Hallucination Detection in Structured Query Generation via LLM Self-Debating (2025)

Abstract: Hallucination remains a key challenge in applying large language models (LLMs) to structured query generation, especially for semi-private or domain-specific languages underrepresented in public training data. In this work, we focus on hallucination detection in these low-resource structured language scenarios, using Splunk Search Processing Language (SPL) as a representative case study. We start from analyzing real-world SPL generation to define hallucination in this context and introduce a comprehensive taxonomy. To enhance detection performance, we propose the Self-Debating framework, which prompts an LLM to generate contrastive explanations from opposing perspectives before rendering a final consistency judgment. We also construct a synthetic benchmark, SynSPL, to support systematic evaluation of hallucination detection in SPL generation. Experimental results show that Self-Debating consistently outperforms LLM-as-a-Judge baselines with zero-shot and chain-of-thought (CoT) prompts in SPL hallucination detection across different LLMs, yielding 5–10% relative gains in hallucination F1 scores on both real and synthetic datasets, and up to 260% improvement for LLaMA-3.1–8B. Besides hallucination detection on SPL, Self-Debating also achieves excellent performance on the FaithBench benchmark for summarization hallucination, demonstrating the strong generalization ability of Self-Debating, with OpenAI o1-mini achieving state-of-the-art performance. All these results consistently demonstrate the strong robustness and wide generalizability of Self-Debating.

## introduction large language models (llms) have shown remarkable success in generating structured queries and code from natural language inputs, particularly in well-resourced domains such as sql and † this work was done during an internship at splunk. python. these languages benefit from extensive public documentation, training corpora, and community support, enabling llms to learn them with high fidelity. however, many real-world applications involve domain-specific or semi-private languages that are less prevalent in public data, such as splunk search processing language (spl) foot_0 , new relic query language (nrql) foot_1 , and kusto query language (kql) foot_2 . these languages are widely used in practice but lack large-scale open datasets and standardized benchmarks. this disparity creates unique challenges for llm-based generation, particularly with respect to hallucination detection. in this work, we study hallucination in structured query generation for such semi-private languages, using spl as a representative case. spl is a domain-specific query language used to retrieve, filter, and analyze machine-generated log data within the splunk platform. it features a rich and expressive syntax that supports complex search, aggregation, and transformation operations, drawing inspiration from both the unix pipeline and sql. despite its power and industrial adoption, authoring spl queries remains challenging, both due to its steep learning curve and the scarcity of publicly available guidance or training data. with the rapid advancement of llms, there is growing interest in using these models to assist users in generating spl queries from natural language inputs, mirroring successful applications in other domains, such as text-to-sql and code generation. however, while llms demonstrate impressive fluency and generalization ability, they often suffer from hallucination. they can produce outputs that are syntactically valid but semantically incorrect or unsupported by the input. this undermines the reliability of llm-generated spl queries. despite the critical nature of this problem, hallucination in spl generation remains an underexplored area. to the best of our knowledge, no systematic study or benchmark exists for hallucination detection in spl. this work aims to fill this gap by investigating the types, prevalence, and detection strategies of hallucination in llmgenerated spl queries. in this work, we begin by formally defining hallucination in the context of spl and introduce a taxonomy that categorizes common types of hallucinated behaviors observed in llm-generated queries. we propose the self-debating framework for hallucination detection, drawing inspiration from recent research on multi-agent debate @xcite @xcite . while prior methods typically involve multiple llms or agents engaging in back-and-forth discussion to reach a consensus, self-debating adopts a more lightweight and self-contained approach. it leverages contrastive reasoning within a single llm, prompting it to generate explanations for both the consistent and hallucinated interpretations of a generated query before making a final judgment. to support systematic evaluation, we construct a synthetic spl benchmark, synspl, which serves both as a testbed for our framework and as a reusable resource for future research on hallucination mitigation in structured query generation. experimental results show that self-debating consistently outperforms llm-as-a-judge baselines using standard zero-shot and chain-of-thought (cot) prompts across six different llms. to assess the generalizability of our method beyond spl, we further evaluate self-debating on faithbench @xcite , a challenging benchmark for hallucination detection in summarization tasks. self-debating achieves consistent gains in f1-macro across all six tested llms, with four models showing over 30% relative improvement. notably, when applied to the o1-mini model, self-debating not only surpasses the original baseline performance of o1-mini on faithbench, but also achieves state-ofthe-art (sota) results among all evaluated models. ## hallucinations in spl generation the spl generation task involves producing a valid and grounded spl query based on a given genera-tion prompt. this prompt typically includes system instruction and current user query. definition of hallucination in spl a generated spl is considered consistent if it meets both of the following criteria: 1) all structural components of the query must be explicitly supported by the information provided in the generation prompt. these components can include the index, which specifies the dataset to be searched; the sourcetype, which defines the format or classification of the data; the source, referring to the origin of the data (e.g., file path or data stream); the fields, which represent the extracted attributes from the data. 2) the query is free from syntax errors and adheres to the correct spl syntax. if either of these conditions is violated, the spl query is considered hallucinated. ## self-debating framework for hallucination detection we propose the self-debating framework for hallucination detection, which enables large language models (llms) to assess the faithful consistency of generated content through structured contrastive reasoning. an overview of the framethe model then reflects on both explanations to make a final judgment. ## synspl dataset construction to enable the development and evaluation of hallucination detection methods for spl generation, a suitable benchmark is needed. however, research on spl remains limited, and no large-scale benchmark currently exists for this purpose. collecting real-world queries and associated data is challenging due to privacy concerns and annotation costs. in contrast, text-to-sql has benefited from extensive benchmarks and community support. given the conceptual and structural similarities between sql and spl, we construct a synthetic benchmark for spl hallucination detection by adapting and extending an existing text-to-sql dataset. we construct the synthetic spl benchmark using the development set of the bird @xcite benchmark as the seed. the bird development set spans eleven databases and includes sql queries across three levels of difficulty: challenging, moderate, and simple. each sample in the bird dataset typically includes a user question, a corresponding golden-standard sql query, a piece of relevant knowledge required for sql generation, and the name of target database. the construction process involves two stages. in the first stage, we generate gold-standard (prompt, spl) pairs free from hallucinations. in the second stage, we systematically inject different types of hallucinations into these gold queries to produce corresponding hallucinated examples. ## conclusion this work focuses on the challenge of hallucination detection in llm-generated structured queries, with a focus on semi-private or domain-specific languages that are underrepresented in public training data. using splunk's search processing language (spl) as a case study, we define hallucination in this context and introduce a taxonomy of common error types. to boost the hallucination detection performance, we propose the self-debating framework, which uses contrastive reasoning by prompting a single llm to generate opposing explanations before making a final consistency judgment. to support systematic evaluation, we construct synspl, a synthetic benchmark for hallucination detection in spl generation. experimental results demonstrate that self-debating consistently outperforms promptingbased baselines across six popular llms, with particularly large gains observed in weaker models. furthermore, self-debating generalizes well to other domains, achieving strong performance on the faithbench summarization benchmark, including a new sota performance for o1-mini. our findings highlight the unique challenges of hallucination in underrepresented structured languages and show that contrastive reasoning is a scalable and effective strategy for improving the consistency and trustworthiness of llm-generated outputs.