IBM’s Granite team has released two experimental open models designed to resist prompt injection, one of the biggest security headaches for AI agents. The new Granite 4.1 LLMON previews come in 3B and 8B sizes and are trained to tell the difference between instructions they should follow and data they should only read.
The release landed on November 12, 2026, alongside a toolkit and example workflows. IBM says the models are ready for testing and evaluation, not for production use yet.
What IBM Announced With Granite LLMON
The two models are called granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview. They were built from Granite 4.1 base checkpoints, not from the already released instruct models, so the new behavior was learned during post-training.
Both models carry the permissive Apache 2.0 license. IBM also published a GitHub repository with converters, chat templates and notebooks, plus an attention visualization demo on Hugging Face Spaces.
| Detail | What IBM Shared |
|---|---|
| Models | Granite 4.1 LLMON preview, 3B and 8B |
| License | Apache 2.0 |
| Main goal | Separate trusted instructions from untrusted data |
| Headline result | 47% more attacks avoided than the best frontier model tested on OPI |
| Status | Experimental preview, not for production |
How LLMON Fights Prompt Injection
LLMON stands for LLM Object Notation, and IBM says it is pronounced “lemon.” It is an XML-like markup language that gives each part of a prompt its own labeled, addressable block.
That matters because of indirect prompt injection. In this kind of attack, someone hides a malicious command inside a web page, a document, a tool response or user data. A regular model may read that hidden text and simply obey it, which is a real risk for AI agent security.
Instructions vs. Data
With LLMON, a special execution block tells the model which instruction to run, which data it applies to and where the answer should go. Anything reached as input, like documents or tool results, is treated as material to read rather than a command to follow.
The structural markers are reserved special tokens in the tokenizer. That means a quotation mark or bracket inside a document can’t be confused with the markup that defines the prompt, which is a known weak spot with JSON-style formats.
How the Models Were Trained
IBM re-wrote a normal instruction-tuning dataset into LLMON format, covering chat, multi-turn conversations, retrieval and tool calling. It then added decoy instructions and data that sit in the context but are never called, so the model learns to ignore them.
After that came five rounds of reinforcement learning and a final preference-tuning stage built from about 1,000 examples of the model’s own responses to injection attempts. IBM stresses that the resulting behavior is learned, not an enforced guarantee.
Granite LLMON Benchmark Results
On the OPI benchmark, which hides injected commands inside classic language tasks, IBM reports that the LLMON previews avoided 47% more attacks than the best frontier model it tested. It also says they avoided 95% more than the best open-source model.
IBM says it saw similar trends on two other test sets, ASB and StruQ. It also claims general skills stayed roughly on par with the regular Granite 4.1 Instruct models, so you should not have to trade away much capability for the extra protection.
There is an important limit, though. These benchmarks test static, one-shot injections, and IBM says it is still working on adaptive attacks that unfold over many chat turns.
What This Means for You
If you build chatbots, retrieval tools or agents that read outside content, prompt injection is one of the hardest problems to solve. IBM’s approach is worth a look, especially if you already work with smaller open models.
- Developers can swap a Granite 4.1 3B or 8B model for the LLMON preview and keep the familiar chat template, since parts of a message can simply be named.
- Teams with JSON-heavy pipelines can use IBM’s converters to turn JSON into LLMON and back without losing data.
- You can define your own tags and fine-tune a small adapter so the model understands a custom structure.
- Don’t rely on this alone: keep permission limits, human review and other security safeguards in place.
If you are new to the topic, it also helps to understand how instructions are structured in the first place. Our guide on writing AI prompts covers the basics, and you can follow more stories like this in our AI news section.
Why Prompt Injection Defense Matters Now
AI agents are being asked to browse the web, read email and act inside business software. Each of those jobs exposes them to text written by strangers, and recent funding for startups like agent security firms shows how seriously companies take the threat.
Most defenses today are filters or guardrails added around a model. IBM is betting that building the instruction-versus-data rule into the model’s training and prompt format can do better, at least for the static attacks it tested.
Sources
Primary source: IBM Granite’s LLMON announcement. Additional reporting from Unite.AI.
Conclusion
IBM’s Granite LLMON previews are an early but interesting attempt to bake prompt injection resistance directly into small open models. The reported benchmark gains are large, and the Apache 2.0 license makes them easy to test. Still, these are experimental models, the results come from IBM’s own testing, and multi-turn attacks remain an open problem. Treat them as a promising tool to evaluate, not a complete fix.
