# Deep Reinforcement Fuzzing

arXiv: https://arxiv.org/abs/1801.04589 · HTML: https://mlsanity.com/paper/1801.04589/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 14 Jan 2018.

## Built on by (most cited first, 14 of 14)

- [Search-Based Testing of Reinforcement Learning](https://mlsanity.com/paper/2205.04887/) (2022)
- [ATTRITION: Attacking Static Hardware Trojan Detection Techniques Using Reinforcement Learning](https://mlsanity.com/paper/2208.12897/) (2022)
- [DETERRENT: Detecting Trojans using Reinforcement Learning](https://mlsanity.com/paper/2208.12878/) (2022)
- [BertRLFuzzer: A BERT and Reinforcement Learning Based Fuzzer](https://mlsanity.com/paper/2305.12534/) (2023)
- [SoK: The Pitfalls of Deep Reinforcement Learning for Cybersecurity](https://mlsanity.com/paper/2602.08690/) (2026)
- [A Comparison of Reinforcement Learning Frameworks for Software Testing Tasks](https://mlsanity.com/paper/2208.12136/) (2022)
- [Reinforcement Learning for Hardware Security: Opportunities, Developments, and Challenges](https://mlsanity.com/paper/2208.13885/) (2022)
- [CovRL: Fuzzing JavaScript Engines with Coverage-Guided Reinforcement Learning for LLM-based Mutation](https://mlsanity.com/paper/2402.12222/) (2024)
- [Reinforcement learning guided fuzz testing for a browser's HTML rendering engine](https://mlsanity.com/paper/2307.14556/) (2023)
- [On the importance of data collection for training general goal-reaching policies](https://mlsanity.com/paper/2211.03521/) (2022)
- [Revisiting Neural Program Smoothing for Fuzzing](https://mlsanity.com/paper/2309.16618/) (2023)
- [Reward Augmentation in Reinforcement Learning for Testing Distributed Systems](https://mlsanity.com/paper/2409.02137/) (2024)
- [Clutch Control: An Attention-based Combinatorial Bandit for Efficient Mutation in JavaScript Engine Fuzzing](https://mlsanity.com/paper/2510.12732/) (2025)
- [Red-Teaming the Agentic Red-Team](https://mlsanity.com/paper/2606.24496/) (2026)

## Abstract (arXiv)

Fuzzing is the process of finding security vulnerabilities in input-processing code by repeatedly testing the code with modified inputs. In this paper, we formalize fuzzing as a reinforcement learning problem using the concept of Markov decision processes. This in turn allows us to apply state-of-the-art deep Q-learning algorithms that optimize rewards, which we define from runtime properties of the program under test. By observing the rewards caused by mutating with a specific set of actions performed on an initial program input, the fuzzing agent learns a policy that can next generate new higher-reward inputs. We have implemented this new approach, and preliminary empirical evidence shows that reinforcement fuzzing can outperform baseline random fuzzing.