{"id":"0134ba33-7587-4619-a89e-cff92e9718c5","arxiv_id":"2509.02025","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"A fuzzer that scores seeds by prediction error and multi-objective energy finds more diverse crashes in sequential decision-making agents than prior black-box fuzzers.","lead":"CureFuzz adds a curiosity signal, borrowed from reinforcement learning, to black-box fuzz testing of AI decision-making systems. Testing with CureFuzz finds more and more varied crash-triggering scenarios for driving, aviation, and game-playing agents than prior fuzzers in the same time budget.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Abstract claims universal superiority, but Table 2 shows G-Model beats CureFuzz on Coop Navi; the headline needs a scope qualifier.","rationale":"The reader's verdict is CONDITIONAL and already mentions the Coop Navi exception as a caveat, but the reader's identified weakest assumption is the state-space access requirement. I believe the more load-bearing concern is the unqualified superiority claim, which is directly contradicted by the paper's own Table 2 and Table 3. The paper even discusses the exception in Section 5 but fails to carry that nuance into the abstract or the RQ1 conclusion. This is an internal inconsistency in the central claim, not merely a scope limitation. The fix is straightforward: qualify the claim to specify the exception. Such a revision is entirely feasible and does not undermine the core contribution, so the verdict should remain CONDITIONAL rather than ACCEPT or REJECT. My agreement with the reader is partial because we both flag the Coop Navi issue, but the reader's formal weakest assumption differs from mine. The concrete test I propose is a focused statistical re-check of the Coop Navi results, which would settle whether the overclaim is real or an artifact of the reported summary statistics.","tokens_in":24460,"tokens_out":9746,"duration_ms":101653,"concrete_test":"From the provided replication package, extract the five per-run crash counts for CureFuzz and G-Model on Coop Navi (MARL) and run a two-sided Mann-Whitney U test (n=5 per group). If G-Model's counts are significantly higher (p<0.05), the abstract's unconditional superiority claim is false and must be revised to include the exception. If the test is not significant or favors CureFuzz, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim, as stated in the abstract and introduction, is that CureFuzz 'outperforms the state-of-the-art method by a substantial margin in the total number of faults and distinct types of crash-triggering scenarios.' This is not supported by the paper's own data. In Section 5, Table 2, for Coop Navi (MARL), G-Model finds a mean of 185.4 crashes vs CureFuzz's 85, a 118% advantage; Table 3 shows G-Model finds 184.6 distinct crash types vs CureFuzz's 85.3 at 100 bins. The paper admits this exception but does not qualify the abstract or the RQ1 conclusion ('CureFuzz statistically significantly and substantially outperforms both baselines in these cases'). The stated claim is internally contradicted by the reported results. This is more than a wording issue: it determines whether the headline contribution accurately describes the experimental outcome. The correct claim would be 'outperforms MDPFuzz on all five SDMs and outperforms G-Model on four of five, with Coop Navi as a notable exception.' Other issues (state-space accessibility, missing hyperparameters) are secondary; the overclaim is the load-bearing problem.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes CureFuzz, a curiosity-driven black-box fuzz testing approach for sequential decision-makers (SDMs). CureFuzz uses prediction error between a fixed random target network and a learnable predictor network as an intrinsic novelty signal, combined with a multi-objective seed energy function (cumulative reward, robustness, intrinsic reward) to select seeds for mutation. The approach is evaluated on five SDMs across CARLA (RL and IL), ACAS Xu, Coop Navi (MARL), and BipedalWalker, against MDPFuzz and a generative-model baseline (G-Model). The paper reports that CureFuzz finds more total crashes and more distinct crash types than the baselines in most settings, with lower per-iteration analysis time than MDPFuzz, and that crashes found by CureFuzz can be used to fine-tune ACAS Xu, reducing detected faults by 73%.","tokens_in":24730,"tokens_out":3407,"duration_ms":36928,"significance":"If the results hold, CureFuzz would be a useful addition to the SDM testing toolbox: its RND-style curiosity signal is computationally cheap, the comparison against two external baselines is meaningful, and the authors report five repetitions, confidence intervals, Mann-Whitney U tests, and effect sizes. The Coop Navi exception is disclosed in the text, and the ablation study (RQ2) supports the usefulness of the curiosity mechanism. The replication package and reuse of official baseline implementations are also positives. However, the headline claim of universal superiority over the state of the art is contradicted by the paper's own Table 2/Table 3 for Coop Navi, and the RQ3 repair result is evaluated on the same crash distribution used for repair, so the practical-utility claim needs additional support. The contribution is plausible but currently over-stated.","major_comments":[{"comment":"The abstract claims CureFuzz 'outperforms the state-of-the-art method by a substantial margin in the total number of faults and distinct types of crash-triggering scenarios' without qualification. This is contradicted by Table 2 (Coop Navi: G-Model 185.4 vs CureFuzz 85) and Table 3 (100 bins: G-Model 184.6 vs CureFuzz 85.3). The RQ1 answer ('CureFuzz statistically significantly and substantially outperforms both baselines in these cases') likewise overstates the evidence, since the text later acknowledges G-Model performs better on Coop Navi. The abstract, RQ1 conclusion, and general claims should be revised to state explicitly that CureFuzz outperforms MDPFuzz on all five SDMs and outperforms G-Model on four of five, with Coop Navi as a notable exception.","section":"Abstract; §5 RQ1"},{"comment":"The repair experiment is internally circular. The same CureFuzz-discovered crash scenarios are used to fine-tune ACAS Xu, and then CureFuzz is re-run on the repaired model to count remaining faults. A 73% reduction in this setting largely measures how well the model memorizes or fits the specific crash distribution that CureFuzz already explored; it does not demonstrate generalization to other crash-triggering scenarios. To support the claim that CureFuzz's findings 'can repair SDMs', the evaluation should include held-out crashes (e.g., crashes found by MDPFuzz or G-Model, or crashes from an independent seed/run) and report the reduction on those scenarios. Without this, the RQ3 conclusion is over-stated.","section":"§5 RQ3"},{"comment":"The paper does not report the values of α, β, γ in Eq. (2), the isInteresting threshold (Algorithm 2, line 23), the curiosity network architecture and training hyperparameters, or the seed mutation magnitude (only stated as reused from Pang et al.). These parameters are load-bearing for the reported improvements, since fuzzing performance is often sensitive to such choices. Please provide a configuration table and, ideally, a sensitivity analysis or at least a statement of the ranges explored. Without this, the empirical comparison is not fully reproducible.","section":"§3.4, Eq. (2); §4.3"},{"comment":"The 'black-box' framing is weakened by the assumption in Section 3.4 that 'we are aware of the legitimate state space of the environment' and by the reliance on environment-specific validity oracles (e.g., 'We use the CARLA simulator itself to check for the validity of the mutated state' in Section 4.2). In a genuinely black-box or closed deployment where initial states cannot be freely sampled and legality cannot be checked, CureFuzz is not directly applicable. This limitation should be stated in the assumptions or in the threat-to-validity section, and the abstract/introduction should not imply that the method applies to arbitrary black-box SDMs without such state-space access.","section":"§3.4 and §4.2"}],"minor_comments":[{"comment":"The function initCuriosity returns phi_target twice; the second return value should be phi_pred.","section":"Algorithm 1"},{"comment":"Typos: 'runnign time' in Lines 6 and 16 should be 'running time'.","section":"Algorithm 2"},{"comment":"'remains a to be an ongoing challenge' is ungrammatical; should read 'remains an ongoing challenge'.","section":"§1"},{"comment":"'CureFuzz also archives an improvement of 94.2%' should be 'achieves'.","section":"§5, Table 2 text"},{"comment":"The sentence 'Gong et al. [?]' has a missing reference; either cite the work or remove the placeholder.","section":"§8.4"},{"comment":"The text says curiosity module is implemented with 'Pytorch Library' and uses ReLU; consider adding the predictor's learning rate, batch size, and number of training steps per state sequence for reproducibility.","section":"§4.3"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is formatted as an ICSE 2024 proceedings paper and includes an ACM DOI; if this is being submitted as a new work, the authors should clarify its relationship to the previously published version. This does not affect my technical assessment, but it is relevant for the editor to consider."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Good paper to know about if you work on fuzzing for sequential decision-makers. The core idea — replacing MDPFuzz's density-based novelty with RND-style prediction error, and adding a three-term seed energy — is a real integration, and the empirical body (five SDMs, five repetitions, confidence intervals, statistical tests) is solid enough to take seriously. The efficiency numbers are striking: per-iteration analysis time drops by roughly 80–99% relative to MDPFuzz, which matters if anyone actually deploys these tools.\n\nThe main soft spot is the abstract. CureFuzz outperforms G-Model on four of five SDMs, but on Coop Navi (MARL) G-Model finds 185.4 crashes vs CureFuzz's 85, and more distinct crash types (184.6 vs 85.3 at 100 bins). The paper discloses this in Section 5 and offers a plausible explanation, but the abstract and conclusion still claim a 'substantial margin' over 'the state-of-the-art method' without qualification. That is not a minor wording issue; it misreports the actual result. The correct headline is 'outperforms MDPFuzz on all five SDMs and G-Model on four of five.'\n\nTwo secondary issues. RQ3's repair experiment is close to circular: they fine-tune the ACAS Xu model on crash scenarios found by CureFuzz, then re-run CureFuzz and report a 73% fault reduction. Some reduction is expected from memorization; a held-out set would make the claim meaningful. The other is reproducibility: alpha, beta, gamma, the isInteresting threshold, the curiosity network architecture, and the perturbation magnitude are not reported. There is a GitHub link, so the code may fill the gaps, but as a standalone text it is not self-contained.\n\nThe state-space assumption (knowing legitimate states and being able to mutate them, with a validity oracle) is stated explicitly in Section 3.4, so I would not call it a hidden flaw; it is a scope condition that should be flagged in the abstract. Also, there is a dangling citation placeholder 'Gong et al. [?]' in Section 8.4 — trivial but sloppy.\n\nBottom line: this is a decent contribution to SDM testing, worth reading for the RND-curiosity integration and the efficiency comparison, but the headline claim needs a scope qualifier and the repair evaluation needs a held-out design before the 'substantial margin' language survives. I would accept it for peer review; it has real content. If I were the editor, I would require the abstract fix and a hyperparameter table, and ask for a held-out repair experiment or at least an explicit acknowledgment of the circularity.","headline":"Solid RND-based fuzzing for SDMs with real efficiency gains, but the unqualified superiority claim doesn't survive contact with Coop Navi; the repair experiment is also circular.","tokens_in":25287,"tokens_out":2877,"would_cite":true,"duration_ms":29563,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that a curiosity signal—neural prediction error—lets black-box fuzzing find more, and more varied, crashes in deep-learning decision-makers.","keywords":["fuzz testing","sequential decision-making","deep reinforcement learning","curiosity-driven exploration","random network distillation","crash-triggering scenarios","autonomous driving testing","black-box testing"],"falsifier":"Replace the trained predictor network in the curiosity module with a second frozen random network, so the 'curiosity' score is pure noise, while keeping seed selection, mutation, budget, and environments unchanged. If CureFuzz still finds as many distinct crash-triggering scenarios as reported, the prediction-error signal is not what drives the gain; if performance falls back to MDPFuzz levels, the causal role of curiosity is confirmed.","tokens_in":24322,"feed_emoji":"🚗","tokens_out":7304,"duration_ms":78555,"temperature":0.7,"pith_summary":"Sequential decision-makers—deep-learning policies that drive cars, pilot aircraft, or control robots—are trained to maximize performance and can fail in rare states. The paper claims that a black-box fuzzer can find those failures more often and in greater variety if it treats 'unpredictability to a small neural network' as the signal of novelty, an idea borrowed from reinforcement-learning exploration. The proposed CureFuzz mutates legal starting states, runs the policy to collect state sequences, and scores each seed by a combination of prediction-error curiosity, low cumulative reward, and behavioral sensitivity to perturbation; seeds with higher scores are mutated preferentially. Evaluated over 12-hour runs on CARLA driving, ACAS Xu collision avoidance, Coop Navi, and BipedalWalker, CureFuzz reports more total crash-triggering scenarios than the MDPFuzz baseline in all five settings, with a 422% gain for BipedalWalker, and more distinct crash types at every discretization level except Coop Navi, where a generative-model baseline finds more crashes near the boundary. The paper also reports that fine-tuning an ACAS Xu network on CureFuzz-discovered crashes reduces re-found faults by 73%. If correct, the contribution is a computationally cheap, model-agnostic diversity signal for safety testing of deep-learning decision-makers.","feed_headline":"Curiosity-driven fuzzer finds up to 4x more AI crashes","feed_subtitle":"A prediction-error novelty score guides black-box tests to diverse failures in driving, flight, and robot policies.","key_machinery":"Two interacting mechanisms. First, a curiosity module: a fixed randomly initialized target network and a trainable predictor network with identical MLP architecture; the mean squared error between their outputs on a state sequence is the intrinsic reward, updated online as the fuzzer sees new states. High prediction error means the scenario is unfamiliar, and seeds that produce it are favored. Second, a multi-objective seed energy score: E(s) = e^(-alpha*r) + e^(beta*i) + gamma*r', where r is cumulative reward (low reward raises energy), i is the intrinsic curiosity reward, and r' is robustness, the Euclidean distance between final states of the original and slightly perturbed runs. Energy-p","core_discovery":"The paper's central claim is that curiosity—measured as the prediction error between a frozen random target network and a learned predictor network trained to mimic it—is a practical novelty measure for fuzzing sequential decision-makers. CureFuzz is a black-box fuzzer built on this signal: it randomly seeds an initial corpus of legal environment states, mutates them with small perturbations, executes the SDM to obtain state sequences, and assigns each candidate an energy score combining the mean prediction-error intrinsic reward, an exponential low-cumulative-reward term, and a robustness term that measures how far the final state moves under perturbation. Seeds are selected proportionally","pith_inferences":["The Coop Navi result hints at a boundary-vs-interior trade-off: the generative baseline found more crashes by concentrating agents near the state-space boundary, while CureFuzz spread crashes across the interior. A hybrid that adds boundary-aware robustness to curiosity scoring might dominate both methods—a testable direction the paper does not pursue.","Because the novelty signal is an online-trained predictor, CureFuzz's curriculum is order-dependent; early random seeds shape what counts as 'curious' later. Scheduling the corpus and updating the predictor on non-crash sequences could change the diversity of found crashes as much as the energy weights do.","The 73% repair result is shown for one DNN policy; an untested extension is to feed CureFuzz crashes back into reinforcement-learning training as negative demonstrations or safety constraints, which would test whether the same diversity signal improves policies during learning, not just after fine-tuning."],"forward_implications":["Crash discovery without white-box access: any SDM that can be exercised by setting a legal initial state and observing state sequences can be fuzzed with CureFuzz, even if its weights and gradients are hidden.","A 12-hour CureFuzz run detects more distinct failure modes, not just more crashes: distinct crash-type counts are up to 200% higher than MDPFuzz at 100-bin discretization, reducing duplicate debugging effort.","Per-iteration novelty analysis costs about 0.005–0.011 seconds versus 0.033–0.985 seconds for MDPFuzz, so the diversity signal scales to high-dimensional continuous state spaces where density-based novelty is expensive.","Discovered scenarios can be used to repair SDMs: after fine-tuning ACAS Xu on CureFuzz crashes, the number of faults found on re-testing drops by 73%.","CureFuzz works across policy types—DNN, DRL, MARL, and IL—suggesting the method depends on the environment interface rather than on a particular learning algorithm."],"supporting_citations":[{"why":"Defines the MDPFuzz baseline and supplies the experimental environments, initial-corpus times, mutation implementation, and repair procedure that CureFuzz is compared against.","marker":"[56]"},{"why":"G-Model baseline, the generative model-based testing method whose termination-state novelty measure CureFuzz is compared with on crash counts and diversity.","marker":"[86]"},{"why":"Supplies the random network distillation idea from which the curiosity mechanism's target-predictor prediction error is taken.","marker":"[11]"},{"why":"Provides the DNN-based ACAS Xu aircraft collision avoidance model used as one of the tested SDMs and the repair target.","marker":"[35]"},{"why":"Provides the CARLA autonomous driving simulator used as the environment for the two driving SDMs.","marker":"[16]"},{"why":"Defines the ACAS Xu collision avoidance environment used for the DNN SDM.","marker":"[49]"},{"why":"Defines the Coop Navi multi-agent environment used to evaluate the MARL SDM.","marker":"[45]"},{"why":"Provides the TQC algorithm and BipedalWalker environment used for the robot locomotion SDM.","marker":"[41]"}],"fun_headline_variants":["Curiosity-driven fuzzer exposes diverse AI crashes","Curiosity-based fuzzing finds more AI decision failures","CureFuzz uses curiosity to uncover hidden AI crash scenarios","Novel curiosity metric boosts AI fuzzing crash discovery","Curiosity-powered fuzzing reveals dangerous AI behaviors"],"cache_read_input_tokens":2688,"weakest_assumption_plain":"CureFuzz assumes the tester can sample and mutate valid starting states inside a known legitimate state space, with a simulator to reject illegal states; for a closed SDM whose initial states cannot be controlled or validated, the approach does not apply.","fun_headline_variants_meta":{"raw":{"variants":["Curiosity-driven fuzzer exposes diverse AI crashes","Curiosity-based fuzzing finds more AI decision failures","CureFuzz uses curiosity to uncover hidden AI crash scenarios","Novel curiosity metric boosts AI fuzzing crash discovery","Curiosity-powered fuzzing reveals dangerous AI behaviors"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000402,"raw_usage":{"total_tokens":1940,"prompt_tokens":760,"completion_tokens":1180,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":504,"completion_tokens_details":{"reasoning_tokens":1100}},"tokens_in":504,"tokens_out":1180,"duration_ms":12788,"temperature":1.0,"reasoning_tokens":1100,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T11:57:53.836723+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Replace the trained predictor network in the curiosity module with a second frozen random network, so the 'curiosity' score is pure noise, while keeping seed selection, mutation, budget, and environments unchanged. If CureFuzz still finds as many distinct crash-triggering scenarios as reported, the prediction-error signal is not what drives the gain; if performance falls back to MDPFuzz levels, the causal role of curiosity is confirmed.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"G-Model baseline, the generative model-based testing method whose termination-state novelty measure CureFuzz is compared with on crash counts and diversity."},{"cited_title":"Deep Neural Network Compression for Aircraft Collision Avoidance Systems","cited_arxiv_id":"1810.04240","evidence_quote":"Provides the DNN-based ACAS Xu aircraft collision avoidance model used as one of the tested SDMs and the repair target."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines the ACAS Xu collision avoidance environment used for the DNN SDM."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines the Coop Navi multi-agent environment used to evaluate the MARL SDM."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the TQC algorithm and BipedalWalker environment used for the robot locomotion SDM."}],"review_version":1}