[tensorflow] Build the TFLite interpreter fuzz target - #16075
Open
endorphin13 wants to merge 1 commit into
Open
Conversation
tensorflow/tensorflow#126109 added tensorflow/lite/fuzzing/interpreter_fuzz.cc, the first OSS-Fuzz harness for the TensorFlow Lite runtime. It merged into master on 2026-08-27 as cf6867de5f11354b0c58f71909e1b6895e20cccf. The Dockerfile already clones TensorFlow master, so the harness source is present in the build, but FUZZTEST_TARGET_FOLDER does not list //tensorflow/lite/..., so compile_fuzztests.sh never queries it and the target is silently skipped. Adding //tensorflow/lite/fuzzing:all makes it build. This is scoped to the single new package rather than //tensorflow/lite/... so it cannot pick up unrelated tests as more TFLite fuzzing is added.
|
endorphin13 is a new contributor to projects/tensorflow. The PR must be approved by known contributors before it can be merged. The past contributors are: maflcko, learning-to-play, fcoUnda, mihaimaruseac, kobrineli, catenacyber |
|
Please wait a moment. TFLite has fuzzing tests. They were not open source. We are in a process to make them public. google-ai-edge/LiteRT#8987 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why this is needed
tensorflow/tensorflow#126109 added
tensorflow/lite/fuzzing/interpreter_fuzz.cc— the first OSS-Fuzz harness for the TensorFlow Lite runtime. It merged into TensorFlowmasteron 2026-08-27 ascf6867d.That harness is currently dead code as far as OSS-Fuzz is concerned:
projects/tensorflow/Dockerfilealready doesgit clone --depth 1 .../tensorflow, so the new source is in the build context.projects/tensorflow/build.shexportsFUZZTEST_TARGET_FOLDER, whichcompile_fuzztests.shpasses tobazel query/bazel cqueryto discover fuzz targets.//tensorflow/lite/...is not in that list, so the query never seesinterpreter_fuzz. It is silently skipped — no build error, no target.This one-line change adds
//tensorflow/lite/fuzzing:allso the target is discovered and built.Why scoped to
:allon one package//tensorflow/lite/...would recurse the entire TFLite tree and pull in unrelatedcc_testtargets that happen to depend on fuzztest. Scoping to thefuzzingpackage keeps discovery tight and stays correct as more TFLite harnesses are added alongside this one.What it covers
TFLite previously had zero OSS-Fuzz coverage. The harness drives the interpreter end to end —
VerifyAndBuildFromBuffer→InterpreterBuilder→AllocateTensors()→Invoke()— which reaches the builtin kernel implementations, the arena planner, and the shape-propagation paths. It usesBuiltinOpResolverWithoutDefaultDelegatesso it exercises reference/optimized CPU kernels rather than a delegate, and caps model size at 1 MiB and total input tensor bytes at 64 MiB to stay inside the OSS-Fuzz memory budget.Verification
The resulting target is named
interpreter_fuzz@TfLiteFuzz.FuzzInterpreter, per the{binary}@{entrypoint}convention thatcompile_fuzztests.shuses for fuzztest entrypoints:project.yamlis unchanged — the existingaddress/undefinedsanitizers andlibfuzzerengine apply.