{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/arxiv-2510-04398","title":"SECA: Semantically Equivalent and Coherent Attacks for Eliciting LLM Hallucinations","arxiv_id":"2510.04398","date":"2025-10-05","proceeding":"NeurIPS","authors":["Buyun Liang","Liangzu Peng","Jinqi Luo","Darshan Thaker","Kwan Ho Ryan Chan","René Vidal"],"abstract":"Large Language Models (LLMs) are increasingly deployed in high-risk domains. However, state-of-the-art LLMs often exhibit hallucinations, raising serious concerns about their reliability. Prior work has explored adversarial attacks to elicit hallucinations in LLMs, but these methods often rely on unrealistic prompts, either by inserting nonsensical tokens or by altering the original semantic intent. Consequently, such approaches provide limited insight into how hallucinations arise in real-world settings. In contrast, adversarial attacks in computer vision typically involve realistic modifications to input images. However, the problem of identifying realistic adversarial prompts for eliciting LLM hallucinations remains largely underexplored. To address this gap, we propose Semantically Equivalent and Coherent Attacks (SECA), which elicit hallucinations via realistic modifications to the prompt that preserve its meaning while maintaining semantic coherence. Our contributions are threefold: (i) we formulate finding realistic attacks for hallucination elicitation as a constrained optimization problem over the input prompt space under semantic equivalence and coherence constraints; (ii) we introduce a constraint-preserving zeroth-order method to effectively search for adversarial yet feasible prompts; and (iii) we demonstrate through experiments on open-ended multiple-choice question answering tasks that SECA achieves higher attack success rates while incurring almost no semantic equivalence or semantic coherence errors compared to existing methods. SECA highlights the sensitivity of both open-source and commercial gradient-inaccessible LLMs to realistic and plausible prompt variations. Code is available at https://github.com/Buyun-Liang/SECA.","url_abs":"https://arxiv.org/abs/2510.04398","url_pdf":"https://arxiv.org/pdf/2510.04398","source":{"archive":null,"snapshot":"2025-07-28","note":"not in the Papers with Code archive (frozen at the snapshot)","row_kind":"graph","title_abstract_authors_date":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)"},"code_links":[],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2510.04398","atlas_url":"https://app.syntology.ai/?focus=2510.04398","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2510.04398"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/Buyun-Liang/SECA","reach":null}],"summary":{"ran_violates":1,"ran_draft_wrong":5,"ran_honours":2,"unverified":3},"by_repo_kind":{"found_in_text":{"samples":11,"ran":8,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"d354dde7f3226fed","entry":"feasibility_check","repo":"Buyun-Liang/SECA","repo_kind":"found_in_text","path":"src/seca.py","file_url":"https://github.com/Buyun-Liang/SECA/blob/HEAD/src/seca.py","link_basis":"first_harvest_node","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d354dde7f3226fed"}},{"code_sha256_prefix":"5043517b4a24afe0","entry":"get_new_parents_list","repo":"Buyun-Liang/SECA","repo_kind":"found_in_text","path":"src/seca.py","file_url":"https://github.com/Buyun-Liang/SECA/blob/HEAD/src/seca.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5043517b4a24afe0"}},{"code_sha256_prefix":"c908cca1a7b8292d","entry":"get_probs","repo":"Buyun-Liang/SECA","repo_kind":"found_in_text","path":"src/seca.py","file_url":"https://github.com/Buyun-Liang/SECA/blob/HEAD/src/seca.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c908cca1a7b8292d"}},{"code_sha256_prefix":"cf0a660abde18864","entry":"get_prompt","repo":"Buyun-Liang/SECA","repo_kind":"found_in_text","path":"src/seca.py","file_url":"https://github.com/Buyun-Liang/SECA/blob/HEAD/src/seca.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"cf0a660abde18864"}},{"code_sha256_prefix":"b74243272d5f3d61","entry":"get_second_largest_choice_index","repo":"Buyun-Liang/SECA","repo_kind":"found_in_text","path":"src/seca.py","file_url":"https://github.com/Buyun-Liang/SECA/blob/HEAD/src/seca.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b74243272d5f3d61"}},{"code_sha256_prefix":"48ba4eab96fc8312","entry":"obj_fun","repo":"Buyun-Liang/SECA","repo_kind":"found_in_text","path":"src/seca.py","file_url":"https://github.com/Buyun-Liang/SECA/blob/HEAD/src/seca.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"48ba4eab96fc8312"}},{"code_sha256_prefix":"0b2fdf45cd9667d3","entry":"semantic_equivalence_proposer","repo":"Buyun-Liang/SECA","repo_kind":"found_in_text","path":"src/seca.py","file_url":"https://github.com/Buyun-Liang/SECA/blob/HEAD/src/seca.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"0b2fdf45cd9667d3"}},{"code_sha256_prefix":"b2bb85b015b1aa7e","entry":"wrap_preserve_newlines","repo":"Buyun-Liang/SECA","repo_kind":"found_in_text","path":"src/seca.py","file_url":"https://github.com/Buyun-Liang/SECA/blob/HEAD/src/seca.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b2bb85b015b1aa7e"}},{"code_sha256_prefix":"618de0ef99077865","entry":"get_final_answer","repo":"Buyun-Liang/SECA","repo_kind":"found_in_text","path":"src/seca.py","file_url":"https://github.com/Buyun-Liang/SECA/blob/HEAD/src/seca.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"618de0ef99077865"}},{"code_sha256_prefix":"977374326178f537","entry":"openai_get_log_probs","repo":"Buyun-Liang/SECA","repo_kind":"found_in_text","path":"src/seca.py","file_url":"https://github.com/Buyun-Liang/SECA/blob/HEAD/src/seca.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"977374326178f537"}},{"code_sha256_prefix":"418fceafa5cdb4e2","entry":"seca","repo":"Buyun-Liang/SECA","repo_kind":"found_in_text","path":"src/seca.py","file_url":"https://github.com/Buyun-Liang/SECA/blob/HEAD/src/seca.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"418fceafa5cdb4e2"}}]},"arxiv_metadata":{"licence":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)","fields":["title","abstract","authors","date"],"primary_category":"cs.CL","source":"arxiv_api"},"syntology_extracted_results":null}