OSS-Fuzz-Gen
LLM fuzz target generation
An LLM writes a fuzz target for under-fuzzed code, OSS-Fuzz builds and runs it, and build errors go back to the model.
The loop
- Proposes
Fuzz targets (C/C++ entry points) for functions that Fuzz Introspector flags as under-fuzzed
- Judged by
OSS-Fuzz build; whether the target calls the function, start-up crashes and new line coverage are reported metrics
- Steers
Build errors go back to a code-fixer prompt; repeated rounds fix errors
Headline result
Google's page reports 14 of 31 tested OSS-Fuzz projects compiled new targets and increased coverage (gains 0 to 31%; tinyxml2 line coverage 38% to 69%), and a similar target in OpenSSL rediscovered CVE-2022-3602.
What this does not prove
The page calls this a preliminary investigation on a small set of C/C++ benchmarks with an unnamed Google model. The 14 are the projects that succeeded and the selection of the 31 is not fully explained. Calling-the-function, crash and coverage results are reported metrics; the page does not say they feed back into the model.
How it generalizes the harness
The product is a fuzz target that keeps running in OSS-Fuzz without the model, but the in-loop checker here is the OSS-Fuzz build, not a formal authority; calling the function, start-up crashes and coverage are reported metrics.
Classification
| What it proposes | Fuzz target |
|---|---|
| Generative model | Google LLMs (model not named on the page) |
| Algorithmic authority | OSS-Fuzz build tooling; calling the function, start-up crashes and coverage are reported metrics |
| Feedback | Verifier errors |
| What gets updated | Prompt context |
| When it runs | At inference time |
| Validity | Empirical (measured) |
| Evidence | Experiments reported |
| Lineage | Original system |