DEV Community

Cover image for Context Not Provided Is Context Invented
Sandeep Dhuri
Sandeep Dhuri

Posted on • Originally published at acuity.press

Context Not Provided Is Context Invented

#ai #productivity #llm #programming

Originally published at acuity.press.
By Sandeep Dhuri

Law 4: the context gap gets invented — incorrectly

Every prompt is complete. Not because you completed it — because the model does. Whatever you leave unstated, it fills: the currency handling you assumed, the retry semantics you meant, the tenant-isolation rule "everyone knows." A language model has no access to what everyone knows. It has access to what you wrote and what the internet wrote, and when those conflict, silence sides with the internet.

Delta's Law 4 names the mechanism: context not provided is context invented. The model is not guessing maliciously; it is completing faithfully — from the wrong distribution. Veracode's 2026 analysis of why security performance has stayed flat across two years of model releases lands on exactly this: models learn from the public corpus, the corpus encodes historical practice, and the same insecure patterns that dominated in 2020 dominate the completions of 2026's flagships. Your unstated constraint is not merely missing; it is outvoted — by a few billion lines of average code.

What "providing context" actually means

Not more words. The right categories of words. The Specification Frame's context block carries the facts the model cannot infer:

  • Domain semantics: what the values mean (money, PHI, tenant IDs) and the rules attached to those meanings.
  • System invariants: what must remain true across every operation (idempotency, isolation, conservation).
  • Environmental truth: versions, frameworks, deployment realities that make one correct answer correct here.
  • Failure posture: what happens on the unhappy path (timeouts, partial writes, replays) because the corpus's average code handles the happy path and ships.

Each item you state removes one invented answer. The discipline is not verbosity; several of the highest-leverage constraints in the book are one line ("all queries are parameterized; string interpolation into SQL is prohibited"). It is coverage of the categories the domain cares about — which is why the book pairs the frame with per-domain checklists rather than a generic template.

The compounding payoff

Teams adopting this discipline report the same shape of result the 2026 measurements would predict: the model's raw capability finally cashes out, because it is completing your distribution instead of the internet's. And the alternative now has a public price tag: AI-attributable CVEs tripling in three months on Georgia Tech's tracker, software vulnerabilities leading the 2026 Verizon DBIR as the top breach entry point. The models will keep getting more fluent. Fluent invention is still invention. Say what you mean — all of it. And the machine is finally on your side of the gap.

I keep a private file of context-invented bugs. It reads like short fiction, except every ticket was real.

Adapted from Delta: Closing the Specification Gap (Dhuri, 2026), Law 4 and Chapter 12 — free: https://acuity.press · DOI: 10.5281/zenodo.21584309.

Sources: Veracode, Spring 2026 GenAI Code Security Update (2026); Georgia Tech SSLab, Vibe Security Radar (2026); Verizon, 2026 DBIR (2026).

Top comments (0)