# ELFuzz: Efficient Input Generation via LLM-driven Synthesis Over Fuzzer Space

arXiv: https://arxiv.org/abs/2506.10323 · HTML: https://mlsanity.com/paper/2506.10323/

## Key facts

- Cited by 15 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 12 Jun 2025.

## Built on by (most cited first, 15 of 15)

- [Locus: Agentic Predicate Synthesis for Directed Fuzzing](https://mlsanity.com/paper/2508.21302/) (2025)
- [Hybrid Fuzzing with LLM-Guided Input Mutation and Semantic Feedback](https://mlsanity.com/paper/2511.03995/) (2025)
- [PBFuzz: Agentic Directed Fuzzing for PoV Generation](https://mlsanity.com/paper/2512.04611/) (2025)
- [Adversarial Agent Collaboration for Correctness Improvements of C to Safe Rust Translation](https://mlsanity.com/paper/2510.03879/) (2025)
- [Cybersecurity is the True Frontier for Generative AI Success or Failure](https://mlsanity.com/paper/2606.28929/) (2026)
- [MCP-in-SoS: Risk assessment framework for open-source MCP servers](https://mlsanity.com/paper/2603.10194/) (2026)
- [AI In Cybersecurity Education -- Scalable Agentic CTF Design Principles and Educational Outcomes](https://mlsanity.com/paper/2603.21551/) (2026)
- [Knowdit: Agentic Smart Contract Vulnerability Detection with Auditing Knowledge Summarization](https://mlsanity.com/paper/2603.26270/) (2026)
- [Agentic Fuzzing: Opportunities and Challenges](https://mlsanity.com/paper/2605.10074/) (2026)
- [AgentExecutor: Partial Code Execution via Agentic Context Generation](https://mlsanity.com/paper/2608.05959/) (2026)
- [Orion: Fuzzing Workflow Automation](https://mlsanity.com/paper/2509.15195/) (2025)
- [PrediQL: Automated Testing of GraphQL APIs with LLMs](https://mlsanity.com/paper/2510.10407/) (2025)
- [Fuzzing with Agents? Generators Are All You Need](https://mlsanity.com/paper/2604.01442/) (2026)
- [ABTest: Behavior-Driven Testing for AI Coding Agents](https://mlsanity.com/paper/2604.03362/) (2026)
- [Chai: Agentic Discovery of Cryptographic Misuse Vulnerabilities](https://mlsanity.com/paper/2606.26933/) (2026)

## Abstract (arXiv)

Generation-based fuzzing produces appropriate test cases according to specifications of input grammars and semantic constraints to test systems and software. However, these specifications require significant manual effort to construct. This paper proposes a new approach, ELFuzz (Evolution Through Large Language Models for Fuzzing), that automatically synthesizes generation-based fuzzers tailored to a system under test (SUT) via LLM-driven synthesis over fuzzer space. At a high level, it starts with minimal seed fuzzers and propels the synthesis by fully automated LLM-driven evolution with coverage guidance. Compared to previous approaches, ELFuzz can 1) seamlessly scale to SUTs of real-world sizes -- up to 1,791,104 lines of code in our evaluation -- and 2) synthesize efficient fuzzers that catch interesting grammatical structures and semantic constraints in a human-understandable way. Our evaluation compared ELFuzz with specifications manually written by domain experts and synthesized by state-of-the-art approaches. It shows that ELFuzz achieves up to 434.8% more coverage over the second best and triggers up to 216.7% more artificially injected bugs, compared to the state-of-the-art. We also used ELFuzz to conduct a real-world fuzzing campaign on the newest version of cvc5 for 14 days, and encouragingly, it found five 0-day bugs (three are exploitable). Moreover, we conducted an ablation study, which shows that the fuzzer space model, the key component of ELFuzz, contributes the most (up to 62.5%) to the effectiveness of ELFuzz. Further analysis of the fuzzers synthesized by ELFuzz confirms that they catch interesting grammatical structures and semantic constraints in a human-understandable way. The results present the promising potential of ELFuzz for more automated, efficient, and extensible input generation for fuzzing.