{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:PEWYOCB64HQ7HQDCQEYZB47WOC","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"6039bce11e1a675dc67b12e2e5b8adc6529c700bbf3adabd7a1ecb7ea151eeb0","cross_cats_sorted":["cs.CL","cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2025-01-31T10:26:18Z","title_canon_sha256":"a40b0a7cf9e102f70ebeb493d0a18f183e99e513286601612bb1c74d0501166f"},"schema_version":"1.0","source":{"id":"2501.19012","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2501.19012","created_at":"2026-07-05T10:07:55Z"},{"alias_kind":"arxiv_version","alias_value":"2501.19012v1","created_at":"2026-07-05T10:07:55Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2501.19012","created_at":"2026-07-05T10:07:55Z"},{"alias_kind":"pith_short_12","alias_value":"PEWYOCB64HQ7","created_at":"2026-07-05T10:07:55Z"},{"alias_kind":"pith_short_16","alias_value":"PEWYOCB64HQ7HQDC","created_at":"2026-07-05T10:07:55Z"},{"alias_kind":"pith_short_8","alias_value":"PEWYOCB6","created_at":"2026-07-05T10:07:55Z"}],"graph_snapshots":[{"event_id":"sha256:abac6a2e8ff3519a0bcc6e08431553a45e28e1c129ab0137acb17bd615311e22","target":"graph","created_at":"2026-07-05T10:07:55Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2501.19012/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Large Language Models (LLMs) have become an essential tool in the programmer's toolkit, but their tendency to hallucinate code can be used by malicious actors to introduce vulnerabilities to broad swathes of the software supply chain. In this work, we analyze package hallucination behaviour in LLMs across popular programming languages examining both existing package references and fictional dependencies. By analyzing this package hallucination behaviour we find potential attacks and suggest defensive strategies to defend against these attacks. We discover that package hallucination rate is pre","authors_text":"Arjun Krishna, Erick Galinkin, Jeffrey Martin, Leon Derczynski","cross_cats":["cs.CL","cs.CR"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2025-01-31T10:26:18Z","title":"Importing Phantoms: Measuring LLM Package Hallucination Vulnerabilities"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2501.19012","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:9829cc7888fccc6a5b1830f494a9f8befff8d081002fbe2416b12d55b36b2338","target":"record","created_at":"2026-07-05T10:07:55Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"6039bce11e1a675dc67b12e2e5b8adc6529c700bbf3adabd7a1ecb7ea151eeb0","cross_cats_sorted":["cs.CL","cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2025-01-31T10:26:18Z","title_canon_sha256":"a40b0a7cf9e102f70ebeb493d0a18f183e99e513286601612bb1c74d0501166f"},"schema_version":"1.0","source":{"id":"2501.19012","kind":"arxiv","version":1}},"canonical_sha256":"792d87083ee1e1f3c062813190f3f67092422ee07c34fa47b9855b97b984307e","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"792d87083ee1e1f3c062813190f3f67092422ee07c34fa47b9855b97b984307e","first_computed_at":"2026-07-05T10:07:55.014268Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:07:55.014268Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"h3G3xjOFhw/4IwxEJ5ELuPGiSl0Gu+613wgYHIHZMWJ/FEsuWzgcnpYtm6odLjloidZNbapBClPIJMWmoZYsDg==","signature_status":"signed_v1","signed_at":"2026-07-05T10:07:55.014746Z","signed_message":"canonical_sha256_bytes"},"source_id":"2501.19012","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:9829cc7888fccc6a5b1830f494a9f8befff8d081002fbe2416b12d55b36b2338","sha256:abac6a2e8ff3519a0bcc6e08431553a45e28e1c129ab0137acb17bd615311e22"],"state_sha256":"774f9a7230e7cec7389c4dcb059ea314749f89a9a7b7ae4b47b44883e24ded59"}