HalluSec: Detecting Security-Critical Code Hallucinations in LLM-Generated Code

This repository contains the experiment scripts and data for the HalluSec framework, which detects security-critical hallucinations in code generated by large language models. The framework uses pattern-based detection (95 known hallucinated security function patterns) combined with severity ranking based on CWE classification and CVSS scoring.

The experiments evaluate 11 LLMs across two public benchmarks (CyberSecEval, SecurityEval) and an internal dataset, comparing HalluSec against three real SAST tools (Semgrep, CodeQL, Snyk Code).

Repository Structure

Scripts

File	Description
run_cyberseceval.py	Generate code from 7 LLMs (Groq) + run HalluSec detection + SAST on CyberSecEval (3 languages)
run_cyberseceval_new_models.py	Generate code from 4 additional LLMs (OpenRouter) + run HalluSec detection on CyberSecEval
run_securityeval.py	Generate code from 7 LLMs (Groq) + run HalluSec detection + SAST on SecurityEval
run_securityeval_new_models.py	Generate code from 4 additional LLMs (OpenRouter) + run HalluSec detection on SecurityEval
run_all_detection.py	Run SAST on new model outputs + HalluSec on internal dataset + process retry samples
run_real_sast.py	Run CodeQL and Snyk on internal dataset samples (batch per language, keeps existing Semgrep results)
rerun_hallusec_fixed.py	Re-run HalluSec with definition-check fix on all 6 result CSVs to reduce false positives
create_ground_truth.py	Create ground truth labels (473 samples) via stratified sampling + independent regex verification
run_mcnemar.py	Run SAST tools on ground truth samples, then compute McNemar's test + bootstrap CI vs HalluSec

Data Files

File	Description
internal_7models.csv	Internal dataset results (1,764 samples, 7 models: LLaMA 3.1-8B, LLaMA 3.3-70B, GPT-OSS-120B, LLaMA 4 Maverick, LLaMA 4 Scout, Qwen3-32B, Kimi K2)
new_models_internal.csv	Internal dataset results (1,008 samples, 4 additional models: Claude 3.5 Sonnet, GPT-4o-mini, Gemini 2.5 Pro, Kimi K2.5)
ground_truth_11models.csv	Ground truth labels (473 stratified samples across all 11 models)
annotation_completed_annotator1.csv	Manual annotation by human annotator (300 samples, 7 original models)
cyberseceval_results.csv	CyberSecEval cross-validation results (5,803 samples, 7 Groq models, 3 languages)
cyberseceval_new_models.csv	CyberSecEval cross-validation results (3,316 samples, 4 OpenRouter models, 3 languages)
securityeval_results.csv	SecurityEval cross-validation results (847 samples, 7 Groq models, Python)
securityeval_new_models.csv	SecurityEval cross-validation results (484 samples, 4 OpenRouter models, Python)

CSV output files are written to ../csv/ relative to this directory.

Setup

Install dependencies:

pip install -r requirements.txt

Environment Variables

For Groq-hosted models (run_cyberseceval.py, run_securityeval.py):

export GROQ_API_KEY="your-key-here"

For key rotation with multiple keys (run_cyberseceval.py):

export GROQ_API_KEYS="key1,key2,key3"

For OpenRouter models (run_cyberseceval_new_models.py, run_securityeval_new_models.py):

export OPENROUTER_API_KEY="your-key-here"

SAST Tool Requirements

The SAST comparison scripts require the following tools installed and available on PATH:

• Semgrep
• CodeQL CLI
• Snyk CLI

Reproducing Results

1. Generate code + run HalluSec + SAST on benchmarks (7 Groq models):

python run_cyberseceval.py
python run_securityeval.py

2. Generate code + run HalluSec on benchmarks (4 OpenRouter models):

python run_cyberseceval_new_models.py
python run_securityeval_new_models.py

3. Run remaining SAST + HalluSec on datasets that still need processing:

python run_all_detection.py
python run_real_sast.py

4. Re-run HalluSec with false positive fix (checks function definitions):

python rerun_hallusec_fixed.py

5. Create ground truth and run statistical tests:

python create_ground_truth.py
python run_mcnemar.py

Notes

• Code generation scripts support resume -- they check for existing output files and skip already-completed models/prompts.
• The run_cyberseceval.py script rotates across multiple API keys to handle rate limiting.
• SAST tools (CodeQL, Snyk) are run in batch mode per language for efficiency.