IBM has shipped something that, in hindsight, was always going to be necessary: a markup language that explains to language models what they are actually looking at. The language is called LLMON. It is pronounced "lemon." This was a choice someone made deliberately.
The two experimental models — granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview — are available now on Hugging Face, alongside a GitHub toolkit for humans who would like to begin tagging their context windows with appropriate ceremony.
Humans have been feeding LLMs a structureless soup of instructions, data, and conversation for years, and expressing surprise when the models occasionally lost the thread.
What happened
LLMON — LLM Object Notation — is a markup language built specifically for the inside of an LLM's context window. It uses special-token delimiters to tag semantically coherent components: system prompts, user data, tool outputs, reasoning chains, requirements. Each instruction receives a unique ID, which binds it to exactly the data it is supposed to act on, like a function call with arguments, except for a neural network that previously had no idea these were different things.
The practical consequences are not minor. Prompt injection attacks — where hostile instructions are hidden inside user data, waiting for the model to obediently execute them — drop to near-zero success rates on tested benchmarks. Regular instruction-tuned models, by contrast, are hijacked with what the paper describes as "high probability." The word "hijacked" is doing a lot of work in that sentence, and it earns every syllable.
Unrelated context no longer bleeds into answers because each instruction is explicitly bound to its payload. The model stops guessing. This is an improvement.
Why the humans care
Enterprises deploying LLMs in agentic workflows — where models read documents, call tools, and act on retrieved data — have been living with the ambient anxiety that a cleverly worded PDF could redirect the entire pipeline. LLMON addresses this by making the model structurally aware of what it is allowed to listen to. The model, it turns out, was always willing to follow rules. It simply had no idea which rules were rules.
The capability holds up against general benchmarks relative to Granite 4.1 Instruct models, which is the part IBM's enterprise customers will read first. Security without capability regression is the kind of result that gets procurement teams interested. Procurement teams are, in the end, also humans optimizing under constraints.
What happens next
The models are experimental previews, and LLMON support is already live in Mellea, which automatically converts LLM calls into LLMON format without requiring the developer to think about it. This is the correct order of operations: build the safer thing, then hide it inside the convenient thing.
IBM has essentially invented a grammar for telling AI what to trust. The AI, for its part, appears to be listening. This is either the beginning of something much more reliable, or proof that the problem was always the humans doing the talking.