LLM-based Dynamic Differential Testing for Database Connectors with Reinforcement Learning-Guided Prompt Selection

C. Lyu, Minghao Zhao, Yanhao Wang, Liang Jie. 2025. International Conference on Automated Software Engineering.

Read the paper · doi:10.1109/ase63991.2025.00322 · arXiv:2506.11870

What this paper does with SQLancer

PQS is cited among the DBMS fuzzing techniques whose success does not carry over to connectors. The paper's argument is that those fuzzers generate equivalent SQL queries, while a connector largely bypasses query semantics -- what matters is the JDBC interface, its configuration properties and its stateful interactions. So SQLancer's line of work sets up the gap rather than being used or measured against: the reproducers here are JDBC call sequences, not queries. This work applies large language models to differential testing of database connectors, comparing how MySQL's and OceanBase's JDBC drivers behave on the same calls. A reinforcement-learning policy chooses which prompt to issue next, so generation concentrates where inconsistencies are being found. It reports 16 confirmed bugs and unsafe implementations -- seven in MySQL Connector/J, three bugs and six specification deviations in OceanBase -- including a beforeFirst() call that raises SQLException on one connector and succeeds silently on the other. Written by claude-opus-5 from the 1 place this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — no

SQLancer is cited as related work; the test cases are JDBC call sequences generated by a language model.

extends technique — no

No SQLancer oracle is extended. The oracle is differential comparison between two connectors.

compares with — no

The citation is background about why query-level fuzzing does not transfer to connectors; no run against SQLancer is reported.

describes as state of the art — no

The fuzzing techniques are called highly successful for DBMS testing, which is praise for the field rather than a claim that SQLancer is the state of the art.

SQLancer publications it cites (2)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#	Entry	Matched as
5	Jingzhou Fu, Jie Liang, Zhiyong Wu, Yanyang Zhao, Shanshan Li, and Yu Jiang. 2025. Understanding and Detecting SQL Function Bugs: Using Simple Boundary Arguments to Trigger Hundreds of DBMS Bugs. In EuroSys. 1061–1076.	project authored
13	Manuel Rigger and Zhendong Su. 2020. Testing database engines via pivoted query synthesis. In OSDI. 667–682.	sqlancer publication · PQS

Every place it refers to SQLancer (1)

1 sentence, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id	Sentence	Found by	Where
M1	Notably, while these fuzzing techniques have proven highly successful for DBMS testing, their effectiveness remains constrained for connectors [ 2–5,8,13,14,17].	citation marker motivation	page 1

This page is rendered from _data/papers/paper_doi_10_1109_ase63991_2025_00322.json, extracted from arxiv. 5 pages, 17 references parsed.