← Back to Library

LLMON: An LLM-native Markup Language to Leverage Structure and Semantics at the LLM Interface

Authors: Michael Hind, Basel Shbita, Bo Wu, Farhan Ahmed, Chad DeLuca, Nathan Fulton, David Cox, Dan Gutfreund

Published: 2026-03-23

arXiv ID: 2603.22519v1

Added to Library: 2026-03-25 02:01 UTC

📄 Abstract

Textual Large Language Models (LLMs) provide a simple and familiar interface: a string of text is used for both input and output. However, the information conveyed to an LLM often has a richer structure and semantics, which is not conveyed in a string. For example, most prompts contain both instructions ("Summarize this paper into a paragraph") and data (the paper to summarize), but these are usually not distinguished when passed to the model. This can lead to model confusion and security risks, such as prompt injection attacks. This work addresses this shortcoming by introducing an LLM-native mark-up language, LLMON (LLM Object Notation, pronounced "Lemon"), that enables the structure and semantic metadata of the text to be communicated in a natural way to an LLM. This information can then be used during model training, model prompting, and inference implementation, leading to improvements in model accuracy, safety, and security. This is analogous to how programming language types can be used for many purposes, such as static checking, code generation, dynamic checking, and IDE highlighting. We discuss the general design requirements of an LLM-native markup language, introduce the LLMON markup language and show how it meets these design requirements, describe how the information contained in a LLMON artifact can benefit model training and inference implementation, and provide some preliminary empirical evidence of its value for both of these use cases. We also discuss broader issues and research opportunities that are enabled with an LLM-native approach.

🔍 Key Points

  • Introduction of TreeTeaming, an automated red-teaming framework that transitions from static to dynamic strategy exploration of Vision-Language Models (VLMs).
  • Evidence of TreeTeaming's superior performance, achieving state-of-the-art attack success rates (ASR) on 11 out of 12 evaluated VLMs, with a maximum ASR of 87.60% on GPT-4o.
  • The framework promotes strategic diversity, producing a set of attacks that exhibit a 23.09% reduction in toxicity compared to existing methods.
  • TreeTeaming discovers novel attack strategies beyond previously known techniques, leveraging a hierarchical strategy tree to systematically explore the attack landscape.
  • The experimental results demonstrate the effectiveness of TreeTeaming to uncover vulnerabilities in VLMs, which is critical for improving AI safety and robustness.

💡 Why This Paper Matters

The paper introduces a significant step forward in automated red teaming for VLMs, providing a framework that enhances the exploration and exploitation of potential vulnerabilities. Its ability to achieve high attack success rates while maintaining diversity in strategies makes it a pivotal contribution to the field of AI safety research. This work lays important groundwork for future explorations into securing advanced VLMs against more sophisticated adversarial attacks.

🎯 Why It's Interesting for AI Security Researchers

This paper is of great interest to AI security researchers as it addresses the growing safety concerns associated with emerging Vision-Language Models. The introduction of TreeTeaming not only aids in identifying safety gaps in these models but also provides insights into dynamic exploration strategies that can be employed to enhance model robustness and resilience against adversarial threats. As AI systems continue to integrate into various applications, understanding and mitigating the risks associated with their vulnerabilities becomes paramount.

📚 Read the Full Paper

📄 View on arXiv 📎 Download PDF