IBM Releases Granite Models Designed to Resist Prompt Injection

IBM’s Granite team released two experimental language models on November 12, 2026, trained to separate trusted instructions from untrusted data. IBM reports that the 3B and 8B previews avoided 47% more attacks than the best frontier model it tested on the OPI benchmark.

The two models, Granite-4.1-3B-LLMON-preview and Granite-4.1-8B-LLMON-preview, were fine-tuned from Granite 4.1 base checkpoints rather than the released instruct models. Both carry an Apache 2.0 license and are intended for exploration and evaluation, not production. The work builds on the LLMON language paper, first submitted on March 23, 2026.

Instructions Become Explicit References

LLMON, short for LLM Object Notation and pronounced “lemon,” is an XML-like markup language for describing prompt structure to a model. Instructions, documents, tool definitions, requirements and responses occupy individually addressable blocks. An execution block identifies which instruction to run, which inputs and requirements apply, and where the answer should go; content left unbound remains in context without being called by that block.

The security target is indirect prompt injection, in which a malicious instruction is hidden inside a retrieved document, tool response or user-supplied data. The models are trained to treat instructions reached through an execution block as authoritative, while material reached as input is read rather than obeyed. Structural delimiters are reserved special tokens, and each two-character block ID is drawn from a fixed single-token set, so an address always costs two tokens.

Developers normally do not write that markup themselves. They can name parts of an ordinary messages list and call apply_chat_template; the bundled template renders LLMON while preserving familiar system, user and assistant roles. The accompanying LLMON repository supplies lossless JSON conversion, chat-rendering utilities and examples, while a linked attention demonstration visualizes how attention is distributed across instruction, input and unbound blocks.

Training Targets Indirect Attacks

A post-training paper, submitted on October 28, 2026, describes a 4.6-billion-token structured corpus spanning general, retrieval-augmented generation and tool-calling data. Distractor examples add competing instructions and irrelevant data that remain unreferenced, while the target response stays unchanged. The approach uses supervised fine-tuning and reinforcement learning without modifying the model architecture.

The training recipe then uses five sequential reinforcement-learning stages covering multi-domain reasoning, human-feedback alignment, knowledge calibration and math, followed by direct preference optimization on 1,000 preference pairs generated from the model’s own responses to injection attempts. The resulting privilege rule comes from this learned layout rather than an added guardrail.

OPI places the injection in the data of classic NLP tasks. IBM measures robustness as one minus attack success rate: the share of attacks in which the model does not carry out the injected instruction.

The post-training paper separately reports attack success rates across indirect-injection evaluations falling from 53%–100% to 0.02%–5.6%, while preserving general capabilities. The announced benchmark comparisons concern static indirect injections, not adaptive attacks that develop over multiple chat turns, which remain an active area of work.

General Capability Results

The 8B model card frames parity with Granite 4.1 Instruct as the objective for general tasks, and its results are mixed: GPQA is 35.05 for the preview versus 41.96 for the instruct model, DeepMind Math is 70.86 versus 80.07, BigCodeBench is 44.04 versus 35.00, and MMLU is 74.20 versus 73.84. That pattern positions the release as a test of structured prompting and injection resistance, rather than a uniform capability upgrade.

LLMON can also be adapted to domain-specific vocabularies. IBM demonstrates custom tags and adapter fine-tuning on ScienceWorld reference trajectories, with the trained model playing held-out games and writing its next action in the new vocabulary. Mellea, a higher-level library, automatically converts its model calls to LLMON, so application users need not see the underlying markup.

The release gives developers a concrete way to measure how explicit execution binding behaves in retrieval and tool-using workflows. For sensitive deployments, the open question is whether the learned privilege rule holds beyond the reported tests; the model cards caution that it is not an enforced guarantee and should not be an agent’s sole defense.