AI
Structured training sharply reduced indirect prompt-injection success in two models
Researchers describe LLMON, a post-training approach that separates executable instructions from passive data and requires explicit identifier-based execution. After training two Granite models on 4.6 billion structured tokens with supervised learning and reinforcement learning, they report reducing indirect prompt-injection attack success from 53–100% to 0.02–5.6% while preserving general capabilities. The method changes training rather than model architecture, but the evidence comes from the authors' benchmarks and needs independent replication.
Editorial summary · Publisher article
What matters
- LLMON teaches models to distinguish instructions from data in structured contexts.
- The training corpus covered general, retrieval-augmented and tool-calling examples with distractor instructions.
- The authors used attention-based metrics to inspect layer-level failure modes.
- The results concern two Granite models and do not establish universal protection against prompt injection.
Context & caveats
- The reported security gains are from the paper's own experiments; benchmark design and external replication remain important.
Why this made the edition
The paper presents a specific post-training method, a large structured corpus, benchmark results and a clear security limitation. The evidence is limited to the authors' abstract, so the dramatic attack-success reductions are not independently verified here.
Source material