{"schema_version":"0.1","map_id":"paper-79-map","publication_id":79,"publication_anchor":"paper-79","slug":"paper-79","canonical_path":"/knowledge/papers/paper-79/","machine_path":"/knowledge/papers/paper-79.json","root_node_id":"paper-79","stage":"mapped_draft","contribution_type_vocabulary_version":"0.1","contribution_types":[],"title":"Can Composing Generative Models Avoid Hallucinations? Implications for Cybersecurity Use Cases","short_title":"Can Composing Generative Models Avoid Hallucinations?","year":2026,"venue":"10th International Symposium on Cyber Security, Cryptology and Machine Learning (CSCML 2026)","venue_url":"https://www.cscml.org/","publication_status":"Under review","topic":"ai-machine-learning","labels":["Theory"],"ai_ml_labels":["Foundations","AI for security"],"availability":"Public manuscript not yet linked; an author-supplied abstract and the CSCML 2026 venue website are represented.","abstract_kind":"Author-supplied abstract","abstract_review_status":"author_supplied_not_manuscript_audited","abstract_added_at":"2026-07-11","abstract_note":"Supplied by the author for this website; the manuscript and theorem proofs have not been independently audited.","abstract_source_url":"/knowledge/papers/paper-79/#paper-abstract","abstract":"Today’s AI-powered enterprise systems are increasingly combining multiple models with pre- and post-processing, score aggregation, routing to expert models, and model-as-judge mechanisms. This raises a natural theoretical question with immediate practical implications: can compositions of models and pre- and post-processing techniques reduce hallucination rates inherent in single models?\n\nWe answer this question for the calibrated core of systems composing multiple models with pre- and post-processing techniques. Calibration in this context means that among all claims assigned score z, the average truth rate is z. Kalai and Vempala (KV) proved a limitation for a single calibrated fact-level generator: it must hallucinate monofacts (facts appearing once in training data) at a rate lower-bounded by the Good–Turing missing-mass estimate minus calibration error.\n\nWe show that calibration is preserved by three natural and common composition operators: (1) deterministic semantic post-processing, (2) Bayesian-compatible score aggregation, and (3) routing to one of many expert models (sometimes called a mixture of experts). The KV hallucination floor thus survives compositions built from these operators. A combined system that beats this floor must therefore either be miscalibrated as a final composite or violate one of our closure theorems. We give two counterexamples showing that, when the conditions of our theorems are violated, the overall system may not be calibrated: marginally calibrated experts need not average to a calibrated ensemble, and globally calibrated expert models need not remain calibrated under routing to one of the expert models.\n\nWe map our results to cybersecurity-relevant settings; in such settings, composed systems powered by generative models discover vulnerabilities, review code, generate code and test cases, analyze logs, triage alerts, and summarize incidents. In cybersecurity, “facts” are operational claims whose tail can be viewed as the monofact regime. Such claims can concern, for example, vulnerability existence, exploitability, patch safety, alert validity, or incident attribution. Vulnerability discovery also marks the theorem’s boundary: a model-generated claim that a rare bug exists is monofact-like when supported only by model confidence, while a concrete exploit, proof certificate, or execution trace is a checkable witness. Thus, our theorems apply to pre-verification composition; verified witnesses provide an escape by changing the evidence state.\n\nWe conclude with an evaluation procedure for auditing composed systems powered by generative models acting as a cybersecurity AI assistant or automated pipeline addressing specific tasks in such settings. The evaluation procedure enables one to explain whether, and by which mechanism, an observed hallucination reduction is compatible with our analysis.","authors":["Karim Eldefrawy"],"keywords":["generative models","model composition","hallucinations","cybersecurity AI"],"research_question":"Does calibration—and therefore the Kalai–Vempala monofact hallucination lower bound—persist when fact-level generators are composed using deterministic semantic post-processing, Bayesian-compatible score aggregation, or routing to expert models?","central_answer":"The author-supplied abstract reports that, under the paper’s closure conditions, calibration is preserved by all three operators, so the Kalai–Vempala hallucination floor persists for calibrated composites. Beating the floor requires final miscalibration, violation of a closure condition, or a changed evidence state such as a verified witness.","curation":{"drafted_at":"2026-07-11","drafted_by":[{"actor_type":"ai","name":"OpenAI Codex","role":"abstract-grounded synthesis, conservative claim mapping, and venue linking"}],"method":"AI drafting from author-supplied bibliographic metadata and abstract plus the supplied venue URL; no paper full text, formal theorem statement, proof, review record, dataset, code, or experiment was audited.","source_scope":"metadata_and_author_supplied_abstract","approval":{"status":"pending","note":"The author supplied the abstract. The AI-authored map remains pending author review; technical claims reflect the abstract, while formal theorem statements, hypotheses, and proofs remain unaudited."}},"sources":[{"id":"source-paper-79-curated","type":"curated_site_record","title":"Website publication record for Paper #79","url":"/publications/#paper-79","scope_note":"Author-supplied title, authorship, under-review status, venue, and topical characterization, plus an AI editorial summary. Technical claims are grounded separately in the author-supplied abstract."},{"id":"source-paper-79-author-abstract","type":"author_supplied_abstract","title":"Author-supplied abstract for Paper #79","url":"/knowledge/papers/paper-79/#paper-abstract","scope_note":"Abstract supplied directly by the author for this website; it reports the paper's results but is not a substitute for auditing the manuscript, theorem statements, hypotheses, or proofs."},{"id":"source-paper-79-venue","type":"official_venue_resource","title":"CSCML 2026 venue website","url":"https://www.cscml.org/","scope_note":"Author-supplied venue homepage. It supports venue-level context only and is not a paper-specific listing, acceptance notice, manuscript, or source for technical claims."},{"id":"source-paper-79-citation-search","type":"citation_search_snapshot","title":"Exact-title scholarly-web search","url":"https://www.google.com/search?q=%22Can+Composing+Generative+Models+Avoid+Hallucinations%3F+Implications+for+Cybersecurity+Use+Cases%22","accessed_at":"2026-07-11"}],"source_anchors":[{"id":"anchor-paper-79-curated","source_id":"source-paper-79-curated","label":"Author-supplied metadata and editorial summary","locator":"Website publication record. The title, authorship, status, venue, and topical characterization were supplied by the author; the concise summary is editorial.","url":"/publications/#paper-79"},{"id":"anchor-paper-79-author-abstract","source_id":"source-paper-79-author-abstract","label":"Author-supplied abstract","locator":"Full abstract rendered on the Paper #79 knowledge-map landing page. The manuscript, formal theorem statements, hypotheses, and proofs were not inspected.","url":"/knowledge/papers/paper-79/#paper-abstract"},{"id":"anchor-paper-79-venue","source_id":"source-paper-79-venue","label":"CSCML 2026 venue website","locator":"Venue homepage only. It is not a paper-specific page, acceptance notice, manuscript, review record, or source for technical claims.","url":"https://www.cscml.org/"},{"id":"anchor-paper-79-citations","source_id":"source-paper-79-citation-search","label":"Dated exact-title citation search","locator":"No citing work was verifiably located for the under-review manuscript when searched 2026-07-11","url":"https://www.google.com/search?q=%22Can+Composing+Generative+Models+Avoid+Hallucinations%3F+Implications+for+Cybersecurity+Use+Cases%22"}],"nodes":[{"id":"paper-79","kind":"paper","parent_id":null,"order":1,"epistemic_status":"author_supplied_abstract_pending_full_text_audit","title":"Can Composing Generative Models Avoid Hallucinations? Implications for Cybersecurity Use Cases","summary":"The author-supplied abstract reports that a Kalai–Vempala hallucination lower bound persists under deterministic semantic post-processing, Bayesian-compatible score aggregation, and expert-model routing when the resulting system remains calibrated. It identifies counterexamples outside these closure conditions, connects the theory to cybersecurity workflows, distinguishes unverified model claims from checkable witnesses, and proposes an audit procedure for explaining apparent hallucination reductions.","source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"paper-79-question","kind":"question","parent_id":"paper-79","order":1,"epistemic_status":"reported_in_author_abstract_not_independently_audited","title":"Research question","summary":"Does calibration—and therefore the Kalai–Vempala monofact hallucination lower bound—persist when fact-level generators are composed using deterministic semantic post-processing, Bayesian-compatible score aggregation, or routing to expert models?","source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"paper-79-contribution","kind":"contribution","parent_id":"paper-79","order":2,"epistemic_status":"reported_in_author_abstract_not_independently_audited","title":"Reported contribution","summary":"The abstract reports three calibration-closure theorems for common composition operators, two counterexamples outside their conditions, a cybersecurity interpretation, and an evaluation procedure for explaining apparent hallucination reductions.","source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"paper-79-method","kind":"method","parent_id":"paper-79","order":3,"epistemic_status":"reported_in_author_abstract_not_independently_audited","title":"Method or construction","summary":"The abstract reports closure theorems, under the paper’s conditions, for deterministic semantic post-processing, Bayesian-compatible score aggregation, and expert routing. It also reports two calibration counterexamples and separates confidence-only claims from claims backed by checkable witnesses. Exact formal definitions and hypotheses remain unavailable without the manuscript.","source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"paper-79-calibration","kind":"definition","parent_id":"paper-79-method","order":1,"epistemic_status":"defined_in_author_abstract","title":"Calibration","summary":"The abstract defines calibration operationally: among claims assigned score z, the average truth rate is z. The manuscript's probability space, conditioning, claim granularity, and approximation conventions remain unaudited.","source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"paper-79-kv-baseline","kind":"prior_result","parent_id":"paper-79-method","order":2,"epistemic_status":"reported_in_author_abstract_not_independently_audited","title":"Kalai–Vempala single-generator floor","summary":"The abstract reports the prior result that a calibrated fact-level generator must hallucinate monofacts—facts occurring once in training—at a rate lower-bounded by the Good–Turing missing-mass estimate minus calibration error.","source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"paper-79-closure","kind":"theorem_group","parent_id":"paper-79-method","order":3,"epistemic_status":"reported_in_author_abstract_not_independently_audited","title":"Calibration closure under three operators","summary":"The abstract reports that calibration is preserved by three specified composition operators under the paper's conditions; exact theorem statements, domains, measurability assumptions, and error propagation require the manuscript.","source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"paper-79-postprocessing","kind":"operator","parent_id":"paper-79-closure","order":1,"epistemic_status":"reported_operator","title":"Deterministic semantic post-processing","summary":"The first covered operator deterministically transforms generated semantic content. The abstract reports calibration closure but does not expose the formal semantic map or sufficient conditions.","source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"paper-79-aggregation","kind":"operator","parent_id":"paper-79-closure","order":2,"epistemic_status":"reported_operator","title":"Bayesian-compatible score aggregation","summary":"The second operator combines scores in a Bayesian-compatible way. This is narrower than arbitrary averaging; the abstract's first counterexample warns that marginal calibration alone does not make an averaged ensemble calibrated.","source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"paper-79-routing","kind":"operator","parent_id":"paper-79-closure","order":3,"epistemic_status":"reported_operator","title":"Routing to expert models","summary":"The third operator selects one of several expert models, sometimes described as a mixture of experts. The abstract reports a closure theorem under conditions and separately shows that global expert calibration alone is insufficient under arbitrary routing.","source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"paper-79-floor","kind":"theorem_consequence","parent_id":"paper-79-method","order":4,"epistemic_status":"reported_in_author_abstract_not_independently_audited","title":"Hallucination floor survives covered composition","summary":"Because the covered operators preserve calibration, the abstract concludes that the Kalai–Vempala monofact floor also applies to composites built from those operators.","source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"paper-79-escape","kind":"boundary","parent_id":"paper-79-method","order":5,"epistemic_status":"reported_in_author_abstract_not_independently_audited","title":"Ways to fall outside the conclusion","summary":"An observed composite below the floor must, according to the abstract, be miscalibrated at its final output, violate a closure theorem's conditions, or operate after verification has changed the evidence state.","source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"paper-79-counterexamples","kind":"counterexample_group","parent_id":"paper-79-method","order":6,"epistemic_status":"reported_in_author_abstract_not_independently_audited","title":"Two calibration counterexamples","summary":"The abstract reports examples showing that natural but weaker premises do not guarantee calibration of the composite.","source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"paper-79-counterexample-average","kind":"counterexample","parent_id":"paper-79-counterexamples","order":1,"epistemic_status":"reported_in_author_abstract_not_independently_audited","title":"Marginally calibrated experts may not average safely","summary":"Experts that are each marginally calibrated need not yield a calibrated ensemble when their outputs are simply averaged.","source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"paper-79-counterexample-route","kind":"counterexample","parent_id":"paper-79-counterexamples","order":2,"epistemic_status":"reported_in_author_abstract_not_independently_audited","title":"Globally calibrated experts may fail under routing","summary":"Experts that are globally calibrated need not remain calibrated after a router selectively sends different cases to them.","source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"paper-79-model-judge-boundary","kind":"scope_boundary","parent_id":"paper-79-method","order":7,"epistemic_status":"abstract_scope_observation","title":"Model-as-judge is motivation, not a listed closure operator","summary":"Model-as-judge mechanisms appear in the abstract's system motivation, but the three reported closure results are post-processing, Bayesian-compatible aggregation, and expert routing; the abstract does not claim a general model-as-judge closure theorem.","source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"paper-79-claims","kind":"claim_group","parent_id":"paper-79","order":4,"epistemic_status":"reported_in_author_abstract_not_independently_audited","title":"Principal reported claims","summary":"The abstract reports that calibrated compositions built from the three covered operators retain the Kalai–Vempala monofact hallucination floor; a system that beats it must be finally miscalibrated, violate a closure condition, or change the evidence state through verification.","source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"paper-79-cyber-workflows","kind":"application_context","parent_id":"paper-79-claims","order":1,"epistemic_status":"mapped_in_author_abstract","title":"Cybersecurity workflows","summary":"The abstract maps the theory to vulnerability discovery, code review and generation, test generation, log analysis, alert triage, and incident summarization by generative systems.","source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"paper-79-operational-facts","kind":"concept","parent_id":"paper-79-claims","order":2,"epistemic_status":"mapped_in_author_abstract","title":"Operational claims as facts","summary":"Cybersecurity 'facts' include claims about vulnerability existence, exploitability, patch safety, alert validity, and incident attribution; rare claims in their tail are treated as analogous to monofacts.","source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"paper-79-witness-boundary","kind":"boundary","parent_id":"paper-79-claims","order":3,"epistemic_status":"explicitly_reported_boundary","title":"Verification changes the evidence state","summary":"A rare-bug claim supported only by model confidence remains monofact-like, while a concrete exploit, proof certificate, or execution trace is a checkable witness. The abstract places verified witnesses outside its pre-verification composition analysis.","source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"paper-79-audit-procedure","kind":"evaluation_method","parent_id":"paper-79-claims","order":4,"epistemic_status":"reported_in_author_abstract_not_independently_audited","title":"Evaluation procedure for composed systems","summary":"The abstract reports a procedure for determining whether an observed hallucination reduction is compatible with the analysis and identifying whether calibration, operator conditions, or verification explain it; procedural steps and validation evidence require manuscript audit.","source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"paper-79-evidence","kind":"evidence_group","parent_id":"paper-79","order":5,"epistemic_status":"source_scope_limitation","title":"Reported evidence","summary":"The author-supplied abstract identifies the operators, reported closure results, two counterexamples, cybersecurity boundary, and evaluation procedure. The manuscript, formal definitions, theorem statements, proofs, examples, and any evaluation results were not audited.","source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"paper-79-scope","kind":"limitation_group","parent_id":"paper-79","order":6,"epistemic_status":"author_supplied_abstract_pending_full_text_audit","title":"Scope and limitations","summary":"The reported theorems concern the calibrated fact-level core, the three named operators, and pre-verification composition. They do not claim that every composition preserves calibration or that verified witnesses remain in the same evidence state; exact hypotheses, definitions, and theorem boundaries require manuscript audit.","source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"paper-79-artifacts","kind":"artifact_group","parent_id":"paper-79","order":7,"epistemic_status":"linked_not_content_audited","title":"Artifacts and resources","summary":"The site represents an author-supplied abstract and the venue homepage, but no manuscript, formal proof, code, dataset, evaluation artifact, immutable version, or paper-specific public URL.","source_anchor_ids":["anchor-paper-79-curated","anchor-paper-79-author-abstract","anchor-paper-79-venue"]},{"id":"paper-79-scrutiny","kind":"scrutiny","parent_id":"paper-79","order":8,"epistemic_status":"publication_status_reported_not_independently_audited","title":"Scrutiny and status","summary":"The work is described as under review. That records a pending process, not acceptance, a completed review outcome, or validation; no review report, reproduction, correction, or adversarial analysis is represented.","source_anchor_ids":["anchor-paper-79-curated","anchor-paper-79-venue"]}],"relations":[{"id":"paper-79-relation-question-contribution","type":"motivates","from_id":"paper-79-question","to_id":"paper-79-contribution"},{"id":"paper-79-relation-method-contribution","type":"realizes","from_id":"paper-79-method","to_id":"paper-79-contribution"},{"id":"paper-79-relation-calibration-enables-closure","type":"defines_property_for","from_id":"paper-79-calibration","to_id":"paper-79-closure"},{"id":"paper-79-relation-postprocessing-instantiates-closure","type":"instantiates","from_id":"paper-79-postprocessing","to_id":"paper-79-closure"},{"id":"paper-79-relation-aggregation-instantiates-closure","type":"instantiates","from_id":"paper-79-aggregation","to_id":"paper-79-closure"},{"id":"paper-79-relation-routing-instantiates-closure","type":"instantiates","from_id":"paper-79-routing","to_id":"paper-79-closure"},{"id":"paper-79-relation-closure-transfers-floor","type":"transfers","from_id":"paper-79-closure","to_id":"paper-79-floor"},{"id":"paper-79-relation-kv-grounds-floor","type":"grounds","from_id":"paper-79-kv-baseline","to_id":"paper-79-floor"},{"id":"paper-79-relation-escape-qualifies-floor","type":"qualifies","from_id":"paper-79-escape","to_id":"paper-79-floor"},{"id":"paper-79-relation-counterexamples-bound-closure","type":"bounds","from_id":"paper-79-counterexamples","to_id":"paper-79-closure"},{"id":"paper-79-relation-average-instantiates-counterexamples","type":"instantiates","from_id":"paper-79-counterexample-average","to_id":"paper-79-counterexamples"},{"id":"paper-79-relation-route-instantiates-counterexamples","type":"instantiates","from_id":"paper-79-counterexample-route","to_id":"paper-79-counterexamples"},{"id":"paper-79-relation-model-judge-qualifies-method","type":"qualifies","from_id":"paper-79-model-judge-boundary","to_id":"paper-79-method"},{"id":"paper-79-relation-contribution-claims","type":"grounds","from_id":"paper-79-contribution","to_id":"paper-79-claims"},{"id":"paper-79-relation-cyber-applies-claims","type":"applies","from_id":"paper-79-cyber-workflows","to_id":"paper-79-claims"},{"id":"paper-79-relation-operational-instantiates-cyber","type":"instantiates","from_id":"paper-79-operational-facts","to_id":"paper-79-cyber-workflows"},{"id":"paper-79-relation-witness-bounds-claims","type":"bounds","from_id":"paper-79-witness-boundary","to_id":"paper-79-claims"},{"id":"paper-79-relation-audit-evaluates-claims","type":"evaluates","from_id":"paper-79-audit-procedure","to_id":"paper-79-claims"},{"id":"paper-79-relation-evidence-claims","type":"supports","from_id":"paper-79-evidence","to_id":"paper-79-claims"},{"id":"paper-79-relation-scope-claims","type":"qualifies","from_id":"paper-79-scope","to_id":"paper-79-claims"},{"id":"paper-79-relation-artifacts-evidence","type":"enables_audit_of","from_id":"paper-79-artifacts","to_id":"paper-79-evidence"},{"id":"paper-79-relation-scrutiny-claims","type":"contextualizes","from_id":"paper-79-scrutiny","to_id":"paper-79-claims"}],"assessment":{"id":"paper-79-assessment-2026-07-11","rubric_version":"0.2","assessed_at":"2026-07-11","status":"ai_draft_author_review_pending","note":"These dimensions describe documented support and process, not truth, correctness, or a universal ranking. No composite score is calculated.","axes":[{"id":"epistemic_evidence","level":"medium","rationale":"The author-supplied abstract precisely reports the calibration definition, covered operators, closure results, counterexamples, cybersecurity boundary, and audit procedure. The formal statements, hypotheses, and proofs remain unaudited because the manuscript is not represented.","basis_source_anchor_ids":["anchor-paper-79-author-abstract"]},{"id":"auditability","level":"low","rationale":"The author-supplied abstract is inspectable, but no paper-specific official publication record, public archive, or author-hosted manuscript is represented; full-text assumptions, evidence, artifacts, and version identity cannot presently be audited from this map. Auditability is therefore low.","basis_source_anchor_ids":["anchor-paper-79-author-abstract","anchor-paper-79-venue"]},{"id":"production_provenance","level":"medium","rationale":"The record documents named authorship and the publication or review status of the paper, establishing a baseline human and lifecycle provenance trail. Contributor roles, revision and effort history, AI or tool use, artifact-version lineage, and explicit final approval have not yet been audited, so this provisional medium rating should not be read as complete production provenance.","basis_source_anchor_ids":["anchor-paper-79-curated","anchor-paper-79-author-abstract"]},{"id":"external_scrutiny","level":"low","rationale":"Under-review status records a pending process. No acceptance, completed review outcome, public review report, independent reproduction, correction, or adversarial analysis is represented.","basis_source_anchor_ids":["anchor-paper-79-curated"]},{"id":"reception","level":"low","rationale":"A dated exact-title scholarly-web search located 0 citations for this under-review manuscript. Under the author-defined rule, 0–8 located citations is Low, 9–10 is Medium, and 11 or more is High; this may change after dissemination.","basis_source_anchor_ids":["anchor-paper-79-citations"]},{"id":"contribution_significance","level":"medium","rationale":"The abstract reports a theoretical closure limitation with direct cybersecurity implications, counterexamples, an evidence-state boundary, and an audit procedure. Novelty comparisons, formal proofs, and downstream impact remain unaudited, so this is a provisional significance assessment rather than a breakthrough claim.","basis_source_anchor_ids":["anchor-paper-79-author-abstract"]}]},"reception_snapshot":{"as_of":"2026-07-11","method":"Exact-title scholarly-web search","citation_count":0,"source_url":"https://www.google.com/search?q=%22Can+Composing+Generative+Models+Avoid+Hallucinations%3F+Implications+for+Cybersecurity+Use+Cases%22","signals":[],"limitation":"The work is under review and no manuscript or index record is public. Zero means no verifiable citation was located in this dated exact-title search, not that future or unindexed references are impossible."}}