New technique cuts AI model fabricated package hallucinations by 88%

Large language models regularly invent non-existent software packages during code generation—a dangerous phenomenon known as package hallucinations. When an LLM recommends installing a fictional library, attackers can register that package on public repositories with malicious code, creating a supply-chain attack vector that ensnares developers and automated systems alike.

Researchers have developed a defense mechanism to combat this vulnerability. According to research on arXiv, a post-deployment approach called Adaptive Unlearning surgically removes these harmful outputs without degrading the model's general coding abilities.

How the Attack Works#

Package confusion attacks, also known as slopsquatting, exploit a simple chain of events. An LLM generates code containing import statements for packages that don't exist. Developers or agents running that code attempt to install these phantom libraries. An attacker, having registered the fake package name beforehand with malicious payloads, captures the installation requests and executes arbitrary code on victim systems.

Adaptive Unlearning Strategy#

Rather than retraining the entire model, the new approach uses a hybrid token-level objective that simultaneously strengthens valid package recommendations while suppressing hallucinated ones. The system pairs this targeted suppression with an autonomous discovery loop that continuously identifies new contexts that trigger hallucinations—all without requiring manual human review.

Results and Impact#

Testing shows that Adaptive Unlearning reduces package hallucination rates by 88% while maintaining performance on standard coding benchmarks. Crucially, the distributional shifts remain localized to package-related generations, leaving broader coding behavior largely intact. This surgical precision indicates the technique successfully isolates its effect to the target problem.

The framework relies entirely on model-generated data and needs no human annotation, making it practical for deployment after models have already been released into production.