IBM releases experimental AI models trained to separate instructions from data

Malicious commands hidden inside documents and tool responses were much less effective against IBM’s new experimental models in company tests. On November 12, IBM released two Granite 4.1 LLMON previews and a toolkit built around an explicit distinction: which text gives orders, and which text is only material to read.

That distinction targets indirect prompt injection: an attack that hides instructions inside information a model is supposed to process, such as a retrieved document or a tool’s response. IBM labels both models experimental previews for exploration and evaluation, not production use.

Giving each instruction an explicit target

LLMON stands for LLM Object Notation, pronounced “lemon.” It is a markup language that labels parts of a model’s input and uses reserved special tokens to mark their boundaries. Instructions, data and output requirements become separate, addressable blocks rather than text whose relationships the model must infer.

An execution block then identifies the instruction to run, the data it applies to, the requirements to observe and where the answer belongs. In IBM’s example, a request to write about IBM is bound to that subject and two constraints: fewer than 10 words and no commas. Other blocks can remain visible without being selected for execution.

The models learn this arrangement during post-training, starting from Granite 4.1 base checkpoints rather than the released instruction-tuned versions. IBM reformatted training examples into LLMON and added decoy instructions and irrelevant data that were deliberately left unbound. The desired answer stayed unchanged, teaching the model to follow the named dependencies and disregard distractions. Reinforcement learning and a final preference-training stage followed.

This is a learned behavior, not an enforced guarantee.

IBM Granite team, in its LLMON release post

Strong results against a defined class of attacks

The research behind the release predates the downloadable previews. In an October 28 paper, the researchers reported that LLMON-structured training reduced attack success rates on indirect prompt-injection benchmarks from 53–100% to 0.02–5.6%, while preserving general capabilities. Those figures are reported benchmark ranges, not a promise about every deployment.

The release post adds a comparison on OPI, a benchmark that embeds malicious instructions in data used for language tasks. IBM says the previews avoided 47% more attacks than the best frontier model it tested and 95% more than its best tested open-source model.

The scope is important: IBM says these benchmarks test static indirect prompt injections. Attacks that adapt across multiple chat turns remain an area of ongoing work. Separately, IBM reports that the previews perform on par with Granite 4.1 Instruct across standard benchmark categories, suggesting the measured security gains did not require sacrificing general capability.

A preview developers can wire into existing messages

The downloads are named granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview. They consume and generate LLMON-marked text. Developers do not have to handwrite every delimiter: the models ship with a chat template that turns named message parts, such as instruction, data and requirement, into the structured format.

IBM’s accompanying toolkit supplies workflows and templates. The release also offers several ways to handle existing application structures:

• JSON converters translate structured data to LLMON and back without loss, preserving internal structure as individually addressable blocks.
• Mellea has native support that automatically converts its model calls into LLMON.
• Custom tags let developers define a domain-specific vocabulary and train a lightweight adapter to read and write it.

IBM demonstrates that customization in ScienceWorld, a text-based simulator of elementary science tasks. Its example assigns tags to goals, planning rules, room state, inventory and the next action, then trains an adapter on reference solutions. The notebook walks through testing it on held-out games and comparing its score with the untrained base model.