ROSA: Finding Backdoors with Fuzzing

Dimitrios Kokkonis, M. Marcozzi, Emilien Decoux, Stefano Zacchiroli. 2025. International Conference on Software Engineering.

Read the paper · doi:10.1109/icse55347.2025.00183 · arXiv:2505.08544

What this paper does with SQLancer

Two citations, both pointing to SQLancer's oracles as the known successful use of metamorphic oracles in fuzzing to find intricate logic bugs in mature software -- the precedent for ROSA's own oracle. ROSA detects code-level backdoors -- hidden access such as hard-coded credentials -- by fuzzing. The authors argue manual auditing is hard, existing semi-automated approaches need reverse-engineering, and no existing fuzzing technique recognises a backdoor being triggered at runtime. ROSA pairs AFL++ with a metamorphic oracle able to detect such triggers, and ships ROSARUM, the first open benchmark for backdoor detection. It finds all 17 benchmark backdoors in about 1.5 hours. Written by claude-opus-5 from the 2 places this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — no

SQLancer is cited, not used; nothing in the mentions describes reusing its code.

extends technique — no

No technique is extended; the citation is background.

compares with — no

No empirical comparison against SQLancer is reported in the mentions.

describes as state of the art — no

The citation does not characterise SQLancer as the state of the art.

SQLancer publications it cites (2)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#	Entry	Matched as
38	M. Rigger and Z. Su, “Finding bugs in database systems via query partitioning,” Proc. ACM Program. Lang., vol. 4, no. OOPSLA, 2020.	sqlancer publication · TLP
40	S. Project, “Sqlancer,” 2024. [Online]. Available: https://github.com/ sqlancer/sqlancer	sqlancer publication

Every place it refers to SQLancer (2)

2 sentences, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id	Sentence	Found by	Where
M1	Known successful uses of metamorphic oracles in fuzzing have notably enabled detecting intricate logic bugs in various complex, mature and large programs, like compilers, SQL database management systems and SMT solvers [36]–[40].	citation marker background	B Graybox and metamorphic fuzzing page 3
M2	Bug detection with fuzzing usually relies on simple oracles, like crash detection [14], [34] and sanitizers [13], but metamorphic oracles have also been coupled with fuzzers to find logical bugs in code processors or constraint solvers [36]–[40].	citation marker background	E Threats to validity page 11

This page is rendered from _data/papers/paper_doi_10_1109_icse55347_2025_00183.json, extracted from arxiv. 13 pages, 54 references parsed.