Effective Bug Detection in Graph Database Engines: An LLM-Based Approach
Read the paper · doi:10.1109/tkde.2026.3656491 · arXiv:2402.00292v1
What this paper does with SQLancer
All three of SQLancer's original oracles are described in the survey of prior approaches -- PQS selecting target data and constructing a query to retrieve it, NoREC comparing optimized and non-optimized forms, TLP partitioning on ternary logic -- as the relational precedent for graph-engine testing.
DGDB uses large language models to generate queries for detecting bugs in graph database engines, then applies differential testing to the results. The authors argue existing approaches are tied to a single graph query language and require extensive prior knowledge to produce queries. Applied to engines using Cypher, Gremlin and SPARQL it found 23 previously unknown wrong-result bugs, and reports more than three times as many bugs as prior methods on Cypher engines.
How it was classified
uses infrastructure — no
SQLancer is cited, not used; nothing in the mentions describes reusing its code.
extends technique — no
No technique is extended; the citation is background.
compares with — no
No empirical comparison against SQLancer is reported in the mentions.
describes as state of the art — no
The citation does not characterise SQLancer as the state of the art.
SQLancer publications it cites (4)
Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.
| # | Entry | Matched as |
|---|---|---|
| 35 | Manuel Rigger. 2022. SQLancer. https://github.com/sqlancer/sqlancer. | sqlancer publication |
| 36 | Manuel Rigger and Zhendong Su. 2020. Detecting optimization bugs in database engines via non-optimizing reference engine construction. In Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conf... | sqlancer publication · NOREC |
| 37 | Manuel Rigger and Zhendong Su. 2020. Finding bugs in database systems via query partitioning. Proceedings of the ACM on Programming Languages 4, OOPSLA (2020), 1–30. | sqlancer publication · TLP |
| 38 | Manuel Rigger and Zhendong Su. 2020. Testing database engines via pivoted query synthesis. In 14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20). 667–682. | sqlancer publication · PQS |
Every place it refers to SQLancer (6)
6 sentences, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.
| Id | Sentence | Found by | Where |
|---|---|---|---|
| M1 | The former typically involves detecting bugs in graph database engines by generating equivalent queries[ 5] or utilizing predicate partitioning[ 23,24,37]. |
citation marker |
page 1 |
| M2 | In the predicate partitioning approach for detecting graph database engine bugs[ 24], it starts by constructing queries based on a top-down expression generator[ 35], and then apply Ternary Logic Partitioning techniques to create correspondent queries, namely the "True, False or Null" queries, for running on graph d... |
technique |
page 1 |
| M3 | Most current research focuses on the latter approach and the most widely adopted method is running randomly generated queries [3,35,43] on different graph database engines for bug detection. |
citation marker |
page 2 |
| M4 | PQS[ 38] selects a target data from randomly generated tables, generates conditional expressions based on the target data, constructs an SQL query with a where or join clause, and determines the presence of bugs by checking if the result is included in the result set. |
technique |
page 11 |
| M5 | NoRec[ 36] converts the original SQL query into a nonoptimized SQL query and compares the results of these two SQL queries for consistency. |
technique |
page 11 |
| M6 | TLP[ 37] transforms randomly generated original SQL queries into three different logical queries based on the true, false, and null ternary logic. |
technique |
page 11 |