TCSE logo 
 Sigsoft logo
Sustainability badge
Fri 2 May 2025 16:45 - 17:00 at 205 - Testing and QA 6 Chair(s): Majid Babaei

Recently, many Deep Learning (DL) fuzzers have been proposed for API-level testing of DL libraries. However, they either perform unguided input generation (e.g., not considering the relationship between API arguments when generating inputs) or only support a limited set of corner-case test inputs. Furthermore, many developer APIs crucial for library development remain untested, as they are typically not well documented and lack clear usage guidelines, unlike end-user APIs. This makes them a more challenging target for automated testing. To fill this gap, we propose a novel fuzzer named Orion, which combines guided test input generation and corner-case test input generation based on a set of fuzzing heuristic rules constructed from historical data known to trigger critical issues in the underlying implementation of DL APIs. To extract the fuzzing heuristic rules, we first conduct an empirical study on the root cause analysis of 376 vulnerabilities in two of the most popular DL libraries, PyTorch and TensorFlow. We then construct the fuzzing heuristic rules based on the root causes of the extracted historical vulnerabilities. Using these fuzzing heuristic rules, Orion generates corner-case test inputs for API-level fuzzing. In addition, we extend the seed collection of existing studies to include test inputs for developer APIs. Our evaluation shows that Orion reports 135 vulnerabilities in the latest releases of TensorFlow and PyTorch, 76 of which were confirmed by the library developers. Among the 76 confirmed vulnerabilities, 69 were previously unknown, and 7 have already been fixed. The rest are awaiting further confirmation. For end-user APIs, Orion detected 45.58% and 90% more vulnerabilities in TensorFlow and PyTorch, respectively, compared to the state-of-the-art conventional fuzzer, DeepRel. When compared to the state-of-the-art LLM-based DL fuzzer, AtlasFuz, and Orion detected 13.63% more vulnerabilities in TensorFlow and 18.42% more vulnerabilities in PyTorch. Regarding developer APIs, Orion stands out by detecting 117% more vulnerabilities in TensorFlow and 100% more vulnerabilities in PyTorch compared to the most relevant fuzzer designed for developer APIs, such as FreeFuzz.

Fri 2 May

Displayed time zone: Eastern Time (US & Canada) change

16:00 - 17:30
Testing and QA 6Journal-first Papers / Research Track / Demonstrations at 205
Chair(s): Majid Babaei McGill University
16:00
15m
Talk
Characterizing Timeout Builds in Continuous Integration
Journal-first Papers
Nimmi Weeraddana University of Waterloo, Mahmoud Alfadel University of Calgary, Shane McIntosh University of Waterloo
16:15
15m
Talk
GeMTest: A General Metamorphic Testing FrameworkArtifact-FunctionalArtifact-AvailableArtifact-Reusable
Demonstrations
Simon Speth Technical University of Munich, Alexander Pretschner TU Munich
Pre-print
16:30
15m
Talk
Mole: Efficient Crash Reproduction in Android Applications With Enforcing Necessary UI Events
Journal-first Papers
Maryam Masoudian Sharif University of Technology, Hong Kong University of Science and Technology (HKUST), Heqing Huang City University of Hong Kong, Morteza Amini Sharif University of Technology, Charles Zhang Hong Kong University of Science and Technology
16:45
15m
Talk
History-Driven Fuzzing for Deep Learning Libraries
Journal-first Papers
Nima Shiri Harzevili York University, Mohammad Mahdi Mohajer York University, Moshi Wei York University, Hung Viet Pham York University, Song Wang York University
17:00
15m
Talk
Towards a Cognitive Model of Dynamic Debugging: Does Identifier Construction Matter?
Journal-first Papers
Danniell Hu University of Michigan, Priscila Santiesteban University of Michigan, Madeline Endres University of Massachusetts Amherst, Westley Weimer University of Michigan
17:15
15m
Talk
Janus: Detecting Rendering Bugs in Web Browsers via Visual Delta Consistency
Research Track
Chijin Zhou Tsinghua University, Quan Zhang Tsinghua University, Bingzhou Qian National University of Defense Technology, Yu Jiang Tsinghua University
:
:
:
: