Eidolon: Perform Noise-Aware Fuzzing on FHE Libraries via Equivalence Expression Transformation

Zhensheng Xian, Zhen Yan, Yuanliang Chen, Xuelian Cao, Fuchen Ma, Dalong Shi, Yu Jiang. 2026. Proceedings of the ACM on Software Engineering.

Read the paper · doi:10.1145/3808109

What this paper does with SQLancer

One citation, in a survey of where metamorphic testing has been combined with fuzzing. Eidolon is a fuzzer for fully homomorphic encryption libraries. Existing cryptographic testing tools generate structured inputs suited to cryptographic algorithms and are unaware of FHE noise management, so they fail to exercise computation on encrypted data. Eidolon directs mutations at arithmetic expressions within the noise budget and uses Equivalence Expression Transformation as its oracle, rewriting an expression into mathematically identical but structurally different forms. It found 20 previously unknown bugs, 12 assigned CVEs. Written by claude-opus-5 from the 1 place this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — no

SQLancer is cited, not used; nothing in the mentions describes reusing its code.

extends technique — no

No technique is extended; the citation is background.

compares with — no

No empirical comparison against SQLancer is reported in the mentions.

describes as state of the art — no

The citation does not characterise SQLancer as the state of the art.

SQLancer publications it cites (1)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#	Entry	Matched as
41	Manuel Rigger and Zhendong Su. 2020. Testing database engines via pivoted query synthesis. InProceedings of the 14th USENIX Conference on Operating Systems Design and Implementation (OSDI’20). USENIX Association, USA,...	sqlancer publication · PQS

Every place it refers to SQLancer (1)

1 sentence, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id	Sentence	Found by	Where
M1	For instance, metamorphic fuzz testing [ 28] combines MT with fuzzing to detect faults in autonomous driving systems, QFuzz [ 36] uses execution costs for side-channel leakage quantification, and SQLancer [ 41] employs a containment oracle for DBMS logic bugs.	name background	8.3 Fuzzing page 20

This page is rendered from _data/papers/paper_doi_10_1145_3808109.json, extracted from supplied pdf. 22 pages, 52 references parsed.