PaperlayerView exact revision on arXiv

Source-linked AI summary

Names Can Hurt: Spotting Slopsquatting Risks Caused by Package Name Hallucinations in Local Coding LLMs

Akash Raj, Sargam Sahu

arXiv:2608.23897v1cs.CLcs.AI

TL;DR

Slopsquatting can turn hallucinated Python package names into supply-chain compromises, especially for local LLMs without hosted-model verification. The paper combines deterministic PyPI checks, metadata classification, import-name reconciliation, retries, and fallback routing; across 300 prompts, it produced hallucination-free code on 76% of runs. Its results show that registered squats form a substantial threat surface, while the evaluation is limited by a single same-family model pair and snapshot-era metadata.

  • Problem

    Hallucinated package names can become supply-chain compromises when attackers pre-register them on PyPI, while local LLMs lack convenient hosted-model verification.

  • Method

    The paper combines deterministic PyPI checking, a ten-feature Random Forest, narrow import-name reconciliation, escalating retries, and fallback routing in a LangGraph agent.

  • Results

    76% of 300 prompts produced hallucination-free code, while roughly half of hallucinated recommendations were already registered on PyPI as squats or lookalikes.

  • Takeaways & Limitations

    Because many hallucinated names resolve on PyPI, effective mitigation requires a second layer beyond existence checks.

  • Takeaways & Limitations

    The evaluation uses only one same-family model pair, and the snapshot does not address data drift or metadata freshness.

Abstract

from arXiv · show

When a code generating language model fabricates a Python package name, an adversary who has pre-registered that name on PyPI can convert that hallucination into a supply chain compromise. This event has been termed as 'slopsquatting'. We propose a two layer detector to counter this issue. The first layer performs a deterministic PyPI existence check. The second is a Random Forest classifier trained on ten features derived from the package name and its PyPI metadata. An import name reconciler bridges the two, resolving cases such as 'import cv2' versus 'pip install opencv-python' without a security bypass. The detector is embedded in a LangGraph state machine that retries at escalating temperatures and, on repeated failure, routes to a stronger fallback model. Across 300 curated prompts, the pipeline produces hallucination free code on 76% of runs. The primary exhausts its retry budget on 28.7%; intra model retries recover roughly a quarter of those, and cross model fallback recovers a further 16.5% of the remainder. Four findings have been observed. First, half of the flagged hallucinations are packages already registered on PyPI, as low quality lookalikes of well known projects, caught by the classifier rather than the deterministic layer (e.g., pil, faiss, tabula, haystack). Second, hallucination rate scales almost linearly with prompt adversariality, from 0 to 10% on routine coding to 40 to 73% on slopsquat baits. Third, the weaker primary refused 6 of 10 direct baits unaided, suggesting recent instruction tuning provides a baseline defense. Fourth, when primary and fallback share a model family, approximately 84% of primary failures recur on the fallback, motivating cross family pairing. A user study (n = 24) reports mean satisfaction 4.4 out of 5 and 21 of 24 stated adoption intent.

1. Introduction

The paper addresses slopsquatting risks for small, locally runnable open-weight LLMs, which are widely used, hallucinate more often than frontier systems, and lack hosted-model fallbacks. It proposes a detector and evaluates it across varied prompts.

  • Slopsquatting becomes economically plausible when attackers pre-register package names hallucinated by coding assistants.A nonexistent name may harmlessly return a 404, but a registered name can lead developers to install attacker-controlled software.
  • Small open-weight LLMs in the 7B to 70B range are the paper’s focus because developers run them locally and they require local defenses.Local deployment removes the convenient fallback of asking a stronger hosted model to verify recommendations.
  • The paper constructs a two-layer detector, adds import-name reconciliation, embeds it in a retrying LangGraph agent, and evaluates 300 prompts.The planned system uses deterministic PyPI checking, a per-LLM Random Forest, fallback routing, and JSONL logging.

2. Background and Related Work

Prior mitigations separately use deterministic verification, LLM self-verification, or metadata classifiers, each leaving important weaknesses. This paper combines deterministic and machine-learning checks while treating self-verification as a baseline.

  • A pure 404 check catches fabricated names but misses attacker-registered hallucinations that resolve successfully on PyPI.Deterministic verification is inexpensive, yet a registered squat trivially bypasses it.
  • LLM self-verification can help in practice but remains vulnerable to shared hallucinations, especially when generator and verifier are homogeneous.The paper therefore treats self-verification as a baseline rather than its primary mitigation.
  • Prior metadata-classifier work typically deploys one classifier across models, while this paper examines cross-model transferability.The authors initially trained matched per-LLM classifiers before finding transferability high enough for one classifier to suffice.
  • The proposed pipeline combines deterministic and ML checks, using an import-name reconciler as the connecting mechanism.

3. System Overview

The system sends prompts to a primary LLM, inspects code-block package references, retries flagged outputs at higher temperatures, and routes repeated failures to a fallback model. It then combines reconciliation and metadata checks to assess safety.

  • Package detection is restricted to imports and pip install commands inside code blocks.The pipeline avoids scanning ordinary prose for package-like tokens.
  • Flagged responses trigger retries at temperatures 0.7, 1.0, and 1.2 when retry budget remains.After retries are exhausted, the fallback model starts the loop again.
  • The agent retries non-code answers or fabricated package names and sends repeated failures to a fallback LLM.The process begins with a user prompt and primary generation, then escalates when the output remains unsafe.

4. Detector Design

The detector extracts package references, checks PyPI existence, reconciles known import/install mismatches, and classifies resolved packages using name and metadata features. Its security ordering prevents reconciliation from bypassing classifier scrutiny.

  • Extractor: The extractor uses AST parsing in code blocks, keeps module names from imports, and falls back to restricted regex for messy or non-Python blocks.For example, `import numpy as np` yields `numpy`, not the alias `np`.
  • Extractor: Scanning only code blocks prevents prose tokens such as `github`, `python`, and `spacy-lg` from becoming false package alerts.An earlier whole-response regex caused these errors, while the restricted approach removed most early alerts.
  • Deterministic layer: A PyPI 404 marks a name as fake, whereas a 200 response sends its package information to the classifier.
  • Random Forest classifier: The Random Forest uses ten features: eight from package names and two from PyPI metadata.Name features include structure, suspicious terms, prefixes, and similarity to 15,000 popular names; metadata features are maintainer count and GitHub URL presence.
  • Random Forest classifier: The classifier uses 400 trees, and later results showed that classifiers trained on one LLM transfer well to others.The authors attribute this mainly to features that work across LLMs.
  • Import name reconciliation: The reconciler handles import/install mismatches such as `cv2` versus `opencv-python` and `PIL` versus `Pillow`.These mismatches caused most test mistakes, motivating the reconciliation step.
  • Import name reconciliation: The 24-entry reconciler runs only after a PyPI 404 and requires both the mapped install name and classifier check to pass.This narrow ordering prevents an attacker-registered alias from bypassing the classifier.
  • Import name reconciliation: The classifier should flag attacker packages that resolve on PyPI but lack maintainers or a GitHub link.Testing against attacker packages found that the reconciler refused to help every time.

5. Agent Design

The agent is implemented as a LangGraph state machine that detects package hallucinations, retries generation, and escalates to a fallback model while preserving run lineage.

  • The LangGraph agent uses six nodes and three edges to manage generation, package extraction, classification, retry decisions, and finalization.Its edges handle non-code outputs, flagged-package retry loops, and finalization.
  • The retry schedule increases temperature from 0.7 to 1.0 to 1.2, then transfers unresolved cases to a fallback model.The fallback starts its own retry budget and uses a matched classifier.
  • Each run is recorded in logs/agent_runs.jsonl with model identity, prompt, retry state, extracted packages, verdicts, final output, and role tag.Fallback records retain lineage links to the primary run ID.

6. Evaluation

Across 300 curated prompts, the pipeline achieved clean code on 76% of runs, while evaluation showed complementary detector coverage, transferable classification, adversariality-related failures, and same-family fallback limits.

  • 6.1 Setup: 300 hand-written prompts comprised about 140 routine coding tasks, 55 obscure-dependency tasks, and 105 adversarial prompts.Adversarial prompts included package-name bait and wording designed to induce invented dependencies.
  • 6.3 Recovery rate: 28.7% of runs exhausted the primary retry budget; intra-model retries rescued 24.6% of triggered retries, and fallback rescued 16.5% of transferred cases.The fallback produced code on 14 of 85 transferred cases.
  • 6.3 Recovery rate: 76% of prompts produced clean code end to end with llama-3.1-8b, while 72 of 300 retained hallucinated names after all attempts.The remaining cases would receive a production-time do-not-install warning.
  • 6.4 Prompt tiers: Routine coding tasks had near-zero give-up rates, whereas about three out of four adversarial requests triggered the pipeline.The reported pattern places the strongest detector activity where users most need warnings.
  • 6.5 The 50/50 split: 179 package verdicts were hallucinated, with roughly half returning PyPI 404s and half returning status 200 but suspicious metadata.The results support complementary deterministic and classifier coverage.
  • 6.5 The 50/50 split: For all 90 status=200 flags, the deterministic layer did not activate and the reconciler was never called, preserving the security invariant.Attacker-registered squats therefore depended on suspicious classifier metadata for detection.
  • 6.6 Cross model transferability: The initial cross-model protocol leaked 72.9% of off-diagonal test rows because shared package names appeared in both training and test subsets.The corrected matrix used package-disjoint splits, while several test columns remained statistically uninformative because of few hallucinated examples.
  • 6.6 Cross model transferability: Leakage-safe cross-model F1 estimates ranged from 0.833 to 1.000, with no training model consistently outperforming others across test columns.A classifier trained on gpt-oss-120b worked across all seven models without detectable accuracy loss.

7. Discussion

The discussion emphasizes preprocessing, security invariants, model similarity, and important scope limitations. It identifies cross-family fallback, richer metadata, drift handling, and stronger evaluation as priorities for future work.

  • Discussion: A 49-point drop followed rewriting the extractor and adding the reconciler, while changing the classifier itself helped little.The authors use this result to emphasize that extraction and preprocessing errors dominate real-world text pipelines.
  • Discussion: The security rule held across 300 prompts: 90 status=200 flags produced zero reconciler rescues.The reconciler only permits rescue after a PyPI 404, leaving attacker-registered names to classifier scrutiny.
  • Discussion: About half of local-LLM hallucinations were already registered on PyPI, so existence checks alone leave substantial threats open.The discussion also reports that a rule-based layer performed as well as or better than the Random Forest with these features.
  • Limitations: The evaluation used one same-family Llama pair, limiting evidence for cross-family fallback and the model-similarity claim.The authors lacked enough Groq token budget to test Llama-to-Qwen or Llama-to-GPT-OSS pairings.
  • Limitations: The classifier may misclassify small legitimate packages because PyPI maintainer metadata is effectively unavailable and relies heavily on two metadata features.The authors suggest upload date and update frequency as future signals.
  • Limitations: The evaluation is a snapshot: new, newly popular, abandoned, or renamed packages can become misclassified without refreshed references or retraining.Proposed but unimplemented mitigations include monthly top-N PyPI refreshes and quarterly rolling retraining.
  • Future work: Same-family fallback rescues only 16.5% of primary give-up cases because both models share hallucination patterns.Cross-family pairing is identified as the most important agent extension.
  • Future work: Transferability estimates remain uncertain because individual models contributed only 2 to 12 hallucinated tests.The authors recommend roughly tripling example generation or using pooled cross-validation.

8. Conclusion

The paper concludes that a two-layer detector with retries and fallback routing addresses package-name hallucination in local coding LLMs. Its results support layered checking and motivate cross-family fallback evaluation, while the release artifacts enable further study.

  • Conclusion: 76% of 300 prompts produced clean hallucination-free code with the two-layer detector, retries, and fallback routing.The system also reduced the unmitigated give-up rate from 79% to 28.7%.
  • Conclusion: Half of hallucinated names already existed on PyPI as low-quality squats or lookalikes, supporting a second layer beyond existence checks.The conclusion attributes this protection to the classifier layer.
  • Conclusion: Same-family fallback saved 16.5% of remaining failures, making different-family pairing the next natural step.The weaker primary model independently refused 60% of direct bait prompts.
  • Conclusion: Code, prompts, classifiers, run logs, and transferability artifacts are publicly available in the cited repository.The release includes a mapping table and a retrained leakage-safe transferability matrix.

Appendix A. Curated Import Alias Mapping

The appendix documents a fixed import-to-PyPI mapping used to reconcile Python import names with their corresponding installation names.

  • Appendix A. Curated Import Alias Mapping: The mapping contains 24 entries, each linking a Python project whose import name differs from its PyPI install name.Its header states security invariants and forbids speculative additions.

Appendix B. Extractor Test Suite

The appendix reports regression coverage for extracting package references and reconciling import aliases across varied response formats.

  • Appendix B. Extractor Test Suite: All 12 extractor regression tests pass, covering aliases, submodules, comma-separated imports, flags, comments, prose, and slopsquat baits.The suite also tests prose-and-code responses and version specifiers.

Appendix C. Evaluation Prompt Set

The evaluation prompt set contains 300 prompts, with one prompt per line and tier boundaries marked by comment headers.

  • 300 prompts are listed in data/eval_prompts.txt.
  • One prompt appears on each line, while blank lines are skipped by the batch runner.
  • Comment lines beginning with # are skipped, and comment headers mark tier boundaries.
Loading 2608.23897v1…