一句话：用 LLM 从官方文档与历史崩溃输入中提取 SQL 特征，合成高质量种子以提升 DBMS 模糊测试效果。
基于变异的模糊测试是发现数据库管理系统（DBMS）缺陷的有效手段，但其效果严重依赖初始种子查询的质量：高质量种子需语法语义合法、覆盖多样 SQL 特性，并能将执行引向易出错状态。实践中现有 DBMS 模糊测试器多直接采用单元测试或回归套件中的 SQL 查询作种子，规模与多样性受限，导致大量特性与执行路径未被探索。为此作者提出 SmartFuzz，一个利用大语言模型自动合成高质量初始 SQL 种子的框架。其核心洞察是：官方 DBMS 文档与历史触发崩溃的输入这两类未被充分利用的资源，分别刻画了特性用法与缺陷相关行为，二者知识互补。SmartFuzz 从中抽取结构化特征，再借助 LLM 合成可执行、特性丰富且偏向易出错执行状态的 SQL 种子，并将其集成到现有基于变异的 DBMS 模糊测试流程中。在 4 个广泛使用的 DBMS 上的评估表明，相比当前最先进的变异型模糊测试器，SmartFuzz 显著提升了缺陷发现能力与代码覆盖率，共检测出 61 个此前未知的缺陷，其中 60 个已被开发者确认并修复。
Mutation-based fuzzing is one of the most effective techniques for uncovering bugs in Database Management Systems (DBMSs). However, its effectiveness critically depends on the quality of the initial seed queries. High-quality seeds should be syntactically and semantically valid, incorporate diverse SQL features, and encode behaviors that drive execution into bug-prone states. In practice, existing DBMS fuzzers primarily rely on SQL queries extracted from unit tests or regression suites as initial seeds, which are often limited in diversity and scale, leaving many DBMS features and execution paths unexplored. To address this limitation, we propose SmartFuzz, an automated framework for synthesizing high-quality initial SQL seeds for mutation-based DBMS fuzzing using Large Language Models (LLMs). The key insight behind SmartFuzz is that two underutilized sources---official DBMS documentation and historical crash-triggering inputs---capture complementary knowledge about DBMS feature usage and bug-relevant behaviors. SmartFuzz extracts structured features from these sources and leverages LLMs to synthesize executable, feature-rich SQL seeds that are biased toward bug-prone execution states. We integrate SmartFuzz into existing mutation-based DBMS fuzzing pipelines and evaluate it on 4 widely used DBMSs. The results demonstrate that SmartFuzz significantly improves bug discovery and code coverage compared to state-of-the-art mutation-based fuzzers. In total, SmartFuzz detects 61 previously unknown bugs, of which 60 have been confirmed and fixed by developers.
@article{paperbot12165,
title = {SmartFuzz: Leveraging Large Language Models and Feature Composition to Generate High-Quality Seeds for Database Fuzzing},
author = {Li Lin and Jintai Hong and Yanlin Zhuang and Rongxin Wu},
journal = {Proceedings of the ACM on Programming Languages},
volume = {10},
number = {OOPSLA2},
year = {2026},
doi = {10.1145/3839476}
}