YTYK You think you know

Card 12 of 18 Knowing whether it works ●●○ Working knowledge

The word for it is confabulation

NIST's term for what everyone calls hallucination is confabulation: the production of confidently stated but erroneous or false content by which users may be misled. NIST lists it as one of twelve risks unique to or exacerbated by generative AI.

Why it is like this

"Hallucination" suggests a malfunction — something that could be patched out. Confabulation names the real behaviour: the system is producing plausible continuations, and a plausible continuation that happens to be false is the system working normally.

Not to be confused with

A bug with a fix. NIST's framing is about risk management, not elimination: the danger is that confident phrasing causes users to act on false content, so the controls are citation, verification and interface design, not a better prompt.

In practice

This is why retrieval with visible sources reduces harm even when it does not reduce error — the reader gets something to check.

Source: NIST AI 600-1 — Generative AI Profile (AI RMF) — §2 — risk 2, Confabulation. Read on .

The OWASP Top 10 for LLM Applications is © the OWASP Foundation and published under a Creative Commons licence; NIST AI 600-1 is a US Government work in the public domain. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation or NIST.

Predict Check yourself

Why does NIST prefer "confabulation" to "hallucination"?

  1. Because it names confidently stated false content as a normal output of the mechanism, rather than implying a malfunction that could be fixed.
  2. Because hallucination is a trademarked term in some jurisdictions.
  3. Because confabulation refers only to errors in retrieved content.
  4. Because it distinguishes deliberate deception from accidental error.
Show the answer

Because it names confidently stated false content as a normal output of the mechanism, rather than implying a malfunction that could be fixed.

The vocabulary choice carries the risk-management point: you manage it, you do not patch it.