Search papers, labs, and topics across Lattice.
This paper introduces GRAFT, a novel approach for generating fuzz targets for Rust library APIs by leveraging structured API analysis that accounts for Rust's ownership rules, generic parameters, and trait bounds. By extracting API information from documentation and constructing a dependency graph through generics-aware type matching, GRAFT employs a topology-guided traversal combined with LLM synthesis and compiler-error feedback to create compilable call sequences. The method achieves a macro-average API coverage of 80.75% with a 96.19% compilation success rate, significantly outperforming existing tools like RULF and RPG, and surpassing deepSURF on crates with unsafe-reaching APIs.
GRAFT achieves over 80% API coverage while ensuring high compilation success, outperforming existing fuzzing tools by a wide margin.
Fuzzing Rust library APIs requires constructing well-typed, compilable call sequences that satisfy ownership rules, generic parameters, and trait bounds; existing tools ignore these constraints or use shallow heuristics, yielding low coverage. We present GRAFT, which extracts structured API information from Rust documentation, builds an API dependency graph via recursive generics-aware type matching, and uses topology-guided traversal plus LLM synthesis with compiler-error feedback to produce compilable fuzz targets. On 13 crates from crates.io, GRAFT achieves 80.75% macro-average API coverage at 96.19% compilation success, outperforming RULF and RPG by 4.76x and 2.43x, and reaching 1.41x the average API coverage of deepSURF on crates with unsafe-reaching APIs.
