# FairFuzz: Targeting Rare Branches to Rapidly Increase Greybox Fuzz Testing Coverage

arXiv: https://arxiv.org/abs/1709.07101 · HTML: https://mlsanity.com/paper/1709.07101/

## Key facts

- Cited by 20 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 20 Sep 2017.

## Built on by (most cited first, 20 of 20)

- [PAPILLON: Efficient and Stealthy Fuzz Testing-Powered Jailbreaks for LLMs](https://mlsanity.com/paper/2409.14866/) (2024)
- [Augmenting Greybox Fuzzing with Generative AI](https://mlsanity.com/paper/2306.06782/) (2023)
- [LLAMAFUZZ: Large Language Model Enhanced Greybox Fuzzing](https://mlsanity.com/paper/2406.07714/) (2024)
- [Coverage-Guided Tensor Compiler Fuzzing with Joint IR-Pass Mutation](https://mlsanity.com/paper/2202.09947/) (2022)
- [LEAP: Efficient and Automated Test Method for NLP Software](https://mlsanity.com/paper/2308.11284/) (2023)
- [On the Challenges of Fuzzing Techniques via Large Language Models](https://mlsanity.com/paper/2402.00350/) (2024)
- [CovRL: Fuzzing JavaScript Engines with Coverage-Guided Reinforcement Learning for LLM-based Mutation](https://mlsanity.com/paper/2402.12222/) (2024)
- [Attention Distance: A Novel Metric for Directed Fuzzing with Large Language Models](https://mlsanity.com/paper/2512.19758/) (2025)
- [SLOPT: Bandit Optimization Framework for Mutation-Based Fuzzing](https://mlsanity.com/paper/2211.03285/) (2022)
- [FuzzWiz -- Fuzzing Framework for Efficient Hardware Coverage](https://mlsanity.com/paper/2410.17732/) (2024)
- [Bootstrapping Fuzzers for Compilers of Low-Resource Language Dialects Using Language Models](https://mlsanity.com/paper/2512.05887/) (2025)
- [VulnAgent-R2: Evidence-Calibrated Multi-Agent Auditing for Repository-Level Vulnerability Detection](https://mlsanity.com/paper/2603.13384/) (2026)
- [iPanda: An LLM-based Agent for Automated Conformance Testing of Communication Protocols](https://mlsanity.com/paper/2507.00378/) (2025)
- [DeepGo: Predictive Directed Greybox Fuzzing](https://mlsanity.com/paper/2507.21952/) (2025)
- [From Coverage to Causes: Data-Centric Fuzzing for JavaScript Engines](https://mlsanity.com/paper/2512.18102/) (2025)
- [Fuzzing with Agents? Generators Are All You Need](https://mlsanity.com/paper/2604.01442/) (2026)
- [TEMPLATEFUZZ: Fine-Grained Chat Template Fuzzing for Jailbreaking and Red Teaming LLMs](https://mlsanity.com/paper/2604.12232/) (2026)
- [Towards Reliable Testing of Machine Unlearning](https://mlsanity.com/paper/2604.16536/) (2026)
- [Adversarial SQL Injection Generation with LLM-Based Architectures](https://mlsanity.com/paper/2605.11188/) (2026)
- [NeuronFuzz: Safety Neuron Guided Fuzzing for LLM Safety Evaluation](https://mlsanity.com/paper/2608.26222/) (2026)

## Abstract (arXiv)

In recent years, fuzz testing has proven itself to be one of the most effective techniques for finding correctness bugs and security vulnerabilities in practice. One particular fuzz testing tool, American Fuzzy Lop or AFL, has become popular thanks to its ease-of-use and bug-finding power. However, AFL remains limited in the depth of program coverage it achieves, in particular because it does not consider which parts of program inputs should not be mutated in order to maintain deep program coverage. We propose an approach, FairFuzz, that helps alleviate this limitation in two key steps. First, FairFuzz automatically prioritizes inputs exercising rare parts of the program under test. Second, it automatically adjusts the mutation of inputs so that the mutated inputs are more likely to exercise these same rare parts of the program. We conduct evaluation on real-world programs against state-of-the-art versions of AFL, thoroughly repeating experiments to get good measures of variability. We find that on certain benchmarks FairFuzz shows significant coverage increases after 24 hours compared to state-of-the-art versions of AFL, while on others it achieves high program coverage at a significantly faster rate.