Large Language Models Are Zero-Shot Fuzzers: Fuzzing Deep-Learning Libraries via Large Language Models

By Yinlin Deng, Chun Xia, Haoran Peng, Chenyuan Yang, Lingming Zhang. International Symposium on Software Testing and Analysis, 2022

383 citations recorded by the source corpus.

Deep Learning (DL) systems have received exponential growth in popularity and have become ubiquitous in our everyday life. Such systems are built on top of popular DL libraries, e.g., TensorFlow and PyTorch which provide APIs as building blocks for DL systems. Detecting bugs in these DL libraries is critical for almost all downstream DL systems in ensuring effectiveness/safety for end users. Meanwhile, traditional fuzzing techniques can be hardly effective for such a challenging domain since the input DL programs need to satisfy both the input language (e.g., Python) syntax/semantics and the DL API input/shape constraints for tensor computations. To address these limitations, we propose TitanFuzz – the first approach to directly leveraging Large Language Models (LLMs) to generate input programs for fuzzing DL libraries. LLMs are titanic models trained on billions of code snippets and can autoregressively generate human-like code snippets. Our key insight is that modern LLMs can also include numerous code snippets invoking DL library APIs in their training corpora, and thus can implicitly learn both language syntax/semantics and intricate DL API constraints for valid DL program generation. More specifically, we use both generative and infilling LLMs (e.g., Codex/InCoder) to generate and mutate valid/diverse input DL programs for fuzzing. Our experimental results demonstrate that TitanFuzz can achieve 30.38%/50.84% higher code coverage than state-of-the-art fuzzers on TensorFlow/PyTorch. Furthermore, TitanFuzz is able to detect 65 bugs, with 44 already confirmed as previously unknown bugs. This paper demonstrates that modern titanic LLMs can be leveraged to directly perform both generation-based and mutation-based fuzzing studied for decades, while being fully automated, generalizable, and applicable to domains challenging for traditional approaches (such as DL systems). We hope TitanFuzz can stimulate more work in this promising direction of LLMs for fuzzing.

Subfields: Information Systems, Software, Signal Processing

View Paper: https://www.semanticscholar.org/paper/66476832701361c9f9b2a7eb2354ee8cd9f72e67

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

1. Yinlin Deng
2. Shin Yoo
3. Mark Harman
4. Chun Xia
5. Soren Dunn
6. Lingming Zhang
7. Jiawei Liu
8. Yuyao Wang

In Software

1. Yinlin Deng
2. Shin Yoo
3. Mark Harman
4. Lingming Zhang
5. Chun Xia
6. Soren Dunn
7. Jiawei Liu
8. Yuyao Wang

In Signal Processing

1. Shin Yoo
2. Chun Xia
3. Mark Harman
4. Junjie Wang
5. Song Wang
6. Lingming Zhang

Citations in the corpus

• Agentless: Demystifying LLM-based Software Engineering Agents (2024, methodology): “We refer to this as the repository structure format , which begins with the root folder of the repository and organizes code files or folder names.”
• Large Language Models for Software Engineering: Survey and Open Problems (2023, methodology): “Deng et al. [104] propose TitanFuzz, which uses LLMs (i.e., Codex) to generate valid input DL programs to test DL libraries.”
• Is Your Code Generated by ChatGPT Really Correct? Rigorous Evaluation of Large Language Models for Code Generation (2023, background): “LLMs have demonstrated state-of-the-art performance on various code-related tasks, including code generation [11, 33, 25], program repair [69, 27, 68, 65], automated testing [15, 14, 67, 35, 71], code translation [31, 55] and code summarization [1, 37].”
• Software Testing With Large Language Models: Survey, Landscape, and Vision (2023, positive): “Another example is for generating unusual programs for fuzzing deep learning libraries, Deng et al. [58] first generate a possible “bug” (bug description) before generating the actual “bug-triggering” code snippet that invokes the target API.”
• Large Language Model guided Protocol Fuzzing (2024, neutral): “F UZZ [17] and F UZZ GPT [18] used an LLM to automatically generate test cases for Deep Learning software libraries, specifically.”