Two Granite 4.1 preview models use tags against prompt injection
The authors tell that attacks in the data almost always stop in some tests. The model keeps its general skill.
The Granite 4.1 team released 2 experimental preview models. They read and write LLMON, a markup language. Its tags show the model what each part of a prompt does. The authors tell that the success of attacks drops to zero in some benchmarks. They also released a code repo with tools. The 2 models are early tests, not final products.
How it works
LLMON puts a tag on each part of the context: instruction, data or requirement. Special tokens, not usual characters, mark the tags. A control block tells which instruction is used on which data.
Tools turn JSON into LLMON and back with no loss.
The numbers
The text gives no figure. The authors tell that regular instruction-tuned models get hijacked with a high risk. They tell that the new models keep the general skill of the Granite 4.1 Instruct models.
What is not known
The 2 models are previews. The text that we have stops before the full results. It names one test, the OPI benchmark, which puts the attack in the data of language tasks. Other attacks are not shown.
Insight: A new format that only new models can read
The defence works with models made for LLMON. JSON converters cut the cost of the move. This reads as a bid to make one format the standard, and teams that use it can be tied to these models. Look for other model makers that read LLMON.
Sources
Posted
