REVIEW 8 cited by
Locus: Agentic Predicate Synthesis for Directed Fuzzing
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
Locus: Agentic Predicate Synthesis for Directed Fuzzing
read the original abstract
Directed fuzzing aims to find program inputs that lead to specified target program states. It has broad applications, such as debugging system crashes, confirming reported bugs, and generating exploits for potential vulnerabilities. This task is inherently challenging because target states are often deeply nested in the program, while the search space manifested by numerous possible program inputs is prohibitively large. Existing approaches rely on branch distances or manually-specified constraints to guide the search; however, the branches alone are often insufficient to precisely characterize progress toward reaching the target states, while the manually specified constraints are often tailored for specific bug types and thus difficult to generalize to diverse target states and programs. We present Locus, a novel framework to improve the efficiency of directed fuzzing. Our key insight is to synthesize predicates to capture fuzzing progress as semantically meaningful intermediate states, serving as milestones towards reaching the target states. When used to instrument the program under fuzzing, they can reject executions unlikely to reach the target states, while providing additional coverage guidance. To automate this task and generalize to diverse programs, Locus features an agentic framework with program analysis tools to synthesize and iteratively refine the candidate predicates, while ensuring the predicates strictly relax the target states to prevent false rejections via symbolic execution. Our evaluation shows that Locus substantially improves the efficiency of eight state-of-the-art fuzzers in discovering real-world vulnerabilities, achieving an average speedup of 41.6x. So far, Locus has found nine previously unpatched bugs, with three already acknowledged with draft patches.
Forward citations
Cited by 8 Pith papers
-
Mystra: Declarative Dynamic Taint Analysis via Shadow Virtual Machine
A declarative taint-analysis DSL plus a shadow virtual machine detects 95.5% of benchmark JS CVEs at 1.85x runtime overhead and ports to V8, SpiderMonkey, and CPython.
-
SeedSmith: LLM-Driven Seed Synthesis for Directed Fuzzing
An agentic LLM seed generator that recovers missing call edges and crash preconditions yields 11–15× geometric-mean crash-time speedups on Magma and unlocks 16 previously unreachable ARVO bugs.
-
SeedSmith: LLM-Driven Seed Synthesis for Directed Fuzzing
An agentic LLM pipeline generates sink-targeted fuzzing seeds that on Magma give geomean crash-time speedups of 11.51-14.66x and unlock 16 ARVO bugs unreachable with default seeds.
-
Like a Hammer, It Can Build, It Can Break: Large Language Model Uses, Perceptions, and Adoption in Cybersecurity Operations on Reddit
Reddit analysis of 892 posts shows SOC practitioners adopt LLMs mainly for controllable productivity work and constrain autonomy due to reliability, security, and cost concerns.
-
Mystra: Declarative Dynamic Taint Analysis via Shadow Virtual Machine
A Shadow Virtual Machine plus declarative Mystra rules delivers portable multi-level DTA for JS/Python with 95.5% recall and 1.85× overhead on Node.js.
-
PBFuzz: Agentic Directed Fuzzing for PoV Generation
An agentic fuzzing system lets LLM agents infer vulnerability constraints, encode them as parameter generators, and solve them with property-based testing; it triggered 57 Magma CVEs, 17 missed by other fuzzers.
-
Like a Hammer, It Can Build, It Can Break: Large Language Model Uses, Perceptions, and Adoption in Cybersecurity Operations on Reddit
Security practitioners use LLMs independently for low-risk productivity tasks while showing interest in enterprise platforms, but reliability, verification needs, and security risks limit broader autonomy.
-
BODHI: Precise OS Kernel Specification Inference
A structured domain-knowledge translation guide injected into LLM prompts improves OS kernel specification generation from 55% to 97% Pass@1 across nine models.
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.