Generics-Aware Fuzz Target Generation for Rust Libraries via Structured API Analysis

2026-08-09

AI Summary

Existing fuzzing tools struggle to generate compilable API call sequences that satisfy Rust’s ownership, generic, and trait constraints, resulting in low coverage. This work proposes a novel approach that constructs a generic- and trait-aware API dependency graph through structured parsing of Rust documentation, then combines topological-guided traversal with large language model–based code synthesis, iteratively refining test cases under compiler feedback. To the best of our knowledge, this is the first method to systematically model generic and trait constraints for fuzzing. Evaluated on 13 real-world crates, it achieves an average API coverage of 80.75% and a compilation success rate of 96.19%, outperforming RULF, RPG, and deepSURF by factors of 4.76×, 2.43×, and 1.41× in coverage, respectively.

Abstract

Fuzzing Rust library APIs requires constructing well-typed, compilable call sequences that satisfy ownership rules, generic parameters, and trait bounds; existing tools ignore these constraints or use shallow heuristics, yielding low coverage. We present GRAFT, which extracts structured API information from Rust documentation, builds an API dependency graph via recursive generics-aware type matching, and uses topology-guided traversal plus LLM synthesis with compiler-error feedback to produce compilable fuzz targets. On 13 crates from crates.io, GRAFT achieves 80.75% macro-average API coverage at 96.19% compilation success, outperforming RULF and RPG by 4.76x and 2.43x, and reaching 1.41x the average API coverage of deepSURF on crates with unsafe-reaching APIs.

Problem

• fuzzing
• Rust
• generics
• API coverage
• ownership

Innovation

• generics-aware
• fuzz target generation
• API dependency graph
• LLM synthesis
• Rust fuzzing