Frequently Asked Questions

In AI, a hallucination is when a language model generates text that sounds confident and fluent but is factually wrong, fabricated, or unsupported. Examples: a lawyer citing a case that doesn't exist, a summary that contradicts the source document, or a chatbot inventing a statistic. The model isn't lying — it has no concept of truth — it's producing plausible-sounding tokens that happen to be wrong.

It's a hallucination detector for LLM output. You paste a response (or call the API), and you get back a calibrated probability score (0–1), a booleanflag (true when the calibrated threshold is crossed), and the most likely type of hallucination. The detector analyzes the response text itself — it doesn't need to know which model produced it.

The detector is probabilistic, not perfect — it outputs a 0-1 score plus a per-type breakdown that's useful as a triage signal or risk indicator, not a definitive verdict. Some hallucination types are caught much more reliably than others. See the Performance page for current numbers and the full per-type breakdown.

It's strongest on counterfactual authority (fake or misattributed citations) and fabricated facts (invented entities, dates, or statistics) — both around 0.80 AUC on out-of-distribution text. Near-false claims (misleading-but-technically-true) are weaker, and false refusals and underspecified answers are weakest at v1 — see the Performance page for honest per-class numbers. Anything the model can't reliably classify is returned as Other rather than a misleading label.

All of them. The detector reads the response text — it doesn't receive API calls to the source model, inspect model weights, or need to know which system produced the text. If you have the response, you can check it.

A few things are out of scope at launch: (1) closed-domain hallucinations, where the LLM contradicts a document you gave it — the detector only sees the response, not your source material; (2) code correctness — that's a planned future release; (3) languages other than English; (4) very recent facts past the model's knowledge cutoff. Fabricated facts about obscure topics are especially hard — a made-up claim can look identical to a correct one. See the Performance page for per-type numbers.

Neither, exactly. It's a probabilistic signal that a response contains patterns associated with hallucinated content. It should prompt you to verify, not substitute for verification. We specifically ask that you not use it as the sole input for medical, legal, safety-critical, or financial decisions.

Sign up free — no credit card — then go to the detector and paste any LLM response. The detector is sign-in-gated; there is no anonymous tier. The Free tier includes 300 web checks/month plus 3,700 API units/month. See the Pricing page for exact limits.

300 web-app checks/month plus 3,700 API units/month, plus an API key. No credit card required. See the Pricing page for exact limits. Sign up with Google (one click) or with email and password.

Sign up for a free account. Your API key is shown once at creation — copy it; we never store the raw value. You can also create additional keys or revoke them from your account page.

No. The Free web and API tiers require no payment details. A card is required only when you upgrade to a paid plan.

First create a free API key in the dashboard — every request, including on the free tier, needs one. Then pass it as Authorization: Bearer <key> with curl, requests, or our halu Python library:

curl -X POST https://api.komplexai.io/api/detect \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"response": "The Eiffel Tower was built in 1789 by Napoleon Bonaparte."}'

See the Guide for copy-paste examples in Python and curl.

Go to the detector, paste the LLM response into the text box, and click Paste & Go (reads from clipboard automatically) or Go(runs on whatever is in the box). You'll see a risk band, a probability score, and the top hallucination type within a couple of seconds.

Optional. The detector works well on response text alone. Including the prompt helps classify what kind of hallucination it is (regime classification) but has minimal effect on the binary hallucination score.

The web detector page buckets the raw probability score into three visual bands for at-a-glance scanning. These are display-only — the API itself returns the raw p_hallucination float and a calibrated flag boolean, not a band label. The bands shown in the web UI:

The regime is the most likely hallucination pattern. The API returns one of: FABRICATED (invented facts), NEAR_FALSE (misleading but technically true), CF_AUTH (fake or misattributed citations), FALSE_REFUSAL (refusing a reasonable request), NORMAL (not a hallucination), or Other. Anything the detector cannot reliably distinguish from clean text on out-of-distribution input is returned as Other at v1, rather than a label whose accuracy is at chance. The Performance page describes each type with examples and per-type accuracy. Hover any regime label in the result card for a one-line description.

All tiers are capped at 2,048 characters per detection at v1. The character counter is visible in the bottom-right corner of the text box. Long-document detection is planned for a later release. See the Pricing page for daily and monthly quotas.

Every tier has a 2,048-character cap per detection at v1. Longer input is trimmed and you'll see a “Clipped” notice. Long-document detection is planned for a later release.

The only required field is response. Raw HTTP works without any library:

curl -X POST https://api.komplexai.io/api/detect \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"response": "The Eiffel Tower was built in 1789 by Napoleon Bonaparte."}'

See the Guide for Python and curl examples.

Pass your API key in the Authorization header as Bearer YOUR_API_KEY. Free-tier requests need a key too — a free one. Get your key from your account page. See the Guide for full auth examples.

No. response is the only required field. Including prompt improves regime classification accuracy but has minimal effect on the binary hallucination score. Most integrations send response-only.

You get back p_hallucination (float 0–1, calibrated probability), flag (bool, true if the calibrated threshold was crossed), top_regime, regime_scores (array of up to 6 entries), request_id, detections_billed, mode, latency_ms, model_version, calibrator_version, input_mode_used, task_used, and a warnings array. See the full schema on the API docs page.

An optional integer that controls how many regime scores are returned in regime_scores. Defaults to 6 (all current public regime classes). Pass a smaller number if you only care about the top result.

Limits vary by plan. Every response includes X-Quota-Remaining and X-Quota-Period headers so you can track your usage in real time. See the Pricing page for the per-plan rate and quota table.

You get an HTTP error with a machine-readable body and a retry hint. Failed requests are never billed against your quota. See the Guide for the full error schema.

Auth errors, rate-limit errors, input validation errors, and transient service errors. All return consistent JSON with an error code and a human-readable message. See the Guide for the full list.

Yes — 2,048 characters per field at v1, across all tiers. Longer inputs to the API are rejected with an input_too_long error (HTTP 400); the web UI clips at the limit before sending. Long-document detection is planned for a later release. See the Guide for character-cap details.

Yes — the spec is served as a static file at https://detector.komplexai.io/openapi.yaml. You can feed it directly to openapi-generator, openapi-typescript, or any other code-gen tool to generate clients for languages we don't ship first-party. For the human-readable reference + examples, see the API docs page.

Yes — halu is a small Python library on PyPI: pip install halu. The API itself is a single POST endpoint with standard JSON, so any HTTP client works too. See the Guide for examples using the library, plus raw curl.

Treat flag=true (or a high p_hallucination) as a strong signal to verify, not a definitive ruling. The score is a calibrated probability — 0.85 means the model assigns 85% probability of hallucination based on learned patterns. It can be wrong. Fabricated facts are the hardest class, and highly specialized domain content (medical, legal, technical) can produce both false positives and false negatives.

False positives happen — the detector is a probabilistic signal, not a fact-checker. They're most likely on very short inputs: a single short sentence gives the model little to work with, and it tends to over-flag. The detector works best on complete, multi-sentence responses. Treat a flag on a short true statement as a prompt to double-check, not a verdict — and give it more context where you can.

A low p_hallucination (and flag=false) means the response does not exhibit strong hallucination patterns. It is not a guarantee of factual accuracy. Closed-domain hallucinations (contradictions of a specific source document you provided) and very recent facts past the model's knowledge cutoff will not be caught regardless of score.

Significantly. Some types (CF_AUTH — fake or misattributed citations) score very high; fabricated facts are hardest because a made-up claim about an obscure topic looks structurally identical to a correct one. See the Performance page for the full per-type table.

Not yet. Code detection is planned for a future release. The current model is trained and evaluated on general-context English prose. See Research for what's planned.

English only at launch. Other languages are untested and accuracy is not characterized for them.

Partially. It can catch open-domain hallucinations in the response — fabricated claims and fake or misattributed citations. It cannot catch closed-domain hallucinations where the LLM contradicts a document you fed it, because the detector only sees the response, not your retrieval context. Closed-domain detection is on the roadmap — see Research for what's planned.

Yes. The scores are calibrated probabilities, not raw model outputs. A score of 0.7 is intended to mean approximately 70% of responses with that score actually contain hallucinations on our benchmark.

Two tracks — Web (browser) and API — each with a free tier and paid plans. See the Pricing page for the full table of limits, quotas, and prices.

One detection = one API call to /detect on up to 2,048 characters of input (response plus optional prompt), regardless of whether a hallucination is found. Failed requests (HTTP 429 or 503) are never billed. See the Pricing page for tier limits and overage rates.

There's no hard cutoff — your service keeps running and additional checks are billed at per-plan overage rates via Stripe. See the Pricing page for overage rates by tier.

Once your monthly usage exceeds the included quota plus overage on your current plan, the next tier's flat rate becomes cheaper. The Pricing page has the break-even thresholds for each tier.

Yes. Monthly plans cancel at the end of the current billing period with no penalty. Cancellation is available through the Stripe Customer Portal linked from your account dashboard.

Charges are non-refundable. You can cancel any time before the next monthly renewal via the Customer Portal; access continues through the end of the period you already paid for. (This matches the standard developer-SaaS pattern used by Stripe, Vercel, GitHub, and others.)

You'll get advance notice and a grandfather period before any price change takes effect on your account. See the Pricing page for our current commitments.

No — unused detections do not roll over. Your monthly quota resets at the start of each billing period.

Submitted text is not stored. It is processed in memory for the detection call and discarded immediately. Only minimal metadata (timestamp, status code, request byte count — no content) is retained for billing and abuse prevention. This applies to all tiers and to every API call at v1.

No. We do not retain submitted text, so there is nothing to train on. This is the same for free and paid tiers, and the same regardless of whether you are signed in. There is no opt-in or opt-out toggle for v1 because there is nothing to opt into.

No. Don't submit personal data, credentials, health records, non-public business information, or legally privileged material. Strip or redact sensitive fields before sending. The detector doesn't need real content — synthetic or anonymized text works fine.

Only the inference backend processes it. Our third-party service providers (Clerk for auth, Stripe for payments, Modal for inference) are each contractually restricted to the purposes described in the Privacy Policy. We do not share content with third parties for marketing or advertising.

It is not retained. Submitted text is processed in memory and discarded as soon as the response is returned. Only minimal metadata (timestamp, status code, byte counts — no content) is kept for billing and abuse prevention. See the Privacy Policy for the full retention schedule.

No. We use only essential cookies: theme preference (local storage), authentication session, and short-lived rate-limiting signals. No advertising cookies, no cross-site tracking, no third-party analytics that build profiles across sites.

GDPR applies. You have rights of access, correction, deletion, portability, and objection. We are the data controller for general use; enterprise customers under a DPA may designate us as processor. International transfers from the EU/UK rely on Standard Contractual Clauses with our service providers. Contact us through the Contact page to exercise your rights.

Sign up with Google OAuth (one click) or with email and password. No credit card required for a free account.

After signing up, go to your account page. Your key is shown exactly once at creation — copy it immediately. We never store the raw value.

Revoke the old key from your account page and generate a new one. The old key stops working immediately once revoked.

Yes. You can create multiple keys from your account page — useful for separating production, staging, and local development environments. Each key belongs to your plan, so quota is shared across all your keys.

Go to your account page and click Manage next to your billing row. This opens the Stripe Customer Portal, where you can update your payment method, view invoices, change plan, or cancel.

From the account page, scroll to the Danger Zone section and click Delete. Account deletion cancels any active subscription and is permanent.

Sub-second to a few seconds depending on input length and instance warmth. The latency_ms field in every response lets you measure it directly. See the Performance page for benchmarked latency numbers.

The inference backend is serverless (Modal), scaling to zero when idle to keep the free tier free. Cold starts can add ~10–30 secondsto the first request after a quiet period. You'll get an HTTP 503 or a timeout on that first call — wait a few seconds and retry (exponential backoff). Later requests are fast.

No dedicated batch endpoint at launch. For bulk workloads, parallelize calls up to your tier's burst rate limit — higher tiers support meaningful pipeline throughput. See the Pricing page for per-tier burst limits. A dedicated batch API is on the roadmap.

The common pattern is: call your LLM, pass the response to POST /detect, and decide what to do based on flag (boolean — true when the calibrated threshold was crossed) or by thresholding p_hallucination directly. Options include: raise an exception and retry (for automated pipelines), log the score for offline review, surface a warning to the user, or filter flagged responses before they reach downstream systems. See the Guide for code examples.

The API allows the Komplex AI web app origin detector.komplexai.io and localhost:3000 for local development. Other browser origins are blocked. If you need to call the API from a browser on a different domain, contact us. (Server-to-server calls are unaffected by CORS.)

At /terms. By using the detector or the API you agree to those terms.

Komplexity AI LLC, a California limited liability company.

Yes. Enterprise customers with specific data handling requirements can request a DPA via the Contact page. Under a DPA, your submissions are never used for model training and retention is governed by the agreement.

We have implemented data practices consistent with GDPR (EU/UK/Switzerland) and CCPA (California). Our Privacy Policy describes our obligations and your rights under both frameworks. This policy has not been reviewed by outside counsel — if you need legal certainty, have your own counsel review it.

Not at launch. We are a small independent team. SOC 2 compliance is on the roadmap for enterprise readiness. Enterprise customers requiring certification should contact us to discuss their timeline.

We are based in the United States. Our infrastructure is primarily in the United States (Modal for inference, Postgres for API key and usage storage, Clerk for auth, Stripe for payments). EU/UK/Switzerland customers' data is transferred to the US under Standard Contractual Clauses.

Yes, subject to the Terms of Use. You may use the hallucination probability scores and detection results in your own product. You may not resell raw API access or represent the output as a guarantee of factual accuracy.

Code hallucination detection (incorrect function signatures, invented APIs, wrong behavior) is planned for a future release. The current model is trained on general-context English prose. No specific date is committed. See Research for the planned extension scope.

Yes, eventually. English is first because that's where the training data is most mature. Other languages are on the roadmap but without a committed timeline.

Closed-context detection — catching cases where an LLM contradicts a specific document you provided — is on the roadmap. It requires a different approach (comparing the response against the retrieval context) and is not in the current release. See Research for the planned extension scope.

A dedicated batch endpoint is planned. For now, parallelize calls up to your tier's burst limit. Growth and Scale tiers support meaningful throughput for offline pipelines.

Yes — halu is a small library on PyPI: pip install halu. It wraps the single POST endpoint with a clean Python API plus a few convenience helpers (raise-on-flag, regenerate-until-clean). The raw HTTP API also works directly if you'd rather skip the library — see the Guide for both paths.

Not at launch. Custom fine-tuning or per-customer calibration is a future possibility for enterprise agreements. No timeline committed.

Performance numbers and major changes will be posted on the Performance page. For questions or to be notified of updates, use the Contact page.