# Hybrid Fuzzing with LLM-Guided Input Mutation and Semantic Feedback

arXiv: https://arxiv.org/abs/2511.03995 · HTML: https://mlsanity.com/paper/2511.03995/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- Builds on 15 of its 42 references that are in the map.
- First posted on arXiv 6 Nov 2025.

## Builds on (most cited first, 15 of 15)

- [RADAR: Robust AI-Text Detection via Adversarial Learning](https://mlsanity.com/paper/2307.03838/) (2023)
- [Fuzz4All: Universal Fuzzing with Large Language Models](https://mlsanity.com/paper/2308.04748/) (2023)
- [WhiteFox: White-Box Compiler Fuzzing Empowered by Large Language Models](https://mlsanity.com/paper/2310.15991/) (2023)
- [Adapting LLMs for Efficient Context Processing through Soft Prompt Compression](https://mlsanity.com/paper/2404.04997/) (2024)
- [Theoretical Analysis of Meta Reinforcement Learning: Generalization Bounds and Convergence Guarantees](https://mlsanity.com/paper/2405.13290/) (2024)
- [ELFuzz: Efficient Input Generation via LLM-driven Synthesis Over Fuzzer Space](https://mlsanity.com/paper/2506.10323/) (2025)
- [LLAMAFUZZ: Large Language Model Enhanced Greybox Fuzzing](https://mlsanity.com/paper/2406.07714/) (2024)
- [Enhancing Multi-Hop Knowledge Graph Reasoning through Reward Shaping Techniques](https://mlsanity.com/paper/2403.05801/) (2024)
- [Harnessing Large Language Models for Seed Generation in Greybox Fuzzing](https://mlsanity.com/paper/2411.18143/) (2024)
- [Reinforcement Learning Approach for Integrating Compressed Contexts into Knowledge Graphs](https://mlsanity.com/paper/2404.12587/) (2024)
- [CA-BERT: Leveraging Context Awareness for Enhanced Multi-Turn Chat Interaction](https://mlsanity.com/paper/2409.13701/) (2024)
- [Advancements in Natural Language Processing: Exploring Transformer-Based Architectures for Text Understanding](https://mlsanity.com/paper/2503.20227/) (2025)
- [LLM-Assisted Model-Based Fuzzing of Protocol Implementations](https://mlsanity.com/paper/2508.01750/) (2025)
- [FuzzCoder: Byte-level Fuzzing Test via Large Language Model](https://mlsanity.com/paper/2409.01944/) (2024)
- [ReFuzzer: Feedback-Driven Approach to Enhance Validity of LLM-Generated Test Programs](https://mlsanity.com/paper/2508.03603/) (2025)

## Built on by (most cited first, 7 of 7)

- [Adaptive Detector-Verifier Framework for Zero-Shot Polyp Detection in Open-World Settings](https://mlsanity.com/paper/2512.12492/) (2025)
- [Adaptive Multi-Stage Patent Claim Generation with Unified Quality Assessment](https://mlsanity.com/paper/2601.09120/) (2026)
- [EVLA: An Electro-Aware Multimodal Assistant for Physically-Grounded Driving Reasoning and Control](https://mlsanity.com/paper/2606.28938/) (2026)
- [A3M: Adaptive, Adversarial and Multi-Objective Learning for Strategic Bidding in Repeated Auctions](https://mlsanity.com/paper/2606.28943/) (2026)
- [Beyond Skepticism: Evaluating LLMs Pedagogical Intent Reasoning with the Adaptive Pedagogical Vigilance Framework](https://mlsanity.com/paper/2607.01581/) (2026)
- [FedCausal-Dyn: A Causal-Dynamic Paradigm for Federated Learning under Dynamic Feature Drift](https://mlsanity.com/paper/2607.09695/) (2026)
- [Graph-Based Modeling of Financial Volatility Dynamics](https://mlsanity.com/paper/2608.26127/) (2026)

## Abstract (arXiv)

Software fuzzing has become a cornerstone in automated vulnerability discovery, yet existing mutation strategies often lack semantic awareness, leading to redundant test cases and slow exploration of deep program states. In this work, I present a hybrid fuzzing framework that integrates static and dynamic analysis with Large Language Model (LLM)-guided input mutation and semantic feedback. Static analysis extracts control-flow and data-flow information, which is transformed into structured prompts for the LLM to generate syntactically valid and semantically diverse inputs. During execution, I augment traditional coverage-based feedback with semantic feedback signals-derived from program state changes, exception types, and output semantics-allowing the fuzzer to prioritize inputs that trigger novel program behaviors beyond mere code coverage. I implement our approach atop AFL++, combining program instrumentation with embedding-based semantic similarity metrics to guide seed selection. Evaluation on real-world open-source targets, including libpng, tcpdump, and sqlite, demonstrates that our method achieves faster time-to-first-bug, higher semantic diversity, and a competitive number of unique bugs compared to state-of-the-art fuzzers. This work highlights the potential of combining LLM reasoning with semantic-aware feedback to accelerate and deepen vulnerability discovery.