# FunFuzz: An LLM-Powered Evolutionary Fuzzing Framework

arXiv: https://arxiv.org/abs/2605.02789 · HTML: https://mlsanity.com/paper/2605.02789/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 22 references that are in the map.
- First posted on arXiv 4 May 2026.

## Builds on (most cited first, 6 of 6)

- [AlphaEvolve: A coding agent for scientific and algorithmic discovery](https://mlsanity.com/paper/2506.13131/) (2025)
- [ShinkaEvolve: Towards Open-Ended And Sample-Efficient Program Evolution](https://mlsanity.com/paper/2509.19349/) (2025)
- [LLAMAFUZZ: Large Language Model Enhanced Greybox Fuzzing](https://mlsanity.com/paper/2406.07714/) (2024)
- [Evolutionary Grammar-Based Fuzzing](https://mlsanity.com/paper/2008.01150/) (2020)
- [A Survey of Modern Compiler Fuzzing](https://mlsanity.com/paper/2306.06884/) (2023)
- [V-Fuzz: Vulnerability-Oriented Evolutionary Fuzzing](https://mlsanity.com/paper/1901.01142/) (2019)

## Built on by (most cited first, 1 of 1)

- [Inference-Engine Fingerprinting Attacks are Practical: Exploring Model-Driven Environmental Discovery, Exploitation, and Escape](https://mlsanity.com/paper/2609.20614/) (2026)

## Abstract (arXiv)

Modern fuzzers increasingly use Large Language Models (LLMs) to generate structured inputs, but LLM-driven fuzzing is sensitive to prompt initialization and sampling variance, which can reduce exploration efficiency and lead to redundant inputs. We present FunFuzz, a multi-island evolutionary fuzzing framework that runs several isolated searches in parallel and periodically migrates high-value candidates to maintain diversity. FunFuzz derives initial generation prompts from documentation and initializes islands with topic-specific instructions, then continuously adapts prompts using feedback-guided selection. During fuzzing, candidates are prioritized by incremental compiler coverage, while compiler-internal failure signals are used to identify crash-inducing inputs. We evaluate FunFuzz on compiler fuzzing, where inputs are source programs and success is measured by compiler coverage and unique compiler-internal failures. Across repeated 24-hour campaigns on GCC and Clang, FunFuzz achieves higher compiler coverage than previous LLM-driven baselines and discovers more unique failure-triggering inputs.