mlsanityData to 14 Oct 2026

Clutch Control: An Attention-based Combinatorial Bandit for Efficient Mutation in JavaScript Engine Fuzzing

arXiv 2510.12732 ↗First posted 14 Oct 2025cs.AIcited by 0

Not on the map. Why?

Abstract (arXiv)

JavaScript engines are widely used in web browsers, PDF readers, and server-side applications. The rise in concern over their security has led to the development of several targeted fuzzing techniques. However, existing approaches use random selection to determine where to perform mutations in JavaScript code. We postulate that the problem of selecting better mutation targets is suitable for combinatorial bandits with a volatile number of arms. Thus, we propose CLUTCH, a novel deep combinatorial bandit that can observe variable length JavaScript test case representations, using an attention mechanism from deep learning. Furthermore, using Concrete Dropout, CLUTCH can dynamically adapt its exploration. We show that CLUTCH increases efficiency in JavaScript fuzzing compared to three state-of-the-art solutions by increasing the number of valid test cases and coverage-per-testcase by, respectively, 20.3% and 8.9% on average. In volatile and combinatorial settings we show that CLUTCH outperforms state-of-the-art bandits, achieving at least 78.1% and 4.1% less regret in volatile and combinatorial settings, respectively.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 20 of its 57 references that are in the map. First posted on arXiv 14 Oct 2025.

Builds on

20 of 57 references.

References · 20

  1. 2015Pointer Networkscited by 895
  2. 2017Concrete Dropoutcited by 227
  3. 2020Neural Thompson Samplingcited by 128
  4. 2021Automatic Web Testing using Curiosity-Driven Reinforcement Learningcited by 19
  5. 2023Reward Shaping for Happier Autonomous Cyber Security Agentscited by 19
  6. 2018Deep Contextual Multi-armed Banditscited by 16
  7. 2023Combinatorial Neural Banditscited by 16
  8. 2018Deep Reinforcement Fuzzingcited by 14
  9. 2018Superion: Grammar-Aware Greybox Fuzzingcited by 12
  10. 2022AutoCAT: Reinforcement Learning for Automated Exploration of Cache-Timing Attackscited by 9
  11. 2019A systematic review of fuzzing based on machine learning techniquescited by 8
  12. 2024SoK: Prudent Evaluation Practices for Fuzzingcited by 8
8 more
  1. 2020Montage: A Neural Network Language Model-Guided JavaScript Engine Fuzzercited by 7
  2. 2025DRMD: Deep Reinforcement Learning for Malware Detection under Concept Driftcited by 7
  3. 2021Simulating SQL Injection Vulnerability Exploitation Using Q-Learning Reinforcement Learning Agentscited by 6
  4. 2024Fuzzing MLIR Compilers with Custom Mutation Synthesiscited by 4
  5. 2024APIRL: Deep Reinforcement Learning for REST API Fuzzingcited by 4
  6. 2025SoK: Where to Fuzz? Assessing Target Selection Methods in Directed Fuzzingcited by 4
  7. 2023Reinforcement learning guided fuzz testing for a browser's HTML rendering enginecited by 1
  8. 2023Make out like a (Multi-Armed) Bandit: Improving the Odds of Fuzzer Seed Scheduling with T-Schedulercited by 1

Built on by

Not cited yet.