Technical Summary: SeedSmith

Problem Statement

Directed fuzzing aims to uncover vulnerabilities by steering fuzzers toward user-defined "sink" functions. However, the paper identifies two fundamental challenges that prevent directed fuzzers from successfully triggering crashes, even after extensive campaigns:

1. Incomplete Static Analysis of Indirect Calls (C1): Many directed fuzzers rely on static analysis to compute distance metrics for guiding exploration. However, indirect calls (via function pointers or virtual dispatch) are notoriously difficult to resolve statically. When call edges are missing from the call graph, the distance metric becomes unreliable, rendering entire reachable paths invisible to the fuzzer's guidance algorithm.
2. Lack of Semantic Guidance for Crash Preconditions (C2): Even when a fuzzer reaches a sink, triggering a crash often requires satisfying precise input-level conditions (e.g., specific field values, format constraints, or data-flow dependencies). These conditions are invisible to coverage-based feedback, and blind byte-level mutation is unlikely to satisfy them simultaneously within practical time budgets.

Existing seed generation techniques fail to address these issues effectively. Grammar-based and format-driven methods produce structurally valid inputs but lack "sink awareness," failing to target specific vulnerabilities or resolve the preconditions required to crash them. Conversely, existing LLM-based approaches often rely on one-shot prompting with static analysis summaries, thereby inheriting the same incompleteness and lack of iterative reasoning found in traditional static analysis.

Methodology: SeedSmith

The authors propose SeedSmith, an agentic LLM pipeline designed to replicate the workflow of a skilled security analyst constructing a crash-triggering input. SeedSmith operates as a fuzzer-agnostic seed generation front-end, meaning it produces an initial seed corpus that can improve any downstream mutation-based fuzzer without modifying the fuzzer's internal logic.

The system is designed as a two-stage agentic pipeline:

1. Target Preparation

Before agent execution, SeedSmith performs lightweight static analysis and instrumentation:

• Project Indexing: Builds an index mapping function names to source code locations.
• Call Path Identification: Extracts a static call graph using CodeQL. While it attempts to resolve indirect calls via type-signature matching, it acknowledges this may be over-approximated or incomplete. Crucially, it applies a path optimization step to compress the call graph into a linearized representation (preserving shared prefixes/suffixes and collapsing divergent middles) to fit within the LLM's context window.
• Instrumentation: Compiles the target with sanitizers (ASAN, MSAN, or UBSAN) for crash detection.

2. Agentic Code Exploration (Analysis Agent)

This stage addresses C1 and C2 by iteratively exploring the codebase using an LLM agent equipped with a context-aware code-search tool.

• Iterative Reasoning: Unlike one-shot prompting, the agent starts with a harness and a sink function, then iteratively queries the codebase to resolve indirect calls and trace data flows.
• Context-Aware Retrieval: The search tool does not return fixed-line windows. Instead, it returns semantically complete units (e.g., the full function body for a function match, global declarations for variable matches, or type definitions for structure matches). This allows the agent to resolve indirect calls and understand input format requirements that static analysis misses.
• Output: The agent produces a structured Analysis Report containing the sink location, a validated call path, crash preconditions, and a generation strategy.

3. Agentic Seed Generation (Seed Generation Agent)

This stage consumes the Analysis Report to produce concrete test inputs.

• Programmatic Construction: Instead of generating raw bytes, the agent emits Python scripts that use format libraries (e.g., PIL for images) to construct inputs that satisfy structural constraints.
• Refinement Loop: Generated seeds are validated against the sanitizer-instrumented binary. Execution feedback (crashes, sanitizer output, exit codes) is fed back to the agent to refine the script in an iterative loop (up to 10 rounds).
• Cost Optimization: A heavier code-reasoning model is used for the exploration stage, while a cheaper model handles seed generation.

Key Contributions

1. Identification of Limitations: The paper formally identifies incomplete static analysis of indirect calls (C1) and the lack of semantic guidance for crash preconditions (C2) as primary bottlenecks in directed fuzzing and existing seed generation.
2. SeedSmith System: The design and implementation of an agentic LLM pipeline that iteratively explores codebases to generate structurally valid, sink-targeted seeds. It resolves indirect calls and infers crash preconditions on demand, bypassing the limitations of static analysis snapshots.
3. Large-Scale Evaluation: A comprehensive evaluation across 23 Magma bugs and 115 ARVO challenges (spanning 26 projects), demonstrating significant improvements in crash discovery and time-to-crash.

Results

The authors evaluated SeedSmith using four downstream fuzzers (AFL++, AFLGo, AFLRun, FairFuzz) on the Magma and ARVO benchmarks.

• Magma Performance:

  • Fuzzers using SeedSmith seeds achieved geometric mean crash-time speedups ranging from 11.51× (AFL++) to 14.66× (AFLGo) over default seeds.
  • SeedSmith enabled the discovery of 2 additional bugs (PDF011, SQL013) that default seeds never triggered within 24 hours.
  • Five bugs were triggered in a "one-shot" manner (the LLM-generated seed triggered the crash before any fuzzer mutation).
  • SeedSmith outperformed Locus (an alternative LLM-augmented approach that synthesizes predicates rather than seeds) in both the number of crashes triggered and time-to-crash on the Magma subset.

• ARVO Performance:

  • SeedSmith enabled fuzzers to trigger 16 previously unreachable bugs across 10 projects with diverse input formats (e.g., binary headers, protocol grammars).
  • On the 59 ARVO targets where crashes were triggered, SeedSmith yielded a 3.09× speedup for AFL++ and a 3.02× speedup for AFLRun.
  • The primary contribution on ARVO was unlocking crashes that were entirely unreachable with default corpora, rather than just accelerating existing paths.

• Fuzzer Agnosticism: The results demonstrate that SeedSmith improves both coverage-guided fuzzers (like AFL++) and directed fuzzers (like AFLGo). Notably, AFL++ with SeedSmith seeds outperformed AFLGo in exposing targeted crashes, suggesting that high-quality seeds can grant general-purpose fuzzers directed-fuzzing capabilities.

Significance

The paper claims that SeedSmith represents a shift from "blind exploration" to "local refinement" by providing seeds that encode the correct control-flow path and satisfy key crash preconditions. By automating the manual workflow of a security analyst—iteratively tracing paths, resolving indirect calls, and reasoning about input constraints—SeedSmith addresses the fundamental gaps left by static analysis and traditional seed generation.

The significance lies in its ability to:

1. Decouple seed quality from fuzzer internals: It acts as a drop-in front-end compatible with any mutation-based fuzzer.
2. Overcome static analysis limitations: It uses LLMs to resolve indirect calls and infer semantic constraints that static tools miss.
3. Unlock deep vulnerabilities: It successfully triggers crashes in complex, real-world scenarios (ARVO) that were previously unreachable, demonstrating that the initial seed corpus is a critical, often overlooked, intervention point in the fuzzing pipeline.