Hallucinations

What Are Hallucinations in Code?

How LLMs Generate Code: The Autoregressive Process

Temperature

Controls how peaked the distribution is. Low (0.0–0.3) = deterministic, less hallucinatory but repetitive. High (0.8–1.2) = creative but more prone to hallucination.

Top-k Sampling

Only samples from the k most probable tokens, eliminating very low probability tokens that would be hallucinations.

Top-p (Nucleus)

Samples from a probabilistic nucleus containing the smallest set of tokens whose cumulative probability exceeds threshold p.

CodeHalu Taxonomy: Four Categories

Deep Dive: API and Parameter Hallucinations

# API Hallucination Example 1: Non-existent method
import pandas as pd
df1 = pd.read_csv("data1.csv")
df2 = pd.read_csv("data2.csv")

# HALLUCINATED: pandas has no .smart_merge() method
result = pd.smart_merge(df1, df2,
    on="id",
    strategy="fuzzy",        # not a real param
    threshold=0.85)          # not a real param

# CORRECT approach:
# result = pd.merge(df1, df2, on="id")
# For fuzzy: use thefuzz or recordlinkage library

Spot the Hallucination: Interactive Examples

# Challenge 1: Spot the hallucination
# Snippet A:
import random
data = [random.randint(1, 100) for _ in range(20)]
sorted_data = data.sortDescending()  # HALLUCINATED
print(sorted_data)

# Snippet B:
import random
data = [random.randint(1, 100) for _ in range(20)]
sorted_data = sorted(data, reverse=True)  # CORRECT
print(sorted_data)

// Challenge 2: String vs Array API confusion
// Hallucinated:
const text = "Hello, World!";
const reversed = text.reverse();  // WRONG: strings don't have .reverse()

// Correct:
const reversed = text.split('').reverse().join('');

# Challenge 3: Logic hallucination (all APIs are real)
def is_palindrome(s):
    s = s.lower().strip()
    return s == s[:-1]  # WRONG: should be s[::-1]

# This code:
# - Is syntactically valid (no errors)
# - Uses real Python APIs (slice notation)
# - But implements incorrect logic

Why LLMs Hallucinate Code

Training Data Gaps

APIs that are infrequent in training data are more likely to be hallucinated. Less popular libraries have far fewer training examples, leading to fabricated method names.

API Version Confusion

Training data contains code using multiple versions of the same library. The model may blend APIs across incompatible versions.

Distribution Shift

When a prompt asks for code combining libraries in novel ways, the model falls back on statistical patterns rather than genuine understanding.

Autoregressive Accumulation

Each generated token conditions on all previous tokens. A small early error cascades through the rest of the function.

Pattern Mimicry over Semantics

LLMs are pattern-matching systems. They synthesize plausible-sounding method names that follow conventions but do not actually exist.

Detecting Hallucinations: Multiple Strategies

RAG for Hallucination Reduction

Mitigation: De-Hallucinator's Iterative Approach

Prompt Engineering as Mitigation

Be Explicit About Constraints

Tell the model exactly what it can and cannot use: "Only use Python standard library functions. Do not import any third-party packages."

Provide API Documentation in Context

Paste the relevant API docs directly into the prompt. The model is far less likely to hallucinate APIs when it has the real docs in its context window.

Ask for Citations and Reasoning

Prompt: "Cite which library each method comes from" or "Explain why you chose this approach before writing code."

Add Negative Examples

"Do NOT use deprecated methods. Do NOT use eval(). Do NOT concatenate strings into SQL queries."

Request Self-Verification

"After generating the code, verify that all API methods you used actually exist in the specified library version."

Tool-Augmented Generation: Real-Time Verification

Real-World Hallucinations: Production Case Studies

Copilot Suggests Non-Existent npm Package

GitHub Copilot suggested require('express-validator-sanitizer') — a package that does not exist. A researcher later registered the hallucinated name and found that other developers had already attempted to install it, demonstrating real-world slopsquatting risk.

ChatGPT Generates Deprecated TensorFlow Code

ChatGPT frequently generated TensorFlow 1.x session-based code for users on TensorFlow 2.x. The pattern tf.Session().run() was removed in TF 2.0, but the model generates it confidently.

Hallucinated Django ORM Methods

LLM-generated Django code frequently hallucinates QuerySet methods: .filter_active(), .get_or_none(). These follow Django's naming conventions perfectly but do not exist.

Incorrect Cryptographic Patterns

Security audits found LLM-generated code frequently uses hashlib.md5(password) for password hashing — an insecure practice. The correct approach is bcrypt or argon2.

Building Hallucination-Resistant Workflows

Step 1: Use RAG for Grounding

Provide relevant documentation and code context in your prompts.

Step 2: Set Low Temperature

Use T=0.0–0.2 for code you plan to ship.

Step 3: Add Explicit Constraints

Specify which libraries, versions, and patterns to use. Include negative constraints.

Step 4: Run Linting and Type Checking

Automatically catch naming and resource hallucinations with static analysis.

Step 5: Generate and Run Tests

Ask the LLM to generate tests for its own code, then execute them. Failing tests indicate hallucinations.

Step 6: Human Review for Critical Logic

Logic hallucinations cannot be caught by automated tools alone.

Step 7: Monitor in Production

Log LLM outputs, track error rates, set up alerts for unexpected failures.

Measuring and Evaluating Hallucinations

MiHN (Micro Hallucination Number)

Total count of individual hallucinated elements across all generated samples. Lower is better.

MaHR (Macro Hallucination Rate)

Fraction of generated code samples that contain at least one hallucination. Ranges from 0 to 1.0.

Edit Distance

How many edits are needed to fix hallucinated code to match correct code.

API Recall

Fraction of required API calls that are correctly included in generated code.

Test Pass Rate

Percentage of generated code that passes the specification's test suite. The ultimate metric.

Summary and Key Takeaways

Hallucinations are Unavoidable but Manageable

LLMs will always hallucinate at some rate. The goal is not to eliminate them entirely but to detect and mitigate them systematically.

Taxonomies Enable Precision

CodeHalu provides a framework for precise classification. Different hallucination types require different detection strategies.

Multiple Defense Layers Work Better Than One

Linting catches naming errors. Type checkers catch parameters. Tests catch logic errors. RAG prevents information gaps.

RAG and Iterative Refinement Are Powerful

Providing documentation and repeatedly refining generated code dramatically reduces hallucinations. De-Hallucinator and MARIN show 50–70% reduction.

Production Code Requires Human Oversight

For critical code (security, infrastructure, algorithms), human code review remains essential.