LLMON : A Native Markup Language for LLMs Arrives in Granite 4.1 3B and 8B

A large language model (LLM) generates each new token, i.e., each text fragment, from its context. Over a long interaction, this context fills up with system prompts, conversation histories, instructions for documents, tool responses, user data, constraints, and reasoning chains. Much of this structure remains implicit to the model or is encoded in formats like JSON, which were not designed to be read by LLMs. According to the source, this partly explains the fragility of models, especially smaller ones, as well as some unexpected behaviors. This lack of structure can also be exploited by attackers, notably via prompt injections.

LLMON, for ‘LLM Object Notation’, is pronounced ‘lemon’. Its tags mark semantically coherent components, framed by reserved special delimiters. Unique identifiers allow linking an instruction, which can be anywhere in the context, to the data it should operate on, similar to a function call with its arguments in programming.

Separating Instructions and Data

An indirect prompt injection involves hiding a malicious instruction within data, such as a retrieved document, a tool response, or user input. According to the source, LLMON models largely ignore these hidden instructions, thanks to the explicit separation between instructions and data. On some benchmarks, the attack success rate drops almost to zero, whereas classically instruction-tuned models are hijacked with a high probability.

The authors compared the previews to several open-source and proprietary models on the OPI benchmark, which inserts the injection into data from classic language processing tasks. They measure robustness as ‘1 − attack success rate’. According to them, LLMON ‘practically eliminates the problem’ on this test, avoiding 47% more attacks than the best state-of-the-art model tested, and 95% more than the best open-source model. Similar trends are observed on the ASB and StruQ benchmarks. The source specifies that these tests involve static injections, and the team is still working on adaptive attacks, which unfold over multiple conversation turns.

General Capabilities and Training

According to the source, the security gains do not come at the expense of general capabilities: on major categories of standard benchmarks, the LLMON models achieve results comparable to those of Granite 4.1 Instruct models. To try it, one simply needs to name the parts of a conversation turn, such as instruction, data, or requirement, with the conversation template handling their transformation into LLMON blocks. A conversion library also allows processing structured data, like JSON, as typed and addressable blocks.

The models start from the Granite 4.1 base checkpoints, not the published instruct versions. The authors rewrote a classic instruction-tuning corpus into the LLMON format, then added decoy blocks, present in the context but deliberately unlinked. They then applied five steps of GRPO reinforcement learning, followed by a DPO step based on a thousand preference pairs from the model’s responses to injection attempts. This results, according to the source, in a privilege rule: an instruction called by an execution block is authoritative, while data, documents, or tool results remain elements to be read, not orders to be followed. The authors specify that this is a learned behavior, not an enforced guarantee.

The source also presents an example of adaptation on the ScienceWorld benchmark, where an agent performs elementary scientific tasks. A tag vocabulary specific to this task was defined, then a LoRA adapter was trained on an LLMON model. Teams are invited to share their feedback on GitHub Discussions, as the project remains, according to its authors, an experimental preview, not intended for production.