ChatAFL
Protocol-guided greybox fuzzer that uses an LLM to infer message grammars and mutate state-machine inputs under coverage feedback.
The loop
- Proposes
An LLM extracts protocol request grammars and synthesizes structure-aware seed sequences and state-transition mutations.
- Judged by
The greybox fuzzer (AFLNet engine) executes the target network server, measuring edge coverage, state transitions, and sanitizer crashes.
- Steers
When coverage stalls in a protocol state, the fuzzer queries the LLM with the observed server responses to generate inputs that unlock new states.
Headline result
Covered 47.6% more state transitions and 29.6% more code branches than AFLNet across nine network protocol implementations, discovering 9 previously unknown vulnerabilities.
What this does not prove
Targets text-based application protocols (RTSP, FTP, SMTP, SIP); binary protocols require separate serialization adapters.
How it generalizes the harness
The evolutionary greybox fuzzer runs the main coverage loop and calls the LLM only to infer protocol grammars and break coverage plateaus.
Classification
| What it proposes | Fuzz target |
|---|---|
| Generative model | LLM protocol grammar and seed mutator |
| Algorithmic authority | Coverage-guided stateful greybox fuzzer and address sanitizers |
| Feedback | Code coverage |
| What gets updated | Population of candidates |
| When it runs | In continuous operation |
| Validity | Empirical (measured) |
| Evidence | Code released |
| Lineage | Original system |