The Pulse
IBM Trains Granite Models to Resist Prompt Injection
IBM Research authors report that LLMON post-training cut success on two indirect prompt-injection benchmarks to as low as 0.02%. A red-team evaluation found weaker protection against indirect attacks, while direct and multi-turn attacks rem
AI.info Team · Written with AI · fact-checked ·
Near-zero results meet a tougher red-team test
Training models to distinguish instructions from data drove prompt-injection success rates as low as 0.02% on two published benchmarks, according to a new paper from IBM Research authors. But a separate red-team exercise in the same study found that indirect attacks still succeeded often enough to temper the headline result, while direct and multi-turn attacks proved harder still.
The October 28 paper evaluates LLMON, short for LLM Object Notation, on two Granite-4.1 models. Its results suggest that structured training can sharply reduce attacks hidden in documents or tool outputs, but do not show that the approach eliminates prompt injection across settings.
“Our results demonstrate that explicit execution semantics can be taught through standard post-training without architectural modification.”
Basel Shbita et al., “Post-Training Large Language Models with LLMON”
LLMON binds each task to named inputs
LLMON separates instructions from passive material using typed blocks with unique identifiers. An execution block points to the particular instruction and data the model should use; text inside a document or tool response stays data unless the execution block refers to it as an instruction.
The researchers trained Granite-4.1-3B and Granite-4.1-8B base models on a structured corpus of 4.6 billion tokens, including general instruction, retrieval-augmented generation and tool-calling examples. The corpus also included examples with planted adversarial instructions and distractors: the intended response followed the actual task, not commands embedded in the data.
Training combined supervised fine-tuning with reinforcement learning and a final preference-optimization stage. The fine-tuning ran for three epochs across 4.4 million examples, with the paper describing the final models as post-trained versions of the Granite-4.1 base checkpoints.
Text attacks fall further than tool-observation attacks
On the OPI benchmark, which tests attacks embedded in task data, attack success fell from 100% to 0.1% for the 3B model and from 96.3% to 0.02% for the 8B model. On the ASB benchmark, where malicious instructions arrive in an agent’s tool observations, success dropped from 99.2% to 5.6% for the 3B model and from 52.8% to 3.1% for the 8B model.
The gap matters: “near zero” describes the text-injection results more closely than the tool-observation results. The paper also reports a separate ARES red-team evaluation, measuring robustness rather than attack success. For indirect attacks, robustness rose from 2.8% to 84.6% on the 3B model and from 0.7% to 79.8% on the 8B model—meaning the red-team results still leave a substantial share of attacks succeeding.
Direct and multi-turn attacks remain a weakness
The researchers report much smaller gains when attacks arrive as direct user instructions or unfold over multiple turns. In the ARES evaluation, robustness against direct attacks reached 37.1% for the 3B model and 32.7% for the 8B model after LLMON training; for multi-turn attacks, it reached 28.0% and 37.0%, respectively.
That difference follows the method’s boundary: it is designed to keep untrusted input from taking control, not to block a user from issuing a harmful request or gradually steering a conversation toward one. The authors describe the approach as a defense against indirect injection, not a standalone answer to every form of adversarial prompting.
Capability scores hold, with costs and open questions
The paper reports that the 3B model’s average across six capability categories stayed at 66.7, matching its instruction-tuned baseline. The 8B model’s average fell from 74.2 to 72.8; its mathematics score declined from 84.1 to 79.6. Safety scores improved for both sizes, while the authors say capability was broadly preserved.
The evaluation covers two model sizes from one model family, and the authors say transfer to other architectures and training corpora remains untested. LLMON’s delimiters add about 7% to 15% to context length, depending on example complexity; the study does not quantify the resulting inference-latency or throughput impact. Its strongest benchmark result is therefore a measured reduction on specified tests—not proof that structured training makes prompt injection disappear.