AssignEnergy Function
Overview
The AssignEnergy function is the routine, within the power scheduler of a coverage-based greybox fuzzer, that calculates and assigns a numerical energy value to each seed in the fuzzing corpus. The energy value controls how many mutated inputs are generated from a given seed during the fuzzing campaign — higher-energy seeds are mutated more often, while lower-energy seeds are deprioritized.
In the MTCFuzz implementation described in the source literature, the function operates on per-seed metadata that records the code coverage observed when the seed was executed. Across the entire corpus, the number of times that the same code-coverage signature has been seen in different seeds is aggregated, and this aggregated count is the key input the power scheduler uses when AssignEnergy computes the energy for a particular seed. Seeds whose coverage signatures are observed rarely across the corpus (i.e., unique or near-unique coverage) typically receive higher energy, while seeds whose coverage has been seen many times receive lower energy.
Role in the Fuzzing Loop
In a coverage-based greybox fuzzer, AssignEnergy is invoked periodically (or after each interesting seed is added) by the power scheduler, which itself is part of the broader Coverage-based Greybox Fuzzing technique. Its responsibilities are:
- Reading aggregated coverage metadata — the count of how many distinct seeds have triggered each observed coverage signature.
- Computing per-seed energy — applying the power-schedule formula that translates the aggregated coverage count into an energy value.
- Influencing mutation allocation — the resulting energy value drives how many times that seed is selected and mutated in subsequent fuzzing rounds.
Inputs and Outputs
| Aspect | Detail |
|---|---|
| Input | Seed's code-coverage metadata; aggregated count of how many seeds observed each coverage signature. |
| Output | A non-negative integer energy value assigned to the seed. |
| Used by | Power scheduler / mutation engine during seed selection. |
Relation to Coverage-based Greybox Fuzzing
The AssignEnergy function is a core component of the power-scheduling mechanism that defines coverage-based greybox fuzzing. It is the place where coverage observations are translated into concrete scheduling decisions: by tying energy to the rarity of the coverage signature across seeds, AssignEnergy implements the greybox aspect — it uses lightweight, observable signals (coverage, not internal program state) to allocate fuzzing effort.
Evidence Source
The behavior described above is drawn from the MTCFuzz paper (arXiv:2603.25354), which states that "the number of times the same code coverage has been observed in different seeds is aggregated. This count is then used by the power scheduler when calculating the energy assigned to each seed."
The exact algorithmic formulation of the energy calculation (e.g., the AFL-style
min(p / s_i, α)formula used in the original AFLfast power schedule) is not specified in the provided evidence and is therefore not asserted here.