Foundational Research: Ontology-Native AI
Semantic-Integrity Defects Evade Static Analysis and Shape Validation: A Cross-Library Detection Study
Detecting semantic-integrity defects across four knowledge-graph libraries. A controlled study of four real defects in popular open-source knowledge-graph libraries, and whether mainstream static analysis and SHACL validation catch them. They do not. A semantic verifier does.
Why these defects hide
Knowledge graphs increasingly sit underneath production AI systems, and a defect in how a graph is serialized, parsed, or validated can silently corrupt data or open an injection path. These defects live in the semantic layer rather than in the control flow of the program, so the tools that ordinarily guard software may not see them at all. We ran a small controlled study to find out whether they do.
Method
We took four confirmed defects in four popular open-source knowledge-graph and RDF libraries, kept anonymous here, spanning serialization, parsing, and validation. For each defect we ran the analysis tool appropriate to its layer and Open Ontologies against the same artifact. Every artifact was produced by the library's own code, not simulated.
The four defects
Each defect is a genuine fault in a real library, described here at the level of mechanism so that nothing identifies the source.
- A hand-rolled serializer interpolates a language tag without escaping, so a crafted value forges an additional triple, which is an injection.
- An identifier encoder omits the backslash from its set of forbidden characters, so it emits an IRI that a strict parser must reject and a lenient one silently misreads as a different identifier.
- A parser flattens datatype, language tag, and IRI-versus-literal distinctions, so terms that are genuinely different become indistinguishable once imported.
- A validation component generates constraint shapes that target a namespace absent from the data, so the shapes match nothing and the artifact is certified as conformant even though a required field is missing.
Results
| Defect | Appropriate mainstream tool | Verdict | Open Ontologies |
|---|---|---|---|
| Serialization injection | Pattern-based and dataflow static analyzers | Not flagged | Caught (surfaces the forged triple) |
| Invalid identifier | Pattern-based and dataflow static analyzers | Not flagged | Caught (rejects the invalid identifier) |
| Information loss on import | Pattern-based and dataflow static analyzers | Not flagged | Caught (preserves the term distinctions) |
| Vacuous validation | A reference SHACL validator | Reported "Conforms: True" | Caught (reports conformance as undetermined and names the unmatched shape) |
The pattern-based analyzer ran 694 security rules including an OWASP pack. The dataflow analyzer ran its full security-extended suites, 50 and 103 queries with interprocedural taint analysis, and still passed the injection, which is precisely the class it advertises.
What we found
Across the four defects, the mainstream tool appropriate to each layer flagged none. The static analyzers passed the serialization and parsing defects clean, including the injection, because the dangerous sink is defined in the data model rather than in the program, so no amount of code-level analysis reaches it. The reference validator certified the vacuous-shape artifact as conformant. Open Ontologies caught all four.
The boundary we do not cross
One further defect we examined, an edge reversal in application logic over a non-RDF graph, is caught by no tool including Open Ontologies, because it is a semantic-correctness error with no structural signature. We state the boundary rather than hide it.
What it means
The standard toolchain guards the code, not the meaning. When the correctness of a system depends on the semantics of the data it emits, verification has to operate at the semantic layer, on the artifact itself, which is where Open Ontologies works.
"A static analyzer can read every line of the code and still miss the defect, because the defect is in the meaning of the data the code emits, not in the code."
Fabio Rovai, Tesseract Academy
Verify at the semantic layer
The engine that caught all four defects is open source.
