IBM Releases Granite 4.1 LLMON Preview, Cuts Indirect Prompt Injection Success From 53-100% to Under 6%

IBM released Granite 4.1 LLMON-preview models in 3B and 8B sizes on Nov 12, replacing conventional chat templates with LLMON — a markup that wraps every prompt block (system, instructions, data, documents, tool definitions, tool results) and tags each with an exec permission. IBM's internal tests show indirect prompt-injection success dropping from 53-100% on baselines to 0.02-5.6% when the privilege rule treats only exec-authoritative instructions as commands. IBM cautions the behavior is learned, not enforced, and should not be the sole defense for agents with access to sensitive systems.