IBM's LLMON: New LLM-Native Markup Language Cuts Prompt Injection by 95%

Executive Overview

IBM has announced LLMON (LLM Object Notation), a native markup language for large language models, via its official Granite blog on Hugging Face. The language is integrated into two experimental preview models: granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview. The models are available immediately on Hugging Face with an open GitHub repository and lossless JSON↔LLMON conversion tools. According to IBM, LLMON reduces the success of indirect prompt injection attacks by 47% compared to the best frontier model and by 95% compared to the best open-source model, while maintaining general performance.

Deep-Dive Features & Architecture

LLMON addresses a fundamental problem in the context architecture of large language models: the context is filled with heterogeneous components (system prompt, previous roles, instructions on retrieved documents, tool responses, output requirements, reasoning chains), most of which are either implicit or encoded in formats like JSON that were not originally designed for LLM digestion. LLMON introduces an explicit structure through semantic tags surrounded by reserved special token delimiters, unambiguous data schemas for the causal model, and unique identifiers linking each instruction to the payload it operates on, similar to function calling and argument passing in programming languages.

Unlike JSON, which relies on literal characters ({, ", :) that may appear in plain text, LLMON uses reserved delimiters that make structure and content occupy separate parts of the vocabulary. Tags are declared at the beginning of each scope with explicit boundaries, and nested structure is declared locally so the model does not need to track hierarchy across long distances. The accompanying package includes lossless bidirectional conversion tools between JSON and LLMON, example notebooks, and custom chat templates that render blocks automatically, with the ability to tag each part with exec: True or False to determine what is linked to the execution block.

Training relies on re-serializing a traditional instruction-tuning dataset into LLMON, so that each component becomes an addressable block, with added instructions and decoy data blocks that exist in the context but are intentionally unlinked. This is followed by five sequential GRPO stages covering multi-domain reasoning, RLHF, knowledge calibration, and mathematics, then a final DPO stage on one thousand preference pairs built from the model's own responses to injection attempts.

Benchmark & Competitive Performance

On the OPI benchmark, which embeds injections within classic natural language processing task data, the non-immune models showed...

Industry Impact & Enterprise Adoption

The release of LLMON signals a significant shift in how enterprises can approach LLM security. By making instruction-data separation a first-class architectural feature rather than an afterthought, IBM provides a practical path for organizations deploying LLMs in sensitive environments. The open-source availability on Hugging Face, combined with native support in the Mellea framework and conversion tooling, lowers the barrier for developers to integrate LLMON into existing pipelines. As prompt injection remains a top concern for AI security, LLMON's reported 95% reduction against open-source baselines offers a compelling benchmark for the industry.

Conclusion

IBM's LLMON represents a novel and timely contribution to LLM security and interoperability. By introducing a native markup language that explicitly separates instructions from data, IBM not only achieves substantial reductions in prompt injection success rates but also maintains general model performance. The immediate availability of preview models, tools, and documentation on Hugging Face and GitHub invites community validation and adoption. While context window size and Arabic-specific evaluations are not detailed in the announcement, the language-neutral design and multilingual foundation of Granite 4.1 suggest broad applicability. LLMON is poised to become a key building block for secure, reliable LLM deployments.

Media Source: Hugging Face | البيان الرسمي للشركة: المصدر الأصلي | Fact Verification & Analysis: AI Tools Oasis