Hallucination Attacks in Express with Cockroachdb

Hallucination attacks in an Express service that uses CockroachDB arise when model-generated responses present information as factual even though it is not grounded in the database or is directly contradicted by stored data. Because CockroachDB is a distributed SQL store, developers often assume strong consistency for reads, but application-level queries and ORM usage can still produce non-deterministic or incomplete result sets that an LLM may reinterpret, fabricate, or overconfidently assert.

In Express, a typical pattern is to accept user input, build a dynamic query against CockroachDB, and pass the results to an LLM for natural language synthesis. If the query relies on ambiguous filters, unchecked pagination offsets, or incomplete WHERE clauses, the returned rows may miss relevant context. The LLM then hallucinates to fill gaps, inventing record IDs, timestamps, or relationships that do not exist. This is especially risky when the schema contains array or JSONB columns; malformed extraction paths can yield partial documents that the model treats as full sources.

Attackers craft prompts that steer the LLM toward these weak query results. For example, an injection in a filter value can cause row omission or type confusion, leading the model to hallucinate plausible but false entries. Because CockroachDB supports secondary indexes and distributed joins, inconsistent isolation levels or misconfigured leases can exacerbate non-repeatable reads, giving the LLM slightly different data on repeated calls and enabling context-dependent fabrications. The interaction between Express route handlers, CockroachDB transaction semantics, and the model’s training to sound authoritative creates a credible channel for misinformation.

Consider an endpoint /api/orders/:id that builds a SQL string without strict schema validation. If the parameter does not properly map to an indexed column, the query may fall back to a table scan and return an unintended subset. An LLM summarizing this subset may hallucinate order lines or shipping statuses. A concrete risk is when Costly Queries or statement timeouts cause partial results; the LLM may treat the partial set as complete and generate coherent but incorrect continuations.

These issues map to OWASP API Top 10’s A03:2023 Injection and A05:2023 Security Misconfiguration when combined with insufficient input validation and inconsistent data retrieval practices. Mitigation requires deterministic queries, strict schema constraints, and explicit grounding checks before LLM consumption, rather than relying on the database’s default isolation or the model’s fluency.

To reduce hallucination surfaces, enforce strict SQL contracts and deterministic behavior in Express routes that interact with CockroachDB. Always use parameterized statements, validate and limit result scopes, and ensure the LLM only operates on verified data.

const express = require('express');
const { Pool } = require('pg');
const app = express();
app.use(express.json());

const pool = new Pool({
  connectionString: process.env.DATABASE_URL,
  ssl: { rejectUnauthorized: false },
});

app.get('/api/orders/:id', async (req, res) => {
  const orderId = req.params.id;
  // Validate input: positive integer UUID or integer depending on schema
  if (!/^[0-9a-fA-F-]{36}$/.test(orderId) && !/^[0-9]+$/.test(orderId)) {
    return res.status(400).json({ error: 'Invalid order identifier' });
  }

  const client = await pool.connect();
  try {
    await client.query('BEGIN');
    // Use a deterministic, indexed lookup with a limit
    const sql = 'SELECT id, customer_id, total, status, items FROM orders WHERE id = $1 LIMIT 1';
    const result = await client.query(sql, [orderId]);
    await client.query('COMMIT');

    if (result.rows.length === 0) {
      return res.status(404).json({ error: 'Order not found' });
    }

    const order = result.rows[0];
    // Explicit grounding: only pass verified fields to the LLM prompt
    const prompt = `Order ID: ${order.id}
Customer ID: ${order.customer_id}
Total: ${order.total}
Status: ${order.status}
Items: ${JSON.stringify(order.items)}

Summarize this order in one sentence.`;
    // llmCall is a placeholder for your model integration
    const summary = await llmCall(prompt);
    res.json({ order, summary });
  } catch (err) {
    await client.query('ROLLBACK');
    console.error(err);
    res.status(500).json({ error: 'Internal server error' });
  } finally {
    client.release();
  }
});

This approach ensures a single indexed read, avoids offset-based pagination drift, and provides a concise, verifiable context to the LLM. For queries involving arrays or JSONB, use CockroachDB’s built-in functions with strict casts to prevent partial extraction that invites hallucination.

app.get('/api/users/:id/preferences', async (req, res) => {
  const userId = req.params.id;
  if (!/^[0-9]+$/.test(userId)) {
    return res.status(400).json({ error: 'Invalid user identifier' });
  }

  const client = await pool.connect();
  try {
    const sql = 'SELECT preference_key, preference_value FROM user_preferences WHERE user_id = $1';
    const result = await client.query(sql, [userId]);
    if (result.rows.length === 0) {
      return res.status(404).json({ error: 'Preferences not found' });
    }
    const prefs = result.rows.map(r => ({ key: r.preference_key, value: r.preference_value }));
    const prompt = `User preferences:\n${JSON.stringify(prefs, null, 2)}
Identify any opt-out flags and list them.`;
    const flagged = await llmCall(prompt);
    res.json({ preferences: prefs, flagged });
  } catch (err) {
    console.error(err);
    res.status(500).json({ error: 'Internal server error' });
  } finally {
    client.release();
  }
});

Additional remediation includes setting explicit transaction isolation where supported, using schema constraints to reject malformed inputs, and implementing runtime input validation before query construction. These steps reduce the surface for hallucination by ensuring the data the LLM sees is complete, consistent, and directly traceable to verified CockroachDB queries.