  Many modern software systems are enabled by deep learning libraries such as
TensorFlow and PyTorch. As deep learning is now prevalent, the security of deep
learning libraries is a key concern. Fuzzing deep learning libraries presents
two challenges. Firstly, to reach the functionality of the libraries, fuzzers
have to use inputs from the valid input domain of each API function, which may
be unknown. Secondly, many inputs are redundant. Randomly sampled invalid
inputs are likely not to trigger new behaviors. While existing approaches
partially address the first challenge, they overlook the second challenge.
  We propose SkipFuzz, an approach for fuzzing deep learning libraries. To
generate valid inputs, SkipFuzz learns the input constraints of each API
function using active learning. By using information gained during fuzzing,
SkipFuzz infers a model of the input constraints, and, thus, generate valid
inputs. SkipFuzz comprises an active learner which queries a test executor to
obtain feedback for inference. After constructing hypotheses, the active
learner poses queries and refines the hypotheses using the feedback from the
test executor, which indicates if the library accepts or rejects an input,
i.e., if it satisfies the input constraints or not. Inputs from different
categories are used to invoke the library to check if a set of inputs satisfies
a function's input constraints. Inputs in one category are distinguished from
other categories by possible input constraints they would satisfy, e.g. they
are tensors of a certain shape. As such, SkipFuzz is able to refine its
hypothesis by eliminating possible candidates of the input constraints. This
active learning-based approach addresses the challenge of redundant inputs.
Using SkipFuzz, we have found and reported 43 crashes. 28 of them have been
confirmed, with 13 unique CVEs assigned.
