IcFuzz: Fuzzing Isaac Sim with Semantic Stage Guidance and Multi-level Mutation

2026-08-06

AI Summary

This work addresses the challenge of effectively uncovering bugs in NVIDIA Isaac Sim, where existing fuzzing approaches struggle due to context-aware semantics, hierarchical control structures, and an expansive state space. To overcome these limitations, the authors propose IcFuzz, the first fuzzing framework tailored for this simulator. IcFuzz innovatively leverages large language models (LLMs) to perform semantic phase segmentation, constructing a structured simulation-phase model that guides multi-granularity mutation strategies. It further employs a multi-armed bandit algorithm to adaptively schedule these mutation strategies, enabling efficient exploration of the state space. Experimental results demonstrate that IcFuzz achieves 190%–205% higher code coverage than baseline methods within 12 hours, detects an average of 3.7 unique crashes per round, and has identified 11 real-world vulnerabilities over four months, nine of which have been confirmed or patched.

Abstract

Robotics simulators serve as a foundational infrastructure for embodied AI, facilitating safe and scalable robotic system development. NVIDIA Isaac Sim has emerged as one of the most popular simulators, distinguished by its GPU-accelerated physics engine and photorealistic rendering, which enable high-fidelity modeling of complex environments. However, its inherent complexity inevitably introduces software bugs that can compromise simulation reliability. Existing fuzzing approaches struggle to test Isaac Sim effectively due to challenges of context-aware object semantics, hierarchical simulation control, and a vast simulation state space. In this paper, we propose IcFuzz, the first fuzzing approach for Isaac Sim. IcFuzz first performs an LLM-based semantic stage segmentation, decomposing simulation programs into structured stages that capture context-aware object semantics. Guided by this information, IcFuzz designs multi-level mutation operators to systematically exercise the simulator across hierarchical granularities. To efficiently navigate the vast simulation state space, IcFuzz employs a multi-armed bandit algorithm to adaptively schedule mutation operators. Experimental results show that IcFuzz outperforms the baselines in terms of both code coverage and bug detection. Specifically, IcFuzz achieves approximately 190\%--205\% of the code coverage of the baselines and detects an average of 3.7 unique crashes over three rounds of 12-hour tests, while no crashes are detected by the baselines. Moreover, IcFuzz has uncovered 11 bugs over approximately four months, 9 of which have been confirmed or fixed by the developers.

Problem

• fuzzing
• Isaac Sim
• simulation reliability
• software bugs
• state space

Innovation

• semantic stage guidance
• multi-level mutation
• LLM-based segmentation
• multi-armed bandit scheduling
• Isaac Sim fuzzing