ELFuzz: Efficient Input Generation via LLM-driven Synthesis Over Fuzzer Space
summary
ELFuzz automatically synthesizes generation-based fuzzers via an LLM-driven evolution loop that starts from naive seed generators and iteratively applies splicing, completion, and infilling mutators, evaluates mutants by exact covered code ranges in a lattice, and selects survivors with a set-cover approximation. Implementation uses a 13B Colama model on a single >26 GB GPU. Evaluation scales to 1,791,104 LOC, achieves up to 434.8% more coverage and up to 174.0% more injected bugs, and finds five 0-day bugs (three exploitable) in a 14-day cvc5 campaign.
AI-written summary · about
chapters (12)
- 0:00ELFuzz introduction
- 2:25Evolutionary input generation
- 3:28Three-step evolution loop
- 5:13Mutating generators with LLM
- 6:38Evaluating mutants in space
- 8:03Selecting survivors with set cover
- 9:05Implementation details
- 10:06Research questions
- 11:12Effectiveness results
- 13:02Ablation study
- 14:05Extensibility and implications
- 15:08Conclusion
related talks
52mStructure aware fuzzing
01h 15mMake your programs more reliable with Fuzzing
53mFuzzing 101
15mInterleaving Large Language Models for Compiler Testing
31m“Fuzz or lose..."
39mMaking Fuzzing Part of Your Software Development Lifecycle
20mAFL++ : Combining Incremental Steps of Fuzzing Research
20mKFuzzTest: Targeted Fuzzing of Internal Kernel Functions