Source-linked AI summary
Large Language Models are Zero-Shot Fuzzers: Fuzzing Deep-Learning Libraries via Large Language Models
Yinlin Deng, Chunqiu Steven Xia, Haoran Peng, Chenyuan Yang, Lingming Zhang
TL;DR
Fuzzing DL libraries is difficult because generated programs must satisfy both Python syntax and semantics and intricate tensor API and shape constraints. TitanFuzz uses generative and infilling LLMs to synthesize and mutate DL programs, achieving higher coverage than prior fuzzers and finding previously unknown bugs.
Problem
DL-library fuzzing is difficult because programs must satisfy Python syntax/semantics and library-specific tensor input and shape constraints.
Method
TitanFuzz uses a generative LLM to create seed programs and an infilling LLM with evolutionary fuzzing to mutate them toward valid, diverse API-using programs.
Results
TitanFuzz improves code coverage over state-of-the-art fuzzers on both libraries and detects 65 bugs, including 41 confirmed previously unknown bugs.
Takeaways & Limitations
The paper demonstrates that modern LLMs can directly perform automated generation-based and mutation-based fuzzing for DL libraries and other challenging software domains.
Takeaways & Limitations
The evaluation's external validity is constrained by its benchmark selection of two popular DL libraries, PyTorch and TensorFlow.
Abstract
from arXiv · showhide
Detecting bugs in Deep Learning (DL) libraries (e.g., TensorFlow/PyTorch) is critical for almost all downstream DL systems in ensuring effectiveness/safety for end users. Meanwhile, traditional fuzzing techniques can be hardly effective for such a challenging domain since the input DL programs need to satisfy both the input language (e.g., Python) syntax/semantics and the DL API input/shape constraints for tensor computations. To address these limitations, we propose TitanFuzz - the first approach to directly leveraging Large Language Models (LLMs) to generate input programs for fuzzing DL libraries. LLMs are titanic models trained on billions of code snippets and can auto-regressively generate human-like code snippets. Our key insight is that modern LLMs can also include numerous code snippets invoking DL library APIs in their training corpora, and thus can implicitly learn both language syntax/semantics and intricate DL API constraints for valid DL program generation. More specifically, we use both generative and infilling LLMs (e.g., Codex/InCoder) to generate and mutate valid/diverse input DL programs for fuzzing. Our experimental results demonstrate that TitanFuzz can achieve 30.38%/50.84% higher code coverage than state-of-the-art fuzzers on TensorFlow/PyTorch. Furthermore, TitanFuzz is able to detect 65 bugs, with 41 already confirmed as previously unknown bugs. This paper demonstrates that modern titanic LLMs can be leveraged to directly perform both generation-based and mutation-based fuzzing studied for decades, while being fully automated, generalizable, and applicable to domains challenging for traditional approaches (such as DL systems). We hope TitanFuzz can stimulate more work in this promising direction of LLMs for fuzzing.
1 INTRODUCTION
Existing DL-library fuzzers struggle to exercise diverse API sequences and arbitrary valid code because Python semantics and tensor shape constraints are difficult to satisfy. TitanFuzz uses generative and infilling LLMs with evolutionary mutation to improve API and code coverage and detect bugs.
- Challenges: Prior fuzzers mainly test individual APIs or complete models, limiting their ability to expose bugs caused by chained API sequences.API-level fuzzers isolate single calls, while model-level fuzzers often use restricted mutation rules and limited API patterns.
- Challenges: A PyTorch GPU bug triggered by the log-to-matrix_exp sequence is missed when the intermediate tensor is passed directly.The sequence exposes a synchronization error involving NaN values that prior API-level fuzzers cannot find and model-level fuzzers rarely generate.
- Challenges: Traditional synthesis and fuzzing methods restrict code structure and input variety because DL APIs have diverse parameters, types, and tensor-shape constraints.Predefined grammars and small mutations reduce generation errors but limit the variety of programs and inputs tested.
- TitanFuzz: TitanFuzz combines generative LLM seed synthesis with infilling-LLM mutation and evolutionary fuzzing to generate valid and diverse DL programs.The approach uses Codex for seeds and InCoder-based mutation operators to replace parts of existing programs.
- Significance: TitanFuzz opens a dimension for fully automated, generalizable LLM-based generation and mutation fuzzing in domains challenging for traditional approaches.The paper identifies potential extensions beyond DL systems, including compilers, interpreters, databases, and SMT solvers.
- Results: TitanFuzz covers 1329/2215 APIs with 20.98%/39.97% coverage on PyTorch/TensorFlow and improves state-of-the-art code coverage by 50.84%/30.38%.It detects 65 bugs, including 41 confirmed previously unknown bugs.
2 BACKGROUND AND RELATED WORK
DL libraries provide the APIs underlying model construction, while prior fuzzers operate either on complete models or individual APIs. LLMs support generative completion and infilling, motivating their use for broader code-generation-based fuzzing.
- Deep Learning Libraries: DL libraries such as TensorFlow and PyTorch provide thousands of APIs used to build, train, and deploy models.The paper illustrates these APIs through convolutional and linear layers in a model's forward pass.
- Prior Fuzzing Work: Model-level fuzzers test complete DL models, whereas API-level fuzzers generate inputs for one library API at a time.Model-level approaches compare outputs across backends or synthesize models; API-level approaches mine or infer valid inputs before mutation.
- Prior Fuzzing Work: Model-level generation is restricted by API input/output constraints or requires manual annotations, limiting unique API coverage and mutation patterns.Examples include shape-preserving mutation rules and manually annotated API restrictions.
- Large Language Models: LLMs are pretrained on billions of text tokens and can perform downstream tasks through prompt engineering without specialized fine-tuning.The paper connects this capability to code-generation applications supported by code naturalness.
- Large Language Models: LLM architectures include decoder-only, encoder-only, and encoder-decoder models with different pretraining and context-processing schemes.Decoder-only models predict the next token from left context, while encoder-only models learn representations using masked language modeling.
- LLM-Based Code Generation: Code generation includes generative completion from left context and infilling that replaces masked spans using surrounding context.TitanFuzz uses infilling to mutate small parts of input programs and produce more diverse programs.
- LLMs for Fuzzing: Earlier neural fuzzers trained models to synthesize code, while COMFORT fine-tuned GPT-2 on open-source JavaScript programs for engine testing.The paper distinguishes these approaches from TitanFuzz's direct use of modern pretrained code LLMs.
- LLMs for Fuzzing: TitanFuzz differs from unit-test generation by using system-level fuzzing oracles and by supporting both generation-based and mutation-based fuzzing.The approach is presented as fully automated and applicable to challenging real-world systems when sufficient code examples exist in pretraining data.
3 APPROACH
TitanFuzz combines generative and infilling LLMs with evolutionary fuzzing to create and mutate DL-library programs. It guides mutation and seed selection toward valid, diverse programs with deeper API interactions.
- 3.2 Evolutionary Fuzzing: TitanFuzz combines Codex-generated seeds with InCoder infilling to produce additional mutated programs using context before and after masked code spans.Codex provides high-quality seeds, while InCoder replaces selected portions with related code.
- 3.1 Initial Seed Generation: Codex generates multiple initial seed programs for each target DL API using step-by-step prompts containing the library and API signature.The API signature is automatically extracted from API documentation, and the prompt instructs the model through multiple generation steps.
- 3.2.2 Mutation Operator Selection: TitanFuzz adaptively selects mutation operators with a multi-armed bandit, updating operator posteriors from valid and invalid generated samples.The approach models each operator as an arm and uses beta-Bernoulli reasoning with Thompson Sampling to balance exploration and exploitation.
- 3.2.1 Mutation Operators: Four mutation operators—argument, prefix, suffix, and method—mask one or more seed segments so the infilling model can generate alternative API calls and program behaviors.Argument replacement can target arbitrary library APIs, while keyword mutations are intended to expose bugs in API-call combinations.
- 3.2.4 Fitness Function: The fitness function favors programs with deeper dataflow graphs and more unique API calls while penalizing repeated API calls with the same inputs.This prioritizes long-chained API sequences and diverse interactions while avoiding inefficient repetition.
4 EVALUATION
The evaluation examines TitanFuzz against prior DL-library fuzzers, its component contributions, and its ability to detect real-world bugs on PyTorch and TensorFlow.
- The study asks how TitanFuzz compares with existing fuzzers, how its components contribute, and whether it detects real-world bugs.
- Seed generation samples 25 Codex programs per API using configured nucleus sampling, token, and temperature settings.
- Generated programs are repaired by removing trailing lines until syntax parsing succeeds, while InCoder performs fuzzing mutations.
- The evaluation targets PyTorch v1.12 and TensorFlow v2.10, using a default one-minute fuzzing budget per API.
- For RQ3, the fuzzing budget increases to four minutes per API, and Python line coverage is measured with coverage.py.
5 RESULT ANALYSIS
TitanFuzz achieves higher API and line coverage than prior fuzzers, with guided LLM generation contributing to sustained coverage and the discovery of confirmed bugs.
- 5.1 RQ1: Comparison with Prior Work: TitanFuzz covers 2215 TensorFlow APIs and 1329 PyTorch APIs, the highest counts among compared techniques.
- 5.1 RQ1: Comparison with Prior Work: 50.84% and 30.38% higher line coverage than DeepREL is achieved on PyTorch and TensorFlow, respectively.
- 5.1 RQ1: Comparison with Prior Work: TitanFuzz continues improving coverage after 50 seconds, whereas DeepREL’s coverage barely increases after approximately 10 to 20 seconds.
- 5.2.1 Seed Generation: A step-by-step prompt and API signatures improve Codex’s valid-program generation and API coverage, with temperature 0.4 balancing these outcomes.
- 5.2 Component Analysis: The fitness function’s preference for unique APIs and longer chained sequences produces higher coverage than random selection.
- 5.2 Component Analysis: Thompson Sampling generates more unique valid programs and higher code coverage than uniformly random operator selection.
- 5.2 Component Analysis: Codex provides high-quality seeds, while the smaller InCoder model is faster for evolutionary mutation.
- 5.3 RQ3: Detected Bugs: 65 bugs are detected, including 53 confirmed bugs and 41 confirmed as previously unknown; 8 of the unknown bugs are fixed.
6 CONCLUSION
TitanFuzz applies generative and infilling LLMs to DL-library fuzzing, improving API and code coverage while uncovering previously unknown bugs.
- TitanFuzz combines generative LLMs for seed programs with infilling LLMs in an evolutionary algorithm for mutation.The approach uses prompt engineering to generate seeds and LLM-based mutation to expand the test-program pool.
- TitanFuzz significantly improves covered library APIs and code coverage on PyTorch and TensorFlow.
- 65 bugs were detected, including 41 confirmed as previously unknown.