{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/prompt-fuzzing-for-fuzz-driver-generation","title":"Prompt Fuzzing for Fuzz Driver Generation","arxiv_id":"2312.17677","date":"2023-12-29","proceeding":null,"authors":["Yunlong Lyu","Yuxuan Xie","Peng Chen","Hao Chen"],"abstract":"Crafting high-quality fuzz drivers not only is time-consuming but also requires a deep understanding of the library. However, the state-of-the-art automatic fuzz driver generation techniques fall short of expectations. While fuzz drivers derived from consumer code can reach deep states, they have limited coverage. Conversely, interpretative fuzzing can explore most API calls but requires numerous attempts within a large search space. We propose PromptFuzz, a coverage-guided fuzzer for prompt fuzzing that iteratively generates fuzz drivers to explore undiscovered library code. To explore API usage in fuzz drivers during prompt fuzzing, we propose several key techniques: instructive program generation, erroneous program validation, coverage-guided prompt mutation, and constrained fuzzer scheduling. We implemented PromptFuzz and evaluated it on 14 real-world libraries. Compared with OSS-Fuzz and Hopper (the state-of-the-art fuzz driver generation tool), fuzz drivers generated by PromptFuzz achieved 1.61 and 1.63 times higher branch coverage than those by OSS-Fuzz and Hopper, respectively. Moreover, the fuzz drivers generated by PromptFuzz detected 33 genuine, new bugs out of a total of 49 crashes, out of which 30 bugs have been confirmed by their respective communities.","url_abs":"https://arxiv.org/abs/2312.17677v2","url_pdf":"https://arxiv.org/pdf/2312.17677v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"links_only","authors_date_abstract":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license), from the Kaggle arXiv metadata snapshot of 2026-09-12"},"code_links":[{"paper_slug":"prompt-fuzzing-for-fuzz-driver-generation","repo_url":"https://github.com/promptfuzz/promptfuzz","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2312.17677","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2312.17677"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/promptfuzz/promptfuzz","reach":{"status":"ok"}}],"summary":{"ran":5,"unverified":5},"by_repo_kind":{"official":{"samples":10,"ran":5,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":10,"samples":[{"code_sha256_prefix":"f71a8927dfb3ef46","entry":"analyze_seed_statistics","repo":"promptfuzz/promptfuzz","repo_kind":"official","path":"experiments/analyze_statistics.py","file_url":"https://github.com/promptfuzz/promptfuzz/blob/HEAD/experiments/analyze_statistics.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f71a8927dfb3ef46"}},{"code_sha256_prefix":"c78a7b0461918414","entry":"create_archive","repo":"promptfuzz/promptfuzz","repo_kind":"official","path":"experiments/archive.py","file_url":"https://github.com/promptfuzz/promptfuzz/blob/HEAD/experiments/archive.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c78a7b0461918414"}},{"code_sha256_prefix":"08848c816d1a16a9","entry":"get_project_list","repo":"promptfuzz/promptfuzz","repo_kind":"official","path":"experiments/archive.py","file_url":"https://github.com/promptfuzz/promptfuzz/blob/HEAD/experiments/archive.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"08848c816d1a16a9"}},{"code_sha256_prefix":"509a10b8d7efb717","entry":"parse_int","repo":"promptfuzz/promptfuzz","repo_kind":"official","path":"experiments/collect_round_branch_coverage.py","file_url":"https://github.com/promptfuzz/promptfuzz/blob/HEAD/experiments/collect_round_branch_coverage.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"509a10b8d7efb717"}},{"code_sha256_prefix":"4490af07179f498b","entry":"parse_report_rows","repo":"promptfuzz/promptfuzz","repo_kind":"official","path":"experiments/collect_round_branch_coverage.py","file_url":"https://github.com/promptfuzz/promptfuzz/blob/HEAD/experiments/collect_round_branch_coverage.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"4490af07179f498b"}},{"code_sha256_prefix":"ed0dcdc676d6b9e8","entry":"collect_round_coverage","repo":"promptfuzz/promptfuzz","repo_kind":"official","path":"experiments/collect_round_branch_coverage.py","file_url":"https://github.com/promptfuzz/promptfuzz/blob/HEAD/experiments/collect_round_branch_coverage.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ed0dcdc676d6b9e8"}},{"code_sha256_prefix":"0b00b7d91548832e","entry":"get_coverage","repo":"promptfuzz/promptfuzz","repo_kind":"official","path":"experiments/analyze_statistics.py","file_url":"https://github.com/promptfuzz/promptfuzz/blob/HEAD/experiments/analyze_statistics.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"0b00b7d91548832e"}},{"code_sha256_prefix":"ff7aa329a90f467a","entry":"load_compilation_extra_flags","repo":"promptfuzz/promptfuzz","repo_kind":"official","path":"experiments/afl_script.py","file_url":"https://github.com/promptfuzz/promptfuzz/blob/HEAD/experiments/afl_script.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ff7aa329a90f467a"}},{"code_sha256_prefix":"098df39571622252","entry":"load_shared_library_name","repo":"promptfuzz/promptfuzz","repo_kind":"official","path":"experiments/afl_script.py","file_url":"https://github.com/promptfuzz/promptfuzz/blob/HEAD/experiments/afl_script.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"098df39571622252"}},{"code_sha256_prefix":"c9b0e357ecca20fd","entry":"load_static_library_name","repo":"promptfuzz/promptfuzz","repo_kind":"official","path":"experiments/afl_script.py","file_url":"https://github.com/promptfuzz/promptfuzz/blob/HEAD/experiments/afl_script.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c9b0e357ecca20fd"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}