Concept note · the lab vocabulary
Counterfeit code
Code that is not what it claims to be — it runs, reads clean, and does no real work.
What it is
Counterfeit code: code that is not what it claims to be. It compiles. It passes review. It reads clean. Its inputs never reach its outputs. It arrives in three recognizable shapes: dead code paths — branches and fallbacks that can never execute; severed data flow — values computed, then never used; and hollow functions — logic that looks right and does nothing. None of the three looks wrong, which is the entire reason each survives review.
In the lab
- CodeRadar →
- The counter-instrument: 97+ deterministic rules over the four invariants at file-save speed, one vetted before/after repair per finding, and every verdict written to a state mirror so the audit trail outlives the fix.
Our position
The word is chosen for its standard of proof: a counterfeit is judged against something objective, and so is this. Every legitimate implementation satisfies four invariants — inputs influence outputs, computation is captured, iteration accumulates, functions produce. Violating any one is proof of counterfeit, not an opinion about style: the violation is a property of the data-flow graph, demonstrable on the syntax tree, and the verdict is the same on every run. That is also why the checker cannot be another model. A probabilistic failure cannot be caught by a probabilistic checker — a model that hallucinates code can hallucinate a passing verdict, which is precisely the defect it was installed to catch. The gate has to be math: deterministic checks, binary verdicts, an audit trail that outlives the fix.
Honest limitations
A name this sharp invites overreach, so the boundary stays explicit. The invariants catch code that does no real work; they do not catch code that does the wrong real work — a clean verdict bounds review, it does not replace it. The definition is structural, not forensic: it says nothing about who or what wrote the code, and human-written code goes counterfeit too — machine generation just raises the rate faster than human review scales. And the published measurements that make the problem legible are point-in-time analyses of open-source work, not constants; the rates will move as the tools do. The definition is what holds still.
In the record
- Entrepreneur — software quality as a founder problem (Mudit Singh) →
- The symptoms, measured: AI-co-authored code carrying roughly 1.7× more issues, with security vulnerabilities at up to 2.74× the human rate (a December 2025 analysis of 470 open-source pull requests), and 25% of Y Combinator’s Winter 2025 startups shipping codebases roughly 95% AI-generated.
Related in the vocabulary
- Code provenance →
- Meets it in CodeRadar — whether code is what it claims to be — and proving it with an audit trail.
- Instrumentation →
- Meets it in CodeRadar — building the instrument that makes a hidden state legible.
The experiments are the proof
Every claim in this note is made concrete somewhere in the lab — the idea exists because the machines needed it.
The map of the lab →