IBM's granite-4.1-3b-LLMON-preview tags prompt parts to block injections

The release addresses a structural weakness IBM identifies in how LLMs receive context: system prompts, conversation turns, retrieved documents, tool responses, and output constraints all arrive flattened into one stream, leaving the model to infer which part is the task and which is merely material. JSON, IBM argues, was built for parsers rather than causal models, since a quotation mark inside a document and one closing a field are the same token. LLMON instead marks each span with reserved special-token delimiters, states nesting locally, and uses unique block IDs so an instruction can point to data anywhere in the context — the way a function call names its arguments. The two preview models start from Granite 4.1 base checkpoints rather than the released instruct models, so the behavior is learned during post-training. IBM re-serialized an instruction-tuning corpus into LLMON and augmented it with decoy instructions and data blocks deliberately left unbound, so the model learns to follow only the dependencies named in the execution block. A final DPO stage on a thousand on-policy preference pairs built from the model's own responses to injection attempts follows five GRPO stages. IBM notes the resulting privilege rule — instructions reached through an execution block are authoritative, while anything reached as input is material to read — is a learned behavior, not an enforced guarantee. LLMON also enriches rather than replaces chat templates, and tag vocabularies can be customized and tuned with a LoRA, as IBM demonstrates on the ScienceWorld benchmark.