Bihuan Chen

With the rapid development of autonomous driving systems (ADSs), it has become critical to ensure their operational safety, leading to the widespread adoption of simulation testing. While existing scenario-based simulation testing approaches have demonstrated effectiveness in detecting safety violations, they often fall short in providing insight into the underlying causes of these violations, which is an essential capability for improving the safety and reliability of ADSs. To address this limitation, we propose a two-phase novel framework, Poirot, for root cause analysis in simulation testing via hypothetical reasoning. Given a reproducible violation scenario, in the module-level analysis phase, Poirot replays the violation scenario and identifies the faulty module by iteratively replacing an actual module with an idealized module and checking whether the violation persists. In the component-level analysis phase, depending on the identified faulty module, Poirot further applies either hypothetical reasoning with a suspicion-guided search strategy or causal analysis to narrow the fault space and pinpoint the faulty component. We evaluate Poirot with two ADSs, e.g., Apollo and Autoware, on a comprehensive benchmark that includes a total of 80 real and injected faults along with their triggering scenarios. Compared with the state-of-the-art root cause analysis approaches, e.g., ACAV and Rocas, Poirot improves the module-level accuracy by 187.29% on average, and identifies the faulty components at a finer granularity, achieving component-level accuracy of 90.62%. Our ablation study shows that our suspicion-guided search strategy in Poirot efficiently reduces the exploration of the fault space by 58.77%, leading to a 65.41% reduction in the time for fault localization. Finally, applied to two scenario-based simulation testing methods, i.e., AvFuzzer and MoDitector, Poirot attributes 425 violation scenarios to 8 faults, cutting debugging time by 96.89% compared to manual analysis in practice.

System functional testing is a critical step before the production release of automotive electronic control units (ECUs), especially for safety-critical functions. It is typically performed on hardware-in-the-loop (HIL) benches, and engineers translate functional requirements in natural language into executable test scripts using bench-specific APIs (or test harness primitives (THPs)). Existing research either focuses on generating abstract test cases that lack execution capability, or relies on bench-specific solutions that cannot be generalized. Consequently, industrial practice remains labor-intensive, and is hindered by three main challenges, i.e., the high learning cost of THPs, the incompleteness of functional requirements due to missing tacit domain knowledge (e.g., power management dependencies or system wake-up sequences), and the limited automation. To address these challenges, we propose AUTOHIL, an LLM-based, domain-knowledge-augmented framework for requirement-driven ECU functional test generation on HIL benches. AUTOHIL automatically constructs a THP knowledge base to understand bench operations, extracts tacit domain knowledge from AUTOSAR ECU source code and configurations to augment requirements, and generates test scripts for the augmented requirements based on the THP knowledge base. We evaluate AUTOHIL on two industrial ECUs, i.e., an Airbag Control Unit (ACU) on an in-house bench and an Active Safety Domain Master (ASDM) on a dSPACE platform. AUTOHIL achieves test script executability of 90.33% on ACU and 81.31% on ASDM. We also manually evaluate the functional equivalence between generated scripts and manual scripts, and AUTOHIL reaches a functional correctness of 89.69% on ACU and 84.00% on ASDM. We discover 39 and 25 new functional defects in ACU and ASDM, which have been patched by technicians from the supplier.

The public models on the model hosting platforms have undergone exponential growth, allowing developers to build upon existing models rather than training from scratch. These models are continuously reused, modified, and re-distributed similar to traditional software components, breeding a dense and rapidly evolving model supply chain. However, while enjoying the benefits of model reuse, developers also inherit supply chain risks ranging from legal liabilities to security threats. To mitigate these risks, a well-established model dependency graph can significantly benefit supply chain risk governance. Unfortunately, although model hosting platforms offer mechanisms for dependency disclosure, such declarations are optional and frequently missing. To address this challenge, we propose a novel model dependency recovering framework Tensorlock. It works in two phases; i.e., (1) model clustering, and (2) type-aware dependency identification within these clusters. In the first phase, Tensorlock performs connectivity-based clustering to accommodate the open-ended dependency topology, grouping models with dependency relations. In the second phase, Tensorlock employs a divide-and-conquer strategy, leveraging distinct type-specific fingerprints to first identify data-free dependencies (Quantization and Merging), and then resolve data-driven Fine-Tuning dependencies. Our evaluation demonstrates that Tensorlock substantially outperforms state-of-the-art approaches, achieving an ARI of 0.96 in clustering and a DF 1 of 0.82 in dependency identification, improving over the best baselines by at least 39% and 193%, respectively. Additionally, we apply Tensorlock to 289 supposedly isolated models and recover 189 previously missing model dependencies, with 42 model authors confirming our findings.

Third-party libraries (TPLs) play critical roles in modern software development. Upgrading them is crucial for enhanced security and functionality, but often introduces incompatibility errors, caused by breaking changes in library APIs, in client code. Existing approaches rely on predefined migration patterns or API recommendation heuristics, which suffer from limited pattern coverage and ignore the usage context of broken API, leading to incorrect or incomplete fixes. To address these limitations, we propose Librarian, a novel LLM-based approach to automatically fix incompatibility errors when upgrading a dependent library in a client project. The core idea of Librarian is to extract context-aware fix hints from the library codebase, serving as semantic few-shot examples, enabling LLM to generate fixes without relying on predefined patterns. Since LLM may generate an incorrect or incomplete fix, Librarian performs fix refinement based on compilation feedback from the client project. Our evaluation has demonstrated that Librarian achieves a fixing success rate of 84.2%, outperforming the state-of-the-arts by at least 45.3%. Our evaluation has also indicated the practical usefulness of Librarian in fixing incompatibility errors in 32 real-world projects.

While coverage-guided kernel fuzzers have been proposed to uncover Linux kernel vulnerabilities, their code coverage and bug-finding capability are limited due to the lack of seed diversity, which is caused by the compounding effect of initial seed generation, seed scheduling, and seed mutation. To address this limitation, we propose a diversity-guided kernel fuzzer SyzDiversity. Specifically, to mitigate overvaluation of early seeds, it leverages proof-of-concept (PoC) seeds derived from real-world vulnerabilities as initial seeds, and further partitions these seeds into multiple communities. To improve diversity guidance in seed scheduling, it leverages a novel metric, community popularity rate (CPR), to model community diversity, and introduces a CPR-aware hierarchical Multi-Armed Bandit (MAB) algorithm that integrates CPR and code coverage as reward signals to prioritize the scheduling of diverse seed communities and seeds. Further, to efficiently populate sparse communities or break through community boundaries, it adopts a CPR-guided seed mutation strategy that adaptively allocates higher mutation frequencies to communities that are more conducive to the diversity evolution of the seeds. Our extensive experiments on Linux kernel versions v5.15 and v6.14 have demonstrated that SyzDiversity improves code coverage and bug-finding capability by 17.2% and 6.4×, respectively, compared to the state-of-the-art kernel fuzzers. It has discovered 32 unique new vulnerabilities, with 12 of them confirmed.

Large language models (LLMs) have sparked significant impact with regard to both intelligence and productivity. Numerous enterprises have integrated LLMs into their applications to solve their own domain-specific tasks. However, integrating LLMs into specific scenarios is a systematic process that involves substantial components, which are collectively referred to as the LLM supply chain . A comprehensive understanding of LLM supply chain composition, as well as the relationships among its components, is crucial for enabling effective mitigation measures for different related risks. A comprehensive understanding of LLM supply chain composition and the relationships among its components, particularly from a security perspective, is crucial for enabling effective mitigation of associated risks. While existing literature has explored various risks associated with LLMs, there remains a notable gap in systematically characterizing the LLM supply chain from the dual perspectives of contributors and consumers. In this work, we develop a structured taxonomy encompassing risk types, risky actions, and corresponding mitigations across different stakeholders and components of the supply chain. We believe that a thorough review of the LLM supply chain composition, along with its inherent risks and mitigation measures, would be valuable for industry practitioners to avoid potential damages and losses, and enlightening for academic researchers to rethink existing approaches and explore new avenues of research.

With the wide adoption of GPUs, CUDA programming has become essential for leveraging GPU parallelism. However, its complex programming model poses challenges in performance optimization. Consequently, CUDA programs often suffer from performance problems. In that sense, it is crucial to understand the performance problems specific to CUDA programming. Unfortunately, no systematic study has been conducted in literature. To bridge this gap, we conduct the first systematic study to 1) characterize the symptoms and root causes of 216 performance problems collected from 55 StackOverflow posts and 122 NVIDIA forum posts, and 2) measure the speedup of fixing performance problems, and assess the capability of existing performance analysis methods in identifying performance problems, using a dataset of 69 reproduced performance problems. Our findings provide practical guidance for developers, and opportunities for researchers to advance performance analysis.

Static analysis tools can identify potential vulnerabilities, but they often fall short in providing concrete proofs-of-concept (PoCs) to validate their findings. Directed greybox fuzzing (DGF) has emerged as a promising solution by systematically guiding execution toward suspicious code locations and generating reproducible PoCs that can trigger the target vulnerabilities. However, DGF tools often overlook the influence of configurable options on reaching target locations. Besides, option-aware greybox fuzzing (GF) tools suffer from ineffective option extraction to target locations, and inefficient coordination between options and file fuzzing. To address these limitations, we present CoupleFuzz, a novel option-aware DGF tool that redefines PoC inputs as the combination of option input (OI) and file input (FI). CoupleFuzz adopts a two-phase workflow. The static analysis phase extracts option knowledge for guiding the fuzzing. The option-aware fuzzing phase employs taint analysis to dynamically prioritize effective option combinations and file bytes to target locations, and introduces a novel cross-guided fuzzing strategy that coordinates OI and FI fuzzing modules and enables each module to adapt to and benefit from its counterpart's advances, iteratively driving execution toward the target locations efficiently. Our evaluation has demonstrated that CoupleFuzz significantly outperforms the state-of-the-art DGF tools in generating PoCs for 22 real-world vulnerabilities, generating 15 (a 3.1× improvement) more PoCs than the best traditional DGF baseline and achieves an average speedup of 5.6× to reach target locations, with 6 0-day vulnerabilities confirmed by developers and 1 CVE identifier assigned.

With the rapid development of open-source software (OSS), the number of OSS vulnerabilities has been increasing rapidly. To mitigate such security risks, vulnerability patches are deployed across a wide range of security tasks. However, patches may contain non-critical changes, and such non-critical changes can hurt the effectiveness and efficiency of these security tasks. Existing approaches of identifying critical changes often lack precise inter-procedural analysis, work at a coarse granularity, or do not scale well to large and complex patches, limiting their effectiveness. To address these limitations, we propose a novel approach CoCoPat to identify critical changes in a vulnerability patch at the statement level. CoCoPat decompose critical changes identification into two phases, i.e., function-level and statement-level phases . CoCoPat follows a filtering-then-recovering strategy in each phase to first pinpoint a necessary minimal set of critical changes by semantic-enhanced LLM, then recover any semantically similar and functionally related critical changes. Our evaluation demonstrates that CoCoPat outperforms state-of-the-arts by at least 0.43 (98%) at F1-score. By integrating CoCoPat with tools of three downstream tasks, those tools show the improvement both in effectiveness and efficiency, underscoring the value of identifying critical changes in vulnerability patches.