Prompt injection, where an instruction hidden in a document or tool result hijacks an AI agent, remains one of the hardest security problems for anyone building with language models. IBM's Granite team has published an unusual answer: rather than adding another filter, it changes the format the model reads. LLMON, short for LLM Object Notation and pronounced lemon, is a markup language designed so the model can tell which text is an order and which is only material.
The core idea is to stop encoding structure with ordinary characters. In JSON, the quotation mark that closes a field is the same token as one inside a quoted document, and nesting is tracked by counting brackets, which transformers handle poorly over long spans. LLMON uses six reserved special tokens as delimiters, so structure and content draw on separate parts of the vocabulary. Each component, such as an instruction, a piece of data or a requirement, gets a tag and a short ID that costs two tokens, and an execution block at the end states which instruction to run on which data and where the answer goes. Anything not referenced there is meant to be ignored.
IBM is releasing two experimental preview models, granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview, trained from Granite 4.1 base checkpoints so the behaviour is learned during post-training. Training used a re-serialised instruction corpus with deliberate decoy instructions left unbound, followed by five GRPO reinforcement stages and a final DPO stage on a thousand preference pairs built from the model's own responses to injection attempts. On the OPI benchmark, IBM reports that LLMON avoids 47% more attacks than the best frontier model it tested and 95% more than the best open model, with similar trends on ASB and StruQ, while general benchmark scores stay on par with Granite 4.1 Instruct.
The practical appeal is low friction. The preview models ship with a chat template, so developers name the parts of a message and mark which ones to execute; converters turn existing JSON into LLMON and back without loss. That is a different approach from the instruction hierarchies and classifiers frontier labs use, and it could matter for agents that read email or web pages on your behalf.
IBM is candid about the limits. These are previews, not for production. The benchmarks test static injections; attacks that unfold over many turns are still being worked on. And IBM stresses that the separation is learned behaviour, not an enforced guarantee, so a determined attacker may yet find a way around it.