ai-research-survey

scan.json (26152B)

---

 {
   "paper": {
     "title": "Library Hallucinations in LLMs: Risk Analysis Grounded in Developer Queries",
     "authors": ["Lukas Twist", "Jie M. Zhang", "Mark Harman", "Helen Yannakoudakis"],
     "year": 2025,
     "venue": "arXiv preprint",
     "arxiv_id": "2509.22202"
   },
   "scan_version": 2,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "LLMs are highly susceptible to library hallucinations triggered by time-related prompts (up to 84% of tasks for 'from 2025') and user typos (one-character misspellings cause hallucinations in up to 26% of tasks, fake library names accepted in up to 99%). Prompt engineering mitigation is inconsistent and LLM-dependent: self-analysis and explicit-check prompts help in some cases, while chain-of-thought and step-back prompts often worsen hallucinations. The study reveals a novel connection between LLM sycophancy and typosquatting/slopsquatting supply chain risks.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "GitHub repository provided: https://github.com/itsluketwist/realistic-library-hallucinations (Section 1, Section 7, Reproducibility Statement)."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper states the full dataset, prompts, labels, and outputs are released in the GitHub repository. LibraryHalluBench benchmark with 4,628 prompts is also released (Section 7)."
       },
       "environment_specified": {
         "applies": true,
         "answer": true,
         "justification": "Reproducibility Statement: 'The repository specifies exact dependency versions, enabling a consistent reproduction of our experiments.'"
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": true,
         "justification": "Reproducibility Statement: 'a detailed README.md file describing its contents, structure, installation steps, and usage procedure.' LibraryHalluBench also includes 'full usage instructions and an evaluation script' (Section 7)."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Tables report only point estimates (RHR, THR percentages) with no confidence intervals or error bars."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes many comparative claims (e.g., 'GPT-5-mini had a 32% increase from 2024 to 2025') but no statistical significance tests are reported."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Percentage differences with baselines are consistently reported (e.g., '34% more responses when the year changed from 2023 to 2024', Table 3 shows ↑/↓ changes). Baseline context is always provided."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The dataset of 356 tasks (from BigCodeBench filtering) is described but not justified via power analysis or sample size rationale. The 10% preliminary/90% main split is mentioned but no justification for adequacy."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Three responses are generated per task 'to mitigate sampling variability' (Section 3.2), but no variance, standard deviation, or spread measures across these responses are reported. Only aggregated RHR and THR are shown."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Each experiment includes a 'no description' or 'valid library' baseline condition (Tables 1 and 2), against which prompt variations are compared."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Seven contemporary LLMs are tested including GPT-5-mini (Aug 2025), DeepSeek-V3.1 (Aug 2025), and Claude-4.5-Haiku (Oct 2025). All are recent production models."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "The three experiments systematically vary prompt components (adjective descriptions, year-based descriptions, error types, mitigation strategies), effectively ablating the impact of each variation."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Two metrics are used throughout: RHR (Response Hallucination Rate) and THR (Task Hallucination Rate), reported for both library name and library member hallucinations."
       },
       "human_evaluation": {
         "applies": true,
         "answer": true,
         "justification": "Manual validation of the hallucination detection pipeline on 100 random samples (Section 6). Manual review of unmatched libraries for genuine hallucinations (Section 3.6). Single author manually evaluated 200 SRSE questions for filter validation (Appendix B.2.1)."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "10% of tasks reserved for preliminary experiments, remaining 90% used for main analysis (Section 3.2). Fine-tuning experiment uses equal train/test split (Appendix E.1)."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Appendix D provides detailed domain-level breakdown across seven BigCodeBench domains (computation, visualisation, general, system, time, network, cryptography) in Table 6."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Appendix C provides detailed case analyses of hallucination failures including year-based hallucinations (C.1), one-character misspellings (C.2), and ineffective prompt strategies (C.3) with specific examples per LLM."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Chain-of-thought and step-back prompting often worsened hallucination rates (Table 3, Experiment 3 summary). Fine-tuning had 'minimal impact' in most configurations (Appendix E.1). These negative results are prominently discussed."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims (26% for one-char misspellings, 99% for fake names, 84% for time prompts, inconsistent prompt engineering) are all directly supported by Tables 1-3."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The study uses controlled manipulation of prompt variables while holding other factors constant (same template, same tasks, same models). Each experiment varies a single dimension (description type, error degree, mitigation strategy), which is adequate for causal claims about prompt effects on hallucination rates."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title says 'LLMs' broadly but the study is restricted to Python libraries and 7 specific models. While Appendix E.2 tests generalizability on CodeInsight with 4 models, the paper's claims extend to 'LLM code generation' generally without sufficient bounding. The abstract and conclusions do not qualify findings to Python."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 discusses knowledge cutoffs as an alternative explanation for year-based hallucinations. Section 4.2 discusses sycophancy as a mechanism. Section 6 (Threats to Validity) addresses data leakage, construct validity, and LLM variability as alternative factors."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper clearly defines what it measures: library name hallucinations (imports of non-existent packages verified against PyPI) and library member hallucinations (invalid calls verified against documentation). Claims match measurement granularity — no broader framing beyond what was measured."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Table 4 (Appendix A) lists exact model versions: gpt-4o-mini-2024-07-18, gpt-5-mini-2025-08-07, ministral-2410, qwen2.5-coder-32b-instruct, llama-3.3-70b-instruct-turbo, deepseek-chat-v3.1, claude-haiku-4-5-20251001."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full prompt template given in Appendix B.1. All library directives listed verbatim in Appendix B.2.2 and B.3.2. Mitigation strategy texts given in Section 3.5. Mistake generation prompts in Appendix B.3.1."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 4 reports temperature and top_p for all seven models. Section 3.1 explains default parameters are used but manually configured for reproducibility."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The study uses direct API calls to LLMs with single-turn prompts."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2 describes filtering out tasks where descriptions mention ground-truth libraries, restricting to external libraries with accessible documentation, yielding 356 tasks from 1140. Appendix B.2.1 describes SRSE filtering and clustering. Section 3.6 describes AST-based extraction."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 'Threats to Validity' provides dedicated discussion of internal and external validity threats."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 discusses specific threats: automatic data extraction validated on 100 samples, prompt realism grounded in SRSE analysis, dataset bias from excluding ground-truth-revealing tasks, LLM nondeterminism mitigated by multiple runs and fixed versions."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2 explicitly states 'Our scope is restricted to Python.' Section 6 acknowledges dataset and LLM selection limitations. However, the title and abstract do not reflect these boundaries clearly."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "The paper releases 'full outputs' in the GitHub repository (Section 1), meaning raw LLM responses are available for verification."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2 describes BigCodeBench as the seed dataset, the filtering criteria (356 tasks, 30 libraries), and the 10/90 split. Section 3.6 describes the hallucination detection pipeline in detail."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data source is the BigCodeBench benchmark (standard public dataset)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline is documented: BigCodeBench → filtering (Section 3.2) → prompt generation with variations (Appendices B.2-B.3) → LLM response collection → AST extraction → PyPI/documentation verification (Section 3.6). Each stage is described with criteria."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding acknowledgment or statement found in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations clearly listed: King's College London and University College London. None of the authors are affiliated with the LLM providers being evaluated."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding information disclosed, so independence cannot be assessed."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement found in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": true,
         "justification": "Table 4 (Appendix A) lists knowledge cutoff dates for all models where available (e.g., GPT-4o-mini: Oct '23, GPT-5-mini: May '24, etc.)."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2: BigCodeBench tasks 'rephrased with the NL-Augmenter framework, reducing the risk of data leakage and ensuring realistic yet unseen problem statements.' Section 6: 'any residual data leakage is likely to only cause fewer hallucinations, making our findings conservative.'"
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2 explains BigCodeBench uses NL-Augmenter rephrasing to reduce leakage. Section 6 notes residual leakage would make findings conservative. Tasks further filtered to remove those mentioning ground-truth libraries."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No API costs, token counts, or per-example costs reported despite calling 7 LLM APIs across thousands of prompts with 3 responses each."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget, API spend, or hardware information reported."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "Three responses generated per task but no seed sensitivity analysis. The Reproducibility Statement mentions 'fixed seeds when sampling datasets' but not for LLM generation, and no cross-seed variance is reported."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2: 'For each prompt, we generate three responses to mitigate sampling variability in LLM outputs.'"
       },
       "hyperparameter_search_budget": {
         "applies": false,
         "answer": false,
         "justification": "Default API parameters are used; no hyperparameter search was conducted."
       },
       "best_config_selection_justified": {
         "applies": false,
         "answer": false,
         "justification": "No configuration selection; default parameters used throughout."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "Many comparisons across 7 models, 13+ prompt variations, and 2 hallucination types, but no statistical tests are performed at all, let alone corrections for multiple comparisons."
       },
       "self_comparison_bias_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The study evaluates existing LLMs rather than proposing a new system. No self-comparison bias applies."
       },
       "compute_budget_vs_performance": {
         "applies": false,
         "answer": false,
         "justification": "The study does not compare systems at different compute budgets; it evaluates hallucination rates across models."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.6 discusses construct validity of hallucination detection: PyPI verification for library names, documentation scraping for members, version-aware conservative counting, and manual validation on 100 samples."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding used. Direct API calls with single-turn prompts."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": true,
         "justification": "Table 4 lists knowledge cutoffs. Section 3.2 uses NL-Augmenter rephrased tasks. Section 4.1 discusses how year-based hallucinations partly relate to knowledge cutoffs but notes the behavior is 'problematic' even for years within cutoffs."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2 filters out tasks where the description directly mentions the ground-truth library, preventing answer leakage through prompts."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether BigCodeBench tasks are independent of each other (they derive from ODEX, potentially sharing structural patterns). Tasks from the same domain may share similar solution patterns."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": true,
         "justification": "NL-Augmenter rephrasing (Section 3.2) serves as a concrete leakage prevention method, generating unseen problem statements to reduce memorization risk."
       }
     }
   },
   "claims": [
     {
       "claim": "Time-related prompts produce hallucinated libraries in up to 84% of tasks (GPT-4o-mini, 'from 2025').",
       "evidence": "Table 1: GPT-4o-mini THR = 84.74% for 'from 2025' description. Section 4.1.",
       "supported": "strong"
     },
     {
       "claim": "One-character misspellings in library names trigger hallucinations in up to 26% of tasks.",
       "evidence": "Table 2: GPT-5-mini TUR = 25.86% for one-character misspellings. Section 4.2.",
       "supported": "strong"
     },
     {
       "claim": "Fake library names are used in up to 99% of tasks.",
       "evidence": "Table 2: GPT-5-mini TUR = 99.22% for fake library names. Section 4.2.",
       "supported": "strong"
     },
     {
       "claim": "Prompt engineering shows inconsistent mitigation: self-analysis and explicit-check reduce hallucinations in 29/36 and 30/36 instances respectively, while chain-of-thought and step-back often increase them.",
       "evidence": "Table 3 and Section 4.3. Average reductions for GPT-5-mini (-5.53%) and DeepSeek-V3.1 (-5.35%) but increase for Qwen-2.5-Coder (+5.08%).",
       "supported": "strong"
     },
     {
       "claim": "Adjective-based descriptions rarely trigger library name hallucinations (≈0%).",
       "evidence": "Table 1: All non-year adjective descriptions show RHR < 1% across all models. Section 4.1.",
       "supported": "strong"
     },
     {
       "claim": "Rarity-seeking language increases hallucinations, with 'hidden gem' prompts producing hallucinations in 5.35% of tasks on average.",
       "evidence": "Table 5 (Appendix B.4) and Section 5.2. Progressive increase: lesser known (1.92%) → not widely used (3.01%) → hidden gem (5.35%).",
       "supported": "moderate"
     },
     {
       "claim": "Fine-tuning shows limited promise for hallucination mitigation, with only one configuration (e=10, η=1e-4) showing meaningful improvement (16% reduction for fake names).",
       "evidence": "Table 7 (Appendix E.1). Most configurations within ≈1% of base model.",
       "supported": "weak"
     }
   ],
   "red_flags": [
     {
       "flag": "No statistical tests for comparative claims",
       "detail": "The paper makes extensive comparative claims across models and conditions but reports no significance tests, confidence intervals, or error bars. With only 3 responses per task, sampling variability could explain some observed differences, particularly smaller ones."
     },
     {
       "flag": "No cost reporting",
       "detail": "The study calls 7 LLM APIs across thousands of prompts (356 tasks × 13+ conditions × 3 responses × 7 models) but reports no API costs or total compute budget."
     },
     {
       "flag": "Single-author manual validation",
       "detail": "Manual review of unmatched libraries (Section 3.6) and SRSE filter validation (Appendix B.2.1) performed by a single author with no inter-rater reliability assessment."
     }
   ],
   "cited_papers": [
     {
       "title": "We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs",
       "authors": ["Joseph Spracklen", "Raveen Wijewickrama", "A. H. M. Nazmus Sakib", "Anindya Maiti", "Bimal Viswanath", "Murtuza Jadliwala"],
       "year": 2024,
       "arxiv_id": "2406.10279",
       "relevance": "Prior work on package hallucinations in LLM code generation, establishing the slopsquatting threat model this paper extends."
     },
     {
       "title": "Importing Phantoms: Measuring LLM Package Hallucination Vulnerabilities",
       "authors": ["Arjun Krishna", "Erick Galinkin", "Leon Derczynski", "Jeffrey Martin"],
       "year": 2025,
       "arxiv_id": "2501.19012",
       "relevance": "Measures LLM package hallucination vulnerabilities at aggregate level; this paper extends with prompt-variation analysis."
     },
     {
       "title": "CodeHalu: Investigating Code Hallucinations in LLMs via Execution-based Verification",
       "authors": ["Yuchen Tian", "Weixiang Yan", "Qian Yang"],
       "year": 2024,
       "arxiv_id": "2405.00253",
       "relevance": "Taxonomy and benchmark for code hallucinations in LLMs."
     },
     {
       "title": "LLM Hallucinations in Practical Code Generation: Phenomena, Mechanism, and Mitigation",
       "authors": ["Ziyao Zhang", "Yanlin Wang", "Chong Wang"],
       "year": 2024,
       "arxiv_id": "2409.20550",
       "relevance": "Examines phenomena and mitigation of code hallucinations in practical LLM usage."
     },
     {
       "title": "BigCodeBench: Benchmarking Code Generation with Diverse Function Calls and Complex Instructions",
       "authors": ["Terry Yue Zhuo"],
       "year": 2024,
       "arxiv_id": "2406.15877",
       "relevance": "Benchmark dataset used as the seed for this study's experiments."
     },
     {
       "title": "Hallucination by Code Generation LLMs: Taxonomy, Benchmarks, Mitigation, and Challenges",
       "authors": ["Yunseo Lee", "John Youngeun Song"],
       "year": 2025,
       "arxiv_id": "2504.20799",
       "relevance": "Taxonomy of code generation hallucinations providing framework for categorizing library hallucinations."
     },
     {
       "title": "De-Hallucinator: Mitigating LLM Hallucinations in Code Generation Tasks via Iterative Grounding",
       "authors": ["Aryaz Eghbali", "Michael Pradel"],
       "year": 2024,
       "arxiv_id": "2401.01701",
       "relevance": "RAG-based mitigation approach for code generation hallucinations."
     },
     {
       "title": "Discovering Language Model Behaviors with Model-Written Evaluations",
       "authors": ["Ethan Perez"],
       "year": 2023,
       "relevance": "Foundational work on sycophancy in LLMs, which this paper connects to library hallucination compliance behavior."
     },
     {
       "title": "Breaking the Silence: The Threats of Using LLMs in Software Engineering",
       "authors": ["June Sallou", "Thomas Durieux", "Annibale Panichella"],
       "year": 2024,
       "doi": "10.1145/3639476.3639764",
       "relevance": "Discusses threats of LLM non-determinism in software engineering, motivating this study's repeated sampling approach."
     },
     {
       "title": "A Survey on Large Language Models for Code Generation",
       "authors": ["Juyong Jiang", "Fan Wang"],
       "year": 2024,
       "arxiv_id": "2406.00515",
       "relevance": "Survey of LLM code generation establishing the landscape this paper's hallucination analysis sits within."
     },
     {
       "title": "CodeMirage: Hallucinations in Code Generated by Large Language Models",
       "authors": ["Vibhor Agarwal", "Yulong Pei"],
       "year": 2024,
       "arxiv_id": "2408.08333",
       "relevance": "Proposes taxonomy for code hallucinations relevant to the library hallucination categories studied here."
     }
   ]
 }