# From Coverage to Causes: Data-Centric Fuzzing for JavaScript Engines

arXiv: https://arxiv.org/abs/2512.18102 · HTML: https://mlsanity.com/paper/2512.18102/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 22 of its 78 references that are in the map.
- First posted on arXiv 19 Dec 2025.

## Builds on (most cited first, 22 of 22)

- [A Unified Approach to Interpreting Model Predictions](https://mlsanity.com/paper/1705.07874/) (2017)
- [XGBoost: A Scalable Tree Boosting System](https://mlsanity.com/paper/1603.02754/) (2016)
- [Tabular Data: Deep Learning is Not All You Need](https://mlsanity.com/paper/2106.03253/) (2021)
- [Large Language Models are Zero-Shot Fuzzers: Fuzzing Deep-Learning Libraries via Large Language Models](https://mlsanity.com/paper/2212.14834/) (2022)
- [Fuzz4All: Universal Fuzzing with Large Language Models](https://mlsanity.com/paper/2308.04748/) (2023)
- [The Art, Science, and Engineering of Fuzzing: A Survey](https://mlsanity.com/paper/1812.00140/) (2018)
- [Optimized Feature Generation for Tabular Data via LLMs with Decision Tree Reasoning](https://mlsanity.com/paper/2406.08527/) (2024)
- [CRANE: Reasoning with constrained LLM generation](https://mlsanity.com/paper/2502.09061/) (2025)
- [LLM-FE: Automated Feature Engineering for Tabular Data with LLMs as Evolutionary Optimizers](https://mlsanity.com/paper/2503.14434/) (2025)
- [Continuous Learning for Android Malware Detection](https://mlsanity.com/paper/2302.04332/) (2023)
- [Dynamic and Adaptive Feature Generation with LLM](https://mlsanity.com/paper/2406.03505/) (2024)
- [FairFuzz: Targeting Rare Branches to Rapidly Increase Greybox Fuzz Testing Coverage](https://mlsanity.com/paper/1709.07101/) (2017)
- [NEUZZ: Efficient Fuzzing with Neural Program Smoothing](https://mlsanity.com/paper/1807.05620/) (2018)
- [Enhancing Tool Retrieval with Iterative Feedback from Large Language Models](https://mlsanity.com/paper/2406.17465/) (2024)
- [Superion: Grammar-Aware Greybox Fuzzing](https://mlsanity.com/paper/1812.01197/) (2018)
- [Automated Conformance Testing for JavaScript Engines via Deep Compiler Fuzzing](https://mlsanity.com/paper/2104.07460/) (2021)
- [Montage: A Neural Network Language Model-Guided JavaScript Engine Fuzzer](https://mlsanity.com/paper/2001.04107/) (2020)
- [SAVIOR: Towards Bug-Driven Hybrid Testing](https://mlsanity.com/paper/1906.07327/) (2019)
- [JEST: N+1-version Differential Testing of Both JavaScript Engines and Specification](https://mlsanity.com/paper/2102.07498/) (2021)
- [Exposing Bugs in JavaScript Engines through Test Transplantation and Differential Testing](https://mlsanity.com/paper/2012.03759/) (2020)
- [SHAPFUZZ: Efficient Fuzzing via Shapley-Guided Byte Selection](https://mlsanity.com/paper/2308.09239/) (2023)
- [PatchFuzz: Patch Fuzzing for JavaScript Engines](https://mlsanity.com/paper/2505.00289/) (2025)

## Abstract (arXiv)

Context: Exhaustive fuzzing of modern JavaScript engines is infeasible due to the vast number of program states and execution paths. Coverage-guided fuzzers waste effort on low-risk inputs, often ignoring vulnerability-triggering ones that do not increase coverage. Existing heuristics proposed to mitigate this require expert effort, are brittle, and hard to adapt. Objective: We propose a data-centric, LLM-boosted alternative that learns from historical vulnerabilities to automatically identify minimal static (code) and dynamic (runtime) features for detecting high-risk inputs. Method: Guided by historical V8 bugs, iterative prompting generated 115 static and 49 dynamic features, with the latter requiring only five trace flags, minimizing instrumentation cost. After feature selection, 41 features remained to train an XGBoost model to predict high-risk inputs during fuzzing. Results: Combining static and dynamic features yields over 85% precision and under 1% false alarms. Only 25% of these features are needed for comparable performance, showing that most of the search space is irrelevant. Conclusion: This work introduces feature-guided fuzzing, an automated data-driven approach that replaces coverage with data-directed inference, guiding fuzzers toward high-risk states for faster, targeted, and reproducible vulnerability discovery. To support open science, all scripts and data are available at https://github.com/KKGanguly/DataCentricFuzzJS .