Overview
Fuzzing is a testing technique in which an application is repeatedly exercised with modified, or “fuzzed,” inputs. In the software-security setting described by Learn&Fuzz, its goal is to find security vulnerabilities in input-parsing code.
Input-structure learning and fuzzing
One challenge in input fuzzing is balancing valid input structure against disruptive mutations. Learn&Fuzz frames this as a tension: learning aims to capture the structure of well-formed inputs, while fuzzing aims to break that structure so that testing reaches unexpected code paths and exposes bugs.
The same work proposes using sample inputs and neural-network-based statistical machine-learning techniques to automatically generate an input grammar suitable for fuzzing. Its reported case study targets PDF inputs and the PDF parser embedded in Microsoft Edge, and it describes an algorithm that uses a learned input probability distribution to guide where inputs should be fuzzed.
Fuzz driver generation
Fuzzing libraries often requires fuzz drivers: small programs or harnesses that call library APIs in ways the fuzzer can exercise. Prompt Fuzzing for Fuzz Driver Generation states that crafting high-quality fuzz drivers is time-consuming and requires deep library understanding.
PromptFuzz is described as a coverage-guided fuzzer for prompt fuzzing that iteratively generates fuzz drivers to explore previously undiscovered library code. The paper reports techniques including instructive program generation, erroneous program validation, coverage-guided prompt mutation, and constrained fuzzer scheduling. In an evaluation on 14 real-world libraries, PromptFuzz-generated drivers achieved 1.61× and 1.63× higher branch coverage than OSS-Fuzz and Hopper, respectively, and detected 33 genuine new bugs among 49 crashes, with 30 confirmed by the relevant communities.
Use in hardware verification context
The related work UVM Based Design Verification of a RISC-V CPU Core includes a “Fuzzing” subsection in its experimental evaluation chapter, indicating that fuzzing is used or discussed as part of that RISC-V CPU-core verification study.