Arquimedes Canedo's paper reveals 'oracle anchoring' lets software defects hide in plain sight

A new arXiv paper from software engineering researcher Arquimedes Canedo exposes a subtle but dangerous flaw in test oracle design: oracle anchoring. The problem occurs when a test oracle obtains its expected value from the same system it is judging. If a software fault shifts both the measurement and the expectation together, the comparison cancels exactly—no generated input will ever reveal the bug. Canedo names this defect 'oracle anchoring' and distinguishes between specification-anchored expectations (computed from fixed values outside the code) and state-anchored expectations (derived directly or transitively from the code under mutation).

Canedo tested this phenomenon on a deployed air traffic control simulator using 12 model-free property suites across 4 modules and 366 mutants. The anchored property suites detected only 3 more mutants than hand-written tests, yet were 6 to 33 times more efficient per test—giving a false sense of completeness. The paper also documents three interventions, each predicted before execution. Re-anchoring one holding oracle on published procedure recovered 8 of 46 mutants without changing production code; state-anchoring a healthy debounce oracle cost 4 of 19 detections; and a reference model killed exactly the same mutants as specification anchoring, proving model-freedom is not the issue—anchoring is. Of six ablated oracle instances, just two accounted for 11 of the 12 recovered mutants. Strikingly, the published test-smell rule would revert Canedo's repair, and writing the missing oracle afterward exposed two defects that deployment had never surfaced.