Fuzzwise: Intelligent Initial Corpus Generation for Fuzzing

2025-12-24

AI Summary

Gray-box fuzzing suffers from low-quality initial seed sets (ICS) and a disjointed workflow between seed generation and corpus minimization. Method: This paper proposes an LLM-driven multi-agent collaborative framework that unifies high-coverage, high-bug-triggering ICS generation. It introduces a novel execution-free predictive coverage assessment mechanism, where a dedicated LLM agent dynamically evaluates seed utility in real time; seed generation and corpus minimization are integrated into a single end-to-end process. Contribution/Results: Experiments demonstrate that our approach achieves higher code coverage and detects more runtime errors using fewer test cases than state-of-the-art baselines. Both time efficiency and coverage efficiency are significantly improved, validating the effectiveness of LLM-guided, agent-coordinated seed optimization.

Technology Category

• Search and Optimization: Sampling/Simulation-based Search
• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: Code Generation / Program Synthesis from Natural Language

Application Category

• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Economics, Online Markets and Human Computation: Cost models of using LLMs in production systems
• User Modeling, Personalization and Recommendation: Large Language Models (LLM) for user modeling and recommendation

Abstract

In mutation-based greybox fuzzing, generating high-quality input seeds for the initial corpus is essential for effective fuzzing. Rather than conducting separate phases for generating a large corpus and subsequently minimizing it, we propose FuzzWise which integrates them into one process to generate the optimal initial corpus of seeds (ICS). FuzzWise leverages a multi-agent framework based on Large Language Models (LLMs). The first LLM agent generates test cases for the target program. The second LLM agent, which functions as a predictive code coverage module, assesses whether each generated test case will enhance the overall coverage of the current corpus. The streamlined process allows each newly generated test seed to be immediately evaluated for its contribution to the overall coverage. FuzzWise employs a predictive approach using an LLM and eliminates the need for actual execution, saving computational resources and time, particularly in scenarios where the execution is not desirable or even impossible. Our empirical evaluation demonstrates that FuzzWise generates significantly fewer test cases than baseline methods. Despite the lower number of test cases, FuzzWise achieves high code coverage and triggers more runtime errors compared to the baselines. Moreover, it is more time-efficient and coverage-efficient in producing an initial corpus catching more errors.

Problem

• Generates optimal initial seed corpus for fuzzing
• Integrates corpus generation and minimization into one process
• Uses LLM agents to predict coverage without program execution

Innovation

• LLM multi-agent framework generates test cases
• Predictive coverage assessment without program execution
• Integrated process optimizes initial seed corpus