OSS-Fuzz-Gen
LLM fuzz target generation
An LLM writes a fuzz target for under-fuzzed code, OSS-Fuzz builds and runs it, and build errors go back to the model.
The loop
- Proposes
Fuzz targets (C/C++ entry points) for functions that Fuzz Introspector flags as under-fuzzed
- Judged by
OSS-Fuzz build, a check that the target calls the function, a crash-on-start check, and new line coverage
- Steers
Build errors and a not-calling-the-function error are fed back in a code-fixer prompt; repeated rounds fix errors
Headline result
Google's page reports 14 of 31 tested OSS-Fuzz projects compiled new targets and increased coverage (gains 0 to 31%; tinyxml2 line coverage 38% to 69%), and a similar target in OpenSSL rediscovered CVE-2022-3602.
What this does not prove
The page calls this a preliminary investigation on a small set of C/C++ benchmarks with an unnamed Google model. The 14 are the projects that succeeded and the selection of the 31 is not fully explained. Crash and coverage results are checks; the page does not say they feed back into the model.
How it generalizes the harness
The product is a fuzz target that keeps running in OSS-Fuzz without the model, but the checker here is compile, run and coverage tooling, not a formal authority.
Classification
| What it proposes | Fuzz target |
|---|---|
| Generative model | Google LLMs (model not named on the page) |
| Algorithmic authority | OSS-Fuzz build and coverage tooling |
| Feedback | Verifier errors |
| What gets updated | Prompt context |
| When it runs | At inference time |
| Validity | Empirical (measured) |
| Evidence | Experiments reported |
| Lineage | Original system |