# SLOPT: Bandit Optimization Framework for Mutation-Based Fuzzing

arXiv: https://arxiv.org/abs/2211.03285 · HTML: https://mlsanity.com/paper/2211.03285/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 16 of its 70 references that are in the map.
- First posted on arXiv 7 Nov 2022.

## Builds on (most cited first, 16 of 16)

- [Explore no more: Improved high-probability regret bounds for non-stochastic bandits](https://mlsanity.com/paper/1506.03271/) (2015)
- [An Improved Parametrization and Analysis of the EXP3++ Algorithm for Stochastic and Adversarial Bandits](https://mlsanity.com/paper/1702.06103/) (2017)
- [Multi-Armed Bandits with Correlated Arms](https://mlsanity.com/paper/1911.03959/) (2019)
- [Taming Non-stationary Bandits: A Bayesian Approach](https://mlsanity.com/paper/1707.09727/) (2017)
- [FairFuzz: Targeting Rare Branches to Rapidly Increase Greybox Fuzz Testing Coverage](https://mlsanity.com/paper/1709.07101/) (2017)
- [Magma: A Ground-Truth Fuzzing Benchmark](https://mlsanity.com/paper/2009.01120/) (2020)
- [Angora: Efficient Fuzzing by Principled Search](https://mlsanity.com/paper/1803.01307/) (2018)
- [Multi-Armed Bandits with Dependent Arms](https://mlsanity.com/paper/2010.09478/) (2020)
- [Finite-time Analysis of Globally Nonstationary Multi-Armed Bandits](https://mlsanity.com/paper/2107.11419/) (2021)
- [Smart Greybox Fuzzing](https://mlsanity.com/paper/1811.09447/) (2018)
- [Bandits with adversarial scaling](https://mlsanity.com/paper/2003.02287/) (2020)
- [SQUIRREL: Testing Database Management Systems with Language Validity and Coverage Feedback](https://mlsanity.com/paper/2006.02398/) (2020)
- [Adaptive Grey-Box Fuzz-Testing with Thompson Sampling](https://mlsanity.com/paper/1808.08256/) (2018)
- [Full-speed Fuzzing: Reducing Fuzzing Overhead through Coverage-guided Tracing](https://mlsanity.com/paper/1812.11875/) (2018)
- [Greybox fuzzing as a contextual bandits problem](https://mlsanity.com/paper/1806.03806/) (2018)
- [PTrix: Efficient Hardware-Assisted Fuzzing for COTS Binary](https://mlsanity.com/paper/1905.10499/) (2019)

## Built on by (most cited first, 1 of 1)

- [VulnLLM-R: Specialized Reasoning LLM with Agent Scaffold for Vulnerability Detection](https://mlsanity.com/paper/2512.07533/) (2025)

## Abstract (arXiv)

Mutation-based fuzzing has become one of the most common vulnerability discovery solutions over the last decade. Fuzzing can be optimized when targeting specific programs, and given that, some studies have employed online optimization methods to do it automatically, i.e., tuning fuzzers for any given program in a program-agnostic manner. However, previous studies have neither fully explored mutation schemes suitable for online optimization methods, nor online optimization methods suitable for mutation schemes. In this study, we propose an optimization framework called SLOPT that encompasses both a bandit-friendly mutation scheme and mutation-scheme-friendly bandit algorithms. The advantage of SLOPT is that it can generally be incorporated into existing fuzzers, such as AFL and Honggfuzz. As a proof of concept, we implemented SLOPT-AFL++ by integrating SLOPT into AFL++ and showed that the program-agnostic optimization delivered by SLOPT enabled SLOPT-AFL++ to achieve higher code coverage than AFL++ in all of ten real-world FuzzBench programs. Moreover, we ran SLOPT-AFL++ against several real-world programs from OSS-Fuzz and successfully identified three previously unknown vulnerabilities, even though these programs have been fuzzed by AFL++ for a considerable number of CPU days on OSS-Fuzz.