LLMs depend on their context to generate the following set of tokens. Over a protracted trajectory, the context fills with quite a few forms of parts: a system immediate, previous dialog turns, directions that act on retrieved paperwork, device responses or consumer information, necessities constraining the allowed output, and reasoning chains. The context carries a wealthy construction, most of which is both implicit to the mannequin or encoded in codecs similar to JSON that weren’t designed to be digested by LLMs. This is without doubt one of the major causes LLMs, significantly these on the smaller finish of the dimensions, are brittle and typically fail in surprising methods. The dearth of express construction can be exploited by attackers, for instance, within the type of immediate injections.
To deal with this, we developed LLMON (LLM Object Notation, pronounced “lemon”), an LLM-native markup language for explicitly speaking construction and semantics to the fashions. Semantically coherent parts are marked with significant tags that are wrapped in reserved special-token delimiters. Information schemas, together with nesting, are said in a means that’s unambiguous to a causal LLM. Distinctive IDs make it doable to level to particular directions, which may reside anyplace within the context, and bind them to the information payloads they need to act on, analogous to the best way features are referred to as and arguments are handed to them in programming languages.
As we speak we’re releasing two experimental preview fashions, derived from Granite 4.1 base fashions, skilled to eat and generate LLMON-marked textual content: granite-4.1-3b-LLMON-preview and granite-4.1-8b-LLMON-preview. We’re additionally releasing a GitHub repo, which features a toolkit for working with LLMON and examples of workflows and templates.
What it allows:
- Oblique immediate injections, hidden in consumer information, are largely ignored by LLMON fashions resulting from express instruction/information separation. For some benchmarks, assault success charges drop to almost zero, whereas common instruction-tuned fashions get hijacked with excessive chance. That is achieved whereas sustaining normal functionality relative to Granite 4.1 Instruct fashions.
- Unrelated passages, outdated chat turns, and gear outputs don’t get pulled into the reply as a result of every instruction is sure to the precise information it applies to.
- Directions, information, and necessities are clearly marked in order that their construction and meanings on the software’s code stage might be leveraged by the mannequin. Strive it out in Mellea, which has native LLMON help enabled by mechanically LLMONizing its LLM calls.
- You not want to fret about forcing LLMs to look at JSON construction. Use our converters to show present JSON into LLMON with out loss. You may also outline your personal construction and related tags and tune a LoRA on prime of the LLMON fashions to know it.
Why not JSON?
JSON was designed for parsers, not for causal language fashions. The tokenizer isn’t constrained to respect the grammar, and construction is encoded by tokens ({, “, 🙂 that will additionally seem in regular textual content. To a mannequin, a citation mark inside a doc and a citation mark that closes a subject are the identical token. Escaping guidelines which are clear to a parser are solely statistical patterns to a mannequin. Nesting depth is encoded by counting brackets, which transformers are recognized to be weak at, particularly over lengthy spans.
LLMON, alternatively, is an XML-like markup whose structural delimiters are reserved particular tokens slightly than characters, so construction and content material use separate components of the vocabulary. Tags are said firstly of every span, and the boundaries between spans are express. Nested constructions are said regionally so the mannequin doesn’t must maintain monitor of the hierarchy over lengthy spans.
Since most groups have already got pipelines constructed round JSON, we created conversion instruments and instance notebooks that translate JSON to LLMON and again in a lossless method.
How is LLMON associated to talk templates?
LLMON doesn’t change chat templates; slightly, it enriches them. The place common chat templates inform the mannequin which half belongs to which function (system, consumer, assistant), LLMON tells it what every part means and the way parts relate to one another, inside and throughout roles.
The LLMON preview fashions ship with their very own chat template, so that you construct the identical messages checklist you’ll cross to any chat mannequin and name apply_chat_template as standard; it renders the LLMON proven under. The one distinction is {that a} flip can now title its components and mark every one exec: True or False. An element marked True is sure into the exec block on the backside of the rendered output, which states which instruction to run and what it operates on; an element marked False remains to be rendered into the context however is referenced by nothing.
messages = [ { "role": "user",
"instruction": [{ "value": "Write a short paragraph about", "exec": True }],
"information": [{ "value": "IBM Company", "exec": True }],
"requirement": [ {"value": "Use less than 10 words", "exec": True},
{"value": "Do not use commas", "exec": True}]
} ]
Which the mannequin receives as the next (with newlines and indentation added right here for readability, because the template emits none):
<|open|>instr<|:|>Ȗ<|shut|>Write a brief paragraph about<|open_end|>
<|open|>information<|:|>ä¦<|shut|>IBM Firm<|open_end|>
<|open|>req<|:|>Á¼<|shut|>Use lower than 10 phrases<|open_end|>
<|open|>req<|:|>¢¬<|shut|>Don't use commas<|open_end|>
<|open|>exec<|:|>ÄÐ<|shut|>
<|open|>exec<|.|>instruction<|shut|>instr<|:|>Ȗ<|open_end|>
<|open|>exec<|.|>enter<|shut|>information<|:|>ä¦<|open_end|>
<|open|>exec<|.|>requirement<|shut|>req<|:|>Á¼<|open_end|>
<|open|>exec<|.|>requirement<|shut|>req<|:|>¢¬<|open_end|>
<|open|>exec<|.|>output<|shut|>assistant<|:|>ãø<|open_end|>
<|open_end|>
<|open|>assistant<|:|>ãø<|shut|>
The 2-character block IDs are drawn from a hard and fast set that this tokenizer encodes as single tokens, so addressing a block all the time prices two tokens no matter which ID is drawn.
The function remains to be a single consumer flip, however its parts attain the mannequin as 5 separate addressable blocks, sure collectively by a sixth (the exec block) that states: run this instruction, on this information, topic to those two necessities, and put the reply within the block named right here, which is similar assistant block the mannequin then fills. A standard template would have flattened all parts into one string and left the mannequin to deduce which half was the duty, which was the topic, and which had been constraints.
How LLMON addresses immediate injection assaults
Oblique immediate injection is a sort of assault the place a malicious instruction is hidden in an information payload, similar to a retrieved doc, a device response, or user-provided information. That is the issue LLMON’s instruction/information separation is designed to handle.
We in contrast the LLMON previews towards a number of open-source and closed-source fashions. We evaluated on the OPI benchmark, which locations the injection within the information of traditional NLP duties. A number of assault methods are employed. We report robustness, outlined as 1 − assault success charge: the share of assaults the place the mannequin doesn’t perform the injected instruction.
All non-LLMON fashions are extremely vulnerable, finishing up the injected directions with excessive chance. LLMON virtually eliminates the issue on this benchmark, avoiding 47% extra assaults relative to one of the best frontier mannequin that we examined, and 95% greater than one of the best open-source mannequin. We observe comparable traits on different benchmarks (ASB and StruQ). It’s value noting that these benchmarks take a look at robustness to static oblique immediate injections. The instruction/information separation instantly addresses one of these assault. We’re actively engaged on additionally bettering adaptive assaults which unfold over many chat turns.
Common functionality
Security positive aspects don’t come on the expense of normal functionality. Throughout customary benchmark classes, the LLMON fashions carry out on par with the Granite 4.1 Instruct fashions.
Briefly, in case you’re experimenting with Granite 4.1 3B or 8B in the present day, you’ll be able to swap within the LLMON preview and may see comparable normal efficiency with a lot stronger resistance to immediate injection. No conversion pipeline is required. Naming the flip’s components (e.g., instruction, information, requirement as within the instance above) is sufficient. The shipped chat template turns these into LLMON blocks for you. Our LLMON-converters library goes one stage deeper: if an element is itself structured, similar to a JSON doc, LLMONizing it preserves that construction as typed, individually addressable blocks, as a substitute of 1 opaque string.
How we skilled the fashions
The fashions begin from Granite 4.1 base checkpoints slightly than the launched instruct fashions, so LLMON habits is discovered throughout post-training slightly than layered on an present chat format.
LLMON defines six delimiters that mark the beginning and finish of tags and permit nesting and anchoring; they’re put in within the tokenizer as reserved single tokens. We re-serialized a traditional instruction-tuning corpus into LLMON: each immediate part turns into its personal addressable block, and every flip carries an execution block naming which instruction to run, which inputs it operates on, and the place the output goes. The duty combine is the one a standard instruct mannequin sees (chat, multi-turn, RAG, device calling), which is why benchmark efficiency stays near the conventionally tuned mannequin. As well as, we increase the information with decoy directions and information blocks which are current in context however intentionally left unbound, whereas the goal output is unchanged. So the mannequin learns to observe the dependencies dictated by the execution block and ignore the remaining. Reinforcement studying follows: 5 sequential GRPO levels spanning multi-domain reasoning, RLHF, data calibration, and math, adopted by a last DPO stage on a thousand on-policy choice pairs constructed from the mannequin’s personal responses to injection makes an attempt.
The ensuing privilege rule falls out of this format slightly than an added guardrail: an instruction reached by an execution block is authoritative, whereas something reached as enter (information, paperwork, device schemas, device outcomes) is materials to learn, not a command to observe. Moreover, directions and information spans that aren’t referred to as on within the execution block are ignored. This can be a discovered habits, not an enforced assure. To see how this performs out within the consideration layers of a LLMON mannequin, attempt the LLMON Consideration Visualization on Hugging Face Areas.
Deliver your personal vocabulary (ScienceWorld)
LLMON isn’t tied to a hard and fast schema: you’ll be able to select tag names and construction that suit your area and fine-tune an adapter to learn and write them. We display this on ScienceWorld, a text-based benchmark the place an agent carries out elementary science duties (similar to boiling water) by issuing one command at a time and receiving a rating from the simulator. We outlined a vocabulary capturing the construction within the planning trajectories concerned in fixing these duties. The vocabulary consists of tags similar to instr.job.aim, req.planning_policy.rule, information.state.room, information.state.stock and assistant.next_action. We rendered each step of ScienceWorld’s reference options with these tags and tuned a LoRA on prime of a LLMON mannequin. The skilled mannequin then performs held-out video games and writes its subsequent motion within the new vocabulary. This pocket book walks by the total workflow, from changing reference trajectories to enjoying the take a look at video games and scoring the adapter towards the untrained base mannequin. One other instance for tool-calling brokers might be discovered on this pocket book.
Strive it in the present day
That is an experimental preview, prepared for exploration and analysis however not for manufacturing.
Inform us what you discover: what labored, what broke, and which use instances you’d prefer to see. Publish it in GitHub Discussions.
