💻 computer science

SDLLMFuzz: Dynamic-static LLM-assisted greybox fuzzing for structured input programs

SDLLMFuzz is a novel greybox fuzzing framework that enhances vulnerability discovery in structured-input programs by integrating LLM-based syntactically valid seed generation with static crash analysis to create a dynamic-static feedback loop for efficient deep path exploration.

Original authors: Yihao Zou, Tianming Zheng, Futai Zou, Yue Wu

Published 2026-04-21

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Yihao Zou, Tianming Zheng, Futai Zou, Yue Wu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to find a hidden treasure (a software bug) inside a massive, incredibly complex castle (a computer program). This castle has very strict rules: to get past the front door, you must speak a specific language, wear the right uniform, and follow a precise map. If you get even one detail wrong, the guards (the program's parser) kick you out immediately, and you never get to see the inner rooms where the treasure might be hiding.

This is the problem with traditional "Fuzzing" (a technique used to find software bugs). Traditional fuzzers are like throwing thousands of random rocks at the castle walls. Most rocks bounce off because they don't look like valid keys. They never get inside to find the deep, hidden problems.

SDLLMFuzz is a new, smarter way to do this. It combines two powerful tools: a Super-Intelligent Architect (LLM) and a Forensic Detective (Static Analysis).

Here is how it works, broken down into simple steps:

1. The Problem: The "Random Rock" Approach

Imagine you are trying to open a high-tech safe.

Old Way: You grab a hammer and smash random buttons. 99% of the time, nothing happens because the safe rejects the random noise. You waste time and energy.
The Issue: Modern software (like image viewers or XML parsers) is like that safe. It demands perfect structure. Random inputs just get rejected before the program even starts working.

2. The Solution: The "Smart Architect" (The LLM)

Instead of throwing random rocks, SDLLMFuzz uses a Large Language Model (LLM). Think of the LLM as a master architect who has read the blueprints of the castle.

What it does: It doesn't just guess; it understands the rules. It knows exactly what the "uniform" and "map" look like.
The Result: It generates test inputs that are perfectly formatted. They look like valid keys, so the guards let them inside. This means the fuzzer can actually explore the deep, complex rooms of the castle where bugs usually hide.

3. The Missing Piece: The "Forensic Detective"

Here is where most other smart tools fail. If a test input does cause the program to crash (a "crash"), traditional tools just say, "Oh, it broke! Let's try again." They throw the broken piece away and forget it.

SDLLMFuzz adds a Static Crash Analyzer. Think of this as a Forensic Detective who arrives at the scene of the crash.

The Investigation: Instead of just seeing the crash, the detective looks at the "body" (the crash report). They check the call stack (the path the program took), the memory values, and the exact moment things went wrong.
The Insight: The detective figures out why it broke. "Ah, the program crashed because the input was missing a specific comma in the third line."

4. The Magic Loop: "Learn and Refine"

This is the secret sauce. SDLLMFuzz connects the Architect and the Detective in a continuous loop.

Generate: The Architect creates a perfect, valid key.
Test: The key is tried in the castle.
Crash? If it crashes, the Detective analyzes why.
Feedback: The Detective tells the Architect: "The last key was good, but it was missing a comma. Next time, try a key that is almost perfect but has a tiny, specific error in that spot."
Repeat: The Architect uses this new information to build an even better (or more specifically broken) key.

Why is this a big deal?

Old Fuzzers: Like a child throwing darts blindfolded. They might hit the bullseye eventually, but it takes forever.
Other "Smart" Fuzzers: Like a child who can see the board but doesn't learn from their misses. They keep making the same mistakes.
SDLLMFuzz: Like a grandmaster chess player. Every move is calculated based on the rules, and every mistake is analyzed to improve the next move.

The Results

The researchers tested this on real-world software (like image libraries and XML parsers). They found that SDLLMFuzz:

Found more bugs than traditional methods.
Found them faster (it didn't waste time on invalid inputs).
Got deeper into the program logic, finding complex bugs that others missed.

In a Nutshell

SDLLMFuzz is like hiring a team to find a needle in a haystack.

The LLM is the expert who knows exactly what a needle looks like and how to build a magnet that attracts it.
The Crash Analyzer is the scientist who studies every time the magnet fails to pick up a needle, figuring out exactly what magnetic field is needed next.
Together, they don't just throw magnets at the haystack; they learn, adapt, and refine their strategy until they find every single needle, faster than anyone else.

1. Problem Statement

Fuzzing is a dominant technique for vulnerability discovery, but it faces significant limitations when applied to structured-input programs (e.g., XML parsers like libxml2, image decoders like libpng, and audio libraries like libsndfile).

Syntactic Constraints: These programs require inputs to adhere to strict hierarchical syntax and semantic rules. Traditional mutation-based fuzzers (like AFL++) often generate invalid inputs that are rejected during early parsing stages, preventing deep exploration of the program logic.
Semantic Blindness: Existing approaches lack semantic understanding of the input format, leading to low efficiency in triggering bugs located in deep execution paths.
Underutilized Feedback: While modern fuzzers collect runtime data (crashes, execution traces), they rarely analyze the root causes of crashes (e.g., core dumps) to semantically guide subsequent input generation. Current LLM-assisted fuzzing methods focus primarily on seed generation but fail to integrate dynamic runtime feedback into a closed loop.

2. Methodology: SDLLMFuzz

The authors propose SDLLMFuzz, a framework that integrates Large Language Models (LLMs) with dynamic greybox fuzzing and static crash analysis into a unified, iterative feedback loop.

Core Components

LLM-Guided Structured Seed Generation:
- Instead of random byte-level mutations, the system uses an LLM to generate test seeds.
- Input to LLM: Format documentation, initial seed corpus, and optional execution feedback.
- Output: Syntactically valid and semantically diverse inputs that preserve hierarchical structures and cross-field dependencies.
Greybox Fuzzing Engine:
- The generated seeds are executed using a standard greybox fuzzer (e.g., AFL++).
- The engine collects coverage feedback, execution traces, and identifies crash-triggering inputs.
Static Crash Analysis:
- When a crash occurs, the system performs static analysis on the core dump using tools like GDB.
- It extracts semantic information including the crash location, call stack, exception type, and memory access patterns.
Crash Feedback Encoding & Dynamic-Static Loop:
- Low-level debugging data is transformed into structured semantic descriptions.
- This encoded feedback is appended to the LLM's prompt for the next iteration.
- Mechanism: The LLM uses this semantic guidance to refine subsequent inputs, specifically targeting the root causes of previous failures to explore deeper execution paths.

Key Mechanisms

Coverage-Aware Seed Selection: Seeds are scored based on edge and block coverage changes ( $\Delta Edge$ , $\Delta Block$ ) to prioritize high-value inputs.
Crash Deduplication: Crashes are grouped based on structural similarity (RIP, Signal, TopFunction, StackHash) to avoid redundant reporting.

3. Key Contributions

Novel Framework: Proposes the first dynamic–static LLM-assisted fuzzing framework specifically designed for structured-input programs, bridging the gap between semantic generation and runtime feedback.
Crash-Feedback Mechanism: Designs a mechanism to transform static crash analysis results (core dumps) into semantic guidance for the LLM, enabling iterative refinement of test cases beyond simple coverage metrics.
Comprehensive Evaluation: Demonstrates significant improvements over state-of-the-art baselines in both bug discovery rates and time-to-bug on the Magma benchmark.

4. Experimental Results

The framework was evaluated on the Magma benchmark using structured-input targets (libxml2, libpng, libsndfile, openssl, sqlite3).

Bug Discovery: SDLLMFuzz significantly outperformed traditional greybox fuzzers (AFL++) and LLM-assisted baselines (LLM Seed + AFL++ without feedback). It achieved higher median and average bug counts with lower variance.
Time-to-Bug: The framework triggered vulnerabilities faster than baselines, particularly for structured inputs, demonstrating faster convergence.
Scalability: The performance advantage persisted over longer time budgets (24h and 48h), whereas traditional fuzzers tended to plateau.
Ablation Study:
- Removing LLM-based seed generation caused the largest performance drop, confirming its critical role in generating valid structured inputs.
- Removing static crash feedback also degraded performance, proving that feedback-driven refinement is essential for efficient exploration.

5. Significance and Impact

Overcoming Structural Barriers: SDLLMFuzz effectively addresses the "sparse input space" problem in structured programs by leveraging LLMs to understand and generate valid syntax, while using crash analysis to navigate semantic complexities.
Closed-Loop Optimization: By converting crash artifacts into actionable semantic prompts, the system creates a self-improving loop that escapes local optima more effectively than coverage-only feedback.
Future Direction: The work establishes a promising paradigm for next-generation automated vulnerability discovery, suggesting that combining semantic understanding (LLMs) with deep runtime analysis (Static/Dynamic feedback) is the key to solving the challenges of fuzzing complex, structured software.

Limitations Noted: The approach incurs higher computational overhead due to LLM inference and static analysis, and its effectiveness relies heavily on the quality of prompt design and the specific LLM used.