Rise From The Ashes: LLM-based Static Analysis for Deep Learning Framework Bugs
2026-07-01 • Software Engineering
Software Engineering
AI summaryⓘ
The authors created Phoenix, a new static analysis tool that uses large language models (LLMs) to find bugs in deep learning frameworks without running the code. They represent cross-language tensor data flows and code context in a special format called SBIR, which helps the LLM understand and spot potential bugs. Phoenix uses multiple agents to summarize past bugs, find relevant code, build these SBIRs, and analyze them for errors. Their tests show Phoenix works well alongside traditional testing methods and has already found and helped fix 31 real bugs in PyTorch.
deep learning frameworksstatic analysisfuzzinglarge language modelstensor flowsintermediate representationPyTorchbug detectionmulti-agent systemssoftware security
Authors
Shaoyu Yang, Haifeng Lin, Chunrong Fang, Xiang Chen, Wei Cheng, Jiawei Liu, Yiyu Zhang, Hongyu Liu, Zhenyu Chen
Abstract
Deep learning (DL) frameworks are critical AI infrastructures that often hide bugs with serious security implications. While dynamic approaches such as fuzzing are effective in uncovering these bugs, they require real test execution and incur high computational costs. Static analysis is a natural complement because it can detect bugs without runtime execution, offering fast and scalable testing. Unfortunately, there is still limited work targeting static analysis for DL frameworks due to their multilingual architectures and tensor-related program state. We present Phoenix, the first LLM-based static analysis technique for DL frameworks. Our key insight is that cross-language tensor flows in DL frameworks can be modeled, together with concrete code context, as a structured semantic bridge intermediate representation (SBIR) that LLMs can analyze for potential bugs in tensor semantic propagation. We implement this insight through a multi-agent workflow. A summarization agent first distills bug summaries from historical bug-fix patches and CWE rules. Guided by each summary, an extraction agent identifies bug-relevant repository symbols for code retrieval, and a generation agent synthesizes grounded SBIRs from the retrieved context. Finally, an analysis agent is leveraged to check SBIRs and report potential bugs. Our evaluation shows that Phoenix is a practical complement to dynamic DL framework testing for bug finding. To date, Phoenix has found 31 real new bugs in PyTorch for different heterogeneous hardware backends (Intel CPU, NVIDIA CUDA, and Apple MPS). Among them, 20 submitted bug-fixing patches have been merged into upstream.