BanditFuzz: A Synergistic Differential Fuzzing Framework for Compilers

Abstract

Compiler fuzzing is critical for ensuring the reliability of modern optimizing compilers. However, traditional generators and raw Large Language Model (LLM) outputs often yield syntactically invalid or low-value programs, incurring significant computational overhead. In this paper, we present BanditFuzz, an end-to-end synergistic differential fuzzing framework integrating four core mechanisms: (1) a coverage-feedback-driven dynamic prompt scheduler that alternates strategies to generate diverse corpora; (2) a lightweight repair module (CompileFix) that heuristically recovers near-compilable raw LLM outputs; (3) a deterministic AST mutation engine (ASTMutate) that systematically expands high-quality seeds to compensate for inference latency; and (4) a sanitizer-enhanced differential testing oracle utilizing an unoptimized baseline (-O0) to precisely identify miscompilations while filtering Undefined Behavior (UB). Extensive evaluations on GCC and Clang demonstrate that BanditFuzz significantly improves backend coverage over state-of-the-art baselines under identical budgets, successfully identifying 28 realworld compiler bugs.