VDBFuzz: Understanding and Detecting Crash Bugs in Vector Database Management Systems
Vector Database Management Systems~(VDBMSs) have become critical in LLM-integrated applications, powering tasks such as Retrieval-Augmented Generation~(RAG) and long-term memory. However, their inherent complexity—stemming from high-dimensional data structures, diverse indexing strategies, and heterogeneous implementations—makes them prone to reliability issues, particularly crash bugs caused by boundary condition failures such as invalid configurations and mismatched data dimensions. These bugs can result in severe consequences, including data loss, corrupted indexes, and cascading downstream failures. To address this gap, we propose VDBFuzz, the first fuzzing framework specifically designed to detect crash bugs in VDBMSs through systematic boundary value testing. VDBFuzz systematically leverages techniques to collect high-quality seeds, generate edge-case inputs, and explore complex API interactions. We evaluated VDBFuzz on 8 representative VDBMSs, including native systems (e.g., Weaviate, Milvus), libraries (e.g., Faiss, hnswlib), and extended systems (e.g., pgvector, sqlite-vec). VDBFuzz achieved up to 3x higher code coverage compared to state-of-the-art tools such as RESTler and Schemathesis, uncovering 19 previously unknown crash bugs, including 13 memory corruption and 6 runtime exceptions. These results highlight VDBFuzz’s effectiveness in improving the robustness and reliability of VDBMSs.
Thu 16 AprDisplayed time zone: Brasilia, Distrito Federal, Brazil change
11:00 - 12:30 | Testing and Analysis 8Research Track at Oceania IX Chair(s): Luca Di Grazia University of St. Gallen | ||
11:00 15mTalk | RusyFuzz: Unhandled Exception Guided Fuzzing for Rust OS Kernel Research Track Yuwei Liu Ant Group, Yanhao Wang Independent Researcher, Minghua Wang Ant Group, Lin Huang Ant Group, Purui Su Institute of Software/CAS China, Tao Wei Ant Group | ||
11:15 15mTalk | VDBFuzz: Understanding and Detecting Crash Bugs in Vector Database Management Systems Research Track Shenao Wang Huazhong University of Science and Technology, Zhao Liu 360 AI Security Lab, Yanjie Zhao Huazhong University of Science and Technology, Quanchen Zou 360 AI Security Lab, Haoyu Wang Huazhong University of Science and Technology | ||
11:30 15mTalk | GPTrace: Effective Crash Deduplication Using LLM Embeddings Research Track Patrick Herter Fraunhofer AISEC, Vincent Ahlrichs Fraunhofer AISEC, Ridvan Açilan Technical University of Munich, Julian Horsch Fraunhofer AISEC Pre-print Media Attached | ||
11:45 15mTalk | Is My RPC Response Reliable? Detecting RPC Bugs in Blockchain Client under Context Research Track Zhijie Zhong School of Software Engineering, Sun Yat-sen University, Yuhong Nan Sun Yat-sen University, Mingxi Ye Sun Yat-sen University, Qing Xue Sun Yat-sen University, Jiashui Wang Zhejiang University, Long Liu , Xinlei Ying , Zibin Zheng Sun Yat-sen University | ||
12:00 15mTalk | EchoFuzz: Empowering Smart Contract Fuzzing with Large Language Models Research Track Juanen Li Tsinghua University, Peng Qian Zhejiang University, Guanyan Li University of Oxford, Rui Wang Beijing Normal University, Peixin Wang East China Normal University, Zhiqing Tang Beijing Normal University, Fuchen Ma Tsinghua University, Yuanliang Chen Tsinghua University, Lun Zhang GoPlus Security | ||
12:15 15mTalk | StorFuzz: Using Data Diversity to Overcome Fuzzing Plateaus Research Track Leon Weiß Ruhr University Bochum, Tobias Holl Ruhr University Bochum, Kevin Borgolte Ruhr University Bochum Pre-print Media Attached | ||