Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
The paper introduces FuzzPilot, a controller for AFL++ that uses a recipe-based approach to guide fuzzing by evaluating mutation strategies in isolated micro-campaigns when coverage plateaus. FuzzPilot uses JSON recipes to control operator weights, byte ranges, corpus selection, and dictionary tokens, with recipes sourced from local rules or language models. Evaluation on cJSON, a saturated target, showed FuzzPilot maintains throughput and descriptively reduces plateau duration, but the difference was not statistically significant, and no language-model-proposed recipes were promoted.
FuzzPilot's recipe-based fuzzing approach, while not significantly improving coverage on a saturated target, offers a promising framework for integrating language models and structured mutation strategies into fuzzing workflows.
FuzzPilot is a controller for AFL++ that moves expensive reasoning out of the mutation hot path. When coverage plateaus, it snapshots the corpus, prepares candidate mutation recipes, evaluates them in short isolated AFL++ micro-campaigns, and promotes only recipes with positive validation reward. Recipes are JSON data, not generated code: a native custom mutator consumes operator weights, byte ranges, corpus-selection rules, and dictionary tokens. Candidate recipes can come from local rules or from a language-model agent, with Ghidra-derived constants and decompiled context as target hints. This preprint reports a deliberately narrow cJSON evaluation. We compare vanilla AFL++ and the full FuzzPilot agent over five 14,400 s repetitions per arm. cJSON is saturated: baseline AFL++ reaches the exposed 269-edge ceiling at a median of about 2,500 s. The experiments therefore do not show that language-model proposals improve coverage or generalize beyond cJSON. Within this scope, FuzzPilot preserves throughput (median execs_per_sec about 1.06x baseline), shows a descriptively shorter median plateau (1,384 s versus 2,532 s), but the difference is not statistically significant at N=5 (Mann-Whitney p=0.42). The validation gate evaluated 20 model-proposed recipes and promoted none because all rewards were zero. The observed plateau reduction is more likely due to controller snapshot and restart machinery than to the model or recipe mutator. This version is best read as an auditable implementation report and baseline for ongoing non-saturated-target evaluation.