Markdown edition

# IBM releases experimental Granite LLMON models

> A preview for evaluating instruction and data separation.

By BIGCHANGE.AI Editorial

Published: 2026-11-13T01:45:38.546Z
Updated: 2026-11-13T01:45:38.546Z
Canonical: https://bigchange.ai/blog/ibm-granite-llmon-preview

![Illustration of a reviewer examining an email.](https://bigchange.ai/api/media/file/email-v2.png)
AI-generated illustration for BIG CHANGE.

[IBM released](https://huggingface.co/blog/ibm-granite/llmon-an-llm-native-markup-language-now-in-granite) experimental 3B and 8B Granite LLMON models, Apache 2.0 weights and tooling on November 12.

An assistant summarizing outside material can encounter instructions embedded in that material. OWASP calls this indirect prompt injection: the content redirects behavior even though it did not arrive as the user's request. The distinction matters whenever a model reads websites, files or tool responses before deciding what to do.

### The big change

- The previews learn an instruction/data boundary; they do not enforce a security guarantee. IBM describes them as experimental and not ready for production.
- LLMON's earlier format research separates named text blocks and points to the instruction and input to use. Making that relationship explicit helps describe the intended task instead of leaving every connection implicit in prose.
- Application permissions remain a separate defense. OWASP recommends limiting access and requiring human approval for privileged operations, so an unexpected model response cannot automatically become an unrestricted action.

### How the format expresses a task

The team's [March paper](https://arxiv.org/html/2603.22519v1) introduced LLMON, short for LLM Object Notation. Tags identify text segments, while unique identifiers allow one segment to refer to another. An execution block specifies which instruction is selected and which data it should use. Special tokens convey structure to the model; ordinary words alone do not carry that same structural role.

The earlier paper gives a concrete example: generate a title for an email about poor airline Wi-Fi and a refund request. The title-writing request is marked as instruction, and the customer's email as data. The refund demand is therefore material for the title, not a request to issue a payment. This illustrates the notation, not a demonstrated payment safeguard.

IBM's new training includes competing instructions that are present but not selected, teaching the models to follow the designated instruction instead.

Use the supplied chat template: the [model card](https://huggingface.co/ibm-granite/granite-4.1-8b-llmon-preview) warns that conventional formatting can degrade quality.

### What IBM measured

IBM's [October preprint](https://arxiv.org/html/2610.38120v1) compares matched 8B models. Attack success fell from 96.3% to 0.02% on OPI's language-task data and 52.8% to 3.1% on ASB's tool observations.

IBM's separate ARES red team reported 8B robustness—unsuccessful attacks—of 79.8% indirect, 32.7% direct and 37.0% multi-turn. These are different attack surfaces, not interchangeable scores or independent validation.

A success rate counts attacks that worked; robustness counts those that did not. Reversing the direction of the measure changes how a percentage should be read. A low failure rate in one test does not mathematically establish the rate in a different population.

### Keep authorization outside the answer

[OWASP](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) recommends treating the model as an untrusted user during adversarial testing. It also recommends restricting its privileges to the minimum required and handling extensible functions in code. That makes the surrounding application responsible for enforcing access, rather than allowing generated text to decide its own authority.

For example, a summarization service does not need permission to transfer money merely because a document discusses a refund. If an application also offers payment actions, its authorization and human-approval rules need to apply before execution. This example illustrates least privilege; it does not demonstrate that prompt injection has been eliminated.

## Sources

- [IBM release](https://huggingface.co/blog/ibm-granite/llmon-an-llm-native-markup-language-now-in-granite) — Models and tooling.
- [Model card](https://huggingface.co/ibm-granite/granite-4.1-8b-llmon-preview) — Formatting and limits.
- [Post-training paper](https://arxiv.org/html/2610.38120v1) — Company evaluations.
- [March format paper](https://arxiv.org/html/2603.22519v1) — Original notation and example.
- [OWASP prompt injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) — General injection defenses.