mlsanityData to 14 Oct 2026

BertRLFuzzer: A BERT and Reinforcement Learning Based Fuzzer

arXiv 2305.12534 ↗First posted 21 May 2023cs.SE cs.CR cs.LGcited by 5

Not on the map. Why?

Abstract (arXiv)

We present a novel tool BertRLFuzzer, a BERT and Reinforcement Learning (RL) based fuzzer aimed at finding security vulnerabilities for Web applications. BertRLFuzzer works as follows: given a set of seed inputs, the fuzzer performs grammar-adhering and attack-provoking mutation operations on them to generate candidate attack vectors. The key insight of BertRLFuzzer is the use of RL with a BERT model as an agent to guide the fuzzer to efficiently learn grammar-adhering and attack-provoking mutation operators. In order to establish the efficacy of BertRLFuzzer we compare it against a total of 13 black box and white box fuzzers over a benchmark of 9 victim websites with over 16K LOC. We observed a significant improvement relative to the nearest competing tool in terms of time to first attack (54% less), new vulnerabilities found (17 new vulnerabilities), and attack rate (4.4% more attack vectors generated).

Key facts. Cited by 5 papers in the map (data through 14 Oct 2026). Builds on 19 of its 58 references that are in the map. First posted on arXiv 21 May 2023.

Builds on

19 of 58 references.

References · 19

  1. 2017Attention Is All You Needcited by 60,361
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  3. 2020Language Models are Few-Shot Learnerscited by 32,419
  4. 2017Proximal Policy Optimization Algorithmscited by 15,215
  5. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,372
  6. 2021Evaluating Large Language Models Trained on Codecited by 8,320
  7. 2022PaLM: Scaling Language Modeling with Pathwayscited by 5,326
  8. 2021On the Opportunities and Risks of Foundation Modelscited by 4,033
  9. 2020CodeBERT: A Pre-Trained Model for Programming and Natural Languagescited by 1,310
  10. 2020GraphCodeBERT: Pre-training Code Representations with Data Flowcited by 609
  11. 2020Unsupervised Translation of Programming Languagescited by 263
  12. 2021Studying the Usage of Text-To-Text Transfer Transformer to Support Code-Related Taskscited by 70
7 more
  1. 2018The Art, Science, and Engineering of Fuzzing: A Surveycited by 62
  2. 2018Deep Reinforcement Fuzzingcited by 14
  3. 2020DeepSQLi: Deep Semantic Learning for Testing SQL Injectioncited by 12
  4. 2013Penetration Testing == POMDP Solving?cited by 9
  5. 2021Simulating SQL Injection Vulnerability Exploitation Using Q-Learning Reinforcement Learning Agentscited by 6
  6. 2018FuzzerGym: A Competitive Framework for Fuzzing and Learningcited by 4
  7. 2019A Review of Machine Learning Applications in Fuzzingcited by 4

Built on by

Cited by year

Citing papers per year: 2024: 3; 2025: 2.

5 papers.

  1. 2024RLSF: Fine-tuning LLMs via Symbolic Feedbackcited by 14
  2. 2024LLMStinger: Jailbreaking LLMs using RL fine-tuned LLMscited by 5
  3. 2025Generative AI for Self-Adaptive Systems: State of the Art and Research Roadmapcited by 5
  4. 2024On the Challenges of Fuzzing Techniques via Large Language Modelscited by 4
  5. 2025LLMs are All You Need? Improving Fuzz Testing for MOJO with Large Language Modelscited by 0