arXiv:2512.21440cs.SEcs.LG2025-12

用大模型智能生成少量高质量测试用例,提升模糊测试效率

Fuzzwise: Intelligent Initial Corpus Generation for Fuzzing

  • 用大模型分两步生成并预测测试用例覆盖效果
  • 测试用例少但覆盖率高,错误触发更多
  • 无需执行即可评估,节省时间和资源

在基于变异的灰盒模糊测试中,生成高质量初始测试用例对有效模糊测试至关重要。传统方法需先生成大量用例再精简,而FuzzWise将该过程整合为一步,直接生成最优初始种子集(ICS)。该方法基于大语言模型(LLM)的多智能体框架:第一个智能体生成目标程序的测试用例;第二个智能体作为预测性代码覆盖率模块,评估每个生成用例是否能提升当前集合的整体覆盖率。新生成用例可立即被评估其贡献,无需实际执行。该预测方法利用大模型,避免了执行开销,尤其适用于无法或不宜执行的场景。实证表明,相比基线方法,FuzzWise生成的测试用例更少,但代码覆盖率更高,触发的运行时错误也更多,且在生成初始种子集方面更具时间与覆盖率效率。

原文摘要 · Abstract (English)

In mutation-based greybox fuzzing, generating high-quality input seeds for the initial corpus is essential for effective fuzzing. Rather than conducting separate phases for generating a large corpus and subsequently minimizing it, we propose FuzzWise which integrates them into one process to generate the optimal initial corpus of seeds (ICS). FuzzWise leverages a multi-agent framework based on Large Language Models (LLMs). The first LLM agent generates test cases for the target program. The second LLM agent, which functions as a predictive code coverage module, assesses whether each generated test case will enhance the overall coverage of the current corpus. The streamlined process allows each newly generated test seed to be immediately evaluated for its contribution to the overall coverage. FuzzWise employs a predictive approach using an LLM and eliminates the need for actual execution, saving computational resources and time, particularly in scenarios where the execution is not desirable or even impossible. Our empirical evaluation demonstrates that FuzzWise generates significantly fewer test cases than baseline methods. Despite the lower number of test cases, FuzzWise achieves high code coverage and triggers more runtime errors compared to the baselines. Moreover, it is more time-efficient and coverage-efficient in producing an initial corpus catching more errors.

模糊测试大模型智能生成

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。