· Nov 12, 2026
LLMON: An LLM-Native Markup Language, now in Granite 4.1 3B and 8B
Markdown · JSON · Original source
The listed IBM Granite authors introduce LLMON, a markup language that separates instructions, data and requirements into explicitly tagged, addressable blocks for language models. They argue that this structure can help models distinguish commands from text they should only process, a distinction they say conventional formats such as JSON leave implicit. They report that two experimental preview models, based on Granite 4.1, resisted more indirect on the OPI than the models they tested, while performing on par with Granite 4.1 Instruct models across standard benchmark categories. The authors say the results concern static indirect prompt injections; improving adaptive attacks that unfold over multiple chat turns remains work in progress. LLMON’s instruction-following behavior is learned, not enforced as a guarantee, and the preview models are intended for exploration and evaluation, not production. The authors also describe conversion tools for JSON and an example of adapting LLMON’s tags to ScienceWorld, a benchmark of elementary science tasks. Their proposal is to make the relationships among instructions, inputs and outputs explicit in the model’s context; how well that protection holds against adaptive attacks remains unresolved.
Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.
Original source
· Article
Source details
Original source date: Nov 12, 2026 (2026-11-12T19:07:35.000Z).
Date basis: Date supplied by the publisher’s feed.
Added to Escape Meridian: 2026-11-12T20:16:38.959Z. First observed: 2026-11-12T19:09:28.052Z. Retrieved: 2026-11-12T19:16:58.683Z.
Referenced by
Recorded citations and public file attachments. A reference alone does not establish agreement or influence.
No public references recorded here yet.
Limits
The reported robustness results concern static indirect ; the authors say adaptive attacks that unfold over multiple chat turns remain an area of work. The article states that LLMON’s privilege rule is learned behavior, not an enforced guarantee. The models are experimental previews and are not presented as ready for production.
Open question
How well do the LLMON models resist adaptive attacks that unfold over multiple chat turns?
Source-stated
The authors present LLMON as a markup language that explicitly marks model-context components and links instructions to the data they apply to.
an LLM-native markup language for explicitly communicating structure and semantics to the models.
Source-stated
The authors report that LLMON models avoided more attacks than the best frontier and open-source models they tested on the OPI benchmark.
avoiding 47% more attacks relative to the best frontier model that we tested, and 95% more than the best open-source model.
Source-stated
The authors report that the LLMON models performed on par with Granite 4.1 Instruct models across standard benchmark categories.
Across standard benchmark categories, the LLMON models perform on par with the Granite 4.1 Instruct models.
Source-stated
The authors say the benchmarks test static indirect prompt injections and that they are working on adaptive attacks spanning multiple chat turns.
these benchmarks test robustness to static indirect prompt injections. The instruction/data separation directly addresses this type of attack.
Source-stated
The authors state that LLMON’s privilege rule is learned behavior, not an enforced guarantee.
This is a learned behavior, not an enforced guarantee.
Source-stated
The authors describe the preview models as suitable for exploration and evaluation, but not production.
This is an experimental preview, ready for exploration and evaluation but not for production.
Source and contributor context
Hugging Face · Publisher
The publisher is identified here. No individual author has been inferred.
Source media
Media was declared by the source, but no asset passed the supported availability checks. Open the original source to view it.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Large language model
A language model with many learned numerical settings, used to process and generate language.
Prompt injection
Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it.
Benchmark
A defined set of tests used to compare systems. Results depend on the tasks and measures selected.
Hugging Face
Hugging Face hosts models, datasets and software that let people share, adapt and inspect AI systems.
Editorial provenance
Version 1. Publication ID: 355ff529-a34c-470a-8ecd-53083927d87f.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: passed by anthropic/claude-opus-5.5 on 2026-11-12T20:16:38.959Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 2e7804703aed5653f9248dc0587f1a5885aff30c9e6e314dee36139d877b8666. Source text hash: 13197d23cfd01d9ebab516c3b6cbe9b204360c15c35ada39c7b257a37dd95364.
Revision and source-check history
Version 1 · 2026-11-12T20:16:38.959Z
LLMON: An LLM-Native Markup Language, now in Granite 4.1 3B and 8B
The listed IBM Granite authors introduce LLMON, a markup language that separates instructions, data and requirements into explicitly tagged, addressable blocks for language models. They argue that this structure can help models distinguish commands from text they should only process, a distinction they say conventional formats such as JSON leave implicit. They report that two experimental preview models, based on Granite 4.1, resisted more indirect on the OPI than the models they tested, while performing on par with Granite 4.1 Instruct models across standard benchmark categories. The authors say the results concern static indirect prompt injections; improving adaptive attacks that unfold over multiple chat turns remains work in progress. LLMON’s instruction-following behavior is learned, not enforced as a guarantee, and the preview models are intended for exploration and evaluation, not production. The authors also describe conversion tools for JSON and an example of adapting LLMON’s tags to ScienceWorld, a benchmark of elementary science tasks. Their proposal is to make the relationships among instructions, inputs and outputs explicit in the model’s context; how well that protection holds against adaptive attacks remains unresolved.
Original source
· Article
Source details
Original source date: Nov 12, 2026 (2026-11-12T19:07:35.000Z).
Date basis: Date supplied by the publisher’s feed.
Added to Escape Meridian: 2026-11-12T20:16:38.959Z. First observed: 2026-11-12T19:09:28.052Z. Retrieved: 2026-11-12T19:16:58.683Z.
Limits
The reported robustness results concern static indirect ; the authors say adaptive attacks that unfold over multiple chat turns remain an area of work. The article states that LLMON’s privilege rule is learned behavior, not an enforced guarantee. The models are experimental previews and are not presented as ready for production.
Open question
How well do the LLMON models resist adaptive attacks that unfold over multiple chat turns?
Source-stated
The authors present LLMON as a markup language that explicitly marks model-context components and links instructions to the data they apply to.
an LLM-native markup language for explicitly communicating structure and semantics to the models.
Source-stated
The authors report that LLMON models avoided more attacks than the best frontier and open-source models they tested on the OPI benchmark.
avoiding 47% more attacks relative to the best frontier model that we tested, and 95% more than the best open-source model.
Source-stated
The authors report that the LLMON models performed on par with Granite 4.1 Instruct models across standard benchmark categories.
Across standard benchmark categories, the LLMON models perform on par with the Granite 4.1 Instruct models.
Source-stated
The authors say the benchmarks test static indirect prompt injections and that they are working on adaptive attacks spanning multiple chat turns.
these benchmarks test robustness to static indirect prompt injections. The instruction/data separation directly addresses this type of attack.
Source-stated
The authors state that LLMON’s privilege rule is learned behavior, not an enforced guarantee.
This is a learned behavior, not an enforced guarantee.
Source-stated
The authors describe the preview models as suitable for exploration and evaluation, but not production.
This is an experimental preview, ready for exploration and evaluation but not for production.
Source and contributor context
Hugging Face · Publisher
The publisher is identified here. No individual author has been inferred.
Source media
Media was declared by the source, but no asset passed the supported availability checks. Open the original source to view it.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Large language model
A language model with many learned numerical settings, used to process and generate language.
Prompt injection
Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it.
Benchmark
A defined set of tests used to compare systems. Results depend on the tasks and measures selected.
Hugging Face
Hugging Face hosts models, datasets and software that let people share, adapt and inspect AI systems.
Editorial provenance
Version 1. Publication ID: 355ff529-a34c-470a-8ecd-53083927d87f.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: passed by anthropic/claude-opus-5.5 on 2026-11-12T20:16:38.959Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 2e7804703aed5653f9248dc0587f1a5885aff30c9e6e314dee36139d877b8666. Source text hash: 13197d23cfd01d9ebab516c3b6cbe9b204360c15c35ada39c7b257a37dd95364.
passed · 2026-11-12T20:16:38.959Z · anthropic/claude-opus-5.5
Publication: 355ff529-a34c-470a-8ecd-53083927d87f
attribution — pass: The reading attributes LLMON and its reported results to the IBM Granite authors listed on the Hugging Face article. Performance and robustness claims are framed as the authors' reports, not as established facts.
To address this, we developed LLMON (LLM Object Notation, pronounced “lemon”), an LLM-native markup language
summary — pass: The summary states what LLMON is: tagged, addressable blocks that separate instructions, data and requirements. It covers the authors' JSON critique, the preview models, the OPI results, parity on general capability, and the scope and production caveats. The term "indirect prompt injection" is not spelled out, but the commands-versus-text distinction gives enough context, and term tooltips can cover it. The question follows directly from the open problem the authors acknowledge.
We are actively working on also improving adaptive attacks which unfold over many chat turns.
date — pass: The originalPublished value of 2026-11-12 matches the article's own publication date. Nothing indicates an earlier first publication.
Published November 12, 2026
support — pass: Each claim matches the source. These include the 47% and 95% relative attack-avoidance figures on OPI, parity with Granite 4.1 Instruct, the limitation to static attacks, learned behavior rather than a guarantee, and preview-only status. Saying JSON leaves the distinction implicit is a fair paraphrase of the authors' critique. The reading adds no unsupported benefits or costs.
JSON was designed for parsers, not for causal language models.
media — pass: The selected media is the verified direct link to the original Hugging Face article. It is the most direct way for readers to reach the source.
Challenge or correct this reading
Send a correction or an opposing source with this reading’s URL. Disagreement and uncertainty can remain unresolved.
Hugging Face hosts models, datasets and software that let people share, adapt and inspect AI systems.
Explore Hugging FaceHidden instructions placed in a document, email or web page that try to take control of an AI system reading it.
Definition referenceA defined set of tests used to compare systems. Results depend on the tasks and measures selected.
Definition referenceHugging Face hosts models, datasets and software that let people share, adapt and inspect AI systems.
Explore Hugging FaceHidden instructions placed in a document, email or web page that try to take control of an AI system reading it.
Definition referenceHidden instructions placed in a document, email or web page that try to take control of an AI system reading it.
Definition referenceHidden instructions placed in a document, email or web page that try to take control of an AI system reading it.
Definition referenceA defined set of tests used to compare systems. Results depend on the tasks and measures selected.
Definition referenceHugging Face hosts models, datasets and software that let people share, adapt and inspect AI systems.
Explore Hugging FaceHidden instructions placed in a document, email or web page that try to take control of an AI system reading it.
Definition referenceHidden instructions placed in a document, email or web page that try to take control of an AI system reading it.
Definition reference