IBM's Granite team launches LLMON markup language to curb prompt injection

IBM's Granite team published LLMON (LLM Object Notation) on November 12, 2026, an XML-like markup language paired with two experimental preview models built to resist indirect prompt-injection attacks, according to a post on the Hugging Face blog.

The concrete changes

• LLMON (LLM Object Notation) is an XML-like markup that uses reserved special tokens as delimiters to explicitly separate instructions from data, instead of JSON.
• Two new experimental preview models were released: granite-4.1-3b-llmon-preview (3B parameters) and granite-4.1-8b-llmon-preview (8B parameters), both derived from Granite 4.1 base checkpoints.
• On IBM's own prompt-injection benchmark (OPI), the LLMON models avoid 47% more attacks than the best frontier model tested and 95% more than the best open-source model tested.
• The LLMON models perform on par with the standard Granite 4.1 Instruct models on general benchmarks.
• The models are available on Hugging Face, with an accompanying GitHub toolkit repository and a live attention-visualization demo space.
• IBM labels both models ready for exploration and evaluation but not for production.

What it means for people building with AI

Indirect prompt injection through tool output or retrieved data is one of the most common ways AI coding and browsing agents get hijacked. LLMON represents a concrete attempt to address that problem at the model and format level, by giving the model a way to tell instructions and data apart, rather than relying on external filters bolted on after the fact.

Availability and status

Both granite-4.1-3b-llmon-preview and granite-4.1-8b-llmon-preview are released as experimental previews. IBM describes them as ready for exploration and evaluation, not for production use, and makes them available on Hugging Face alongside a GitHub toolkit repository and a live attention-visualization demo space.

Sources

• LLMON: An LLM-Native Markup Language, now in Granite 4.1 3B and 8B (Hugging Face / IBM, November 12, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.