IcFuzz：基于语义阶段引导与多级变异的Isaac Sim模糊测试
IcFuzz: Fuzzing Isaac Sim with Semantic Stage Guidance and Multi-level Mutation
- Sun Yat-sen University（中山大学）
- Nanyang Technological University（南洋理工大学）
- Chinese University of Hong Kong（香港中文大学）
机构由 AI 辅助整理，请以论文原文为准。
AI总结：
本文提出首个针对Isaac Sim的模糊测试方法IcFuzz，通过LLM语义阶段分割、多级变异算子与多臂老虎机算法提升测试效果，在代码覆盖率与漏洞检测上优于基线，已发现11个漏洞且9个被确认修复。
AI中文摘要：
机器人模拟器是具身人工智能的基础基础设施，可助力安全且可扩展的机器人系统开发。NVIDIA Isaac Sim是最受欢迎的模拟器之一，其GPU加速物理引擎与光逼真渲染特性，支持对复杂环境进行高保真建模。但它的固有复杂性不可避免地会引入软件漏洞，损害模拟可靠性。现有模糊测试方法因面临上下文感知对象语义、分层模拟控制及庞大模拟状态空间的挑战，难以有效测试Isaac Sim。本文提出IcFuzz，首个针对Isaac Sim的模糊测试方法。IcFuzz首先执行基于大语言模型（LLM）的语义阶段分割，将模拟程序分解为结构化阶段，以捕捉上下文感知对象语义。在该信息引导下，IcFuzz设计多级变异算子，按分层粒度系统性地对模拟器进行测试。为高效探索庞大模拟状态空间，IcFuzz采用多臂老虎机算法自适应调度变异算子。实验结果显示，IcFuzz在代码覆盖率与漏洞检测两方面均优于基线方法：具体而言，IcFuzz达到基线方法约190%至205%的代码覆盖率，在三轮12小时测试中平均检测到3.7个唯一崩溃，而基线方法未检测到任何崩溃；此外，IcFuzz在约四个月内发现11个漏洞，其中9个已被开发者确认或修复。
英文摘要：
Robotics simulators serve as a foundational infrastructure for embodied AI, facilitating safe and scalable robotic system development. NVIDIA Isaac Sim has emerged as one of the most popular simulators, distinguished by its GPU-accelerated physics engine and photorealistic rendering, which enable high-fidelity modeling of complex environments. However, its inherent complexity inevitably introduces software bugs that can compromise simulation reliability. Existing fuzzing approaches struggle to test Isaac Sim effectively due to challenges of context-aware object semantics, hierarchical simulation control, and a vast simulation state space. In this paper, we propose IcFuzz, the first fuzzing approach for Isaac Sim. IcFuzz first performs an LLM-based semantic stage segmentation, decomposing simulation programs into structured stages that capture context-aware object semantics. Guided by this information, IcFuzz designs multi-level mutation operators to systematically exercise the simulator across hierarchical granularities. To efficiently navigate the vast simulation state space, IcFuzz employs a multi-armed bandit algorithm to adaptively schedule mutation operators. Experimental results show that IcFuzz outperforms the baselines in terms of both code coverage and bug detection. Specifically, IcFuzz achieves approximately 190\%--205\% of the code coverage of the baselines and detects an average of 3.7 unique crashes over three rounds of 12-hour tests, while no crashes are detected by the baselines. Moreover, IcFuzz has uncovered 11 bugs over approximately four months, 9 of which have been confirmed or fixed by the developers.
