Fuzz4All
Universal compiler and solver fuzzer that generates and mutates source-code fuzzing inputs with an LLM, seeding each iteration with a randomly chosen valid earlier input; coverage is the evaluation measure.
The loop
- Proposes
An autoprompting and fuzzing LLM generates and mutates valid source inputs in C, C++, Go, Rust, Java, and SMT2.
- Judged by
Target compilers (GCC, Clang, rustc, Go) and solvers (Z3, CVC5) execute the inputs; crashes and output checks flag bugs.
- Steers
The next iteration is seeded with a randomly chosen valid earlier input.
Headline result
Achieved 36.8% higher line coverage than language-specific fuzzers across 9 systems in 6 languages and found 98 bugs (64 confirmed previously unknown).
What this does not prove
LLM token generation is slower per input than bit-flip greybox fuzzers, trading raw throughput for semantic validity in complex input grammars.
How it generalizes the harness
A fuzzing loop seeds each iteration with a randomly chosen valid earlier input while calling the LLM as a cross-language input mutator.
Classification
| What it proposes | Fuzz target |
|---|---|
| Generative model | StarCoder + GPT-4 autoprompting distiller |
| Algorithmic authority | Compiler/SMT crash and output-check oracle |
| Feedback | Test results |
| What gets updated | Population of candidates and prompt context |
| When it runs | In continuous operation |
| Validity | Empirical (measured) |
| Evidence | Code released |
| Lineage | Original system |