IBM ships LLMON markup and Granite 4.1 preview models: separating instructions from data leaves most indirect prompt injections unexecuted

A model's context mixes system prompts, past turns, retrieved documents, tool responses and output constraints, and most of that structure is either implicit to the model or written in JSON, a format not designed for language models. IBM's LLMON marks each component with a meaningful tag wrapped in reserved special-token delimiters, making the structure explicit to the model. The prior condition flattened these components into one string or relied on JSON-style formats built for parsers, leaving the model to infer which part was the task, which was material and which was a constraint. On the OPI benchmark, which places the injection in the data of classic NLP tasks, non-LLMON models carried out injected instructions with high probability; the LLMON previews avoided 47% more attacks than the best frontier model tested and 95% more than the best open-source model, with similar trends on ASB and StruQ.

LLMON splits a turn into separately addressable blocks and adds an execution block that states which instruction to run, which data it operates on, which requirements constrain it and where the output goes. A conventional chat template only tells the model which part belongs to which role, whereas LLMON states what each component means and how components relate, and instructions and data not referenced by the execution block are ignored. The two previews start from Granite 4.1 base checkpoints, re-serialize a conventional instruction-tuning corpus into LLMON and add decoy instructions and data blocks left deliberately unbound; training then runs five GRPO stages and a DPO stage on a thousand on-policy preference pairs, over chat, multi-turn, RAG and tool-calling data.

The demonstrated scope is robustness to static indirect prompt injection on OPI, ASB and StruQ, plus general capability on par with Granite 4.1 Instruct across standard benchmark categories; the ScienceWorld example shows tuning a LoRA on an LLMON model to read and write a custom tag vocabulary. IBM states that this is an experimental preview ready for exploration and evaluation but not for production.

IBM notes that the privilege rule separating instructions from data is a learned behavior, not an enforced guarantee, and that these benchmarks test static indirect injection while adaptive attacks unfolding over many chat turns are still being improved.