Skip to content
STIMSMITH

Arithmetic Mutation

Concept WIKI v1 · 8/8/2026

Arithmetic mutation is a fuzzing mutation strategy that adds or subtracts integer values from test inputs to discover new program behaviors. It is one of the notable mutation operators used by coverage-guided grey box fuzzers such as American Fuzzy Lop (AFL), alongside bitflip and havoc mutations.

Arithmetic Mutation

Definition

Arithmetic mutation is a mutation operator used in coverage-guided fuzzing that adds or subtracts integers from bytes in a test input. It is one of several "interesting" mutations applied by grey box fuzzers to mutate test vectors in an attempt to discover new code paths and behaviors in the Software or Design Under Test.

Origin and Use in AFL

Arithmetic mutation is employed by American Fuzzy Lop (AFL), an out-of-process coverage-guided grey box fuzzer. AFL applies a manifold of mutations to evolve its corpus and detect new behaviors via edge coverage. Notable AFL mutations described in the literature include:

  • Bitflip mutations – flip a variety of bits in the input.
  • Arithmetic mutations – add/subtract integers to bytes in the input.
  • Havoc mutations – apply a combination of many individual mutations at random positions.

Within AFL's workflow, the trim mutation is first used to reduce the size of each test vector without changing the measured coverage (since smaller test vectors typically execute faster), and then mutations such as the arithmetic mutation are applied to discover new behaviors.

Role in Cross-Level Processor Verification

Arithmetic mutation is cited as one of the mutation primitives a coverage-guided fuzzer such as AFL can leverage when applied to processor verification contexts. In the cross-level verification approach described in the GLSVLSI 2022 paper "Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing," the fuzzer's ability to robustly mutate binary instructions (using operators such as arithmetic mutation) is an advantage over approaches that require a bus-centric grammar or bus-protocol-conforming test generation.

Related Concepts

  • AFL (American Fuzzy Lop) – the coverage-guided fuzzer that uses arithmetic mutation as one of its core mutation strategies.
  • Bitflip mutation – a complementary AFL mutation that flips bits in the input.
  • Havoc mutation – a complementary AFL mutation that stacks many individual mutations at random positions.
  • Coverage-guided fuzzing – the broader testing paradigm in which arithmetic mutation is applied.

References

LINKED ENTITIES

1 links
AFL USES

CITATIONS

4 sources
4 citations
[1] Arithmetic mutation adds or subtracts integers to bytes in the input as part of fuzzing. Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing
[2] AFL is an out-of-process coverage-guided grey box fuzzer that uses bitflip, arithmetic, and havoc mutations. Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing
[3] AFL's trim mutation reduces test vector size without changing measured coverage before applying mutations such as arithmetic mutation. Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing
[4] Arithmetic mutation enables AFL to robustly mutate binary instructions without requiring a bus-centric grammar. Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing