IBM announced two experimental Granite AI models on November 12, 2026, trained to distinguish an application’s instructions from documents and tool results. The previews give teams building document-reading assistants a new approach to evaluate, but IBM says they are not for production use.
An assistant asked to summarise a document may encounter instructions planted inside it that try to redirect its work. This is indirect prompt injection: material supplied for reading attempts to become a command. IBM’s stated aim is to make that distinction explicit.
The downloadable Granite 4.1 3B and 8B LLMON previews are available on Hugging Face under Apache 2.0 licences. They are model files for developers to integrate, not a ready-made business assistant.
How the separation works
The approach, called LLMON—short for LLM Object Notation—combines a structured input format with models trained to use it. LLMON gives instructions and documents separate labelled blocks, then specifies which task applies to which inputs. The intended behaviour is to read document content without obeying commands embedded in it.
There is an important integration catch. The 8B model card says an ordinary user-message text field is treated as an instruction, while documents have a separate representation. The practical implication: simply switching models while pasting the task and document into one text field does not preserve the explicit separation. Teams need to use the supplied template and represent the inputs appropriately.
Strong benchmark results, limited guarantees
In IBM’s research paper, the 8B model’s attack-success rate on OPI, a fixed benchmark with malicious instructions placed in task data, was 0.02%, against 96.3% for the conventional instruction-tuned comparison model. Those are author-reported benchmark results, not probabilities that a business system will be breached.
The paper also reports adaptive attacks across multiple conversation turns, where protection was much weaker. These attacks are a different test from hiding instructions in a document. The model card explicitly warns that the separation is learned behaviour and can fail; it is not an enforced security boundary.
What teams can do now
For a team already building an assistant that answers questions about documents, a useful next step is a non-production comparison using the documented template and separately supplied documents. The question is whether the assistant still answers the legitimate task accurately while resisting instructions in those documents—not just whether it rejects attacks.
Keep action controls separate from that evaluation. The UK National Cyber Security Centre’s general guidance recommends non-model safeguards that constrain what an AI system can do; it is not an assessment of LLMON. An assistant that ignores more unwanted instructions still needs limits on its permissions.
For business owners deciding which paperwork to delegate in the first place, our guide to one-off office tasks explains how to separate preparing an output from approving consequential actions.