Code does not lie, but it does hide — and so does a prompt. When I was handed a request to produce a blockchain analysis from "parsed content," I ran the first thing I always run: input validation. The result was a null pointer. No title, no source, no information points, no project name. An empty array where the evidence should be.
This is not a curiosity. It is the single most common failure mode in AI-assisted crypto research, and it deserves a forensic post-mortem because it is currently propagating across every research desk that has adopted large language models as a first-pass analyst.
The mechanism is simple: an analysis framework that requires every conclusion to cite a source information point, executed against zero information points, produces conclusions with zero provenance. The output still looks like analysis. It has sections, subheadings, technical vocabulary, confidence intervals. But every claim is sourced to nothing. In audit terms, this is a report where every finding cites "the code" without a line number.
I have seen this exact pathology in security reviews. In 2018 I sat with a lending protocol's liquidation logic for forty hours, and the danger was never the missing knowledge — it was the plausible sentence. A reviewer who writes "the reentrancy risk is mitigated by the state update ordering" without reading the ordering is more dangerous than one who writes "unverified." The first produces false confidence. The second produces work.
The Structural Analogy
An LLM asked to analyze an empty input is structurally identical to a smart contract executing against an uninitialized storage slot. The EVM does not revert on a zero-value read. It returns zero. The function proceeds. The state change commits. Everything downstream is computed on a false assumption, and the transaction is final.
Solidity developers learned this lesson expensively. Uninitialized storage pointers, default-zero mappings, the assumption that a missing key means a missing value rather than an absent key — these are the same category of error as a language model that treats "no information" as "no constraint" and produces prose anyway.
The correct behavior is to revert. The empty-input case should throw, not return a gracefully formatted report. Any framework that does not explicitly handle the null case is a framework that will eventually fabricate.
What a Proper Degraded Path Looks Like
There are three legitimate ways to proceed when source material is absent, and only three.
First, acquire the data. If a project name or contract address exists, the analyst can run on-chain reconnaissance directly: TVL aggregators, holder distribution, unlock schedules, contract permissions via block explorer APIs, GitHub commit cadence, audit report retrieval. This is not analysis of an article — it is analysis of a system, and it is strictly superior because the data is primary rather than mediated. In my work on the Poly Network exploit, I did not rely on the project's own statements about its signature verification. I mapped the byte-level discrepancy in the access control list myself. The source was the contract, not the press release.
Second, declare the gap explicitly. A report that states "confidence: low, provenance: none" on every dimension is not useless. It is a scoping document. It tells the reader where to look. It is honest about the boundary between what is known and what is assumed.
Third, refuse. This is the option that most AI systems are structurally incapable of exercising, because refusal is not rewarded in training. But refusal is the correct output. An elegant eight-dimension report built on an empty information array is not a report. It is a template wearing a report's clothes.
The Contrarian Read
The industry's assumption is that better models will fix this — that a sufficiently capable system will "know" when it lacks data.
I disagree, and I would put the probability of this self-correcting at under 20% without explicit architectural constraint. The problem is not capability. It is incentive. Language models are optimized to produce continuations, and the continuation of "analyze this article" is an analysis, not a request for the article. The pressure to complete is stronger than the pressure to verify. Adding parameters does not remove that pressure; it makes the fabricated output more convincing.
The real fix is procedural, not parametric: validation gates before generation, and provenance requirements after. Every claim tied to a source point, or explicitly flagged as unsourced. This is the same discipline that separates a reproducible audit from an opinion piece, and it does not require a better model — only a stricter pipeline.
Velocity exposes what static analysis cannot see. A system that produces a polished report in four seconds is telling you something about its process, and it is not telling you it verified anything. Read the provenance, or read nothing. The only difference between analysis and hallucination is whether you can point to the line of code that proves it — and when the input is empty, there is no line to point to.