Search papers, labs, and topics across Lattice.
This paper introduces VistaFuzz, a novel document-guided fuzzing technique that leverages a locally hosted open-sourced LLM to extract parameter specifications from API documentation and generate valid inputs for Python libraries. By addressing both per-parameter constraints and inter-parameter dependencies, VistaFuzz significantly improves the generation of valid API inputs, achieving a valid generation rate above 95% when inter-parameter relationships are resolved. The evaluation across 7,718 APIs reveals that disabling inter-parameter resolution drastically reduces valid input generation rates, and VistaFuzz successfully identifies 74 issues, with 43 confirmed and 29 fixed by developers.
Valid input generation for Python APIs can drop from over 95% to as low as 31.6% when inter-parameter relationships are ignored, highlighting the critical role of dependency resolution in fuzzing.
Python libraries underpin deep learning, scientific computing, data analysis, and computer vision, making their reliability critical to downstream applications. Testing their APIs requires inputs that satisfy both per-parameter constraints and dependencies among parameters. Existing approaches either leave such constraints implicit in generated programs or rely on library-specific parsing rules. This paper introduces VistaFuzz, a document-guided fuzzing technique that uses a locally served open-sourced LLM to extract parameter specifications from API documents and generate inputs that satisfy both parameter constraints and inter-parameter dependencies. We evaluate VistaFuzz on 7,718 APIs across twelve Python libraries. Inter-parameter relationships occur in 40.1\% of tested APIs, and disabling their resolution reduces the valid generation rate on those APIs from above 95\% to 31.6\%--52.8\%. VistaFuzz reports 74 issues, of which 43 have been confirmed by developers and 29 have been fixed.
