SPLASH: Contrastive Audit Pressure for Detecting and Localizing Security Hallucinations in Generated Code
Code generated by large language models often passes every functional test while remaining insecure. These security hallucinations are common, written with high confidence, and repeated across samples, so neither the generator's own uncertainty nor static analyzers reliably catch them. We introduce SPLASH, which is guided by a new measure called audit pressure. It contrasts teacher-forced log-probabilities for the generated program under a security review and a style review. Aggregated to statements and programs, and grounded in a probabilistic model of competing edits, audit pressure allows SPLASH to choose the secure program among a model's candidate programs and locate the vulnerable s...
| Authors | Mirza Masfiqur Rahman, MD Ajwad Akil, Imtiaz Karim et al. |
|---|---|
| Primary category | cs.CR |
| Published | 19 October 2026 |
| Last updated at source | 19 October 2026 |
Silytics shows public metadata from arXiv and links to the original. Information may be incomplete or out of date. Last refreshed 20 October 2026. Licenses and terms of the original apply to the work itself. Not financial, legal or professional advice.