一句话：提出 BanditFuzz，融合 LLM 提示调度、修复、AST 变异与差分测试，高效发现编译器缺陷。
编译器模糊测试对保障现代优化编译器的可靠性至关重要，但传统生成器与原始大语言模型（LLM）输出常产生语法无效或低价值程序，导致大量计算开销。本文提出 BanditFuzz，一个端到端的协同差分模糊测试框架，集成四项核心机制：覆盖率反馈驱动的动态提示调度器交替策略以生成多样化语料；轻量修复模块 CompileFix 启发式恢复接近可编译的原始 LLM 输出；确定性 AST 变异引擎 ASTMutate 系统扩展高质量种子以补偿推理延迟；以及利用未优化基线（-O0）的 sanitizer 增强差分测试 oracle，精确识别误编译并过滤未定义行为。在 GCC 和 Clang 上的大量评估表明，相同预算下 BanditFuzz 的后端覆盖率显著优于当前最优基线，并成功发现 28 个真实编译器缺陷。
Compiler fuzzing is critical for ensuring the reliability of modern optimizing compilers. However, traditional generators and raw Large Language Model (LLM) outputs often yield syntactically invalid or low-value programs, incurring significant computational overhead. In this paper, we present BanditFuzz, an end-to-end synergistic differential fuzzing framework integrating four core mechanisms: (1) a coverage-feedback-driven dynamic prompt scheduler that alternates strategies to generate diverse corpora; (2) a lightweight repair module (CompileFix) that heuristically recovers near-compilable raw LLM outputs; (3) a deterministic AST mutation engine (ASTMutate) that systematically expands high-quality seeds to compensate for inference latency; and (4) a sanitizer-enhanced differential testing oracle utilizing an unoptimized baseline (-O0) to precisely identify miscompilations while filtering Undefined Behavior (UB). Extensive evaluations on GCC and Clang demonstrate that BanditFuzz significantly improves backend coverage over state-of-the-art baselines under identical budgets, successfully identifying 28 realworld compiler bugs.
@inproceedings{paperbot12176,
title = {BanditFuzz: A Synergistic Differential Fuzzing Framework for Compilers},
author = {Donghui Li and Yingying Li and Jinlong Xu and Bo Zhao and Nan Wang and Jinyang Yao and Lili Liu},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3834548}
}