# Clutch Control: An Attention-based Combinatorial Bandit for Efficient Mutation in JavaScript Engine Fuzzing

arXiv: https://arxiv.org/abs/2510.12732 · HTML: https://mlsanity.com/paper/2510.12732/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 20 of its 57 references that are in the map.
- First posted on arXiv 14 Oct 2025.

## Builds on (most cited first, 20 of 20)

- [Pointer Networks](https://mlsanity.com/paper/1506.03134/) (2015)
- [Concrete Dropout](https://mlsanity.com/paper/1705.07832/) (2017)
- [Neural Thompson Sampling](https://mlsanity.com/paper/2010.00827/) (2020)
- [Automatic Web Testing using Curiosity-Driven Reinforcement Learning](https://mlsanity.com/paper/2103.06018/) (2021)
- [Reward Shaping for Happier Autonomous Cyber Security Agents](https://mlsanity.com/paper/2310.13565/) (2023)
- [Deep Contextual Multi-armed Bandits](https://mlsanity.com/paper/1807.09809/) (2018)
- [Combinatorial Neural Bandits](https://mlsanity.com/paper/2306.00242/) (2023)
- [Deep Reinforcement Fuzzing](https://mlsanity.com/paper/1801.04589/) (2018)
- [Superion: Grammar-Aware Greybox Fuzzing](https://mlsanity.com/paper/1812.01197/) (2018)
- [AutoCAT: Reinforcement Learning for Automated Exploration of Cache-Timing Attacks](https://mlsanity.com/paper/2208.08025/) (2022)
- [A systematic review of fuzzing based on machine learning techniques](https://mlsanity.com/paper/1908.01262/) (2019)
- [SoK: Prudent Evaluation Practices for Fuzzing](https://mlsanity.com/paper/2405.10220/) (2024)
- [Montage: A Neural Network Language Model-Guided JavaScript Engine Fuzzer](https://mlsanity.com/paper/2001.04107/) (2020)
- [DRMD: Deep Reinforcement Learning for Malware Detection under Concept Drift](https://mlsanity.com/paper/2508.18839/) (2025)
- [Simulating SQL Injection Vulnerability Exploitation Using Q-Learning Reinforcement Learning Agents](https://mlsanity.com/paper/2101.03118/) (2021)
- [Fuzzing MLIR Compilers with Custom Mutation Synthesis](https://mlsanity.com/paper/2404.16947/) (2024)
- [APIRL: Deep Reinforcement Learning for REST API Fuzzing](https://mlsanity.com/paper/2412.15991/) (2024)
- [SoK: Where to Fuzz? Assessing Target Selection Methods in Directed Fuzzing](https://mlsanity.com/paper/2502.08341/) (2025)
- [Reinforcement learning guided fuzz testing for a browser's HTML rendering engine](https://mlsanity.com/paper/2307.14556/) (2023)
- [Make out like a (Multi-Armed) Bandit: Improving the Odds of Fuzzer Seed Scheduling with T-Scheduler](https://mlsanity.com/paper/2312.04749/) (2023)

## Abstract (arXiv)

JavaScript engines are widely used in web browsers, PDF readers, and server-side applications. The rise in concern over their security has led to the development of several targeted fuzzing techniques. However, existing approaches use random selection to determine where to perform mutations in JavaScript code. We postulate that the problem of selecting better mutation targets is suitable for combinatorial bandits with a volatile number of arms. Thus, we propose CLUTCH, a novel deep combinatorial bandit that can observe variable length JavaScript test case representations, using an attention mechanism from deep learning. Furthermore, using Concrete Dropout, CLUTCH can dynamically adapt its exploration. We show that CLUTCH increases efficiency in JavaScript fuzzing compared to three state-of-the-art solutions by increasing the number of valid test cases and coverage-per-testcase by, respectively, 20.3% and 8.9% on average. In volatile and combinatorial settings we show that CLUTCH outperforms state-of-the-art bandits, achieving at least 78.1% and 4.1% less regret in volatile and combinatorial settings, respectively.