Reproduce “Locus: Agentic Predicate Synthesis for Directed Fuzzing” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Jie Zhu, Chihao Shen, Ziyang Li, Jiahao Yu, Yizheng Chen, Kexin Pei
Locus introduces an agentic framework that utilizes large language models (LLMs) to automatically synthesize and semantically validate progress-capturing predicates for directed fuzzing. This approach provides fine-grained guidance to existing fuzzers, demonstrating up to a 214.2x speedup in vulnerability reproduction and the discovery of nine new vulnerabilities in real-world software.
Key insights
- Semantically meaningful predicates, generated at intermediate program points, provide superior, fine-grained guidance for directed fuzzing compared to input-level constraints or basic control-flow distances.
- Integrating LLM-based code reasoning with formal validation via symbolic execution creates a robust mechanism for applying LLMs to security tasks, mitigating their inherent unreliability.
- Propagating validated predicates to earlier program execution points through an iterative refinement process significantly boosts fuzzing efficiency by allowing earlier termination of unpromising execution paths.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.