AI systems generate annotations to guide software testing efficiently
AIJon: Automated Generation of Annotations for Fuzzing
Cryptography and SecuritySoftware Engineering
Summary
Software testing programs called fuzzers usually try out many inputs to find bugs by looking for new ways the program runs. But some useful inputs don’t lead to new ways of running code, so they can be missed. The authors studied a method where notes (annotations) help guide fuzzers to interesting parts. They found large language models (LLMs), a type of AI, can create these notes almost as well as humans. Although using these AI-generated notes didn’t always improve testing, the work shows it’s possible to automate this part and suggests future research to see when annotations help.
What this means in practice
- •For software security teams: Use AI-generated annotations to guide fuzzing tools toward complex bugs without relying solely on code coverage.
- •For software quality assurance teams: Incorporate AI-based annotations to potentially improve fuzz-testing coverage when analyzing large software projects.
Authors
Jayakrishna Menon Vadayath, Hulin Wang, Moritz Schloegel, Jie Hu, Wil Gibbs, Tiffany Bao, Adam Doupé, Ruoyu "Fish" Wang, Yan Shoshitaishvili
Abstract
Modern fuzzers use code coverage as feedback to guide their exploration which has proven to be an effective strategy for driving exploration. However, this strategy overlooks inputs that may be interesting to the target program even without uncovering new code paths. Fortunately, prior research has shown that annotations generated by human domain experts can provide additional feedback, guiding the fuzzer towards interesting parts of the program. In this paper, we replicate experiments presented in IJON and extend them to real-world vulnerability detection at scale. To mitigate the scalability challenge, imposed by the need for human domain expertise, we propose utilizing LLMs to automatically generate annotations. We demonstrate the applicability of LLMs for this purpose and observe that LLMs can generate annotations that perform comparably to human-generated annotations. Motivated by this finding, we design AIJON, a system that leverages LLMs to automatically generate IJON-style annotations. We evaluate AIJON on the Magma benchmark and surprisingly observe that annotation-based fuzzing does not perform strictly better than AFL++. We conduct several experiments to identify the cause of our results and identify key insights regarding the impact of annotations on fuzzing campaigns, including their effect on the energy distribution of the fuzzer. Notably, we observe that LLMs can generate annotations that achieve comparable results to human generated ones, thus opening the door for future research to perform further studies on the impact of annotations at scale.