Boundaries learned during training
IBM Granite released 3B and 8B Granite 4.1 LLMON previews on November 12, alongside a toolkit. Reserved tokens mark structural boundaries; block IDs bind instructions to their inputs and requirements. The behavior depends on model training as well as formatting: adding similar tags to an ordinary model does not establish equivalent protection.
The examples retain message lists and chat templates but name instructions, data and requirements separately. An execution block selects what participates in the task. Malicious commands inside retrieved documents should remain input material, addressing the confusion behind prompt injection.
Evaluation, rather than production
IBM reports improvements on static indirect-injection benchmarks including OPI. Multi-turn adaptive attacks remain under investigation. The team explicitly describes the boundary as learned behavior rather than an enforced security guarantee, and labels the previews unsuitable for production.
For retrieval and tool workflows, a useful local evaluation would place documents and tool responses in separate data blocks and test whether hostile commands cross those boundaries. Authorization and output checks still belong outside the model.
via: IBM Granite: LLMON announcement、LLMON toolkit、3B model card