# LLMON: An LLM-Native Markup Language, now in Granite 4.1 3B and 8B [Canonical reading](https://escapemeridian.com/readings/llmon-an-llm-native-markup-language-now-in-granite-4-1-3b-and-8b-e737d826) The listed IBM Granite authors introduce LLMON, a markup language that separates instructions, data and requirements into explicitly tagged, addressable blocks for language models. They argue that this structure can help models distinguish commands from text they should only process, a distinction they say conventional formats such as JSON leave implicit. They report that two experimental preview models, based on Granite 4.1, resisted more indirect prompt injections on the OPI benchmark than the models they tested, while performing on par with Granite 4.1 Instruct models across standard benchmark categories. The authors say the results concern static indirect prompt injections; improving adaptive attacks that unfold over multiple chat turns remains work in progress. LLMON’s instruction-following behavior is learned, not enforced as a guarantee, and the preview models are intended for exploration and evaluation, not production. The authors also describe conversion tools for JSON and an example of adapting LLMON’s tags to ScienceWorld, a benchmark of elementary science tasks. Their proposal is to make the relationships among instructions, inputs and outputs explicit in the model’s context; how well that protection holds against adaptive attacks remains unresolved. Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source Hugging Face · Article Original source date: Nov 12, 2026 (2026-11-12T19:07:35.000Z). Date basis: Date supplied by the publisher’s feed. Added to Escape Meridian: 2026-11-12T20:16:38.959Z. First observed: 2026-11-12T19:09:28.052Z. Retrieved: 2026-11-12T19:16:58.683Z. - [LLMON: An LLM-Native Markup Language, now in Granite 4.1 3B and 8B](https://huggingface.co/blog/ibm-granite/llmon-an-llm-native-markup-language-now-in-granite) ## Limits The reported robustness results concern static indirect prompt injections; the authors say adaptive attacks that unfold over multiple chat turns remain an area of work. The article states that LLMON’s privilege rule is learned behavior, not an enforced guarantee. The models are experimental previews and are not presented as ready for production. ## Open question How well do the LLMON models resist adaptive prompt injection attacks that unfold over multiple chat turns? ## Source-stated The authors present LLMON as a markup language that explicitly marks model-context components and links instructions to the data they apply to. > an LLM-native markup language for explicitly communicating structure and semantics to the models. - [Supporting source](https://huggingface.co/blog/ibm-granite/llmon-an-llm-native-markup-language-now-in-granite) ## Source-stated The authors report that LLMON models avoided more attacks than the best frontier and open-source models they tested on the OPI benchmark. > avoiding 47% more attacks relative to the best frontier model that we tested, and 95% more than the best open-source model. - [Supporting source](https://huggingface.co/blog/ibm-granite/llmon-an-llm-native-markup-language-now-in-granite) ## Source-stated The authors report that the LLMON models performed on par with Granite 4.1 Instruct models across standard benchmark categories. > Across standard benchmark categories, the LLMON models perform on par with the Granite 4.1 Instruct models. - [Supporting source](https://huggingface.co/blog/ibm-granite/llmon-an-llm-native-markup-language-now-in-granite) ## Source-stated The authors say the benchmarks test static indirect prompt injections and that they are working on adaptive attacks spanning multiple chat turns. > these benchmarks test robustness to static indirect prompt injections. The instruction/data separation directly addresses this type of attack. - [Supporting source](https://huggingface.co/blog/ibm-granite/llmon-an-llm-native-markup-language-now-in-granite) ## Source-stated The authors state that LLMON’s privilege rule is learned behavior, not an enforced guarantee. > This is a learned behavior, not an enforced guarantee. - [Supporting source](https://huggingface.co/blog/ibm-granite/llmon-an-llm-native-markup-language-now-in-granite) ## Source-stated The authors describe the preview models as suitable for exploration and evaluation, but not production. > This is an experimental preview, ready for exploration and evaluation but not for production. - [Supporting source](https://huggingface.co/blog/ibm-granite/llmon-an-llm-native-markup-language-now-in-granite) ## Source and contributor context Hugging Face · Publisher The publisher is identified here. No individual author has been inferred. ## Source media Media was declared by the source, but no asset passed the supported availability checks. Open the original source to view it. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Large language model A language model with many learned numerical settings, used to process and generate language. - [Definition reference](https://developers.google.com/machine-learning/glossary#large-language-model) ## Prompt injection Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it. - [Definition reference](https://en.wikipedia.org/wiki/Prompt_injection) ## Benchmark A defined set of tests used to compare systems. Results depend on the tasks and measures selected. - [Definition reference](https://arxiv.org/abs/2211.09110) ## Hugging Face Hugging Face hosts models, datasets and software that let people share, adapt and inspect AI systems. - [Explore this context](/entities/hugging-face) - [Reference](https://huggingface.co/blog) ## Editorial provenance Version 1. Publication ID: 355ff529-a34c-470a-8ecd-53083927d87f. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: passed by anthropic/claude-opus-5.5 on 2026-11-12T20:16:38.959Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 2e7804703aed5653f9248dc0587f1a5885aff30c9e6e314dee36139d877b8666. Source text hash: 13197d23cfd01d9ebab516c3b6cbe9b204360c15c35ada39c7b257a37dd95364. ## Revision and source-check history ### Version 1 — 2026-11-12T20:16:38.959Z The listed IBM Granite authors introduce LLMON, a markup language that separates instructions, data and requirements into explicitly tagged, addressable blocks for language models. They argue that this structure can help models distinguish commands from text they should only process, a distinction they say conventional formats such as JSON leave implicit. They report that two experimental preview models, based on Granite 4.1, resisted more indirect prompt injections on the OPI benchmark than the models they tested, while performing on par with Granite 4.1 Instruct models across standard benchmark categories. The authors say the results concern static indirect prompt injections; improving adaptive attacks that unfold over multiple chat turns remains work in progress. LLMON’s instruction-following behavior is learned, not enforced as a guarantee, and the preview models are intended for exploration and evaluation, not production. The authors also describe conversion tools for JSON and an example of adapting LLMON’s tags to ScienceWorld, a benchmark of elementary science tasks. Their proposal is to make the relationships among instructions, inputs and outputs explicit in the model’s context; how well that protection holds against adaptive attacks remains unresolved. ## Original source Hugging Face · Article Original source date: Nov 12, 2026 (2026-11-12T19:07:35.000Z). Date basis: Date supplied by the publisher’s feed. Added to Escape Meridian: 2026-11-12T20:16:38.959Z. First observed: 2026-11-12T19:09:28.052Z. Retrieved: 2026-11-12T19:16:58.683Z. - [LLMON: An LLM-Native Markup Language, now in Granite 4.1 3B and 8B](https://huggingface.co/blog/ibm-granite/llmon-an-llm-native-markup-language-now-in-granite) ## Limits The reported robustness results concern static indirect prompt injections; the authors say adaptive attacks that unfold over multiple chat turns remain an area of work. The article states that LLMON’s privilege rule is learned behavior, not an enforced guarantee. The models are experimental previews and are not presented as ready for production. ## Open question How well do the LLMON models resist adaptive prompt injection attacks that unfold over multiple chat turns? ## Source-stated The authors present LLMON as a markup language that explicitly marks model-context components and links instructions to the data they apply to. > an LLM-native markup language for explicitly communicating structure and semantics to the models. - [Supporting source](https://huggingface.co/blog/ibm-granite/llmon-an-llm-native-markup-language-now-in-granite) ## Source-stated The authors report that LLMON models avoided more attacks than the best frontier and open-source models they tested on the OPI benchmark. > avoiding 47% more attacks relative to the best frontier model that we tested, and 95% more than the best open-source model. - [Supporting source](https://huggingface.co/blog/ibm-granite/llmon-an-llm-native-markup-language-now-in-granite) ## Source-stated The authors report that the LLMON models performed on par with Granite 4.1 Instruct models across standard benchmark categories. > Across standard benchmark categories, the LLMON models perform on par with the Granite 4.1 Instruct models. - [Supporting source](https://huggingface.co/blog/ibm-granite/llmon-an-llm-native-markup-language-now-in-granite) ## Source-stated The authors say the benchmarks test static indirect prompt injections and that they are working on adaptive attacks spanning multiple chat turns. > these benchmarks test robustness to static indirect prompt injections. The instruction/data separation directly addresses this type of attack. - [Supporting source](https://huggingface.co/blog/ibm-granite/llmon-an-llm-native-markup-language-now-in-granite) ## Source-stated The authors state that LLMON’s privilege rule is learned behavior, not an enforced guarantee. > This is a learned behavior, not an enforced guarantee. - [Supporting source](https://huggingface.co/blog/ibm-granite/llmon-an-llm-native-markup-language-now-in-granite) ## Source-stated The authors describe the preview models as suitable for exploration and evaluation, but not production. > This is an experimental preview, ready for exploration and evaluation but not for production. - [Supporting source](https://huggingface.co/blog/ibm-granite/llmon-an-llm-native-markup-language-now-in-granite) ## Source and contributor context Hugging Face · Publisher The publisher is identified here. No individual author has been inferred. ## Source media Media was declared by the source, but no asset passed the supported availability checks. Open the original source to view it. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Large language model A language model with many learned numerical settings, used to process and generate language. - [Definition reference](https://developers.google.com/machine-learning/glossary#large-language-model) ## Prompt injection Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it. - [Definition reference](https://en.wikipedia.org/wiki/Prompt_injection) ## Benchmark A defined set of tests used to compare systems. Results depend on the tasks and measures selected. - [Definition reference](https://arxiv.org/abs/2211.09110) ## Hugging Face Hugging Face hosts models, datasets and software that let people share, adapt and inspect AI systems. - [Explore this context](/entities/hugging-face) - [Reference](https://huggingface.co/blog) ## Editorial provenance Version 1. Publication ID: 355ff529-a34c-470a-8ecd-53083927d87f. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: passed by anthropic/claude-opus-5.5 on 2026-11-12T20:16:38.959Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 2e7804703aed5653f9248dc0587f1a5885aff30c9e6e314dee36139d877b8666. Source text hash: 13197d23cfd01d9ebab516c3b6cbe9b204360c15c35ada39c7b257a37dd95364. ### passed — 2026-11-12T20:16:38.959Z — anthropic/claude-opus-5.5 Publication: 355ff529-a34c-470a-8ecd-53083927d87f attribution — pass: The reading attributes LLMON and its reported results to the IBM Granite authors listed on the Hugging Face article. Performance and robustness claims are framed as the authors' reports, not as established facts. > To address this, we developed LLMON (LLM Object Notation, pronounced “lemon”), an LLM-native markup language summary — pass: The summary states what LLMON is: tagged, addressable blocks that separate instructions, data and requirements. It covers the authors' JSON critique, the preview models, the OPI results, parity on general capability, and the scope and production caveats. The term "indirect prompt injection" is not spelled out, but the commands-versus-text distinction gives enough context, and term tooltips can cover it. The question follows directly from the open problem the authors acknowledge. > We are actively working on also improving adaptive attacks which unfold over many chat turns. date — pass: The originalPublished value of 2026-11-12 matches the article's own publication date. Nothing indicates an earlier first publication. > Published November 12, 2026 support — pass: Each claim matches the source. These include the 47% and 95% relative attack-avoidance figures on OPI, parity with Granite 4.1 Instruct, the limitation to static attacks, learned behavior rather than a guarantee, and preview-only status. Saying JSON leaves the distinction implicit is a fair paraphrase of the authors' critique. The reading adds no unsupported benefits or costs. > JSON was designed for parsers, not for causal language models. media — pass: The selected media is the verified direct link to the original Hugging Face article. It is the most direct way for readers to reach the source. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/e737d826e18dc17c838b517a8f0941c3451c137c9352f05e619f5df2b230f97d/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/llmon-an-llm-native-markup-language-now-in-granite-4-1-3b-and-8b-e737d826.json)