Locus: Agentic Predicate Synthesis for Directed Fuzzing
Locus is a novel agentic framework that synthesizes semantically meaningful intermediate predicates to guide directed fuzzing toward target states, substantially improving the efficiency of state-of-the-art fuzzers and successfully discovering previously unpatched real-world vulnerabilities.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine you are trying to find a specific, hidden treasure chest buried deep inside a massive, shifting maze. This isn't just any maze; it's a digital one made of computer code, and the "treasure" is a secret flaw—a bug—that could let a hacker break into a system. This is the world of directed fuzzing. Think of "fuzzing" as throwing millions of random darts at a target to see if you hit a weak spot. Usually, you just throw darts blindly, hoping to hit something interesting. But "directed" fuzzing is smarter: you know exactly where the treasure chest (the bug) is supposed to be, and you want to throw darts that lead straight there.
The problem is that the maze is huge, and the path to the treasure is often blocked by a series of complex, invisible doors. To get through, you need to satisfy a long chain of conditions, like having the right key, wearing the right hat, and standing on the right floor. If you throw a dart that misses even one of these tiny requirements, you get stuck in a dead end. Traditional methods try to guess which way to go by measuring how "close" you are to the treasure in terms of steps, but this is like trying to navigate a city using only a compass that points "North" without knowing if there's a wall blocking the road. It's often too vague to be helpful.
Enter Locus, a new tool developed by researchers at the University of Chicago, University of Maryland, Johns Hopkins, and Northwestern. Instead of just guessing which way is closer, Locus acts like a super-smart, tireless detective that reads the map of the maze and writes down a series of helpful clues. It figures out the specific, meaningful steps you must take to get closer to the treasure, turning a confusing maze into a clear checklist.
Here is how Locus works: it uses a special kind of artificial intelligence (an "agent") to read the computer code and figure out the secret rules needed to reach the bug. Imagine the code is a recipe for a cake, and the bug only happens if you add sugar before you add flour. Traditional tools might just say, "You're getting closer to the mixing bowl!" Locus, however, says, "Stop! You haven't added the flour yet. If you don't add flour now, you'll never get to the part where the cake explodes." It writes these rules down as "predicates"—simple checks that the computer can run while it's testing. If a test input fails the check (e.g., "No flour added!"), the computer immediately stops wasting time on that path and tries something else.
The researchers built Locus with a clever safety net. Because the AI is doing the thinking, it might make mistakes, like suggesting a rule that accidentally blocks the treasure chest. To prevent this, Locus has a "validator" that double-checks every rule the AI creates. It uses a mathematical method called "symbolic execution" to prove that the new rules won't accidentally throw away any valid paths to the bug. It's like having a strict editor who checks every sentence the detective writes to make sure it's true before letting it into the final story.
When the team tested Locus, the results were impressive. They plugged it into eight different existing "dart-throwing" tools (fuzzers) and watched them hunt for bugs in real-world software. On average, Locus made these tools 41.6 times faster at finding the bugs. In some cases, it was even more dramatic: one tool found a bug 214.2 times faster with Locus than without it. Before this, some of these tools would run for a full day and find nothing; with Locus, they found the same bugs in a fraction of the time.
The team didn't just stop at testing; they used Locus to hunt for real, unpatched bugs in popular software like image libraries and archive tools. They successfully found nine previously unknown bugs. Three of these have already been acknowledged by the software makers, who are working on fixes. This suggests that Locus isn't just a theoretical idea; it's a practical tool that can help keep software safer by finding the hidden traps before bad actors do.
In short, Locus changes the game from "throwing darts blindly and hoping" to "throwing darts with a GPS and a checklist." It uses AI to understand the deep logic of computer programs, creates helpful signposts to guide the search, and double-checks its own work to ensure it never leads the search astray. By doing so, it turns a nearly impossible search for digital treasure into a much more efficient and successful adventure.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.