Hybrid Fuzzing with LLM-Guided Input Mutation and Semantic Feedback

2025-11-06

AI Summary

Existing fuzzing mutation strategies lack semantic awareness, leading to redundant test cases and insufficient exploration of deep program states. This paper proposes an LLM-guided, semantics-aware fuzzing framework: it integrates static control- and data-flow analysis with dynamic instrumentation to construct structured prompts that guide large language models in generating syntactically valid yet semantically diverse inputs; introduces a program-state-change–based semantic feedback mechanism—replacing conventional coverage-driven guidance; and incorporates embedded semantic similarity metrics and anomaly-aware semantic prioritization for seed selection. Evaluated on real-world projects—including libpng, tcpdump, and SQLite—the approach significantly accelerates first-bug discovery, enhances input semantic diversity, and increases the number of unique vulnerabilities identified, thereby overcoming the dual limitations of syntax-driven and coverage-oriented fuzzing paradigms.

Technology Category

• Search and Optimization: Sampling/Simulation-based Search
• Natural Language Processing: Code Generation / Program Synthesis from Natural Language
• Machine Learning: Large Multimodal Models (LMMs)

Application Category

• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information

Abstract

Software fuzzing has become a cornerstone in automated vulnerability discovery, yet existing mutation strategies often lack semantic awareness, leading to redundant test cases and slow exploration of deep program states. In this work, I present a hybrid fuzzing framework that integrates static and dynamic analysis with Large Language Model (LLM)-guided input mutation and semantic feedback. Static analysis extracts control-flow and data-flow information, which is transformed into structured prompts for the LLM to generate syntactically valid and semantically diverse inputs. During execution, I augment traditional coverage-based feedback with semantic feedback signals-derived from program state changes, exception types, and output semantics-allowing the fuzzer to prioritize inputs that trigger novel program behaviors beyond mere code coverage. I implement our approach atop AFL++, combining program instrumentation with embedding-based semantic similarity metrics to guide seed selection. Evaluation on real-world open-source targets, including libpng, tcpdump, and sqlite, demonstrates that our method achieves faster time-to-first-bug, higher semantic diversity, and a competitive number of unique bugs compared to state-of-the-art fuzzers. This work highlights the potential of combining LLM reasoning with semantic-aware feedback to accelerate and deepen vulnerability discovery.

Problem

• Enhancing fuzzing efficiency by integrating LLM-guided semantic mutation strategies
• Addressing redundant test cases through semantic feedback from program states
• Improving vulnerability discovery depth using hybrid static-dynamic analysis with LLMs

Innovation

• LLM-guided input mutation for diverse test generation
• Semantic feedback from program state and output changes
• Hybrid static-dynamic analysis with embedding-based seed selection