PhantomLint: AI Vulnerability Detection

• PhantomLint is a suite of methodologies for detecting AI-induced vulnerabilities, including hallucinated package imports and hidden prompt injections in documents.
• It employs real-time linting and OCR-based analysis to measure metrics such as the hallucination rate and achieve near-perfect recall in hidden prompt detection.
• The system integrates with existing workflows via plugins and CI pipelines, while offering mitigation strategies and highlighting limitations for evolving adversarial methods.

PhantomLint is a suite of technical approaches for principled detection of two classes of AI-driven vulnerabilities: (1) hallucinated package imports in AI-generated code, and (2) hidden prompt injections in structured documents. These methods are motivated by the growing reliance on LLM-centric automation in software engineering and document processing and the emergence of new adversarial vectors that exploit model hallucinations or prompt injection attacks. Systematic detection is essential to safeguard critical pipelines such as software supply chains and AI-informed document triage.

1. Threat Models and Attack Scenarios

Two primary adversary models are addressed by PhantomLint technologies. In software engineering, a malicious or inattentive LLM may generate source code containing import statements for nonexistent (phantom) packages that could, if instantiated as real packages, be compromised—thus exposing the supply chain (Krishna et al., 31 Jan 2025). In document processing, adversaries embed “hidden” LLM prompts into documents to trigger indirect prompt-injection attacks on downstream LLM-based automation, remaining invisible to humans but interpretable by machines (Murray, 25 Aug 2025). In both cases, attackers control only input content—neither the detection tool nor the underlying infrastructure is assumed compromised. Defenders require extremely low false positive rates to ensure utility and user trust.

2. Formal Problem Statements and Key Definitions

Hallucinated package imports are defined as import statements referencing packages $p$ such that $p \notin K_\ell(M)$, where $K_\ell(M)$ is the set of officially registered package names for language $\ell$ (e.g., Python’s PyPI), up to model $M$’s knowledge cutoff $t_0$ (Krishna et al., 31 Jan 2025). Important metrics include the package hallucination rate (HPR), given by

$HPR = \frac{H}{N}$

where $H$ is the number of hallucinated imports and $N$ is the total number of imports in a test set.

For hidden prompt detection, documents $D$ are partitioned into contiguous text blocks $p \notin K_\ell(M)$0. A text block is formally determined to contain hidden content if

$p \notin K_\ell(M)$1

where $p \notin K_\ell(M)$2 is the bounding region of $p \notin K_\ell(M)$3 (Murray, 25 Aug 2025).

3. Core Detection Methodologies

3.1 Phantom Package Import Linting

PhantomLint benchmarks LLM hallucination by:

• Constructing $p \notin K_\ell(M)$4 via scraping language repositories at cutoff $p \notin K_\ell(M)$5.
• Measuring HPR by generating code from prompts and extracting import statements, flagging any $p \notin K_\ell(M)$6.
• Integrating real-time linting into developer workflows: every extracted import in AI-generated code is checked against $p \notin K_\ell(M)$7, with hallucinated imports flagged in-editor or via CI.

3.2 Hidden Prompt Detection in Documents

Detection is a two-stage process (Murray, 25 Aug 2025):

• Analyze: Identify candidate blocks via a prompt-detection function (sentence embedding comparisons and “bad-phrase” lookup).
• OCR Consistency Test: For suspicious text blocks, compare text extracted programmatically with OCR output over the rendered region. If the block is present textually but absent visually, flag as hidden.

This approach is agnostic to the hiding method: it covers white-on-white text, zero-opacity, tiny font, off-page content, invisible PDF layers, malicious fonts, and advanced HTML/CSS strategies.

4. Quantitative Results and Empirical Evaluation

Comprehensive experimental evaluation across both domains provides the following results:

Evaluation Aspect	Result / Statistic	Source
Hidden prompt detection, synthetic corpus	100% success across 9 hiding strategies, 26 cases	(Murray, 25 Aug 2025)
False positive rate, ICML '25 papers	3/3,257 flagged (0.092%), all OCR artifacts	(Murray, 25 Aug 2025)
Hidden prompt detection, real documents	100% recall (113/113), 100% specificity in controls	(Murray, 25 Aug 2025)
Phantom import hallucination, model-size	Pearson ρ ≈ –0.59; larger models hallucinate less	(Krishna et al., 31 Jan 2025)
Language effect on code hallucination	Mean HPR: JS ≈14.7%, Python ≈23.1%, Rust ≈24.7%	(Krishna et al., 31 Jan 2025)

For document screening, mean runtime is 68.25 s per ICML paper (PDF), 43.75 s per short document (CVs/HTML) (Murray, 25 Aug 2025). PhantomLint achieves perfect recall on hidden prompt test sets and extremely low false positive rates under diverse conditions.

5. Defensive Strategies and Mitigation

PhantomLint incorporates multiple defensive measures:

• Historical existence check: Reject or flag import statements referencing packages outside the known-good set as of the LLM’s cutoff date.
• Explicit prompt guidance: Advise users and prompting frameworks to specify: “Only use packages already on {PyPI/NPM/crates.io} as of {date}.”
• Repair via nearest-neighbor search: Flag hallucinated packages and suggest top candidates using string similarity or embedding matching.
• Prompt-induced hallucination rate limiting: Detect patterns that commonly induce hallucination (e.g., requests for fictional APIs or packages) and warn the user or terminate prompting (Krishna et al., 31 Jan 2025).
• Hidden prompt-specific: For documents, combining hidden-text detection (as described) with text-based prompt injection sanitizers (e.g., LLMGuard) maximizes robustness.

6. Limitations and Open Challenges

PhantomLint’s effectiveness is bounded by several technical factors:

• OCR limitations: Tesseract accuracy degrades for low-contrast or extremely small fonts, possibly incurring false negatives. Gaussian blur preprocessing is used but is only partially effective (Murray, 25 Aug 2025).
• Granularity of detection: The diff algorithm may merge adjacent visible and hidden tokens, reducing span-level precision.
• Performance: Runtime (1 minute per document) is tolerable for offline analysis but prohibitive for high-throughput scenarios; exploration of GPU OCR or visual heuristics is suggested for acceleration.
• Evolving adversarial tactics: Malicious actors can devise new methods (e.g., dynamic SVG, steganographic prompt injection) not yet covered; multi-modal analysis or pixel-level anomaly detection are identified as future directions (Murray, 25 Aug 2025).
• Scope: For multipage prompts or cross-page content blocks, bounding and merging strategies must be extended.

7. Implementation and Integration Guidance

PhantomLint is available as a Python prototype, employing PyMuPDF and pikepdf for PDF parsing, Playwright for HTML rendering, and Tesseract for OCR. Integration points include command-line interfaces, editor plugins (e.g., VS Code), and CI pipelines for both code and document screening. Configuration files (e.g., phantomlint.yaml) support custom language thresholds, model metadata, Pareto-optimal model selection (balancing HumanEval performance vs hallucination risk), and heuristic estimation of hallucination rates via HumanEval scores (Krishna et al., 31 Jan 2025). For document processing, users can integrate PhantomLint as a pre-processing step prior to LLM-based automation.

PhantomLint establishes foundational methodology for both LLM package hallucination detection and principled hidden prompt discovery in document pipelines, spanning empirical measurement, algorithmic defense, and practical integration (Krishna et al., 31 Jan 2025, Murray, 25 Aug 2025).