LLM-powered seed generation makes fuzzing faster at finding bugs

Fuzzing—a software testing technique that feeds random or mutated inputs into programs to find crashes—remains a staple of vulnerability discovery. But directed fuzzing, which aims mutation at specific target functions, often struggles to expose bugs even after extensive testing runs. A new approach addresses this by rethinking what gets fed into the fuzzer at the start.

The Problem with Directed Fuzzing#

Directed fuzzers steer exploration toward sink functions (where vulnerabilities typically hide) but face two structural barriers. First, incomplete static analysis leaves indirect function calls unmapped, which means the fuzzer doesn't know about whole pathways it should explore. Second, crashes often have preconditions—specific input patterns or state conditions that must be satisfied before a crash can occur—that random mutation alone cannot reach in reasonable time. Starting with generic seed inputs leaves fuzzers to grind blindly through the input space.

A Smarter Seed Strategy#

Rather than relying on grammar rules or format-specific templates to build seeds, researchers have developed SeedSmith, a pipeline that mimics how a human security analyst would approach the problem. The system uses a large language model to work backward from a target sink function, iteratively mapping the codebase, resolving indirect calls, identifying what crash conditions need to be met, and synthesizing concrete inputs that satisfy them. Because seeds emerge from this analysis, they encode both the right control-flow path and the semantic properties needed to trigger bugs.

Results and Impact#

The approach functions as a plug-in layer before any mutation-based fuzzer, so it works with off-the-shelf tools like AFL++ and AFLGo without modification. In testing on Magma (a benchmark suite), fuzzers using SeedSmith-generated seeds reached crashes 11.5 to 14.7 times faster than those starting with default seed sets. On the ARVO corpus, the technique enabled fuzzers to trigger 16 previously unreachable bugs across 10 different projects with varied input formats—vulnerabilities that standard approaches could not surface.

The work highlights how AI-assisted code analysis can transform the efficiency of security testing by front-loading semantic understanding into the initial inputs, shifting fuzzing from undirected exploration toward targeted refinement.