{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2025:27USLXDWTFL3FMAPZEJQL4FKC4","short_pith_number":"pith:27USLXDW","schema_version":"1.0","canonical_sha256":"d7e925dc769957b2b00fc91305f0aa171b1fc58823c46a6467006e2f7e48b77a","source":{"kind":"arxiv","id":"2506.08838","version":1},"attestation_state":"computed","paper":{"title":"ZTaint-Havoc: From Havoc Mode to Zero-Execution Fuzzing-Driven Taint Inference","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"Dongdong She, Wenhui Zhang, Yuchong Xie","submitted_at":"2025-06-10T14:25:07Z","abstract_excerpt":"Fuzzing is a widely used technique for discovering software vulnerabilities, but identifying hot bytes that influence program behavior remains challenging. Traditional taint analysis can track such bytes white-box, but suffers from scalability issue. Fuzzing-Driven Taint Inference (FTI) offers a black-box alternative, yet typically incurs significant runtime overhead due to extra program executions. We observe that the commonly used havoc mutation scheme in fuzzing can be adapted for lightweight FTI with zero extra executions. We present a computational model of havoc mode, demonstrating that "},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2506.08838","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-06-10T14:25:07Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"86ee92e7ab1ae9cc9e1509af6cc6aa49d625fea0ea128865bdbe0470c22ebff6","abstract_canon_sha256":"cd600722dd7e5d4d391eabf1a3991401cfa2909ad3a2de3e8a1f77bef9906703"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:19:13.959889Z","signature_b64":"i9EaBrfzdsk+yzcGMPOq61ULqlNoEmdXaK/xHwKn2/Mw+i5FygeLNNFwM8xjHuLC9IXJAJm1R+gUBQeCGEWpBA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"d7e925dc769957b2b00fc91305f0aa171b1fc58823c46a6467006e2f7e48b77a","last_reissued_at":"2026-07-05T11:19:13.959391Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:19:13.959391Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"ZTaint-Havoc: From Havoc Mode to Zero-Execution Fuzzing-Driven Taint Inference","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"Dongdong She, Wenhui Zhang, Yuchong Xie","submitted_at":"2025-06-10T14:25:07Z","abstract_excerpt":"Fuzzing is a widely used technique for discovering software vulnerabilities, but identifying hot bytes that influence program behavior remains challenging. Traditional taint analysis can track such bytes white-box, but suffers from scalability issue. Fuzzing-Driven Taint Inference (FTI) offers a black-box alternative, yet typically incurs significant runtime overhead due to extra program executions. We observe that the commonly used havoc mutation scheme in fuzzing can be adapted for lightweight FTI with zero extra executions. We present a computational model of havoc mode, demonstrating that "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.08838","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2506.08838/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2506.08838","created_at":"2026-07-05T11:19:13.959447+00:00"},{"alias_kind":"arxiv_version","alias_value":"2506.08838v1","created_at":"2026-07-05T11:19:13.959447+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.08838","created_at":"2026-07-05T11:19:13.959447+00:00"},{"alias_kind":"pith_short_12","alias_value":"27USLXDWTFL3","created_at":"2026-07-05T11:19:13.959447+00:00"},{"alias_kind":"pith_short_16","alias_value":"27USLXDWTFL3FMAP","created_at":"2026-07-05T11:19:13.959447+00:00"},{"alias_kind":"pith_short_8","alias_value":"27USLXDW","created_at":"2026-07-05T11:19:13.959447+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/27USLXDWTFL3FMAPZEJQL4FKC4","json":"https://pith.science/pith/27USLXDWTFL3FMAPZEJQL4FKC4.json","graph_json":"https://pith.science/api/pith-number/27USLXDWTFL3FMAPZEJQL4FKC4/graph.json","events_json":"https://pith.science/api/pith-number/27USLXDWTFL3FMAPZEJQL4FKC4/events.json","paper":"https://pith.science/paper/27USLXDW"},"agent_actions":{"view_html":"https://pith.science/pith/27USLXDWTFL3FMAPZEJQL4FKC4","download_json":"https://pith.science/pith/27USLXDWTFL3FMAPZEJQL4FKC4.json","view_paper":"https://pith.science/paper/27USLXDW","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2506.08838&json=true","fetch_graph":"https://pith.science/api/pith-number/27USLXDWTFL3FMAPZEJQL4FKC4/graph.json","fetch_events":"https://pith.science/api/pith-number/27USLXDWTFL3FMAPZEJQL4FKC4/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/27USLXDWTFL3FMAPZEJQL4FKC4/action/timestamp_anchor","attest_storage":"https://pith.science/pith/27USLXDWTFL3FMAPZEJQL4FKC4/action/storage_attestation","attest_author":"https://pith.science/pith/27USLXDWTFL3FMAPZEJQL4FKC4/action/author_attestation","sign_citation":"https://pith.science/pith/27USLXDWTFL3FMAPZEJQL4FKC4/action/citation_signature","submit_replication":"https://pith.science/pith/27USLXDWTFL3FMAPZEJQL4FKC4/action/replication_record"}},"created_at":"2026-07-05T11:19:13.959447+00:00","updated_at":"2026-07-05T11:19:13.959447+00:00"}