What changed
IBM released Apache-2.0 Granite 4.1 3B and 8B experimental preview models trained to consume LLM Object Notation, plus converters, examples and a toolkit. LLMON uses reserved-token blocks and execution references to separate instructions, data, requirements, tools and outputs instead of flattening them into one prompt string.
Why it matters
The artifacts make instruction and data binding a model-visible, reproducible interface rather than an application convention. That creates a concrete prompt-injection experiment for smaller open models, but a learned privilege rule is not an enforcement boundary.
What to do
Pin the 3B and 8B checkpoints and converters, render the same RAG and tool examples through ordinary and LLMON templates, then run static and adaptive injections plus task-quality, latency and token-cost tests. Keep external tool authorization and data isolation outside the model regardless of the result.
Caveat
The models are experimental previews, not production releases. IBM's near-zero attack rates and capability comparisons are author-run results on selected benchmarks; the model cards warn that learned instruction/data separation does not eliminate injection and that conventional chat prompts are out of distribution.