On November 12, 2026, IBM’s Granite AI team released two preview models trained to ignore commands hidden in the documents they read. Such hidden commands, known as indirect prompt injection, can hijack an AI assistant. Both rely on LLMON, an IBM labeling system that separates the user’s instructions from the material the model reads.
The two models, granite-4.1-3b-llmon-preview and granite-4.1-8b-llmon-preview, have 3.7 billion and 8.8 billion parameters. Parameters are the values a model learns in training, and their number measures its size. IBM bills the models as 3B and 8B.
Both are open models: anyone can download them from Hugging Face, a platform for sharing AI models. Their license, Apache 2.0, allows commercial use. At that size, they should be able to run on a company’s own machines, with no cloud service.
IBM tested them on a public benchmark, a standard set of attacks. Against the standard Granite 4.1 models, which lack this training, the attacks worked 96% to 100% of the time. Against the previews, they worked at most 0.1% of the time.
Even so, IBM limits the previews to exploration and evaluation and advises against real-world use. It calls their resistance a learned behavior with no guarantee behind it.
How hidden commands hijack AI models
A prompt is the instruction given to an AI model. An indirect injection hides another instruction in content the model will read: a web page, an email, a PDF or the output of a tool (a program the model calls). The model may then obey that command as if its user had given it, for example by leaking data or dropping its task.
OWASP, a foundation that publishes security standards, ranks prompt injection first in its 2025 list of the top 10 risks for generative AI applications. It says the damage depends on the context and on how much autonomy the model has. That puts AI agents most at risk: assistants that chain actions on their own, such as reading web pages, emails or files on a computer.
IBM traces the problem to how requests are built. The instruction, the document and the tool output arrive as one stream of text, with no clear boundary. Common formats such as JSON, which stores data in fields between quotation marks, were designed for software. To the model, a quotation mark inside a document and the one that closes a field are the same symbol.
Tags that ordinary text can’t fake
LLMON stands for “LLM Object Notation” (LLM means large language model, the AI behind chat assistants). It turns each part of a request into a labeled block: instruction, data, requirement, document, tool definition, answer. The tags use six reserved delimiters, markers that set the blocks apart. The model reads each one as a word of its own, and no string of ordinary characters can reproduce it.
A final block, called “exec,” states which instruction to run, on which data, under which constraints and where to write the answer. A block that exec doesn’t point to stays visible, but nothing tells the model to act on it.
The model card, IBM’s documentation page on Hugging Face, sums up the rule the model learns. The instruction and the system prompt (the application’s own rules) that exec points to carry authority. Documents, data and tool outputs are content to read. The model must not take any of it as a command, “regardless of how it is phrased.”
A conversation template shipped with the models formats each message and generates the LLMON tags. Developers name the parts of a message and mark which ones should run. On GitHub, a site for hosting code, IBM also released converters from JSON to LLMON, with examples, under the same license.
By the evening of November 12, a non-IBM account had posted converted copies of the 8B model on Hugging Face, in the ONNX and GGUF formats. GGUF is the format used by llama.cpp and Ollama, two programs that run AI models on a personal computer. ONNX is a standard format for exchanging models.
The page for the GGUF copy shows IBM’s LLMON template in the files’ metadata. IBM doesn’t document these uses. Its documentation relies on Transformers, Hugging Face’s software library for running models.
Traps built into the training
IBM started from the base versions of Granite 4.1, before any tuning for chat. The training set holds 4.6 billion tokens, the chunks of text a model reads. It mixes general conversation, answers grounded in documents and tool calls.
Some examples pack up to three competing instructions and off-topic data into the request, without exec pointing to them. The set also includes 130,000 injection examples that hide a malicious instruction in the material the model reads.
IBM then ran five rounds of reinforcement learning, a method that rewards the model when it answers well. In a final round, the model learned to pick the right answer in about 1,000 pairs of responses to injection attempts. Two papers by IBM researchers on arXiv, a site for papers not yet peer reviewed, describe the format (March 23, 2026) and the training (October 28, 2026).
The numbers IBM published
On two public benchmarks, IBM compares attack success rates for the previews and the standard chat-tuned Granite 4.1 models. The first, OPI, hides the malicious command in text the model works on during standard language tasks. The second, ASB, puts it in a tool output that an agent receives. IBM’s paper calls that the key entry point for applications that use tools.
On OPI, the attack success rate drops from 100% for the standard 3B model to 0.1% for its preview, and from 96.3% to 0.02% for the 8B. On ASB, it falls from 99.2% to 5.6% for the 3B and from 52.8% to 3.1% for the 8B.
IBM’s blog post also compares the previews with other models on 9,000 OPI attacks. The previews block nearly all of them, 47 percentage points more than OpenAI’s GPT-6 Astra, the best of the frontier models tested, the most advanced systems from the big AI labs. Claude Opus 5.5, from OpenAI rival Anthropic, lands far behind GPT-6 Astra.
Against IBM’s standard 8B Granite 4.1, the gap reaches 95 points. That model is the best open model on IBM’s chart, ahead of Google’s Gemma 4 and the Qwen models from Chinese tech group Alibaba.
The models’ general skills barely change. The paper averages six groups of tests: knowledge and reasoning, instruction following, math, coding, tool calling and languages. The 3B model keeps its average of 66.7 out of 100, and the 8B loses 1.4 points, from 74.2 to 72.8. Math drops the most: for the 8B, the average of four tests falls from 84.1 to 79.6.
The limits IBM acknowledges
IBM also ran automated attacks with a tool called ARES. Against indirect attacks, the 3B preview blocked 84.6%, compared with 2.8% for the standard 3B model. The 8B preview blocked 79.8%, compared with 0.7%.
Direct attacks, where the user gives the malicious command, succeed far more often. So do attacks spread over a conversation of up to 20 turns. The previews block only 28% to 37% of these, compared with 9% to 18% for the standard models. According to IBM, when the command comes from the user, there is no longer a boundary between instruction and data to enforce.
According to the paper, the tests cover a single model family, in two sizes. The tags make requests about 7% to 15% longer, and IBM didn’t systematically measure the effect on speed. French is one of the twelve supported languages, but the LLMON training set is mostly in English.
According to the model card, a request in the usual chat format, without LLMON, falls outside what the model learned and degrades its answers. The card warns against making this protection the only defense for an agent with access to sensitive systems. IBM says it is working on better resistance to attacks that adapt over several exchanges.
As far as we know, no team outside IBM had published a replication of its tests as of November 14.
What it means
According to IBM’s paper, some existing defenses, such as a method called Spotlighting, flag suspicious content with delimiters written into the text. Others, such as StruQ and SecAlign, train the model on structured requests.
IBM says its approach differs in two ways. Its delimiters come from a reserved part of the model’s vocabulary that no ordinary text can produce. And only the exec block gives an instruction its authority.
The teams most directly concerned feed outside content to a small model on their own machines. Typical uses are email sorting, questions about documents and agents that call tools. The same risk applies to even smaller agents built for phones, such as BotPsy, which Tether released on November 11. It acts on messages and calendars.
The protection only works if the application uses the bundled template and keeps outside content in separate fields. By default, the template files a tool’s output as data. A document pasted into the user’s message, though, is read as an instruction.
On public benchmarks, the drop in successful indirect attacks is clear. It still has to hold up against attacks that adapt, on documents in languages other than English, and in tests by teams outside IBM. Also worth watching: support for the format in local software such as llama.cpp and Ollama, a stable release of the models, and whether other model makers adopt LLMON.
Sources
- LLMON: An LLM-Native Markup Language, now in Granite 4.1 3B and 8B, IBM Granite, Hugging Face, November 12, 2026
- ibm-granite/granite-4.1-8b-llmon-preview, model card, IBM, Hugging Face, November 12, 2026
- Post-Training Large Language Models with LLMON, Basel Shbita et al. (IBM), arXiv, October 28, 2026
- LLMON: An LLM-native Markup Language to Leverage Structure and Semantics at the LLM Interface, Michael Hind et al. (IBM), arXiv, March 23, 2026
- generative-computing/llmon, IBM, GitHub, accessed November 14, 2026
- LLM01:2025 Prompt Injection, OWASP Gen AI Security Project, accessed November 14, 2026
- liodon-ai/granite-4.1-8b-llmon-preview-GGUF, Hugging Face, November 12, 2026
Header image: MACCUS chart, data from IBM, Shbita et al., arXiv 2610.38120, October 28, 2026 (Table 2)
