IBM releases Granite LLMON previews for structured prompts
IBM has released two experimental Granite LLMON models that give instructions and source material separate, explicitly addressed parts of a prompt. The November 12 announcement introduces 3B and 8B previews derived from Granite 4.1 base checkpoints, alongside a toolkit. This is a release for evaluation, not production deployment.
The reader question is practical: can an application make the difference between “follow this instruction” and “read this document” clearer to a model? LLMON changes the interface and the model training together. It is not a security wrapper that can be added to any existing model.
Downloadable previews, not a hosted API launch
The 3B checkpoint and 8B checkpoint are available on Hugging Face under Apache 2.0. Both model cards date the release to November 12. The 3B page currently lists no Inference Provider deployment. Download access should not be confused with a ready-made hosted endpoint or free compute.
IBM lists twelve supported languages, including English, German, Spanish, French, Japanese, Portuguese, Arabic, Czech, Italian, Korean, Dutch and Chinese. The intended tasks include retrieval-augmented generation, extraction, question answering and tool use. These are text instruction models, not the audio-and-adapter arrangement in Granite Switch.
The prompt template is part of the model
The 3B card documents named instruction, data and requirement fields, with an execution block binding the relevant parts together. A plain user content string is treated as an instruction. That distinction matters when an application receives pasted material: treating an entire document as the instruction loses the separation the format is designed to provide.
The 8B card specifies a bundled chat template used through apply_chat_template. Six reserved delimiters identify boundaries and structure, while block identifiers let the model reference particular components. Tool results are represented as input material rather than authoritative instructions. Conventional chat formatting is out of distribution for these previews and can reduce quality.
The Apache 2.0 toolkit repository says the bundled template is sufficient for ordinary use without installing the toolkit. Its Python renderer is useful for building prompts or training data with reproducible block identifiers. The repository also includes examples for domain-specific vocabularies and an attention visualization. Those are development aids, not evidence that a deployment is secure.
Promising research, with a narrow security claim
IBM reports improved resistance on static indirect prompt-injection benchmarks, including OPI, ASB and StruQ, while describing general performance as comparable to Granite 4.1 Instruct. The announcement says work on adaptive attacks across multiple turns is continuing. Static benchmark gains do not establish protection against an attacker who changes tactics after observing responses.
The model cards explicitly describe the instruction/data rule as learned behavior, not an enforced guarantee. They warn against making it the only defense for an agent connected to sensitive systems. We have not run these models or reproduced IBM’s measurements.
What to evaluate first
For a useful pilot, compare ordinary tasks with the same tasks containing misleading document text. Check both whether the model follows the authorized request and whether it still extracts the right information. Keep tool permissions separate from model output, and retain human review for consequential actions. A well-formatted prompt does not itself authorize an action.
AI-generated editorial illustration of structured prompt components. IBM and Granite are trademarks of IBM. No endorsement implied.
