Coverage-guided tensor compiler fuzzing with joint IR-pass mutation
نویسندگان
چکیده
In the past decade, Deep Learning (DL) systems have been widely deployed in various application domains to facilitate our daily life, e.g., natural language processing, healthcare, activity recognition, and autonomous driving. Meanwhile, it is extremely challenging ensure correctness of DL (e.g., due their intrinsic nondeterminism), bugs can cause serious consequences may even threaten human lives. literature, researchers explored techniques test, analyze, verify models, since quality directly affects corresponding system behaviors. Recently, also proposed novel for testing underlying operator-level libraries (such as TensorFlow PyTorch), which provide general binary implementations each high-level operator are foundation running models on different hardware platforms. However, there still limited work targeting reliability emerging tensor compilers (also known compilers), aim automatically compile computation graphs into high-performance binaries better efficiency, portability, scalability than traditional libraries. Therefore, this paper, we target important problem compiler testing, Tzer, a practical fuzzing technique used TVM compiler. Tzer focuses mutating low-level Intermediate Representation (IR) mutation space IR. More specifically, leverages both general-purpose tensor-compiler-specific mutators guided by coverage feedback diverse evolutionary IR mutation; furthermore, passes (i.e., transformations) optimization, performs pass tandem with more effective fuzzing. Our experimental results show that substantially outperforms existing 75% higher 50% valuable tests 2nd-best technique. Also, components validated via ablation study. To date, has detected 49 previously unknown TVM, 37 confirmed 25 fixed (PR merged).
منابع مشابه
INSTRIM: Lightweight Instrumentation for Coverage-guided Fuzzing
Empowered by instrumentation, coverage-guided fuzzing monitors the program execution path taken by an input, and prioritizes inputs based on their contribution to code coverage. Although instrumenting every basic block ensures full visibility, it slows down the fuzzer and thus the speed of vulnerability discovery. This paper shows that thanks to common program structures (e.g., directed acyclic...
متن کاملComplementing Model Learning with Mutation-Based Fuzzing
An ongoing challenge for learning algorithms formulated in the Minimally Adequate Teacher framework is to efficiently obtain counterexamples. In this paper we compare and combine conformance testing and mutation-based fuzzing methods for obtaining counterexamples when learning finite state machine models for the reactive software systems of the Rigorous Exampination of Reactive Systems (RERS) c...
متن کاملImproving Function Coverage with Munch: A Hybrid Fuzzing and Directed Symbolic Execution Approach
Fuzzing and symbolic execution are popular techniques for finding vulnerabilities and generating test-cases for programs. Fuzzing, a blackbox method that mutates seed input values, is generally incapable of generating diverse inputs that exercise all paths in the program. Due to the path-explosion problem and dependence on SMT solvers, symbolic execution may also not achieve high path coverage....
متن کاملذخیره در منابع من
با ذخیره ی این منبع در منابع من، دسترسی به آن را برای استفاده های بعدی آسان تر کنید
ژورنال
عنوان ژورنال: Proceedings of the ACM on programming languages
سال: 2022
ISSN: ['2475-1421']
DOI: https://doi.org/10.1145/3527317