LLMON post-training reduces the success rate of indirect prompt injection attacks

1. 08:56
   arXiv: Jailbreaks, Prompt Injection, Poisoning & DefensesSelected

   Post-training large language models with LLMON

   The IBM Research team proposes the LLMON (LLM Object Notation) post-training method, which uses six reserved delimiters to explicitly distinguish instructions from data, with execution required to be completed through execution blocks referenced by identifiers; the team built a 4.6B token structured corpus covering general, RAG, and tool-calling data and adding variants with distractor instructions and irrelevant data segments, and performed SFT, GRPO, and DPO training on the 3B and 8B base models of Granite-4.1. On the two indirect prompt injection benchmarks OPI and ASB, the attack success rate dropped from 53-100% to 0.02-5.6%; the average of six general capabilities stayed level for 3B and dropped 1.4 points for 8B. The paper also proposes layer-wise attention metrics IFR, DAS, and LEAK, showing that execution binding forms in the middle-to-later layers; ARES red teaming shows robustness to indirect attacks rises to 80-85%, while direct and multi-turn attacks are only 32-37%; the authors say this behavior is learned rather than forcibly guaranteed, and should serve as one layer in a multi-layer defense.

Current attention 40·Peak in the comparable period 40 (Nov 6 03:00)·Change over the comparable past 24 hours 0%