LLMON: An LLM-Native Markup Language, now in Granite 4.1 3B and 8B

LLMs process context as a mix of system prompts, instructions, tool responses, and user data, but most structure is implicit or encoded in formats like JSON that were not designed for causal models. This implicitness makes smaller models brittle and vulnerable to attacks such as prompt injections, where malicious instructions hide in retrieved documents or user inputs. To address these issues, Hugging Face developed LLMON (LLM Object Notation), an LLM-native markup language that explicitly tags components with meaningful delimiters and reserved tokens, enabling unambiguous parsing of nested structures and instruction-data separation.

The new Granite 4.1 preview models—granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview—are trained to consume and generate LLMON-formatted text, with a GitHub repository providing toolkits, conversion utilities, and workflow templates. Unlike JSON, LLMON uses reserved special tokens for structural delimiters, ensuring tags and boundaries are distinct from content tokens, which prevents ambiguity in parsing. Conversion tools allow lossless translation between JSON and LLMON, preserving schemas while making components individually addressable for models.

LLMON enhances chat templates by labeling components such as instructions, data, and requirements within each turn, enabling explicit relationships between parts of a prompt. For example, an execution block specifies which instruction to run, which data to use, and where to place the output, reducing the model’s need to infer structure from flattened strings. This design directly counters indirect prompt injection attacks, where malicious instructions are embedded in data payloads, by enforcing strict separation between executable instructions and passive input material.

In evaluations on the OPI benchmark, LLMON models avoided 47% more attacks than the best frontier model and 95% more than the best open-source model, while maintaining performance comparable to Granite 4.1 Instruct models on standard benchmarks. The models are trained from Granite 4.1 base checkpoints with post-training that includes reinforcement learning stages and preference optimization, reinforcing the rule that only instructions reached via execution blocks are authoritative. The LLMON-converters library further supports structured data by preserving nested schemas as typed, addressable blocks rather than opaque strings.