PHYFU: Fuzzing Modern Physics Simulation Engines

TL;DR

PHYFU is a specialized fuzzing framework that tests modern physics simulation engines by mutating initial states and checking for physics law violations, uncovering thousands of errors across commercial and academic PSEs.

Contribution

The paper introduces PHYFU, a novel fuzzing framework tailored for PSEs, capable of detecting errors in both forward and backward simulation phases.

Findings

Uncovered over 5,000 error-triggering inputs in four PSEs.

Detected errors across the entire software stack of PSEs.

Successfully tested PSEs from Google, NVIDIA, and academia.

Abstract

A physical simulation engine (PSE) is a software system that simulates physical environments and objects. Modern PSEs feature both forward and backward simulations, where the forward phase predicts the behavior of a simulated system, and the backward phase provides gradients (guidance) for learning-based control tasks, such as a robot arm learning to fetch items. This way, modern PSEs show promising support for learning-based control methods. To date, PSEs have been largely used in various high-profitable, commercial applications, such as games, movies, virtual reality (VR), and robotics. Despite the prosperous development and usage of PSEs by academia and industrial manufacturers such as Google and NVIDIA, PSEs may produce incorrect simulations, which may lead to negative results, from poor user experience in entertainment to accidents in robotics-involved manufacturing and surgical operations. This paper introduces PHYFU, a fuzzing framework designed specifically for PSEs to uncover errors in both forward and backward simulation phases. PHYFU mutates initial states and asserts if the PSE under test behaves consistently with respect to basic Physics Laws (PLs). We further use feedback-driven test input scheduling to guide and accelerate the search for errors. Our study of four PSEs covers mainstream industrial vendors (Google and NVIDIA) as well as academic products. We successfully uncover over 5K error-triggering inputs that generate incorrect simulation results spanning across the whole software stack of PSEs.