一句话：提出首个面向新兴深度学习库的通用模糊测试框架 FUTURE，用历史缺陷信息微调 LLM 生成测试代码，在三个新库中发现 148 个缺陷。
PyTorch、TensorFlow 等基础深度学习库面临可扩展性与适配 LLM 快速演进的双重挑战，Apple、华为等企业开始自研 DL 库，其安全性保障至关重要。然而现有模糊测试框架在目标灵活性、有效测试易出错 API 序列以及利用新库有限信息方面存在不足。为此，作者提出 FUTURE——首个面向新引入与前瞻性深度学习库的通用模糊测试框架。它挖掘已有库的历史缺陷信息，据此微调 LLM 进行专门化代码生成，以发现新库中的缺陷，并将从新库获得的洞见反哺既有库的安全加固，形成“从历史到未来再返回”的循环。在三个新引入 DL 库上的评估表明，FUTURE 在缺陷检测、缺陷复现成功率、代码生成有效率与 API 覆盖率上均显著优于现有 fuzzer；在 452 个目标 API 上检出 148 个缺陷（142 个此前未知），其中 10 个获 CVE 编号，并在 PyTorch 中检出 7 个缺陷。
The widespread application of large language models (LLMs) underscores the importance of deep learning (DL) technologies that rely on foundational DL libraries such as PyTorch and TensorFlow. Despite their robust features, these libraries face challenges with scalability and adaptation to rapid advancements in the LLM community. In response, tech giants like Apple and Huawei are developing their own DL libraries to enhance performance, increase scalability, and safeguard intellectual property. Ensuring the security of these libraries is crucial, with fuzzing being a vital solution. However, existing fuzzing frameworks struggle with target flexibility, effectively testing bug-prone API sequences, and leveraging the limited available information in new libraries. To address these limitations, we propose FUTURE, the first universal fuzzing framework tailored for newly introduced and prospective DL libraries. FUTURE leverages historical bug information from existing libraries and fine-tunes LLMs for specialized code generation. This strategy helps identify bugs in new libraries and uses insights from these libraries to enhance security in existing ones, creating a cycle from history to future and back. To evaluate FUTURE's effectiveness, we conduct comprehensive evaluations on three newly introduced DL libraries. Evaluation results demonstrate that FUTURE significantly outperforms existing fuzzers in bug detection, success rate of bug reproduction, validity rate of code generation, and API coverage. Notably, FUTURE has detected 148 bugs across 452 targeted APIs, including 142 previously unknown bugs. Among these, 10 have been assigned CVE IDs. Additionally, FUTURE detects 7 bugs in PyTorch, demonstrating its ability to enhance security in existing libraries in reverse.
DOI 原文 ·
@inproceedings{paperbot8740,
title = {The Seeds of the Future Sprout from History: Fuzzing for Unveiling Vulnerabilities in Prospective Deep-Learning Libraries},
author = {Zhiyuan Li and Jingzheng Wu and Xiang Ling and Tianyue Luo and Zhiqing Rui and Yanjun Wu},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00132}
}