LLMON post-training cuts indirect prompt-injection attack success to 0.02%-5.6%, paper says

[arXiv] A preprint by Basel Shbita and co-authors presents a post-training methodology built on LLMON (LLM Object Notation), a framework that separates executable instructions from passive data and requires explicit identifier-based execution. The authors constructed a 4.6B-token structured training corpus spanning general, RAG and tool-calling data, augmented with distractor-infused variants containing competing instructions and irrelevant segments. After post-training two Granite-4.1 base models (3B and 8B) via supervised fine-tuning followed by reinforcement learning, the authors said LLMON-structured supervision reduced attack success rates on indirect prompt-injection benchmarks from 53-100% to 0.02%-5.6% while preserving general capabilities. They also introduce attention-based interpretability metrics that diagnose failure modes at individual transformer layers for structured inputs. The authors said explicit execution semantics can be taught through standard post-training without architectural modification. The work is a preprint and has not been peer-reviewed.