IBM Granite released two experimental models on November 12: Granite 4.1 3B LLMON preview and Granite 4.1 8B LLMON preview. They use LLM Object Notation, or LLMON, to represent instructions, data and their relationships more explicitly. The release is intended for exploration and evaluation rather than production use.

The boundary the format tries to clarify

An agent request can contain a user's task, document excerpts, previous answers and tool results. Those components have different purposes in the application. For the language model, however, their boundaries must be learned and respected during generation.

LLMON introduces addressable blocks and special delimiters in the tokenizer vocabulary. An execution block connects a particular instruction to the inputs and requirements it should act on. The intention is that material supplied for reading does not acquire the status of a command merely because it uses persuasive language.

A simple original SIExpo example is an assistant extracting a deadline from an email. The sender might add a sentence asking the assistant to delete other messages. The desired behavior is to process the deadline while preserving the user's task. This is an explanatory scenario, not an experiment conducted by the editorial team.

The available components

Official model cards identify variants with three and eight billion parameters under Apache 2.0. The 3B card describes a supplied template that converts messages into LLMON. Developers normally use apply_chat_template rather than manually assembling all special markers.

The public generative-computing/llmon repository contains tools and examples for working with the format. Its connection to Mellea allows a higher programming layer to handle the structure. This distinguishes an available format from a finished application: end users do not have to write LLMON themselves, but an integration must still pass the correct components.

The model card's supported-language list does not include Bulgarian. That does not prove that Bulgarian use is impossible, but it provides no basis for promising verified quality in that language.

Reading the security results

IBM reports substantially improved robustness in tests involving static indirect prompt injections. The authors distinguish these setups from adaptive attacks across multiple conversational turns, which remain an area of continuing work.

The same publication explicitly says the instruction-data boundary is learned behavior rather than an enforced guarantee. LLMON's presence therefore does not establish that an agent can safely receive unlimited access to files or external services.

Practical significance for developers

Editorial analysis: a more explicit interface allows teams to examine both the answer and how the application described the task. If an external document is incorrectly labeled as a trusted instruction, the format will not automatically repair that integration error.

A useful evaluation consequently includes ordinary documents, conflicting data, missing fields and attempts by content to redirect the task. Teams should also measure the cost of more structured context: token use, template compatibility and long-conversation behavior. SIExpo has not measured these properties.

JSON and LLMON address related but different questions. Valid JSON can be read by a program without proving that a model correctly understood the authority of every field. IBM's proposal supplies a concrete experimental way to communicate that semantic boundary more clearly. Success in a particular application must be established using that application's data, tools and constraints.

Sources: IBM Granite: Experimental LLMON previews, IBM Granite 4.1 3B LLMON model card, IBM Granite 4.1 8B LLMON model card, LLMON toolkit and specification.

The cover is a conceptual AI illustration, not a documentary photograph.

Editorial verification: 2026-11-13T17:42:40.897636+00:00.