# IBM releases LLMON markup language and Granite 4.1 3B/8B preview models on Hugging Face

> **Key takeaway:** IBM's LLMON uses reserved special-token delimiters to explicitly separate structure from content in LLM contexts, reducing prompt injection success rates to near zero in benchmarks while maintaining general capability.

**Published:** 2026-11-12T19:07:35+00:00 
**Source:** Hugging Face Blog & Announcements 
**Category:** ai-open-models 
**Canonical URL:** https://fosswire.org/news/ibm-releases-llmon-markup-language-and-granite-41-3b8b-previ.html 

## Summary
IBM has released LLMON (LLM Object Notation), an XML-like markup language designed specifically for causal language models rather than traditional parsers. Two experimental preview models based on Granite 4.1—granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview—are now available on Hugging Face, trained to consume and generate LLMON-structured text. The format addresses a fundamental brittleness in smaller LLMs by replacing implicit context structure with explicit semantic tagging using reserved special-token delimiters, where structure and content occupy separate vocabulary spaces.

The release includes a GitHub repository with a toolkit, conversion utilities for lossless JSON-to-LLMON translation, example notebooks, and workflow templates. LLMON enriches rather than replaces chat templates: while templates identify roles (system, user, assistant), LLMON specifies component meaning, relationships, and execution binding through unique two-character block IDs encoded as single tokens. Components marked executable are bound into an exec block that explicitly links instructions to their data payloads, preventing unrelated context from contaminating outputs.

## How LLMON structures LLM context and mitigates attacks
- **Special-token delimiters:** LLMON wraps semantic components in reserved special tokens (e.g., `<|open|>`, `<|close|>`, `<|open_end|>`) rather than character-based syntax, ensuring structure and content use disjoint vocabulary subsets—unlike JSON where `{`, `"`, `:` tokens appear in both structural and natural-language contexts.
- **Local nesting and explicit boundaries:** Tags appear at span beginnings with explicit boundaries, eliminating the need for transformers to track hierarchy through bracket counting over long contexts—a known weakness in attention mechanisms.
- **Instruction-data binding via block IDs:** Unique two-character IDs (encoded as single tokens) allow precise referencing; executable components assemble into an `exec` block that binds instructions to specific data and requirement blocks, preventing scope leakage from unrelated passages or old chat turns.
- **Prompt injection resistance:** Explicit separation of instructions from user-controlled data causes indirect prompt injections hidden in data payloads to be ignored by the model; benchmark attack success rates drop to nearly zero versus high hijack probability in standard instruction-tuned models.
- **Chat template integration:** The preview models ship with LLMON-aware chat templates; developers use standard `apply_chat_template` calls with messages containing `instruction`, `data`, and `requirement` fields marked `exec: True` or `False`, with automatic rendering to LLMON markup.

## Why it matters
For open-source AI tooling, LLMON offers a principled alternative to ad-hoc JSON structuring that reduces failure modes in smaller deployable models—a significant consideration for local and edge inference where 3B-8B parameter models are practical. The Apache-2.0 licensed Granite base, Hugging Face availability, and provided LoRA tuning pathway for custom tag vocabularies give independent developers concrete mechanisms to adopt and extend the approach without vendor lock-in, though production stability awaits movement beyond experimental preview status.