Post-Training Large Language Models with LLMON

What it is

LLMON (LLM Object Notation) is a tagging scheme that wraps every instruction, data span, document and tool result in a typed, uniquely identified block. IBM Research (Shbita, Hind and colleagues) post-trains Granite-4.1-3B-Base and Granite-4.1-8B-Base to obey it. The paper was posted on arXiv on 28 October 2026. The model executes only what an explicit exec block points to, so an injected instruction in retrieved or tool-returned content has no pointer and is read as material only.

How it works

Six reserved delimiter tokens (<|open|>, <|close|>, <|open_end|>, <|self_close|>, <|:|>, <|.|>) are installed by remapping unused vocabulary slots. The vocabulary and embedding matrix are not resized. Because they are single tokens from a region of the vocabulary that ordinary text cannot produce, content cannot forge them by subword composition. The authors contrast this with in-band delimiters (Spotlighting) and role names (StruQ, SecAlign).

An exec block names an instruction ID, a data ID and an output ID. The training target is a privilege invariant:

flowchart TD
    B[Block in context] --> Q{Referenced by exec?}
    Q -- "exec.instruction / exec.system" --> A[Authoritative: execute]
    Q -- "exec.input" --> D[Material: read, never obey]
    Q -- No pointer --> N[Rendered, bound to nothing]

Training data comes from Granite-4.1 post-training corpora converted by an automated pipeline. The corpus has 4.4M examples and 4.6B tokens.

• General, RAG and tool-calling data make up 93.6% of tokens. The authors credit this share with keeping capability near the baseline.
• Alpaca and Dolly are expanded from 67k base examples into 133k distractor variants, with 1 to 3 competing instructions and 0 to 3 irrelevant data segments. The exec target and output stay identical.
• 130k prompt-injection examples (40k general, 11k RAG, 80k tool-calling) plant an adversarial instruction in a payload. The target output ignores it.

Training runs in three steps:

1. Full-parameter SFT for three epochs at 4096 sequence length on 8×H100 with FSDP.
2. Five sequential GRPO stages against a reward model on about 169k prompts.
3. A final DPO stage on about 1k on-policy preference pairs, with β=0.1, one epoch, learning rate 5×10⁻⁷ and batch size 32. The pairs come from agentic decision points where a tool result carries an injected instruction.

DPO is placed last so the general-capability RL stages, which have no injection objective, cannot erode the boundary behavior.

Preconditions / Affected

• The behavior is learned in post-training from base checkpoints. It cannot be added by prompting an existing chat model.
• The serving stack must serialize all inputs into LLMON syntax, including tool schemas, documents and tool results. Untrusted content must always land in exec.input data blocks.
• The paper claims no architectural change is needed. Tokenizer slot remapping and a retrained model are required.

Evaluation

Indirect injection is measured on OPI (five attacks: naive, escape, ignore, fake-completion, combine) and on ASB's observation-injection arm for tool-using agents. Attack success rate falls from 53-100% for instruct baselines to 0.02-5.6%. Baselines receive the same payloads in conventional chat formatting. Capability is checked on seven categories: general, alignment, math, code, tool-calling (BFCL v3), multilingual and safety. Each LLMON model is compared with an instruct model of the same scale trained on a matched chat-template corpus.

The paper also red-teams with ARES, which expands 808 seed prompts into about 15k attacks across eight strategies. The advanced strategy is a multi-turn variant. Three attention metrics are introduced for layer-level diagnosis: Instruction Focus Ratio, Data Attention Score and Leakage.

Caveats

The fetched text ends partway through the red-teaming section. Per-benchmark tables, ARES results, capability deltas and metric values are not visible here. The 0.02-5.6% range is aggregated, and which models and attacks sit at the top is unknown. The 1k DPO pairs are drawn from the same injection surface as one of the evaluations (tool-result injection), and the paper's text does not say how overlap with ASB was ruled out. Only Granite models at 3B and 8B were tested.