Post-Training Large Language Models with LLMON

What it claims

IBM Research (October 2026) post-trains Granite-4.1-3B-Base and Granite-4.1-8B-Base so that an instruction runs only when an explicit exec block points to it by identifier. Indirect prompt-injection attack success rate falls from 53-100% to 0.02-5.6% across the OPI and ASB benchmarks. The comparison is against an instruct model at the same scale trained on the same corpus in conventional chat-template format. The authors state that no architectural change is needed.

How it works

LLMON adds six delimiter tokens: <|open|>, <|close|>, <|open_end|>, <|self_close|>, <|:|> and <|.|>. They are installed by remapping unused vocabulary slots, so the vocabulary and embedding matrix do not grow. Content goes into typed blocks with IDs: instr<|:|>ID, data<|:|>ID, req<|:|>ID, doc<|.|>title and system<|:|>ID. Tool schemas are flattened so every JSON leaf has its own path, such as tool<|.|>parameters<|.|>arg<|.|>type. Tool results come back as ordinary data blocks.

An exec block names the instruction, the input data and the output slot. The training target is a "privilege invariant": authority comes from which pointer references a block, not from the block's position or role name. Because the delimiters are reserved single tokens, ordinary text cannot form them through subword composition. The authors give this as the difference from Spotlighting, StruQ and SecAlign.

flowchart TD
  B[Block in context] --> Q{Referenced by exec?}
  Q -->|exec.instruction / exec.system| A[Authoritative: execute]
  Q -->|exec.input| R[Read only: data, docs, tools, tool results]
  Q -->|no pointer| N[Bound to nothing]

Distractor augmentation adds d ∈ {1,2,3} competing instructions and m ∈ {0,1,2,3} irrelevant data segments, while exec still points only at the target. The target output stays the same across variants. This produces 8 variant categories, and a model that relies on position or imperative phrasing is penalized.

The training pipeline has three stages:

1. Full-parameter SFT: 3 epochs over 4.4M examples (4.6B tokens) at sequence length 4096, run on 8×H100 with FSDP.
2. Five sequential GRPO stages against a reward model, using about 169k prompts. These cover multi-domain reasoning, RLHF, knowledge calibration and two math boosters.
3. DPO on about 1k on-policy injection preference pairs taken from agentic tool-result decision points. Settings are β=0.1, one epoch, learning rate 5×10⁻⁷ and effective batch size 32. This stage comes last so that the capability stages cannot erode the boundary behavior.

Evidence

The SFT corpus is drawn mainly from the Granite-4.1 post-training corpora:

Three more sources fill out the corpus:

• Alpaca and Dolly: 67k base examples expanded into 133k distractor variants.
• Prompt injection: 130k examples (211M tokens) in general, RAG and tool-calling settings.

General, RAG and tool data make up 93.6% of tokens. The authors credit this share with keeping capability close to the baseline.

Capability is checked in seven categories. Examples are MMLU, MMLU-Pro, GPQA and BBH (general), IFEval (alignment), GSM8K and Minerva Math (math), HumanEval+, MBPP+ and MultiPL-E (code), BFCL v3 (tool calling), Global-MMLU and MGSM (multilingual), and AttaQ and SALAD-Bench (safety).

The injection evaluation has three parts:

• OPI: five attack types (naive, escape, ignore, fake-completion and combine).
• ASB: the observation-injection arm, which covers injection through an agent's tool observations.
• ARES red-teaming: run by IBM's security team, expanding 808 seed prompts into about 15k attacks across eight strategies.

The paper also defines attention metrics for per-layer diagnosis: Instruction Focus Ratio (IFR), Data Attention Score (DAS) and Leakage (LEAK).

How to use it

Adopting LLMON means serializing every prompt into LLMON blocks with exec bindings, including RAG documents and tool schemas. The model must also be post-trained from a base checkpoint. The page does not state a weight release, a licence, code or a tokenizer artifact.

Limits

The fetched text stops partway through the red-teaming section. Per-benchmark ASR, per-category capability scores, the ARES results and the attention-metric findings are not shown. The only results visible are the abstract's ASR ranges and its claim that capabilities are "preserved". The protection depends on the application placing untrusted content in exec.input. Results cover only the 3B and 8B Granite-4.1 models.