Large Language Models are Edge-Case Fuzzers: Testing Deep Learning Libraries via FuzzGPT

Motivation

• Valid DL-library fuzzing inputs must satisfy both programming-language syntax and semantics and tensor/operator constraints for valid computational graphs.Model-level fuzzers may cover limited APIs and patterns, while API-level fuzzers do not expose bugs caused by interactions among APIs.Source: §1 · p. 1
• TitanFuzz can generate valid DL programs, but ordinary, human-like inputs may miss additional library behaviors and paths.Its LLM generation follows patterns from training corpora, whereas fuzzing seeks unusual inputs.Source: §1 · p. 2

Our Work

• FuzzGPT primes LLMs with historical bug-triggering programs through in-context learning or fine-tuning to generate unusual code ingredients and programs.The approach aims to learn generation constraints without dedicated human-built generators.Source: §1 · p. 2
• 60.70%/36.03% higher coverage than TitanFuzz on PyTorch/TensorFlow; FuzzGPT found 76 bugs, including 49 confirmed new bugs and 11 high-priority bugs or security vulnerabilities.These results are reported for FuzzGPT's evaluation on the two libraries.Source: §1 · p. 2

2.1 Large Language Model

• Fine-tuning updates LLM weights using task data, whereas in-context learning uses examples in the prompt without modifying model weights.The paper focuses mainly on Codex and CodeGen and also uses ChatGPT's instruction-following capability for fuzzing.Source: §2.1 · pp. 2–3

2.2 Fuzzing with Historical Bugs

• Traditional history-based fuzzers extract, recompose, or mutate code ingredients from bug-triggering programs, while FuzzGPT learns from such code through LLM fine-tuning and in-context learning.FuzzGPT is presented as automated and generalizable, with LLMs implicitly learning DL program constraints.Source: §2.2 · p. 3

2.3 Fuzzing via Deep Learning

• Earlier DL-based fuzzers used neural models, and TitanFuzz later applied modern LLMs to DL-library fuzzing; FuzzGPT adds historical bug-triggering code as guidance.The paper characterizes this as the first demonstration of automated, generalizable LLM-based history-driven fuzzing for the challenging DL-library domain.Source: §2.3 · p. 3

3 APPROACH

• FuzzGPT mines bug reports for historical code and uses LLM prompting with a few manual labels to annotate snippets with buggy APIs.The labels and snippets form the dataset used in the subsequent fuzzing procedure.Source: §3 · p. 3
• For a target API, FuzzGPT either prompts a pretrained LLM with bug-triggering examples or partial/complete code, or fine-tunes it on the extracted dataset.The methods generate, complete, or edit programs resembling historical bug-triggering code.Source: §3 · p. 3
• FuzzGPT executes generated programs with test oracles, including CPU/GPU and automatic-differentiation oracles, for bug detection.Source: §3 · p. 3

3.1 Dataset Construction

• The dataset pairs each bug-triggering code snippet with its corresponding buggy DL-library API.Source: §3.1 · p. 4

3.1.1 Mining Bug History from GitHub.

• An HTML crawler collects issues and pull requests, extracting code blocks from accepted or pending fixes and code blocks in pull-request commit messages.Issue or pull-request titles are also retained for prompts and fine-tuning.Source: §3.1.1 · p. 4

3.1.2 Automated Buggy API Annotation.

• A few manually labeled examples prime an LLM to predict the buggy API for each mined snippet, and only six examples were manually annotated per target library.Labels need not be fully precise: even a different API used in the triggering code can guide generation of patterns that invoke the target API, and generated code may expose bugs in another API.Source: §3.1.2 · pp. 4–5

3.2.1 Few-shot Learning.

• Few-shot learning prepends examples containing an API name, bug description, and triggering code, then asks the LLM to describe a possible bug before generating code.The prompt uses K examples and a target API query; the predicted bug description provides an additional hint about potential buggy behavior.Source: §3.2.1 · p. 5

3.2.2 Zero-shot Learning.

• Zero-shot completion gives the LLM a prefix of a historical bug-triggering snippet, while zero-shot editing asks it to adapt a complete snippet for a target API.Completion removes a random suffix; editing is designed to reuse most of the original code.Source: §3.2.2 · p. 5
• Zero-shot learning reuses concrete lines from historical bugs, which may contain edge-case values, tensor shapes, or unconventional API usages for targeting additional APIs.Unlike few-shot learning, it asks the model to complete a partial program or replace a small portion of code.Source: §3.2.2 · p. 5

3.2.3 Fine-tuning.

• Fine-tuning updates model weights by training on historical bug-triggering snippets, each formatted with an API name, bug description, and code snippet.FuzzGPT trains a separate model for each DL library and prompts the fine-tuned model with a target API.Source: §3.2.3 · p. 6

• Crash checks detect unexpected aborts, segmentation faults, and INTERNAL_ASSERT_FAILED errors; such crashes may expose security vulnerabilities.The CPU/GPU oracle detects wrong-computation bugs by comparing outputs across execution backends with a tolerance for nondeterministic APIs.Source: §3.3 · p. 6
• The automatic-differentiation oracle detects gradient-computation bugs by comparing reverse-mode AD, forward-mode AD, and numerical differentiation.Source: §3.3 · p. 6

• The dataset contains 1,750 PyTorch and 633 TensorFlow bug-triggering snippets mined from historical issues or PRs, after filtering invalid or overly long code.Snippets that fail syntax checking or exceed 256 tokens are excluded.Source: §4 · p. 6
• Buggy APIs are labeled with Codex using six manually annotated examples; evaluation on 100 PyTorch issues/PRs found 76% precision.The study evaluates Codex and CodeGen, and fine-tunes separate CodeGen models for each library because Codex is not open source.Source: §4 · p. 6

5.1 Research Questions

• The evaluation asks how FuzzGPT learning strategies compare with one another and existing fuzzers, how components contribute, and whether it detects new bugs.Source: §5.1 · p. 7

5.2 Experimental Setup

• FuzzGPT is evaluated on PyTorch and TensorFlow; comparisons use the same library versions and public Python APIs as TitanFuzz, with Muffin run only on TensorFlow.The ablation study uses 50 randomly sampled PyTorch APIs and averages five runs; the default generation budget is 100 programs per target API.Source: §5.2 · p. 7

5.3 Metrics

• Evaluation measures include unique detected bugs and crashes, Python line coverage, covered APIs, and unique valid programs that execute successfully and invoke the target API.Source: §5.3 · p. 7

6.1 Comparison of Learning Paradigms

• FuzzGPT-FS covers the most APIs and generates the most unique valid programs on both libraries, while FuzzGPT-ZS achieves the highest PyTorch coverage and FuzzGPT-FT has comparable coverage.Coverage in all three variants continues to grow after 100 generated snippets; fine-tuning has the highest PyTorch valid rate, but requires a high-quality dataset and task-specific model training.Source: §6.1 · pp. 7–8, Figure 5 · p. 8

6.2 Comparison with Prior Work

• 54.37% line coverage on TensorFlow and 33.72% on PyTorch were achieved by FuzzGPT-FS/FuzzGPT-ZS, improving over TitanFuzz by 36.03%/60.70%, respectively.All three FuzzGPT variants significantly outperform existing fuzzers in code coverage; API coverage is similar to TitanFuzz.Source: §6.2 · p. 8, Table 2 · p. 8
• FuzzGPT-FS detects 2.5 times as many unique crashes as TitanFuzz; combining variants finds 19 crashes, including 14 unique to FuzzGPT and one unique to TitanFuzz.Even FuzzGPT-FS-25 substantially outperforms TitanFuzz at lower cost, though precise efficiency comparisons across different LLMs are difficult.Source: §6.2 · p. 8, Figure 6 · p. 8

6.3.1 Few-shot Learning

• In few-shot learning, larger CodeGen models improve coverage, and CodeGen-6B achieves coverage comparable to Codex; adding bug descriptions improves coverage and API diversity.Coverage rises as examples are added from K=0, then begins to decrease with more examples, which the authors suggest may distract the model.Source: §6.3.1 · p. 9, Figure 7 · p. 9, Figure 8 · p. 9

6.3.2 Zero-shot Learning

• In zero-shot learning, completion with partial historical programs achieves higher coverage than completion from natural-language descriptions alone, but has a lower valid rate.Coverage generally improves with model size, except for Codex; the authors note that Codex’s more valid programs may miss coverage from exception-handling code.Source: §6.3.2 · p. 9, Table 4 · p. 9

6.3.3 Fine-tuning

• In fine-tuning, CodeGen-6B achieves the highest coverage, but CodeGen-2B generates the most unique valid programs; including bug descriptions improves output diversity and coverage.The authors suggest fine-tuning toward unusual generation may trade off information that preserves validity.Source: §6.3.3 · p. 9, Table 5 · p. 9, Table 6 · p. 10

6.4 Bug Finding

• FuzzGPT detected 76 bugs, 61 confirmed, including 49 confirmed as previously unknown; among those new bugs, 25 were crashes and 24 inconsistencies, 30 of them AD-related.A PyTorch PixelShuffle crash from a (1,1,1,1,0) tensor during gradient computation was labeled high-priority. A TensorFlow CPU copy bug was confirmed as a security vulnerability.Source: §6.4 · p. 10

7 DISCUSSION

• ChatGPT’s studied prompts cover more APIs than the typical-usage baseline, but have lower valid rates.The discussion describes results for 50 PyTorch APIs; Table 8 is identified as the source of the main results.Source: §7 · p. 10, Table 8 · p. 10
• Random example selection is competitive with strategies favoring similar or diverse APIs; the authors suggest it can supply diverse ingredients.They suggest modern LLMs can learn from dissimilar examples.Source: §7 · pp. 10–11
• The authors identify implementation and experimentation bugs as internal-validity threats and the choice of subject systems as an external-validity threat.They use PyTorch and TensorFlow to reduce the latter threat.Source: §7 · p. 11

8 CONCLUSION

• FuzzGPT uses historical bug-triggering programs to prime LLMs for edge-case fuzzing, with automation and generalizability across challenging domains.The conclusion contrasts this with traditional fuzzing techniques that leverage historical information.Source: §8 · p. 11
• FuzzGPT substantially outperforms existing DL-library fuzzers and detects various bugs in PyTorch and TensorFlow.Source: §8 · p. 11
• The conclusion points to ChatGPT’s potential for generating edge-case programs without historical information.Source: §8 · p. 11