LLMON gives model context an explicit structure: Granite 4.1 3B and 8B previews cut OPI injection attacks to near zero

Model context mixes system prompts, past turns, retrieved documents, tool responses and output constraints, and most of that structure is either implicit to the model or written in JSON, which was not designed for language models. LLMON marks these components explicitly as semantically tagged blocks, separating instructions from data at the vocabulary level. A conventional chat template flattens all components of a turn into one string and leaves the model to infer which part is the task, which is the subject and which are constraints. On the OPI benchmark, non-LLMON models carry out injected instructions with high probability, while the LLMON previews push attack success to nearly zero, avoiding 47% more attacks than the best frontier model tested and 95% more than the best open-source model.

LLMON uses six reserved special tokens as delimiters that mark the start and end of tags and allow nesting and anchoring, so structure and content occupy separate parts of the vocabulary. JSON encodes structure with characters such as braces, quotes and colons that also appear in ordinary text; to a model, a quotation mark inside a document and one closing a field are the same token, and nesting depth must be counted in brackets. Training starts from Granite 4.1 base checkpoints rather than the released instruct models, re-serializes a conventional instruction-tuning corpus into LLMON, adds decoy instructions and data blocks that are deliberately left unbound, and then runs five GRPO stages plus a DPO stage on a thousand on-policy preference pairs.

The privilege rule the model learns follows from this layout rather than an added guardrail: an instruction reached through an execution block is authoritative, while anything reached as input is material to read. Under a conventional template the model has no explicit basis for distinguishing instruction provenance, so a malicious instruction hidden in a retrieved document or tool response is formally indistinguishable from the real task instruction. Similar trends are observed on ASB and StruQ, and these benchmarks test static indirect prompt injections; the team says it is actively working on adaptive attacks that unfold over many chat turns.

The demonstrated scope is robustness on the OPI, ASB and StruQ static indirect prompt-injection benchmarks, plus general capability on par with Granite 4.1 Instruct across standard benchmark categories; the custom-vocabulary demonstration on ScienceWorld targets a text-based science-task agent that issues one command at a time. The authors position the release as an experimental preview ready for exploration and evaluation but not for production.

The authors state that the instruction-versus-data privilege distinction is a learned behavior, not an enforced guarantee. The reported injection robustness comes from static indirect prompt-injection benchmarks, and work on adaptive attacks unfolding over many turns is ongoing. The release status is an experimental preview.