# DeepGo: Predictive Directed Greybox Fuzzing

arXiv: https://arxiv.org/abs/2507.21952 · HTML: https://mlsanity.com/paper/2507.21952/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 25 of its 84 references that are in the map.
- First posted on arXiv 29 Jul 2025.

## Builds on (most cited first, 25 of 25)

- [Soft Actor-Critic: Off-Policy Maximum Entropy Deep Reinforcement Learning with a Stochastic Actor](https://mlsanity.com/paper/1801.01290/) (2018)
- [Playing Atari with Deep Reinforcement Learning](https://mlsanity.com/paper/1312.5602/) (2013)
- [Deep Inside Convolutional Networks: Visualising Image Classification Models and Saliency Maps](https://mlsanity.com/paper/1312.6034/) (2013)
- [Deep Reinforcement Learning with Double Q-learning](https://mlsanity.com/paper/1509.06461/) (2015)
- [Prioritized Experience Replay](https://mlsanity.com/paper/1511.05952/) (2015)
- [Deep Reinforcement Learning in a Handful of Trials using Probabilistic Dynamics Models](https://mlsanity.com/paper/1805.12114/) (2018)
- [When to Trust Your Model: Model-Based Policy Optimization](https://mlsanity.com/paper/1906.08253/) (2019)
- [Understanding Deep Image Representations by Inverting Them](https://mlsanity.com/paper/1412.0035/) (2014)
- [Unit Test Case Generation with Transformers and Focal Context](https://mlsanity.com/paper/2009.05617/) (2020)
- [Learn&Fuzz: Machine Learning for Input Fuzzing](https://mlsanity.com/paper/1701.07232/) (2017)
- [FairFuzz: Targeting Rare Branches to Rapidly Increase Greybox Fuzz Testing Coverage](https://mlsanity.com/paper/1709.07101/) (2017)
- [NEUZZ: Efficient Fuzzing with Neural Program Smoothing](https://mlsanity.com/paper/1807.05620/) (2018)
- [Angora: Efficient Fuzzing by Principled Search](https://mlsanity.com/paper/1803.01307/) (2018)
- [Regret Analysis of the Finite-Horizon Gittins Index Strategy for Multi-Armed Bandits](https://mlsanity.com/paper/1511.06014/) (2015)
- [MTFuzz: Fuzzing with a Multi-Task Neural Network](https://mlsanity.com/paper/2005.12392/) (2020)
- [Not all bytes are equal: Neural byte sieve for fuzzing](https://mlsanity.com/paper/1711.04596/) (2017)
- [UNIFUZZ: A Holistic and Pragmatic Metrics-Driven Platform for Evaluating Fuzzers](https://mlsanity.com/paper/2010.01785/) (2020)
- [MC2: Rigorous and Efficient Directed Greybox Fuzzing](https://mlsanity.com/paper/2208.14530/) (2022)
- [Badger: Complexity Analysis with Fuzzing and Symbolic Execution](https://mlsanity.com/paper/1806.03283/) (2018)
- [Matryoshka: Fuzzing Deeply Nested Branches](https://mlsanity.com/paper/1905.12228/) (2019)
- [Binary-level Directed Fuzzing for Use-After-Free Vulnerabilities](https://mlsanity.com/paper/2002.10751/) (2020)
- [SAVIOR: Towards Bug-Driven Hybrid Testing](https://mlsanity.com/paper/1906.07327/) (2019)
- [MUZZ: Thread-aware Grey-box Fuzzing for Effective Bug Hunting in Multithreaded Programs](https://mlsanity.com/paper/2007.15943/) (2020)
- [MobFuzz: Adaptive Multi-objective Optimization in Gray-box Fuzzing](https://mlsanity.com/paper/2401.15956/) (2024)
- [HotFuzz: Discovering Algorithmic Denial-of-Service Vulnerabilities Through Guided Micro-Fuzzing](https://mlsanity.com/paper/2002.03416/) (2020)

## Abstract (arXiv)

The state-of-the-art DGF techniques redefine and optimize the fitness metric to reach the target sites precisely and quickly. However, optimizations for fitness metrics are mainly based on heuristic algorithms, which usually rely on historical execution information and lack foresight on paths that have not been exercised yet. Thus, those hard-to-execute paths with complex constraints would hinder DGF from reaching the targets, making DGF less efficient. In this paper, we propose DeepGo, a predictive directed grey-box fuzzer that can combine historical and predicted information to steer DGF to reach the target site via an optimal path. We first propose the path transition model, which models DGF as a process of reaching the target site through specific path transition sequences. The new seed generated by mutation would cause the path transition, and the path corresponding to the high-reward path transition sequence indicates a high likelihood of reaching the target site through it. Then, to predict the path transitions and the corresponding rewards, we use deep neural networks to construct a Virtual Ensemble Environment (VEE), which gradually imitates the path transition model and predicts the rewards of path transitions that have not been taken yet. To determine the optimal path, we develop a Reinforcement Learning for Fuzzing (RLF) model to generate the transition sequences with the highest sequence rewards. The RLF model can combine historical and predicted path transitions to generate the optimal path transition sequences, along with the policy to guide the mutation strategy of fuzzing. Finally, to exercise the high-reward path transition sequence, we propose the concept of an action group, which comprehensively optimizes the critical steps of fuzzing to realize the optimal path to reach the target efficiently.