Skip to content

[tensorflow] Build the TFLite interpreter fuzz target - #16075

Open
endorphin13 wants to merge 1 commit into
google:masterfrom
endorphin13:tflite-fuzz-target
Open

[tensorflow] Build the TFLite interpreter fuzz target#16075
endorphin13 wants to merge 1 commit into
google:masterfrom
endorphin13:tflite-fuzz-target

Conversation

@endorphin13

Copy link
Copy Markdown

Why this is needed

tensorflow/tensorflow#126109 added tensorflow/lite/fuzzing/interpreter_fuzz.cc — the first OSS-Fuzz harness for the TensorFlow Lite runtime. It merged into TensorFlow master on 2026-08-27 as cf6867d.

That harness is currently dead code as far as OSS-Fuzz is concerned:

  • projects/tensorflow/Dockerfile already does git clone --depth 1 .../tensorflow, so the new source is in the build context.
  • projects/tensorflow/build.sh exports FUZZTEST_TARGET_FOLDER, which compile_fuzztests.sh passes to bazel query/bazel cquery to discover fuzz targets.
  • //tensorflow/lite/... is not in that list, so the query never sees interpreter_fuzz. It is silently skipped — no build error, no target.

This one-line change adds //tensorflow/lite/fuzzing:all so the target is discovered and built.

Why scoped to :all on one package

//tensorflow/lite/... would recurse the entire TFLite tree and pull in unrelated cc_test targets that happen to depend on fuzztest. Scoping to the fuzzing package keeps discovery tight and stays correct as more TFLite harnesses are added alongside this one.

What it covers

TFLite previously had zero OSS-Fuzz coverage. The harness drives the interpreter end to end — VerifyAndBuildFromBufferInterpreterBuilderAllocateTensors()Invoke() — which reaches the builtin kernel implementations, the arena planner, and the shape-propagation paths. It uses BuiltinOpResolverWithoutDefaultDelegates so it exercises reference/optimized CPU kernels rather than a delegate, and caps model size at 1 MiB and total input tensor bytes at 64 MiB to stay inside the OSS-Fuzz memory budget.

Verification

The resulting target is named interpreter_fuzz@TfLiteFuzz.FuzzInterpreter, per the {binary}@{entrypoint} convention that compile_fuzztests.sh uses for fuzztest entrypoints:

$ python3 infra/helper.py build_image tensorflow
$ python3 infra/helper.py build_fuzzers --sanitizer address --architecture x86_64 tensorflow
$ ls build/out/tensorflow/ | grep interpreter_fuzz

project.yaml is unchanged — the existing address/undefined sanitizers and libfuzzer engine apply.

tensorflow/tensorflow#126109 added tensorflow/lite/fuzzing/interpreter_fuzz.cc,
the first OSS-Fuzz harness for the TensorFlow Lite runtime. It merged into
master on 2026-08-27 as cf6867de5f11354b0c58f71909e1b6895e20cccf.

The Dockerfile already clones TensorFlow master, so the harness source is
present in the build, but FUZZTEST_TARGET_FOLDER does not list
//tensorflow/lite/..., so compile_fuzztests.sh never queries it and the target
is silently skipped. Adding //tensorflow/lite/fuzzing:all makes it build.

This is scoped to the single new package rather than //tensorflow/lite/... so
it cannot pick up unrelated tests as more TFLite fuzzing is added.
@github-actions

Copy link
Copy Markdown

endorphin13 is a new contributor to projects/tensorflow. The PR must be approved by known contributors before it can be merged. The past contributors are: maflcko, learning-to-play, fcoUnda, mihaimaruseac, kobrineli, catenacyber

@snnn

snnn commented Aug 28, 2026

Copy link
Copy Markdown

Please wait a moment. TFLite has fuzzing tests. They were not open source. We are in a process to make them public. google-ai-edge/LiteRT#8987

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants