一句话：提出 LLM 智能体引导的模糊测试器 Fuzz4DB，解耦语义规划与文法实例化，高效测试 DBMS 特性增量。
现代 DBMS 通过频繁特性提交快速演进，但在 24 小时 CI 预算内验证每个代码增量仍很困难：人工回归测试成本高，生成式 fuzzer 吞吐高却不感知变更，LLM 智能体虽理解增量却慢数个数量级。Fuzz4DB 将基于 LLM 的语义规划与基于文法的测试实例化解耦：智能体分析代码增量与覆盖率反馈，合成文法作用域、推导路径、上下文–查询模板对三级精度的测试指令，文法 fuzzer 再将其展开为合法 SQL 用例，并在覆盖率增长停滞时提升指令精度。系统在 TDSQL 生产环境运行半年以上，拦截 74 个零日缺陷（约占 SQL 子系统缺陷 40%）；在 5 个主流 DBMS 的 12 个特性提交上达到 86.9% 增量代码覆盖率，超最佳自动化基线 36.9%；在 4 个开源 DBMS 上共发现 62 个唯一缺陷（45 个获上游确认），其中 59 个在 24 小时 CI 窗口内无法被现有工具检出，并将每次提交验证成本由约 5 人日降至约 1 人日。
Modern database management systems (DBMSs) evolve rapidly via frequent feature commits, yet validating each code delta within a 24-hour Continuous Integration (CI) budget remains an industrial challenge. Traditional manual regression testing is labor-intensive, while existing automated tools fall short: generation-based fuzzers achieve high throughput but are change-unaware, whereas LLM-based agents understand feature deltas but are orders of magnitude too slow for systematic testing. This paper presents Fuzz4DB, an LLM-agent-guided fuzzer designed for targeted DBMS feature testing. Fuzz4DB decouples LLM-based semantic planning from grammar-based test instantiation, bridging the gap between semantic awareness and generation efficiency. The LLM-powered agent of Fuzz4DB analyzes code deltas and coverage feedback to synthesize test directives—structured specifications at three precision levels, namely grammar scopes, derivation paths, and context–query template pairs. A grammar-based fuzzer then expands each directive into batches of valid SQL test cases. A coverage feedback loop escalates directive precision as coverage growth stalls. Running in the TDSQL production environment for over six months, Fuzz4DB has intercepted 74 zero-day bugs, accounting for ∼40% of all SQL-subsystem bugs. In evaluations across 12 feature commits from 5 mainstream DBMSs, Fuzz4DB achieved 86.9% delta code coverage, outperforming the best automated baseline by 36.9%. Over its full lifecycle on four open-source DBMSs, Fuzz4DB discovered a total of 62 unique bugs (45 newly confirmed by upstream communities), 59 of which were undetectable by state-of-the-art tools within the 24-hour CI window. Furthermore, Fuzz4DB reduces per-commit validation effort from ∼5 person-days to ∼1 person-day, an ∼80% reduction.
@inproceedings{paperbot12370,
title = {Fuzz4DB: A Practice of LLM-Agent-Guided Fuzzing for Database Feature-Level Delta Testing},
author = {Chunling Qin and Yong Hu and Xiao Zhang and Jinchuan Chen and Fangtao Gu and Baoxun Wang and Yuxing Chen and Anqun Pan and Lixiong Zheng},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3834498}
}