Physics Engine Fuzzing

The core target of physics engine fuzzing is the constraint solver—the iterative algorithm that resolves contacts, joints, and collisions. Fuzzers generate ill-conditioned constraint systems with near-singular Jacobian matrices, redundant constraints, or contradictory joint limits. These inputs force the solver into excessive iteration counts, floating-point exception (FPE) traps, or non-convergent states. A solver that fails to converge can leave objects in interpenetrating configurations, creating exploitable tunneling vulnerabilities where agents or projectiles pass through solid barriers.

Fuzzing targets the boundary conditions of floating-point arithmetic within the physics engine. Key injection vectors include:

• NaN and Inf propagation: Feeding Not-a-Number or Infinity values into force accumulators, causing entire simulation states to become unrecoverable.
• Subnormal number flooding: Injecting extremely small denormalized floats that trigger performance cliffs on certain CPU architectures, creating timing side-channels.
• Catastrophic cancellation: Crafting inputs where subtracting nearly equal values destroys numerical precision, leading to object teleportation or energy gain violations.
• Division-by-zero pathways: Triggering unprotected divisions in inertia tensor inversions or time-step calculations.

Fuzzers generate degenerate geometric primitives to exploit the broad-phase and narrow-phase collision detection pipeline. Inputs include:

• Zero-volume meshes: Triangles with colinear vertices or tetrahedra with coplanar faces that break bounding volume hierarchy (BVH) traversal.
• Giant/dwarf scale extremes: Objects with dimensions at the limits of FLT_MAX or FLT_MIN, causing AABB overlap tests to overflow.
• Self-intersecting geometry: Non-manifold meshes that confuse the GJK (Gilbert-Johnson-Keerthi) or EPA (Expanding Polytope Algorithm) distance algorithms.
• Rapid teleportation: Moving objects at velocities exceeding the tunneling threshold, bypassing continuous collision detection (CCD) entirely.

The discrete time-stepping nature of physics engines creates a fundamental attack surface. Fuzzers manipulate:

• Variable time-step injection: Submitting oscillating or negative dt values that destabilize the numerical integrator, particularly semi-implicit Euler or Runge-Kutta methods.
• Sub-stepping exhaustion: Forcing the engine into adaptive sub-stepping loops with inputs that require infinite subdivision, causing denial-of-service via CPU exhaustion.
• Fixed-step desynchronization: Exploiting the gap between the simulation's fixed physics tick and the rendering frame rate to inject state at indeterminate interpolation points.
• Sleep state thrashing: Rapidly toggling objects between sleeping and awake states to trigger expensive island recomputation and memory allocation spikes.

Physics material parameters define coefficients for friction, restitution, and damping. Fuzzers test the extremes:

• Negative restitution: Setting bounce coefficients below zero to create energy-amplifying collisions that accelerate objects without bound.
• Friction coefficient overflow: Injecting values >1.0 or negative friction that violate the Coulomb friction cone constraints, causing solver divergence.
• Zero mass/inertia: Assigning massless objects that produce infinite accelerations under any force, breaking Newton's second law integration.
• Infinite stiffness: Setting spring or constraint stiffness to FLT_MAX, creating stiff differential equations that require impractically small time-steps to solve stably.

Physics engines frequently serialize and deserialize simulation state for save/load, networking, and checkpointing. Fuzzing targets:

• Malformed state buffers: Injecting bit-flipped or truncated serialized data that causes out-of-bounds reads during deserialization of rigid body transforms, velocities, or contact manifolds.
• Type confusion attacks: Crafting serialized payloads where the data type flag is mismatched with the actual payload, exploiting unsafe deserialization patterns in C++ physics engines.
• Pointer invalidation: Serializing handles or indices that become dangling after deserialization into a different memory layout, leading to use-after-free vulnerabilities.
• Determinism violations: Fuzzing for non-deterministic serialization that causes simulation divergence in networked games or distributed physics scenarios.

Fuzzing a simulator's collision detection solver with NaN-coordinate meshes can reveal a code path where the engine silently fails to register a collision. An attacker who understands this bug can craft a malicious 3D asset—a pedestrian or vehicle mesh with a degenerate triangle—that, when placed in the simulation, is invisible to the agent's safety constraints. The agent trains to drive through solid objects, a behavior that transfers directly to the physical vehicle's policy, disabling emergency braking for specific adversarial shapes.

By fuzzing the inverse kinematics solver with joint angle combinations near gimbal lock, an attacker can discover a numerical region where the solver returns a valid but wildly incorrect configuration. This kinematic model inversion attack allows a malicious payload to command the arm to a target pose that passes all simulation safety checks but, due to the singularity bug, causes the physical arm to spin violently through an unexpected trajectory, damaging itself or its surroundings.

Fuzzing the rigid body dynamics integrator with extreme mass ratios—such as a 1g drone carrying a 1000kg payload—can expose a numerical instability in the time-stepping method. An attacker exploits this by injecting a simulation parameter tampering payload that momentarily sets a rotor's moment of inertia to an absurd value. The physics engine produces a plausible-looking but non-physical state update, causing the trained flight controller to issue a catastrophic overcorrection command when the same sensor pattern appears in reality.

Fuzzing the contact manifold generation with interpenetrating collision bodies can uncover a state where the solver's friction model returns a NaN friction impulse. An attacker crafts a virtual terrain patch with a microscopic, self-intersecting geometry that triggers this condition. When the simulated quadruped steps on this patch, the contact solver fails, the leg's foot is 'glued' in place, and the locomotion policy learns a gait that freezes on contact—a behavior exploitable in the physical robot by placing a 3D-printed adversarial tile in its path.

Fuzzing a finite element method solver with negative material densities can trigger a logic path where stress calculations are silently clamped to zero. An attacker who discovers this through automated fuzzing can perform a digital twin poisoning attack, modifying the material properties of a critical structural component in the twin's asset database. The simulation predicts safe operation under load, but the physical asset—manufactured to the twin's validated specifications—suffers a catastrophic structural failure when the real stress exceeds the zeroed-out threshold.

Fuzzing the constraint solver with cyclic dependency graphs in articulated objects can cause an infinite loop or a stack overflow in the physics engine. An attacker exploits this by introducing a simulation asset tampering payload: a seemingly normal shelf with a hidden, self-referential joint constraint. When the simulated warehouse robot's planner queries the physics engine to navigate near this shelf, the solver hangs, causing a denial-of-service. In a real deployment, the physical robot's policy, trained to expect a response within a time window, enters an undefined state and may collide with the actual shelf.