[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-82113-en":3,"doc-seo-82113-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},82113,1099514067415,"Rowan","https://ap-avatar.wpscdn.com/avatar/100002539d78ffe74a7?x-image-process=image/resize,m_fixed,w_180,h_180&k=1779092875211072502",8,"Research & Report","SeedSmith: LLM-Driven Seed Synthesis for Directed Fuzzing","Directed fuzzing targets user-defined sink functions to find software vulnerabilities, but it often fails to reach crashing states even after long campaigns. The work identifies two root causes: incomplete static analysis of indirect calls, which hides reachable paths from distance-based guidance, and missing semantic guidance for crash preconditions, which mutation cannot satisfy within time limits. SeedSmith intervenes at the initial seed corpus by using an agentic LLM workflow to resolve indirect calls, extract crash preconditions, and synthesize concrete inputs. As a seed-generation front-end, SeedSmith improves downstream fuzzers by enabling faster crash triggering, with reported speedups on Magma.","SeedSmith: LLM-Driven Seed Synthesis for Directed Fuzzing  \nJunmin Zhu* UC Santa Barbara California, USA [junmin@ucsb.edu](junmin@ucsb.edu)  \nFabio Gritti  \nUC Santa Barbara California, USA [degrigis@cs.ucsb.edu](degrigis@cs.ucsb.edu)  \nWenbo Guo  \nUC Santa Barbara California, USA [henrygwb@ucsb.edu](henrygwb@ucsb.edu)  \nSiyu Liu*  \nArizona State University Arizona, USA[sliu274@asu.edu](sliu274@asu.edu)  \nAti Priya Bajaj  \nArizona State University Arizona, USA [atipriya@asu.edu](atipriya@asu.edu)  \nTiffany Bao  \nArizona State University Arizona, USA[tbao@asu.edu](tbao@asu.edu)  \nJie Hu  \nArizona State University Arizona, USA [jiehu12@asu.edu](jiehu12@asu.edu)  \nHulin Wang  \nArizona State University Arizona, USA [hwang551@asu.edu](hwang551@asu.edu)  \nChristopher Kruegel UC Santa Barbara California, USA [chris@cs.ucsb.edu](chris@cs.ucsb.edu)  \narXiv :2607 .08949v 1 [ cs .CR] 9 Jul 2026  \nGiovanni Vigna  \nUC Santa Barbara California, USA [vigna@ucsb.edu](vigna@ucsb.edu)  \nAbstract  \nDirected fuzzing steers fuzzers toward user-defined sink functions to identify vulnerabilities, but it frequently fails to trigger crashes even after long campaigns. We identify two challenges that prevent directed fuzzers from exposing crashes: incomplete static analysis of indirect calls, which leaves reachable paths invisible to distancebased guidance, and lack of semantic guidance for crash preconditions, which blind mutation cannot satisfy within practical time budgets. A natural intervention point is the initial seed corpus: seeds that encode the right control-flow path and satisfy key crash preconditions shift fuzzing from blind exploration to local refinement. Existing seed generation approaches address neither: grammarbased and format-driven methods produce structurally valid inputs with no sink awareness, while LLM-based methods either lack sink targeting or inherit static analysis limitations through oneshot prompting. We present SeedSmith, an agentic LLM pipeline that replicates a security analyst’s workflow: starting from a sink, SeedSmith iteratively explores the codebase, resolves indirect calls, identifies crash preconditions, and synthesizes concrete inputs that satisfy them. Because SeedSmith operates as a seed generation front-end, its seeds are fuzzer-agnostic and improve any downstream mutation-based fuzzer without modification. On Magma, fuzzers using SeedSmith seeds achieve geometric mean crash-time speedups of 11 . 51× (AFL++) to 14. 66× (AFLGo) over default seeds.  \nPermission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission [and/or a fee. Request permissions from permissions@acm.org](and/or a fee. Request permissions from permissions@acm.org).  \nConference acronym ’XX, Woodstock, NY  \n© 2018 Copyright held by the owner/author(s) . Publication rights licensed to ACM. ACM ISBN 978-1-4503-XXXX-X/2018/06  \n[https://doi.org/XXXXXXX.XXXXXXX](https://doi.org/XXXXXXX.XXXXXXX)  \nOn ARVO, SeedSmith enables fuzzers to trigger 16 previously unreachable bugs spanning 10 projects with diverse input formats.  \nCCS Concepts  \n• Security and privacy → Software and application security;  \n• Computing methodologies → Artificial intelligence.  \nKeywords  \ndirected fuzzing, seed generation, large language models, vulnerability discovery  \nACM Reference Format:  \nJunmin Zhu*, Siyu Liu*, Jie Hu, Fabio Gritti, Ati Priya Bajaj, Hulin Wang, Wenbo Guo, Tiffany Bao, Christopher Kruegel, and Giovanni Vigna. 2018. SeedSmith: LLM-Driven Seed Synthesis for Directed Fuzzing. In Proceedings of Make sur","cbCaiejKjKXj0CYu","https://ap.wps.com/l/cbCaiejKjKXj0CYu","pdf",1399417,1,17,"English","en",105,"# Introduction\n## Challenges in Directed Fuzzing\n## Seed Corpus as an Intervention Point","[{\"question\":\"为什么定向模糊测试（directed fuzzing）经常难以触发崩溃？\",\"answer\":\"文中指出两类原因：间接调用（indirect calls）的静态分析不完整导致可达路径对距离引导不可见；即使到达 sink，崩溃往往还需要精确的输入语义前置条件，盲目突变难以在时间预算内满足。\"},{\"question\":\"SeedSmith如何在初始种子集（seed corpus）阶段进行干预？\",\"answer\":\"SeedSmith从目标 sink 出发，迭代探索代码库，解析间接调用，识别崩溃前置条件，并合成满足这些条件的具体输入。\"},{\"question\":\"SeedSmith生成的种子对下游模糊器有什么影响？\",\"answer\":\"SeedSmith作为种子生成前端，生成的种子与具体模糊器无关，不需要修改下游基于突变的模糊器即可提升其触发崩溃的速度，文中在Magam上的实验给出了几何平均加速比。\"}]",1784178285,43,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"seedsmith-llm-driven-seed-synthesis-for-directed-fuzzing","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/seedsmith-llm-driven-seed-synthesis-for-directed-fuzzing/82113/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"为什么定向模糊测试（directed fuzzing）经常难以触发崩溃？","Question",{"text":75,"@type":76},"文中指出两类原因：间接调用（indirect calls）的静态分析不完整导致可达路径对距离引导不可见；即使到达 sink，崩溃往往还需要精确的输入语义前置条件，盲目突变难以在时间预算内满足。","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"SeedSmith如何在初始种子集（seed corpus）阶段进行干预？",{"text":80,"@type":76},"SeedSmith从目标 sink 出发，迭代探索代码库，解析间接调用，识别崩溃前置条件，并合成满足这些条件的具体输入。",{"name":82,"@type":73,"acceptedAnswer":83},"SeedSmith生成的种子对下游模糊器有什么影响？",{"text":84,"@type":76},"SeedSmith作为种子生成前端，生成的种子与具体模糊器无关，不需要修改下游基于突变的模糊器即可提升其触发崩溃的速度，文中在Magam上的实验给出了几何平均加速比。","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":45,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":45,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":45,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":45,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":45,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":45,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]