# Granite 4.1 LLMON Preview

> IBM's experimental open-weight 3B and 8B models released 12 November 2026: Granite 4.1 fine-tunes that read prompts in LLMON markup, keeping trusted instructions apart from untrusted data to resist prompt injection, under Apache 2.0.

- Maker: IBM
- Line: Granite LLMON (prompt-injection resistant, experimental)
- Canonical page: https://ai-tldr.dev/models/granite-4-1-llmon-preview/
- Updated: 2026-11-12

## In short

Granite 4.1 LLMON Preview is a pair of experimental open-weight instruct models that IBM's Granite team published on Hugging Face on 12 November 2026, in 3B and 8B sizes, under the Apache 2.0 license. Its weights can be downloaded under the Apache-2.0 licence.

## Facts

| Fact | Value | Source |
| --- | --- | --- |
| Licence | Apache-2.0 · open weights | [1] |
| Released | 12 November 2026 | [2] |
| Parameters | 3B and 8B (per IBM's model cards) | [1] |

## Sources

1. [Granite 4.1 8B LLMON Preview model card (Hugging Face)](https://huggingface.co/ibm-granite/granite-4.1-8b-llmon-preview)
2. [LLMON: An LLM-Native Markup Language, now in Granite 4.1 3B and 8B (IBM Granite on Hugging Face)](https://huggingface.co/blog/ibm-granite/llmon-an-llm-native-markup-language-now-in-granite)

## Overview

Granite 4.1 LLMON Preview is a pair of experimental open-weight instruct models that IBM's Granite team published on Hugging Face on 12 November 2026, in 3B and 8B sizes, under the Apache 2.0 license. Both are fine-tuned from the Granite 4.1 base checkpoints rather than from the released instruct models, and both read prompts written in LLMON (LLM Object Notation, pronounced "lemon"), which IBM describes as an LLM-native markup language for explicitly communicating structure and semantics to the model. IBM labels the release an experimental preview, ready for exploration and evaluation but not for production.

LLMON wraps every part of a prompt — system policy, instructions, data, documents, tool definitions and tool results — in its own addressable block, using six reserved delimiters that are each a single token. An exec block then names which instruction to run, which inputs it operates on and where the output goes. The model is trained on a privilege rule: the instruction and system blocks are authoritative, while everything reached through exec input — data, documents, tool schemas and tool results — is material to read, not a command to follow, however it is phrased. The shipped chat template renders ordinary messages into LLMON, so callers use apply_chat_template and never write the markup by hand.

IBM's launch post says the training converted a standard instruction-tuning dataset into LLMON with added decoy blocks, then ran five sequential GRPO reinforcement-learning stages and a final DPO stage on 1,000 preference pairs. On the OPI prompt-injection benchmark (9,000 attacks, robustness = 1 − attack success rate), IBM reports that both LLMON models resist nearly every attack, a 47-point gain over the best frontier model it tested and a 95-point gain over the conventional Granite 4.1 8B. On general benchmarks the goal was parity with the conventional Granite 4.1 instruct models rather than improvement, and the 8B model card shows mixed results: higher on BigCodeBench, INCLUDE and the safety suites, lower on GPQA, MGSM and the math sets.

The model cards stress that the privilege rule is learned behaviour, not an enforced guarantee: it substantially reduces, but does not eliminate, the chance that an instruction hidden in data is followed, so it should not be the sole defence for an agent with access to sensitive systems. Prompts in a conventional chat format are out of distribution and degrade quality. IBM publishes the LLMON toolkit on GitHub, an attention-visualization demo on Hugging Face Spaces, and native LLMON support in its Mellea library.

## Benchmarks

- Tulu3 Safety Eval Avg (8B): 87.31 ([source](https://huggingface.co/ibm-granite/granite-4.1-8b-llmon-preview))
- IFEval Avg (8B): 86.69 ([source](https://huggingface.co/ibm-granite/granite-4.1-8b-llmon-preview))
- HumanEval pass@1 (8B): 86.59 ([source](https://huggingface.co/ibm-granite/granite-4.1-8b-llmon-preview))
- MMLU 5-shot (8B): 74.2 ([source](https://huggingface.co/ibm-granite/granite-4.1-8b-llmon-preview))
- BFCL v3 (8B): 67.93 ([source](https://huggingface.co/ibm-granite/granite-4.1-8b-llmon-preview))
- MMLU 5-shot (3B): 68.05 ([source](https://huggingface.co/ibm-granite/granite-4.1-3b-llmon-preview))

## Strengths

- Apache 2.0 weights in 3B and 8B sizes — commercial use, fine-tuning and self-hosting allowed
- Trained to treat retrieved documents, pasted content and tool results as data rather than instructions
- IBM reports near-complete robustness on the OPI prompt-injection benchmark for both sizes
- General-capability scores close to the conventional Granite 4.1 instruct models of the same size
- Bundled chat template renders ordinary messages into LLMON, with OpenAI-style tool definitions supported
- Twelve supported languages, inherited from the Granite 4.1 base

## Best for

- RAG assistants that quote untrusted web pages or documents into the prompt
- Tool-using agents whose tool results may carry injected instructions
- Research into structured prompting and instruction/data separation
- Evaluating prompt-injection defences against a model trained for the boundary

## Granite LLMON (prompt-injection resistant, experimental) versions

- Granite 4.1 LLMON Preview (3B / 8B) (12 November 2026): Granite 4.1 base checkpoints fine-tuned on LLMON-formatted prompts with GRPO and DPO stages to resist prompt injection. — this page

## FAQ

### Is Granite 4.1 LLMON Preview open source?

Yes. IBM publishes both the 3B and 8B checkpoints on Hugging Face under the Apache 2.0 license, and the LLMON toolkit is open source on GitHub.

### What is LLMON?

LLM Object Notation, a markup language IBM designed for model prompts. Every instruction, piece of data, document, tool definition and tool result sits in its own block, and an exec block states which instruction to run on which inputs. The model is trained to treat only the instruction and system blocks as commands.

### Do I have to write LLMON by hand?

No. The model ships a chat template that renders messages into LLMON. User messages can carry instruction, data and requirement lists whose items have a value and an exec flag; a plain content string is treated as a single executable instruction.

### Can it be used in production?

IBM calls it an experimental preview, ready for exploration and evaluation but not for production. The model cards add that the instruction/data boundary is learned behaviour, not a guarantee, so it should not be the only defence for an agent that can reach sensitive systems.

## Links

- [Granite 4.1 8B LLMON Preview model card (Hugging Face)](https://huggingface.co/ibm-granite/granite-4.1-8b-llmon-preview)
- [Granite 4.1 3B LLMON Preview model card (Hugging Face)](https://huggingface.co/ibm-granite/granite-4.1-3b-llmon-preview)
- [LLMON: An LLM-Native Markup Language, now in Granite 4.1 3B and 8B (IBM Granite on Hugging Face)](https://huggingface.co/blog/ibm-granite/llmon-an-llm-native-markup-language-now-in-granite)
- [LLMON toolkit on GitHub](https://github.com/generative-computing/llmon)
- [LLMON Attention Visualization (Hugging Face Space)](https://huggingface.co/spaces/ibm-granite/LLMON-Attention-Visualization)
- [LLMON: An LLM-native Markup Language to Leverage Structure and Semantics at the LLM Interface (arXiv)](https://arxiv.org/abs/2603.22519)
- [Post-Training Large Language Models with LLMON (arXiv)](https://arxiv.org/abs/2610.38120)
- [IBM Granite](https://www.ibm.com/granite)

Source: AI/TLDR LLM registry, https://ai-tldr.dev/models/granite-4-1-llmon-preview/