MTZK: Testing and Exploring Bugs in Zero-Knowledge (ZK) Compilers

Dongwei Xiao, Zhibo Liu, Yiteng Peng, Shuai Wang. 2025. Network and Distributed System Security Symposium.

Read the paper · doi:10.14722/ndss.2025.230530

What this paper does with SQLancer

Database testing is cited as one of the domains whose testing-based quality assurance MTZK's approach resembles -- finding errors rather than proving their absence -- alongside CPUs and operating systems. Both mentions are reachable only through citation markers; SQLancer is never named, and nothing of it is used or measured against. MTZK tests zero-knowledge compilers, which translate a high-level program into an arithmetic circuit. A miscompilation there is a soundness or completeness flaw with security consequences, since a wrong circuit can accept a false proof. MTZK applies metamorphic testing to find such bugs. Written by claude-opus-5 from the 2 places this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — no

SQLancer is cited as related work; no reuse of its code, generator or workload is described.

extends technique — no

No SQLancer technique is extended; the citation is background.

compares with — no

No empirical comparison against SQLancer or one of its oracles is reported.

describes as state of the art — no

The text does not describe SQLancer as the state of the art.

SQLancer publications it cites (4)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#	Entry	Matched as
60	Zu-Ming Jiang, Si Liu, Manuel Rigger, and Zhendong Su. Detecting transactional bugs in database engines via {Graph-Based }oracle construction. In 17th USENIX Symposium on Operating Systems Design and Implementation (O...	project authored
89	Manuel Rigger and Zhendong Su. Detecting optimization bugs in database engines via non-optimizing reference engine construction. In Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference...	sqlancer publication · NOREC
90	Manuel Rigger and Zhendong Su. Testing database engines via pivoted query synthesis. In 14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20), pages 667–682, 2020.	sqlancer publication · PQS
103	Theodoros Theodoridis, Manuel Rigger, and Zhendong Su. Finding missed optimizations through the lens of dead code elimination. In Proceedings of the 27th ACM International Conference on Architectural Support for Progr...	project authored

Every place it refers to SQLancer (2)

2 sentences, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id	Sentence	Found by	Where
M1	MTZK shares a similar testing-based approach with quality assurance tools for critical systems, such as CPUs [ 56], [46], databases [ 89], [59], [60], [90], and operating systems [ 65], [16], to detect errors instead of proving their absence.	citation marker background	C Usage Scenario and Clariﬁcation page 5
M2	Besides discovering correctness issues, testing is also applied to identify performance issues in compilers [ 76], [102], [103].	citation marker project authored background	D RQ4: Security Implications of Bugs page 15

This page is rendered from _data/papers/paper_doi_10_14722_ndss_2025_230530.json, extracted from supplied pdf. 18 pages, 117 references parsed.