用多岛进化策略提升LLM模糊测试效率，避免重复输入。
FunFuzz: An LLM-Powered Evolutionary Fuzzing Framework
- 多并行搜索+定期迁移优质样本，保持探索多样性
- 24小时测试中覆盖更高编译器代码，发现更多崩溃输入
- 基于反馈自适应提示，适合编译器安全漏洞挖掘
现代模糊测试工具越来越多地使用大语言模型（LLMs）生成结构化输入，但其对提示初始化和采样方差敏感，导致探索效率下降和输入冗余。我们提出FunFuzz，一种多岛进化模糊测试框架，通过并行运行多个独立搜索，并周期性迁移高价值候选样本以维持多样性。FunFuzz从文档中提取初始生成提示，并用主题相关指令初始化各搜索岛，随后通过反馈引导选择持续优化提示。在模糊测试过程中，候选样本按增量编译器覆盖率优先排序，同时利用编译器内部崩溃信号识别触发崩溃的输入。我们在编译器模糊测试上评估FunFuzz，输入为源程序，成功标准为编译器覆盖率和唯一编译器内部错误数量。在GCC和Clang上进行的多次24小时实验表明，FunFuzz相比先前的LLM驱动基线达到更高的编译器覆盖率，并发现更多独特触发失败的输入。
原文摘要 · Abstract (English)
Modern fuzzers increasingly use Large Language Models (LLMs) to generate structured inputs, but LLM-driven fuzzing is sensitive to prompt initialization and sampling variance, which can reduce exploration efficiency and lead to redundant inputs. We present FunFuzz, a multi-island evolutionary fuzzing framework that runs several isolated searches in parallel and periodically migrates high-value candidates to maintain diversity. FunFuzz derives initial generation prompts from documentation and initializes islands with topic-specific instructions, then continuously adapts prompts using feedback-guided selection. During fuzzing, candidates are prioritized by incremental compiler coverage, while compiler-internal failure signals are used to identify crash-inducing inputs. We evaluate FunFuzz on compiler fuzzing, where inputs are source programs and success is measured by compiler coverage and unique compiler-internal failures. Across repeated 24-hour campaigns on GCC and Clang, FunFuzz achieves higher compiler coverage than previous LLM-driven baselines and discovers more unique failure-triggering inputs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。