一句话：用硬件 IP 采样替代覆盖率插桩，并借助 must-execute 静态分析重建覆盖，从而低成本、高精度地评估 fuzzing 残余风险。
该论文研究黑盒 fuzzing 中残余风险（即未发现缺陷风险与停止时机）的评估问题。传统方法依赖完整覆盖率插桩，虽记录每次执行的完整覆盖，却带来 60%–70% 的性能下降，削弱 fuzzing 吞吐并延误缺陷发现。作者提出以硬件支持的指令指针（IP）采样替代插桩作为低成本观测机制，并针对采样稀疏导致的精度损失，引入 must-execute 分析——一种静态控制流分析，可识别为到达某采样点所必经执行、或在该采样点之后必经执行的语句与基本块，从而由部分观测重建缺失的执行路径。实验表明，尽管覆盖率仅为部分观测，该风险估计方法相较完整覆盖率插桩吞吐提升 4.27 倍，使 fuzzing 活动以 2 倍速度达到停止阈值，同时保持较高精度（相对真值平均相对误差 1.73）。效率提升最终转化为更强的缺陷发现能力：在相同时间预算内触发更多缺陷，加速比最高达 10 倍。
Estimating the residual risk of undiscovered bugs—and thus when to stop fuzzing—is critical for determining testing adequacy. Traditionally, this assessment relies on coverage instrumentation, which records complete coverage of every execution but imposes a 60-70% performance slowdown, reducing fuzzing throughput and delaying bug discovery. This overhead raises a fundamental question: can partial observation provide high-fidelity confidence at a fraction of the coverage instrumentation cost? We propose a risk assessment method in the context of black-box fuzzing that leverages hardware-enabled performance profiling—replacing coverage instrumentation with instruction pointer (IP) sampling—as the core mechanism for low-overhead observation. To recover the accuracy inevitably lost to the sparse nature of sampling, we employ must-execute analysis, a static control-flow analysis that identifies all statements and basic blocks that must have executed to reach, or must execute after, an observed sample, effectively reconstructing missing execution paths from partial observations. Despite the partial coverage inherent to profiler-based sampling, our risk estimation method achieves 4.27× higher throughput than complete-coverage instrumentation, enabling fuzzing campaigns to reach stopping thresholds 2× faster while maintaining high accuracy (1.73 average relative error compared to the ground truth). Ultimately, this efficiency translates into superior bug discovery, triggering more bugs with speedups of up to 10× within the same time budget.
@inproceedings{paperbot12343,
title = {Accurate and Low-Cost Residual Risk Assessment via Sampled Profiling and Structure-Aware Coverage Amplification},
author = {Seongmin Lee and Işıl Özgü and Marcel Böhme and Miryung Kim},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3837519}
}