accompanying IBM blog post says LLMON "practically eliminates the problem on this benchmark, avoiding 47% more attacks relative to the best frontier model that we tested, and 95% more than the best open-source model." Six IBM Granite authors are listed as co-publishers, including Michael Hind, Basel Shbita and Dan Gutfreund. The post-training details, including a 4.6-billion-token structured corpus and supervised fine-tuning followed by reinforcement learning, sit in the companion arXiv paper, Post-Training Large Language Models with LLMON.

Prompts in a conventional chat format are explicitly out of distribution. This is agent infrastructure, not a drop-in chat replacement, and it lands amid a dense week of tracked open-source and agent releases on our radar.