一句话：通过约束式驱动生成与上下文感知崩溃验证，在 OSS-Fuzz-Gen 中过滤过半误报崩溃。
模糊测试依赖高质量 fuzz driver 将原始输入转换为合法函数参数；自动生成可减少人工，却常为复杂函数产生误报崩溃。本文介绍实验性系统 OSS-Fuzz-Gen，其采用基于 agent 的 fuzz driver 生成，并报告两种互补的误报缓解策略：基于约束的 fuzz driver 生成，以及面向真实程序入口点的上下文感知崩溃验证。作者在 OSS-Fuzz 的 1,500 个基准函数上评估，发现这些策略以适度额外开销过滤掉超过一半最初被归为程序错误的崩溃，并总结在大规模模糊测试流水线中部署基于 LLM 的 agent 的经验教训。
Fuzz testing is widely used in industry and open-source ecosystems, but its effectiveness depends on the quality of fuzz drivers that translate raw fuzzer input into valid function arguments. Automated fuzz driver generation reduces manual effort, but in practice often produces false positive crashes, especially for complex functions. We introduce OSS-Fuzz-Gen, an experimental system for agent-based fuzz driver generation. This paper reports our experience mitigating its false positives using two complementary strategies: constraint-based fuzz driver generation and context-aware crash validation against realistic program entry points. In our evaluation on 1,500 benchmark functions from OSS-Fuzz, these strategies filtered out more than half of crashes initially classified as program errors, at modest additional cost. We distill lessons for deploying LLM-based agents in large-scale fuzzing pipelines.
@inproceedings{AmusuoLMMCD26,
title = {Lessons from Mitigating False Positives in Google's OSS-Fuzz-Gen},
author = {Paschal Amusuo and Dongge Liu and Ricardo Andres Calvo Mendez and Jonathan Metzman and Oliver Chang and James C Davis},
booktitle = {FSE},
year = {2026},
doi = {10.1145/3803437.3805205}
}