Pith. sign in

REVIEW 5 major objections 5 minor 62 references

ZTaint-Havoc: From Havoc Mode to Zero-Execution Fuzzing-Driven Taint Inference

T0 review · 5 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that the havoc mutations a fuzzer already executes can be reused as a zero-extra-execution taint inference, and that biasing later mutations toward the inferred hot bytes lifts mean edge coverage by 2.97% on FuzzBench…

desk verdict Clever zero-execution taint inference idea, but the evaluation bundles three changes and never isolates the taint signal, so the headline coverage gains are not yet attributable to the proposed mechanism. read the letter →

arxiv 2506.08838 v1 pith:27USLXDW submitted 2025-06-10 cs.CR cs.SE

Yuchong Xie , Wenhui Zhang , Dongdong She This is my paper
classification cs.CRcs.SE
keywords fuzzingfuzzing-driventaintinferencehavocmodehotbyteszero-executioncoverage-guidededgecoveragemutationscheduling
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that the mutations a fuzzer already makes during havoc mode can double as a free fuzzing-driven taint inference, identifying which input bytes influence program behavior without a single extra program execution. If true, this removes the main cost that has kept black-box taint inference out of high-throughput fuzzing, the $O(N)$ additional executions per seed. The authors formalize havoc mode with a computational model, then build ZTaint-Havoc, which records frontier-branch behavior for seed and mutants, increments per-byte counters whenever behavior diverges within a small Hamming-distance threshold, and uses those counters to bias later mutations. The reported payoff is higher edge coverage in 24-hour campaigns, with average gains of 2.97% on FuzzBench and 6.12% on UniBench, at a runtime overhead of 12.58% and 3.84% respectively.

What carries the argument

The central object is the single havoc mutation treated as an FTI probe: a sequence of unit operators $f(s)$ applied $h$ times (the havoc stack) to a seed or to a spliced seed, written $f^h(s)$ or $f^h(\mathit{splice}(s))$. ZTaint-Havoc keeps only mutants whose Hamming distance $D_{\mathrm{Hamming}}(seed, mutant)$ is at most the adaptive threshold $k = \beta \cdot L / N_{\mathrm{mut}}$ (bounded between 1 and $\lfloor \mathrm{len}(s)/32 \rfloor$ in the prototype), records the frontier branch and control-instruction behavior of seed and mutant, and increments a per-byte taint counter for every differing byte whenever that behavior changes. The normalized counter vector becomes the sampling distribution $P(i) = \mathit{taint\_count}[i] / \sum_j \mathit{taint\_count}[j]$, which replaces the uniform random position selection in the guided mutation phase.

What would settle it

Feed the sampling phase inputs with known byte-level taint, for example a format guarded by a checksum where mutating the checksum byte only flips the guard branch, and compare the inferred counter ordering against ground truth; if checksum bytes are ranked as hot for downstream consumers, the signal is path-induced rather than data-flow taint.

Watch

Extended reading notes

Core claim

The paper's central claim is that the havoc mutation scheme already embedded in coverage-guided fuzzers can be repurposed, at zero extra execution cost, into a fuzzing-driven taint inference engine. Because havoc operators select mutation positions almost uniformly and the havoc stack is usually small, the mutants produced during ordinary fuzzing constitute the same kind of near-minimal perturbations that classic FTI uses; the paper adds an adaptive Hamming-distance threshold $k$ to keep those perturbations small and a cumulative taint counter to separate true hot bytes from noise. In the implemented prototype, the first half of each seed's havoc mutations acts as a sampling phase that compares frontier-branch control-instruction behavior between seed and mutant, and the second half uses the resulting per-byte counts to bias mutation start positions. The authors report mean edge-coverage gains of 2.97% on FuzzBench and 6.12% on UniBench in 24-hour campaigns, with per-target gains up to 33.71% and 51.12%, at a runtime overhead of 12.58% on FuzzBench and 3.84% on UniBench; they also present what they call the first computational model of havoc mode, formalized as a Markov process over seeds.

Load-bearing premise

Everything depends on the equation 'mutated byte caused the observed behavior change': if path divergence flips a frontier branch for a reason unrelated to the mutated bytes, the taint counters fill with false positives and the guided phase wastes effort on irrelevant bytes.

Editorial extensions

If this is right

  • Fuzzing-driven taint inference becomes a byproduct of ordinary havoc mutations; any fuzzer whose mutation engine selects positions nearly uniformly and uses small stacks can run the inference with zero extra executions.
  • The adaptive threshold $k$ removes per-target manual tuning: in the paper's eight-hour comparison, adaptive $k$ won on 16 targets, while fixed values $k=1,10,100,1000,10000$ won on 5, 5, 2, 9, and 7 respectively.
  • In 24-hour campaigns, mean edge coverage rises by 2.97% on FuzzBench and 6.12% on the standalone UniBench programs, with individual targets up to 33.71% and 51.12%.
  • The same taint-guided mutation can be combined with a simple gradient-descent solver, beating the comparison fuzzer's branch-solving mode by an average of 3.06% on FuzzBench and 13.54% on UniBench.
  • The runtime overhead stays modest at 12.58% on FuzzBench and 3.84% on UniBench, so the coverage gains are not offset by a large loss of execution throughput.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the frontier-branch signal has low precision, the method is still likely to act as a useful coverage heuristic, but the 'taint' label would be misleading; a precision/recall study against dynamic taint analysis would settle this.
  • The same sampling phase could be coupled with other behavior deltas, such as full branch-taken vectors or memory-access patterns, without losing the zero-execution property, since the inference only needs a per-mutant behavior difference and the byte-diff set.
  • Because the paper's RQ1 shows the threshold is what makes influenced-byte coverage nearly uniform, fuzzers whose havoc operators have non-uniform position biases would need a similar normalization step before they could inherit the benefit.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. This paper proposes ZTaint-Havoc, an AFL++-based fuzzer that turns havoc mutations into a zero-extra-execution fuzzing-driven taint inference (FTI) scheme. The authors model havoc as a Markov process (Section 3), introduce an adaptive Hamming-distance threshold k (Eq. 5), and maintain cumulative taint counts for bytes implicated when frontier control-instruction signatures change between a seed and a mutant (Algorithm 1). In the second phase of each seed's havoc budget, mutation starting positions are drawn according to Eq. (6). The evaluation reports mean edge-coverage gains of 2.97% on FuzzBench and 6.12% on UniBench over 24-hour campaigns, with claimed overheads of 3.84% and 12.58%. The paper also claims the first computational model of havoc mode and an open-source implementation.

Significance. The central idea is attractive and the zero-extra-execution property is real: the sampling phase reuses executions that vanilla havoc would perform anyway, and no separate taint-inference runs are added. The paper ships an open-source artifact, and its headline coverage comparison is against an external baseline (vanilla AFL++), so there is no circularity in the RQ5 comparison. The descriptive measurements of mutation distance and position distribution (RQ1, RQ3, RQ4) are useful. However, the load-bearing claim that taint-guided byte selection improves coverage is not yet established: the RQ5 comparison bundles the threshold, the phase split, and the taint-weighted sampling, and the taint signal itself is never validated against ground truth. The result is promising, but the mechanism requires a controlled ablation and a taint-accuracy study before it can be credited.

major comments (5)
  1. [Section 8.7, Table 6, Eq. (6)] RQ5 is not a controlled test of the taint-guidance mechanism. ZTaint-Havoc differs from vanilla AFL++ in three bundled changes: the adaptive Hamming-distance threshold k (Eqs. 4-5 plus the floor(len(s)/32) bound described in Section 7), the 50% sampling / 50% mutating phase split in Algorithm 1, and taint-weighted position selection (Eq. 6). A coverage gain from this bundle does not show that the taint counts carry information. Please run an ablation with the same threshold and phase structure but uniform random position selection, or with shuffled taint counts, and report per-target comparisons. Without this, Result 5 cannot be attributed to the proposed FTI signal.
  2. [Section 7 / Algorithm 1, lines 9-12] The taint inference signal is never validated against ground truth. A byte is counted as tainted whenever any frontier control-instruction signature differs between seed and mutant, and all bytes that differ in the mutant receive the increment. Because havoc mutants can differ in multiple bytes, a path divergence caused by one byte increments counts for every differing byte. The paper asserts that cumulative counters suppress such noise, but no precision/recall experiment against known taint (e.g., annotated formats or a dynamic taint baseline) is provided. Since Eq. (6) relies entirely on this signal, the mechanism is currently unsubstantiated.
  3. [Section 5.1, Eq. (5), Section 7] The adaptive threshold depends on an unreported parameter beta, and the implementation adds a further bound 1 ≤ k ≤ floor(len(s)/32) that is not present in Eq. (5). The value of beta used in RQ5-RQ8 is never stated, and the interaction between the bound and Eq. (5) is not explained. Because RQ6 shows that k choice strongly affects coverage, the missing parameter prevents reproduction and makes the adaptive-k component of the bundled gain non-verifiable.
  4. [Section 8.9, Table 8] The overhead labels are internally inconsistent with the text. Section 8.9.2 and the abstract report 3.84% overhead on UniBench and 12.58% on FuzzBench, but as rendered Table 8 places the 'Overhead 3.84%' label in the FuzzBench block and the 'Overhead 12.58%' label in the UniBench block. Please correct the table or the text and recompute the per-dataset overheads.
  5. [Section 8.7 / Section 8.4] Statistical support for the headline gains is thin. The Mann-Whitney U test is mentioned, but Table 6 marks only a few targets as significant, and the mean gains are reported without confidence intervals or per-target variance. In addition, the seed selection in RQ2 and RQ5 uses 'moderate-length seeds and well-formed structures' rather than the standard FuzzBench/UniBench seed corpora. The 24-hour results should be re-reported with the benchmark-standard seed sets and a complete significance summary; otherwise the average-improvement claim is not robust to seed-choice effects.
minor comments (5)
  1. [Section 3, Eq. (2)] The 'computational model' claim is weakened by the unspecified proportionality in D(s,m) ≈ h·D(s,f(s)); Eq. (2) is descriptive and no predictive corollary is derived from it. I suggest either deriving the proportionality under the uniform-selection assumption or rephrasing the novelty claim.
  2. [Algorithm 1 / Section 7] The loop bounds n1 and n2 in Algorithm 1 are undefined, and the sentence 'we will taint the 5 different bytes' in Section 7 appears to be a typo for 'these different bytes'.
  3. [Section 8.3] RQ1's influenced-byte experiment restricts attention to mutants that maintain identical execution paths, while Algorithm 1 uses changed frontier behavior as the taint signal; the relationship between these two notions should be clarified.
  4. [Table 6 / Table 7] Several targets show equal or near-equal coverage between the compared configurations (e.g., jsoncpp and flvmeta); the text should state explicitly how ties are counted in the win/loss summaries.
  5. [Section 3.4 / Section 9] The phrase 'first computational model of havoc mode' should be qualified, since prior work already models coverage-guided fuzzing as a Markov chain (Ref. [9]); the novelty is better positioned as the first FTI-specific model of havoc.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the taint counters are built from runtime behavior comparisons, the coverage gain is measured against an external baseline, and no fitted constant or self-citation is load-bearing.

full rationale

The paper's derivation chain is self-contained and does not reduce to its own inputs. The taint signal (Section 7) is constructed by comparing frontier-branch control-instruction behavior between a seed and its mutants (Algorithm 1, lines 4-12); it is not derived from the coverage result. The mutation probability in Eq. 6 is a reweighting of these measured taint counts, and the coverage improvement is then evaluated against vanilla AFL++ on FuzzBench and UniBench (Section 8.7), so the claimed gain is an empirical comparison rather than a renaming of the input. The adaptive threshold k (Eq. 5) is defined from seed length and mutation count, not fitted to the coverage outcome, and the paper explicitly bounds it (Section 7) rather than calibrating it to benchmark results. The 'computational model of havoc mode' (Section 3.4) is a descriptive Markov-process formulation; it is not used to derive or fit any constant that produces the coverage numbers. Self-citations such as [41] and [54] are contextual references and are not load-bearing for the central claim. The absence of an ablation isolating the taint-guided byte selection is a legitimate experimental-validity concern, but it is not a circularity: the paper does not define the coverage improvement in terms of the taint definition. No uniqueness theorem is imported from the authors' prior work, and no known result is merely renamed. The limitations stated in Section 10 (instrumentation overhead, threshold dependence, filtering reducing sample size) are acknowledged trade-offs, not evidence of circular reasoning. Accordingly, no circular step is present and the score is 0.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The method depends on a small set of assumptions: uniform havoc position selection, branch-behavior difference as a taint signal, and path preservation within threshold k. The paper makes these assumptions explicit in prose but does not prove them or validate them against ground truth. The threshold k is controlled by an unreported beta, and the implementation adds hand-picked constants (32 and 50%), giving the central algorithm three free parameters that are not swept.

free parameters (3)
  • beta in adaptive threshold k = beta * L / Nmut
    Controls the mutation threshold in Eq. (5); its value is never reported, chosen by hand, and directly affects which mutants are used for taint inference.
  • k upper-bound divisor 32 = 32
    Implementation clamps k to floor(len(seed)/32); an arbitrary constant that changes how many bytes may differ before a mutant is used for inference.
  • sampling ratio = 0.5
    The first 50% of havoc mutations are treated as taint sampling; this hand-chosen split determines how many mutations are spent on inference versus guided mutation.
assumptions (4)
  • domain assumption Havoc operator starting positions are selected uniformly across the input space.
    Needed for R2 (thorough byte examination); RQ1 shows approximate uniformity but with a tail falloff, and the model in Section 3 simply assumes it.
  • domain assumption A difference in control-instruction behavior at frontier branches is a valid indicator that mutated bytes influence program behavior.
    This is the entire taint signal; the paper does not compare against ground-truth taint, so precision and recall are unknown.
  • domain assumption Mutants within Hamming distance k preserve enough path similarity for meaningful behavior comparison.
    Stated as 'Path Preservation' in Section 5.1, not proven; used to justify why the threshold k makes inference valid.
  • domain assumption Accumulated taint counts over many mutations separate true taints from noise.
    Section 5.2 asserts that true taints receive consistently higher counts, but no statistical model or convergence argument is given.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ZTaint-Havoc: From Havoc Mode to Zero-Execution Fuzzing-Driven Taint Inference." pith.science (2026). https://pith.science/paper/27USLXDW

@misc{pith2026250608838,
  author       = {Pith},
  title        = {Pith review of: ZTaint-Havoc: From Havoc Mode to Zero-Execution Fuzzing-Driven Taint Inference},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/27USLXDW}},
  note         = {Machine review of arXiv:2506.08838}
}
read the original abstract

Fuzzing is a widely used technique for discovering software vulnerabilities, but identifying hot bytes that influence program behavior remains challenging. Traditional taint analysis can track such bytes white-box, but suffers from scalability issue. Fuzzing-Driven Taint Inference (FTI) offers a black-box alternative, yet typically incurs significant runtime overhead due to extra program executions. We observe that the commonly used havoc mutation scheme in fuzzing can be adapted for lightweight FTI with zero extra executions. We present a computational model of havoc mode, demonstrating that it can perform FTI while generating new test cases. Building on this, we propose ZTaint-Havoc, a novel, efficient FTI with minimal overhead (3.84% on UniBench, 12.58% on FuzzBench). We further design an effective mutation algorithm utilizing the identified hot bytes. Our comprehensive evaluation shows that ZTaint-Havoc, implemented in AFL++, improves edge coverage by up to 33.71% on FuzzBench and 51.12% on UniBench over vanilla AFL++, with average gains of 2.97% and 6.12% in 24-hour fuzzing campaigns.

Figures

Figures reproduced from arXiv: 2506.08838 by the authors.

Figure 1
Figure 1. Workflow of ZTaint-Havoc. • We present a novel zero-execution FTI method that leverages havoc mode’s inherent proper￾ties, eliminating the need for additional program execution. • We demonstrate a practical implementation that enhances fuzzing effectiveness through taint-guided mutations, validated through a comprehensive evaluation. The code can be available at https://github.com/Yu3H0/ZTaint-Havoc 2 Background 2.1… view at source ↗
Figure 2
Figure 2. An example illustrating how havoc mode can be used for FTI. The left side shows the havoc mutation process where testcases are generated with different bytes modified (marked in red) from a 7-byte seed, with each byte represented by a block. The right side demonstrates FTI process. Through multiple iterations, havoc mode covers all byte locations similar to FTI. is ’000’, single-byte mutations can generate mutant te… view at source ↗
Figure 3
Figure 3. Distribution of mutation starting positions across ten target programs. The x-axis represents the position in input space where mutations begin, while the y-axis shows the accumulated selec￾tion frequency over 10 independent runs. The red line indicates the average frequency across all positions [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Distribution of influenced bytes (bytes that differ between the original seed and mutated input) across ten target programs. The x-axis represents the byte position in input space, while the y-axis shows the accumulated frequency of bytes being influenced over 10 indep…
Figure 5
Figure 5. Figure 5: Distribution of influenced bytes across ten target programs with a perturbation threshold of k=5. The x-axis represents the byte position in input space, while the y-axis shows the accumulated frequency of bytes being influenced over 10 independent runs, demonstrating …
Figure 6
Figure 6. Figure 6: Changes in perturbation distances across different havoc stack sizes (1, 2, 4, 8, 16). Each line represents a target program’s perturbation distance measured by L0, L1, L2 norms and edit distance. Results from all ten targets are plotted individually. Result 3: The per…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

62 extracted references · 53 canonical work pages

  1. [1]

    SBST’23 Fuzzing Competition (C/C++ Programs) Report

    2023. SBST’23 Fuzzing Competition (C/C++ Programs) Report. https://storage.googleapis.com/www.fuzzbench.com/ reports/experimental/SBFT23/Final-Coverage/index.html

    work page 2023

  2. [2]

    a library for coverage-guided fuzz testing

    2024. a library for coverage-guided fuzz testing. https://llvm.org/docs/LibFuzzer.html

    work page 2024

  3. [3]

    Evaluation report of aflpp on the Fuzzbench dataset

    2024. Evaluation report of aflpp on the Fuzzbench dataset. (May 28 2024). https://www.fuzzbench.com/reports/ experimental/2024-05-28-aflpp/index.html

    work page 2024

  4. [4]

    SBST’25 Fuzzing Competition

    2025. SBST’25 Fuzzing Competition. https://sbft25.github.io/tools/fuzzing

    work page 2025

  5. [5]

    Andrea Arcuri and Lionel Briand. 2011. A practical guide for using statistical tests to assess randomized algorithms in software engineering. In Proceedings of the 33rd International Conference on Software Engineering (Waikiki, Honolulu, HI, USA) (ICSE ’11). Association for Computing Machinery, New York, NY, USA, 1–10. doi:10.1145/1985793.1985795

    arXiv 2011

  6. [6]

    Cornelius Aschermann, Sergej Schumilo, Tim Blazytko, Robert Gawlik, and Thorsten Holz. 2019. REDQUEEN: Fuzzing with Input-to-State Correspondence.. In NDSS

    work page 2019

  7. [7]

    Dario Asprone, Jonathan Metzman, Abhishek Arya, Giovani Guizzo, and Federica Sarro. 2022. Comparing Fuzzers on a Level Playing Field with FuzzBench. In 2022 IEEE Conference on Software Testing, Verification and Validation (ICST) . 302–311. doi:10.1109/ICST53961.2022.00039

    arXiv 2022

  8. [8]

    Marcel Böhme, Van-Thuan Pham, Manh-Dung Nguyen, and Abhik Roychoudhury. 2017. Directed greybox fuzzing. In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security . 2329–2344

    work page 2017

Show all 62 references
  1. [9]

    Marcel Böhme, Van-Thuan Pham, and Abhik Roychoudhury. 2016. Coverage-based greybox fuzzing as markov chain. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security . 1032–1043

    2016

  2. [10]

    Marcel Böhme, László Szekeres, and Jonathan Metzman. 2022. On the reliability of coverage-based fuzzer benchmarking. In Proceedings of the 44th International Conference on Software Engineering . 1621–1633

    2022

  3. [11]

    Peng Chen and Hao Chen. 2018. Angora: Efficient fuzzing by principled search. In 2018 IEEE Symposium on Security and Privacy (SP). IEEE

    2018

  4. [12]

    Peng Chen, Jianzhong Liu, and Hao Chen. 2019. Matryoshka: fuzzing deeply nested branches. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security . 499–513

    2019

  5. [13]

    Weimin Chen, Xiapu Luo, Haipeng Cai, and Haoyu Wang. 2024. Towards Smart Contract Fuzzing on GPU. InIEEE Symposium on Security and Privacy (SP) . 1–15

    2024

  6. [14]

    Jaeseung Choi, Joonun Jang, Choongwoo Han, and Sang Kil Cha. 2019. Grey-box concolic testing on binary code. In 2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE) . IEEE, 736–747

    2019

  7. [15]

    Jaeseung Choi, Doyeon Kim, Soomin Kim, Gustavo Grieco, Alex Groce, and Sang Kil Cha. 2021. Smartian: Enhancing smart contract fuzzing with static and dynamic data-flow analyses. In 2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE). IEEE, 227–239

    2021

  8. [16]

    Yinlin Deng, Chunqiu Steven Xia, Haoran Peng, Chenyuan Yang, and Lingming Zhang. 2023. Large language models are zero-shot fuzzers: Fuzzing deep-learning libraries via large language models. In Proceedings of the 32nd ACM SIGSOFT international symposium on software testing and...

    2023

  9. [17]

    Yinlin Deng, Chunqiu Steven Xia, Chenyuan Yang, Shizhuo Dylan Zhang, Shujing Yang, and Lingming Zhang. 2024. Large language models are edge-case generators: Crafting unusual programs for fuzzing deep learning libraries. In Proceedings of the 46th IEEE/ACM International Confere...

    2024

  10. [18]

    2020.{AFL++}: Combining incremental steps of fuzzing research

    Andrea Fioraldi, Dominik Maier, Heiko Eißfeldt, and Marc Heuse. 2020.{AFL++}: Combining incremental steps of fuzzing research. In 14th USENIX Workshop on Offensive Technologies (WOOT 20)

    2020

  11. [19]

    Andrea Fioraldi, Dominik Christian Maier, Dongjia Zhang, and Davide Balzarotti. 2022. Libafl: A framework to build modular and reusable fuzzers. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. 1051–1065

    2022

  12. [20]

    2020.{GREYONE}: Data flow sensitive fuzzing

    Shuitao Gan, Chao Zhang, Peng Chen, Bodong Zhao, Xiaojun Qin, Dong Wu, and Zuoning Chen. 2020.{GREYONE}: Data flow sensitive fuzzing. In 29th USENIX security symposium (USENIX Security 20) . 2577–2594

    2020

  13. [21]

    Richard W Hamming. 1950. Error detecting and error correcting codes. The Bell system technical journal 29, 2 (1950), 147–160

    1950

  14. [22]

    Heqing Huang, Yiyuan Guo, Qingkai Shi, Peisen Yao, Rongxin Wu, and Charles Zhang. 2022. Beacon: Directed grey-box fuzzing with provable path pruning. In 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 36–50

    2022

  15. [23]

    Heqing Huang, Peisen Yao, Hung-Chun Chiu, Yiyuan Guo, and Charles Zhang. 2023. Titan: Efficient Multi-target Directed Greybox Fuzzing. In 2024 IEEE Symposium on Security and Privacy (SP) . IEEE Computer Society, 59–59

    2023

  16. [24]

    Heqing Huang, Peisen Yao, Rongxin Wu, Qingkai Shi, and Charles Zhang. 2020. Pangolin: Incremental hybrid fuzzing with polyhedral path abstraction. In 2020 IEEE Symposium on Security and Privacy (SP) . IEEE, 1613–1627

    2020

  17. [25]

    Patrick Jauernig, Domagoj Jakobovic, Stjepan Picek, Emmanuel Stapf, and Ahmad-Reza Sadeghi. 2022. DARWIN: Survival of the Fittest Fuzzing Mutators. arXiv preprint arXiv:2210.11783 (2022)

    2022 arXiv

  18. [26]

    2023.{DAFL}: Directed Grey-box Fuzzing guided by Data Dependency

    Tae Eun Kim, Jaeseung Choi, Kihong Heo, and Sang Kil Cha. 2023.{DAFL}: Directed Grey-box Fuzzing guided by Data Dependency. In 32nd USENIX Security Symposium (USENIX Security 23) . 4931–4948. Proc. ACM Softw. Eng., Vol. 2, No. ISSTA, Article ISSTA041. Publication date: July 20...

    2023

  19. [27]

    George Klees, Andrew Ruef, Benji Cooper, Shiyi Wei, and Michael Hicks. 2018. Evaluating fuzz testing. In Proceedings of the 2018 ACM SIGSAC conference on computer and communications security . 2123–2138

    2018

  20. [28]

    Vladimir I Levenshtein et al. 1966. Binary codes capable of correcting deletions, insertions, and reversals. In Soviet physics doklady, Vol. 10. Soviet Union, 707–710

    1966

  21. [29]

    Wen Li, Jinyang Ruan, Guangbei Yi, Long Cheng, Xiapu Luo, and Haipeng Cai. 2023. PolyFuzz: Holistic Greybox Fuzzing of Multi-Language Systems. In 32nd USENIX Security Symposium (USENIX Security 23) . USENIX Association, Anaheim, CA, 1379–1396. https://www.usenix.org/conference...

    2023

  22. [30]

    Wen Li, Haoran Yang, Xiapu Luo, Long Cheng, and Haipeng Cai. 2023. PyRTFuzz: Detecting Bugs in Python Runtimes via Two-Level Collaborative Fuzzing. InACM Conference on Computer and Communications Security (CCS) . 1645—-1659. doi:10.1145/3576915.3623166 (artifact evaluated; bad...

    2023

  23. [31]

    Yuwei Li, Shouling Ji, Yuan Chen, Sizhuang Liang, Wei-Han Lee, Yueyao Chen, Chenyang Lyu, Chunming Wu, Raheem Beyah, Peng Cheng, et al. 2021. {UniBench}: A holistic and pragmatic{Metrics-Driven} platform for evaluating fuzzers. In 30th USENIX Security Symposium (USENIX Securit...

    2021

  24. [32]

    Jie Liang, Mingzhe Wang, Chijin Zhou, Zhiyong Wu, Yu Jiang, Jianzhong Liu, Zhe Liu, and Jiaguang Sun. 2022. PATA: Fuzzing with Path Aware Taint Analysis. In 2022 IEEE Symposium on Security and Privacy (SP) . 1–17. doi:10.1109/ SP46214.2022.9833594

    2022

  25. [33]

    Dongge Liu, Jonathan Metzman, Marcel Böhme, Oliver Chang, and Abhishek Arya. 2023. SBFT Tool Competition 2023–Fuzzing Track. arXiv preprint arXiv:2304.10070 (2023)

    2023 arXiv

  26. [34]

    Yuwei Liu, Siqi Chen, Yuchong Xie, Yanhao Wang, Libo Chen, Bin Wang, Yingming Zeng, Zhi Xue, and Purui Su. 2023. VD-Guard: DMA Guided Fuzzing for Hypervisor Virtual Device. In 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE). IEEE, 1676–1687

    2023

  27. [35]

    Chenyang Lyu, Shouling Ji, Chao Zhang, Yuwei Li, Wei-Han Lee, Yu Song, and Raheem Beyah. 2019. {MOPT}: Optimized mutation scheduling for fuzzers. In 28th USENIX Security Symposium (USENIX Security 19)

    2019

  28. [36]

    Jonathan Metzman, László Szekeres, Laurent Simon, Read Sprabery, and Abhishek Arya. 2021. Fuzzbench: an open fuzzer benchmarking platform and service. InProceedings of the 29th ACM joint meeting on European software engineering conference and symposium on the foundations of so...

    2021

  29. [37]

    Hui Peng, Yan Shoshitaishvili, and Mathias Payer. 2018. T-Fuzz: fuzzing by program transformation. In 2018 IEEE Symposium on Security and Privacy (SP) . IEEE, 697–710

    2018

  30. [38]

    Sanjay Rawat, Vivek Jain, Ashish Kumar, Lucian Cojocar, Cristiano Giuffrida, and Herbert Bos. 2017. VUzzer: Application-aware evolutionary fuzzing.. In NDSS, Vol. 17. 1–14

    2017

  31. [39]

    Abhishek Shah, Dongdong She, Samanway Sadhu, Krish Singal, Peter Coffman, and Suman Jana. 2022. MC2: Rig- orous and Efficient Directed Greybox Fuzzing. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. 2595–2609

    2022

  32. [40]

    Dongdong She, Abhishek Shah, and Suman Jana. 2022. Effective Seed Scheduling for Fuzzing with Graph Centrality Analysis. 2022 IEEE Symposium on Security and Privacy (SP) (2022), 2194–2211

    2022

  33. [41]

    Dongdong She, Adam Storek, Yuchong Xie, Seoyoung Kweon, Prashast Srivastava, and Suman Jana. 2024. Fox: Coverage-guided fuzzing as online stochastic control. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security . 765–779

    2024

  34. [42]

    Nick Stephens, John Grosen, Christopher Salls, Andrew Dutcher, Ruoyu Wang, Jacopo Corbetta, Yan Shoshitaishvili, Christopher Kruegel, and Giovanni Vigna. 2016. Driller: Augmenting fuzzing through selective symbolic execution.. In NDSS, Vol. 16. 1–16

    2016

  35. [43]

    Jianzhong Su, Hong-Ning Dai, Lingjun Zhao, Zibin Zheng, and Xiapu Luo. 2022. Effectively generating vulnerable transaction sequences in smart contracts with reinforcement learning-guided fuzzing. In Proceedings of the 37th IEEE/ACM International Conference on Automated Softwar...

    2022

  36. [44]

    Jinghan Wang, Chengyu Song, and Heng Yin. 2021. Reinforcement learning-based hierarchical seed scheduling for greybox fuzzing. (2021)

    2021

  37. [45]

    Mingzhe Wang, Jie Liang, Yuanliang Chen, Yu Jiang, Xun Jiao, Han Liu, Xibin Zhao, and Jiaguang Sun. 2018. SAFL: increasing and accelerating testing coverage with symbolic execution and guided fuzzing. In Proceedings of the 40th International Conference on Software Engineering:...

    2018

  38. [46]

    Shuai Wang and Dinghao Wu. 2017. In-memory fuzzing for binary code similarity analysis. In 2017 32nd IEEE/ACM International Conference on Automated Software Engineering (ASE) . IEEE, 319–330

    2017

  39. [47]

    Tielei Wang, Tao Wei, Guofei Gu, and Wei Zou. 2010. TaintScope: A checksum-aware directed fuzzing tool for automatic software vulnerability detection. In 2010 IEEE Symposium on Security and Privacy . IEEE, 497–512

    2010

  40. [48]

    Yanhao Wang, Xiangkun Jia, Yuwei Liu, Kyle Zeng, Tiffany Bao, Dinghao Wu, and Purui Su. 2020. Not All Coverage Measurements Are Equal: Fuzzing by Coverage Accounting for Input Prioritization.. In NDSS. Proc. ACM Softw. Eng., Vol. 2, No. ISSTA, Article ISSTA041. Publication dat...

    2020

  41. [49]

    Weisstein

    Eric W. Weisstein. [n. d.]. Vector Norm. From MathWorld–A Wolfram Web Resource. https://mathworld.wolfram. com/VectorNorm.html

  42. [50]

    Taiyu Wong, Chao Zhang, Yuandong Ni, Mingsen Luo, HeYing Chen, Yufei Yu, Weilin Li, Xiapu Luo, and Haoyu Wang. 2024. ConFuzz: Towards Large Scale Fuzz Testing of Smart Contracts in Ethereum. In IEEE INFOCOM 2024-IEEE Conference on Computer Communications . IEEE, 1691–1700

    2024

  43. [51]

    Mingyuan Wu, Ling Jiang, Jiahong Xiang, Yanwei Huang, Heming Cui, Lingming Zhang, and Yuqun Zhang. 2022. One fuzzing strategy to rule them all. InProceedings of the 44th International Conference on Software Engineering . 1634–1645

    2022

  44. [52]

    Shuohan Wu, Zihao Li, Luyi Yan, Weimin Chen, Muhui Jiang, Chenxu Wang, Xiapu Luo, and Hao Zhou. 2024. Are we there yet? unraveling the state-of-the-art smart contract fuzzers. In Proceedings of the IEEE/ACM 46th International Conference on Software Engineering . 1–13

    2024

  45. [53]

    Chunqiu Steven Xia, Matteo Paltenghi, Jia Le Tian, Michael Pradel, and Lingming Zhang. 2023. Universal fuzzing via large language models. arXiv preprint arXiv:2308.04748 (2023)

    2023 arXiv

  46. [54]

    Yuchong Xie, Yu Liu, Zhibo He, Rundong Yang, Jin Wei, and Dongdong She. 2025. HFuzz: Havoc Mode Guided Fuzzing. In Proceedings of the 18th ACM/IEEE International Workshop on Search-Based and Fuzz Testing

    2025

  47. [55]

    Chenyuan Yang, Yinlin Deng, Jiayi Yao, Yuxing Tu, Hanchi Li, and Lingming Zhang. 2023. Fuzzing automatic differentiation in deep-learning libraries. In 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE). IEEE, 1174–1186

    2023

  48. [56]

    Wei You, Xueqiang Wang, Shiqing Ma, Jianjun Huang, Xiangyu Zhang, XiaoFeng Wang, and Bin Liang. 2019. Profuzzer: On-the-fly input type probing for better zero-day vulnerability discovery. In 2019 IEEE symposium on security and privacy (SP). IEEE, 769–786

    2019

  49. [57]

    2018.{QSYM}: A practical concolic execution engine tailored for hybrid fuzzing

    Insu Yun, Sangho Lee, Meng Xu, Yeongjin Jang, and Taesoo Kim. 2018.{QSYM}: A practical concolic execution engine tailored for hybrid fuzzing. In 27th USENIX Security Symposium (USENIX Security 18) . 745–761

    2018

  50. [58]

    Michał Zalewski. [n. d.]. American Fuzz Lop. https://github.com/google/AFL

  51. [59]

    Kunpeng Zhang, Zongjie Li, Daoyuan Wu, Shuai Wang, and Xin Xia. 2025. Low-Cost and Comprehensive Non-textual Input Fuzzing with LLM-Synthesized Input Generators. arXiv preprint arXiv:2501.19282 (2025)

    2025 arXiv

  52. [60]

    Kunpeng Zhang, Shuai Wang, Jitao Han, Xiaogang Zhu, Xian Li, Shaohua Wang, and Sheng Wen. 2024. Your Fix Is My Exploit: Enabling Comprehensive DL Library API Fuzzing with Large Language Models. In 2025 IEEE/ACM 47th International Conference on Software Engineering (ICSE) . IEE...

    2024

  53. [61]

    Kunpeng Zhang, Xi Xiao, Xiaogang Zhu, Ruoxi Sun, Minhui Xue, and Sheng Wen. 2022. Path transitions tell more: Optimizing fuzzing schedules via runtime program states. InProceedings of the 44th International Conference on Software Engineering. 1658–1668

    2022

  54. [62]

    Kunpeng Zhang, Xiaogang Zhu, Xi Xiao, Minhui Xue, Chao Zhang, and Sheng Wen. 2023. SHAPFUZZ: Efficient Fuzzing via Shapley-Guided Byte Selection. arXiv preprint arXiv:2308.09239 (2023). Received 2024-10-31; accepted 2025-03-31 Proc. ACM Softw. Eng., Vol. 2, No. ISSTA, Article ...

    2023 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.