一句话:提出 PhyFu 模糊测试框架,依据基本物理定律检测物理仿真引擎前向与反向仿真的错误。
现代物理仿真引擎(PSE)同时支持前向预测与反向梯度计算,广泛应用于游戏、影视、VR 和机器人控制,但其错误仿真可能导致从体验下降到制造/手术事故的严重后果。本文提出 PhyFu,一个专为 PSE 设计的模糊测试框架,同时检测前向与反向仿真阶段的错误。PhyFu 变异初始状态,并基于基本物理定律断言被测 PSE 行为的一致性;它还采用反馈驱动的测试输入调度来引导并加速错误搜索。作者评估了四款 PSE,覆盖 Google、NVIDIA 等工业主流产品与学术系统,成功发现超过 5K 个触发错误的输入,这些输入会在 PSE 整个软件栈中产生不正确的仿真结果。
A physical simulation engine (PSE) is a software system that simulates physical environments and objects. Modern PSEs feature both forward and backward simulations, where the forward phase predicts the behavior of a simulated system, and the backward phase provides gradients (guidance) for learning-based control tasks, such as a robot arm learning to fetch items. This way, modern PSEs show promising support for learning-based control methods. To date, PSEs have been largely used in various high-profitable, commercial applications, such as games, movies, virtual reality (VR), and robotics. Despite the prosperous development and usage of PSEs by academia and industrial manufacturers such as Google and NVIDIA, PSEs may produce incorrect simulations, which may lead to negative results, from poor user experience in entertainment to accidents in robotics-involved manufacturing and surgical operations. This paper introduces PhyFu, a fuzzing framework designed specifically for PSEs to uncover errors in both forward and backward simulation phases. PHyFu mutates initial states and asserts if the PSE under test behaves consistently with respect to basic Physics Laws (PLs). We further use feedback-driven test input scheduling to guide and accelerate the search for errors. Our study of four PSEs covers mainstream industrial vendors (Google and NVIDIA) as well as academic products. We successfully uncover over 5K error-triggering inputs that generate incorrect simulation results spanning across the whole software stack of PSEs.