Skip to content

LLM-Based Invariant Testing for Software Functional Bugs

Jul 2026 · arXiv.org · Vol abs/2607.18711 · 0 citations · 70 references
Computer Science

TL;DR

LISA iteratively generates API sequences and program invariants guided by API n-gram feedback, achieving higher bug-detection rates and competitive code coverage compared with both fuzzing and prior LLM-based test generation approaches, and reporting each finding as a high-confidence bug candidate for developer confirmation.

Abstract

Manually writing unit tests to uncover functional bugs in software libraries is not only time-consuming but also requires a deep understanding of the intended semantics of the APIs. Heuristic-based test generation methods suffer from low usability because they cannot reason about program semantics or interpret source code and documentation as humans do. Traditional fuzzing techniques like OSS-Fuzz often rely on crashes to detect bugs, but functional bugs do not always cause crashes. To overcome these limitations, we present LISA, a novel LLM-based invariant testing framework for software functional bugs. LISA iteratively generates API sequences and program invariants guided by API n-gram feedback, achieving higher bug-detection rates and competitive code coverage compared with both fuzzing and prior LLM-based test generation approaches, and reporting each finding as a high-confidence bug candidate for developer confirmation.

View source

Similar papers

Open access Aug 2026

Improving Bug Detection in LLM-Generated Unit Tests: Revisiting Test-Oracle Reliability Across Modern Large Language Models

This paper presents a formal mathematical model for categorizing the outcome of generated-tests into four classes, a couple of basic metrics: Bug-Revealing Rate (BRR) and Bug-Validating Rate (BVR); and two basic statistical tests to ensure that the results are rigorous.

Zeyad Farooq Lutfi · 0 citations
#software testing Preprint Sep 2026

How effective are traditional test criteria at detecting bugs in large language models generated code?

An empirical study involving 5 Large Language Models and 4 benchmarks evaluates the effectiveness and efficiency of 3 widely used adequacy criteria: statement coverage, branch coverage, and mutation testing, finding that mutation testing only marginally outperforms traditional coverage criteria in both triggering and detecting faults.

Asma Hamidi, Michael Konstantinou, R. Degiovanni et al. · 0 citations
Preprint Aug 2026

Can Formal Specifications Be Synthesized from Tests Alone?

This approach uses LLMs to infer candidate specifications solely from test code and dynamic execution traces: the LLM observes only the program interface, selected inputs, and corresponding outputs or state changes, while the implementation internals remain hidden.

Tianhai Liu, Maximilian Müller, Tobias Hey et al. · 0 citations
Jul 2026

CoFiLoc: A Coarse-to-fine LLM-based framework for method-level bug localization

CoFiLoc first performs structured bug report denoising to extract high-value technical information, and then progressively narrows the candidate space by integrating lightweight dynamic execution evidence, stack-trace-guided structural signals, and dual semantic-lexical ranking, before applying LLM-based reasoning over a compact set of fault-relevant methods.

Nham Cao, Nhut Tien Nguyen, Thanh Nguyen · 0 citations
Preprint Aug 2026

Bug Localization from Bug Reports: A Multi-Objective Approach

Bug localization is a labor-intensive task, particularly in large software systems. When abnormal behavior occurs, developers must perform repetitive and time-consuming steps to identify faulty files. Previous studies have mainly focused on single-objective localization methods, many of which are limited to specific programming languages. In addition, relying solely on lexical similarity between source code and bug reports is often insufficient due to the natural language nature of bug descriptions. In this study, we propose a class-level automated multi-objective search-based system to identify and rank potentially buggy classes from bug reports. The main objective is to maximize similarity while minimizing the number of suggested faulty files. The evolutionary optimization algorithm SPEA-2 was applied to six open-source Java projects comprising more than 22,000 bug reports. The proposed approach was evaluated against two widely used algorithms, NSGA-II and MOEA/D. Results indicate that SPEA-2 achieved higher precision and recall than both multi-objective and single-objective baseline methods. The proposed recommender system successfully identified buggy classes or files for 88.5\% of bug reports within the top 10 recommendations and 94\% within the top 20. The effectiveness of the model was further validated on an industrial Android project written in Kotlin, demonstrating its adaptability across programming languages.

W. Ahmad, Mehtab Kiran Suddle, Maryam Bashir · 0 citations
Preprint Aug 2026

Improving Debugging in Verification-Aware Languages Through Automated Fault Localization: A Case Study in Dafny

This paper investigates automated fault localization for verification-aware languages by comparing two paradigms: state-based and counterexample-based localization, and shows that counterexample-based approaches substantially outperform state-based localization in this setting.

Álvaro F. Silva, Isabel Amaral, João Pascoal Faria et al. · 0 citations

We use cookies to run the site and, with your consent, for analytics and to show ads. See our Cookie Policy.