Search papers, labs, and topics across Lattice.
This paper evaluates inference-time defenses against package hallucination in LLM-generated code, revealing that existing evaluation methods inflate hallucination rates by misclassifying standard-library modules, particularly in Python. The authors assess seven defenses, finding that Retrieval-Augmented Generation (RAG) effectively reduces package hallucination rates across various models and programming languages, while Greedy decoding offers the best trade-off between mitigation and utility. Additionally, they highlight the vulnerability of Ruby to adversarial prompts, suggesting that effective defenses must incorporate external grounding or iterative self-verification to combat heightened hallucination risks.
RAG-based defenses can significantly reduce package hallucination rates in LLM-generated code, but only if matched to the specific threat model and utility requirements.
LLMs are increasingly used for code generation, yet they frequently hallucinate non-existent software packages, creating exploitable entry points into the software supply chain. We make four contributions to this problem. First, we show that prior evaluation methodologies systematically inflate hallucination rates by misclassifying standard-library modules as hallucinations in some languages. For Python, the overestimation reaches 9.4 percentage points. Second, we evaluate seven inference-time defenses for mitigating package hallucinations, including five guided decoding strategies (Greedy, Contrastive, DoLa, Nudging, and Active Layer-Contrastive Decoding), an iterative self-refinement approach (Self-Refine), and a Retrieval-Augmented Generation (RAG)-based defense.. Across eight models spanning five families and four programming languages (Python, JavaScript, Ruby, Rust), RAG reduces the package hallucination rate (PHR) in 18 of 32 model--language configurations. Third, we introduce Package Utility (PU) to assess whether defenses preserve valid and task-relevant recommendations. Among strategies evaluated, Greedy decoding provides the strongest average mitigation--utility trade-off. Fourth, we stress-test all strategies under adversarial prompts seeded with fabricated package names and find that PHR surges by up to 45 percentage points relative to standard prompts, with Ruby consistently the most vulnerable language (80.9--95.2\%). Under adversarial conditions, RAG and Self-Refine outperform all decoding-only strategies, indicating that robust defense requires either external grounding or iterative self-verification when prompts are actively hostile. Our results recast package hallucination as both a measurement problem and a decoding-time control problem, and they demonstrate that the choice of defense must be matched to the threat model and recommendation utility.
