IBM has released experimental 3-billion and 8-billion-parameter Granite 4.1 models trained on LLM Object Notation, or LLMON. The XML-like format marks instructions, data and requirements with reserved tokens, then uses an execution block to state exactly which instruction should operate on which input.
The design targets ambiguity in ordinary prompts and JSON. Text retrieved from a document can contain an instruction that a model mistakes for a command. LLMON instead trains the model to treat content bound as data as material to read, not authority to follow. Conversion tools can translate existing JSON into the tagged structure and back without losing information.
IBM reports that the previews sharply reduced successful indirect prompt injections on OPI, ASB and StruQ benchmarks while maintaining general capability near conventional Granite 4.1 Instruct models. The strongest claim applies to static attacks that match the instruction-versus-data separation. Adaptive attacks unfolding over several turns remain active research, and the learned behavior is not a hard parser-enforced security guarantee.
The models, toolkit, examples and visualization are available through Hugging Face and GitHub. IBM labels them experimental previews rather than production-ready systems. Developers would need to test both security and task quality on their own prompts before treating the notation as a control.