TitanFuzz
Evolutionary fuzzing of deep-learning libraries (PyTorch and TensorFlow) using infill language models as structure-aware AST mutation operators.
The loop
- Proposes
A generative model (Codex) seeds multi-API tensor programs, and an infill model (InCoder) masks and regenerates spans around selected AST operators.
- Judged by
PyTorch and TensorFlow CPU/GPU execution engines, differential backends, and crash/NaN sanitizers evaluate every mutated program and log operator coverage.
- Steers
An evolutionary fitness function combining API depth, dataflow graph edges, and new branch coverage selects seeds for the next mutation round.
Headline result
Achieved 50.84% (PyTorch) and 30.38% (TensorFlow) higher code coverage than state-of-the-art DL fuzzers and detected 65 bugs (41 confirmed previously unknown).
What this does not prove
Differential testing across CPU and GPU backends can trigger false-positive floating-point rounding discrepancies if tolerances are too tight.
How it generalizes the harness
An evolutionary coverage-guided fuzzing loop manages the seed corpus and invokes the infill LLM as a span-mutation operator.
Classification
| What it proposes | Fuzz target |
|---|---|
| Generative model | Codex seed generator + InCoder span mutator |
| Algorithmic authority | Dataflow/branch coverage analyzer and differential execution oracle |
| Feedback | Code coverage |
| What gets updated | Population of candidates |
| When it runs | In continuous operation |
| Validity | Empirical (measured) |
| Evidence | Code released |
| Lineage | Original system |