# Evolutionary Grammar-Based Fuzzing

arXiv: https://arxiv.org/abs/2008.01150 · HTML: https://mlsanity.com/paper/2008.01150/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 Aug 2020.

## Built on by (most cited first, 4 of 4)

- [Neural Network Guided Evolutionary Fuzzing for Finding Traffic Violations of Autonomous Vehicles](https://mlsanity.com/paper/2109.06126/) (2021)
- [Coverage-based Scene Fuzzing for Virtual Autonomous Driving Testing](https://mlsanity.com/paper/2106.00873/) (2021)
- [FunFuzz: An LLM-Powered Evolutionary Fuzzing Framework](https://mlsanity.com/paper/2605.02789/) (2026)
- [Enhancing Software Vulnerability Detection Through Adaptive Test Input Generation Using Genetic Algorithm](https://mlsanity.com/paper/2508.05923/) (2025)

## Abstract (arXiv)

A fuzzer provides randomly generated inputs to a targeted software to expose erroneous behavior. To efficiently detect defects, generated inputs should conform to the structure of the input format and thus, grammars can be used to generate syntactically correct inputs. In this context, fuzzing can be guided by probabilities attached to competing rules in the grammar, leading to the idea of probabilistic grammar-based fuzzing. However, the optimal assignment of probabilities to individual grammar rules to effectively expose erroneous behavior for individual systems under test is an open research question. In this paper, we present EvoGFuzz, an evolutionary grammar-based fuzzing approach to optimize the probabilities to generate test inputs that may be more likely to trigger exceptional behavior. The evaluation shows the effectiveness of EvoGFuzz in detecting defects compared to probabilistic grammar-based fuzzing (baseline). Applied to ten real-world applications with common input formats (JSON, JavaScript, or CSS3), the evaluation shows that EvoGFuzz achieved a significantly larger median line coverage for all subjects by up to 48% compared to the baseline. Moreover, EvoGFuzz managed to expose 11 unique defects, from which five have not been detected by the baseline.