On November 12, 2026 the authors published an announcement introducing LLMON (LLM Object Notation), an LLM-native markup language, and two preview models trained to consume and generate LLMON-marked text: granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview.
How LLMON works
LLMON uses XML-like tags encoded as reserved special-token delimiters so structural markers occupy separate tokens from content. Semantically coherent components—instructions, data, requirements, and outputs—are wrapped in named tags and given unique two-character block IDs. An explicit execution block binds an instruction to the exact data it should act on and to the block where the model should write its output. The authors contrast this with JSON, arguing JSON’s punctuation and escaping are not designed for causal LLM tokenizers and that nesting depth is difficult for transformers to track over long contexts.
Conversion tools are provided to translate existing JSON into LLMON losslessly. Teams can define custom tag vocabularies and fine-tune adapters (for example, LoRA adapters) so the model reads and writes domain-specific structures such as those used in ScienceWorld.
Evaluation, training and availability
The authors report that LLMON markedly reduces the success of static indirect prompt injection attacks on benchmarks. On the OPI benchmark, LLMON models avoided 47% more attacks than the best non-LLMON frontier model tested and 95% more than the best open-source model, with similar trends on ASB and StruQ. These robustness gains are reported alongside general capability that the authors say is on par with Granite 4.1 Instruct models.
Training began from Granite 4.1 base checkpoints and re-serialized an instruction-tuning corpus into LLMON blocks. The post-training pipeline included five sequential GRPO stages, RLHF, knowledge calibration and math, followed by a final DPO stage on about a thousand on-policy preference pairs generated from injection attempts. The authors describe the resulting behavior as learned rather than enforced: instructions referenced by an execution block are treated as authoritative while unbound data blocks are learned to be informational.
The release is described as an experimental preview for exploration and evaluation. The models are granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview; a toolkit, visualization demo and a GitHub repository are provided for testing and conversion, and Mellea is cited as an example of native LLMON support.
Original source: Hugging Face Blog