一句话:提出 PoCo,通过禁用障碍条件守卫并迭代选择,挖掘被覆盖守卫抑制的黄金种子以提升模糊测试效果。
变异灰盒模糊测试的初始种子集影响效果,但种子集膨胀会降低吞吐。现有基于覆盖率的种子选择存在盲点:无法识别因未通过覆盖守卫而被抑制的黄金种子,即使其中包含有价值的载荷。论文提出 PoCo,通过轻量级程序变换灵活禁用障碍条件守卫,并借助守卫层级分析识别障碍守卫,再以迭代式种子选择逐步挖掘被抑制的黄金种子。作者在 AFL++ 4.10c 上实现原型,与七个基线(含 afl-cmin、OptiMin)比较:两小时内相比 afl-cmin 多选出 3–40 个种子。在 Magma 八个目标上进行超过 17,280 CPU 小时的 AFL++ 模糊测试,结果显示额外种子在覆盖率和缺陷发现上有适度提升,同时揭示了 PoCo 的局限并提炼出经验教训。
Mutational greybox fuzzing (MGF) is a powerful software testing technique. Initial seeds are critical for MGF since they define the space of possible inputs and fundamentally shape the effectiveness of MGF. Nevertheless, having more initial seeds is not always better. A bloated initial seed set can inhibit throughput, thereby degrading the effectiveness of MGF. To avoid bloating, modern fuzzing practices recommend performing seed selection to maintain golden seeds (i.e., those identified as beneficial for MGF) while minimizing the size of the set. Typically, seed selection favors seeds that execute unique code regions and discards those that contribute stale coverage. This coverage-based strategy is straightforward and useful, and is widely adopted by the fuzzing community. However, coverage-based seed selection (CSS) is not flawless and has a notable blind spot: it fails to identify golden seeds suppressed by unpassed coverage guards, even if these seeds contain valuable payload that can benefit MGF. This blind spot prevents suppressed golden seeds from realizing their true values, which may ultimately degrade the effectiveness of downstream MGF. In this paper, we propose a novel technique named PoCo to address the blind spot of traditional CSS. The basic idea behind PoCo is to manifest the true strengths of the suppressed golden seeds by gradually disabling obstacle conditional guards. To this end, we develop a lightweight program transformation to enable flexible disabling of guards and devise a novel guard hierarchy analysis to identify obstacle ones. An iterative seed selection algorithm is constructed to stepwise select suppressed golden seeds. We prototype PoCo on top of the AFL++ utilities (version 4.10c) and compare it with seven baselines, including two state-of-the-art tools afl-cmin and OptiMin . Compared with afl-cmin , PoCo selects 3–40 additional seeds within a practical time budget of two hours. To evaluate how effective the studied techniques are in seeding MGF, we further conduct extensive fuzzing (over 17, 280 CPU hours) with eight different targets from a mature benchmark named Magma, adopting the most representative fuzzer AFL++ for MGF. The results show that the additional seeds selected by PoCo yield modest improvements in both code coverage and bug discovery. Although our evaluation reveals some limitations of PoCo , it also demonstrates the presence and value of suppressed golden seeds. Based on the evaluation results, we distill lessons and insights that may inspire the fuzzing community.
@article{paperbot3799,
title = {Peeling Off the Cocoon: Unveiling Suppressed Golden Seeds for Mutational Greybox Fuzzing},
author = {Ruixiang Qian and Chunrong Fang and Zengxu Chen and Youxin Fu and Zhenyu Chen},
journal = {Proceedings of the ACM on Programming Languages},
volume = {10},
number = {OOPSLA1},
year = {2026},
doi = {10.1145/3798205}
}