Large Language Models (LLMs) treat every context token uniformly, which blurs the boundary between executable instructions and passive data. This uniformity creates prompt‑injection vulnerabilities, ambiguous instruction binding, and unreliable execution control. We introduce a post‑training methodology called LLMON (LLM Object Notation) that separates instructions from data via explicit identifiers and requires identifier‑based execution. A structured training corpus of 4.6 B tokens was assembled, covering general, Retrieval‑Augmented Generation (RAG), and tool‑calling scenarios. The corpus is enriched with distractor‑infused variants where competing instructions and irrelevant data appear in the context but are never referenced. Two Granite‑4.1 base models (3 B and 8 B) were first fine‑tuned with supervised learning and then refined with reinforcement learning. Results show that LLMON‑structured supervision reduces indirect prompt‑injection attack success rates from 53‑100% down to 0.02‑5.6% while preserving general capabilities. We also propose attention‑based interpretability metrics that diagnose failure modes at individual transformer layers for structured inputs, revealing a reshaping of internal attention patterns. In summary, explicit execution semantics can be taught through standard post‑training without architectural changes.
Review: LLMON proves that instruction‑data separation and improved safety can be achieved via post‑training alone, offering a practical path toward more secure and interpretable LLMs.