MASFuzzer: Fuzz Driver Generation and Adaptive Scheduling via Multidimensional API Sequences
A new fuzzing framework uses LLMs guided by real API usage patterns to find 16 previously unknown security vulnerabilities in well-tested open-source libraries.
The Thesis
Most software libraries ship with inadequate fuzz testing because writing the glue code — called fuzz drivers — that exercises a library's API is tedious and requires deep domain knowledge. MASFuzzer automates that process by mining how APIs are actually used in real codebases, then feeding those patterns to an LLM to generate better starting drivers. The result is 8.54% higher code coverage than current best-in-class tools and 16 new vulnerabilities found in libraries that were already considered well-tested. The catch is that the gains are measured on 12 open-source libraries, so it is not yet clear how well this generalizes to proprietary or heavily obfuscated code. If the results hold at scale, this approach could meaningfully reduce the manual burden on security engineers doing library audits.
Catalyst
LLMs capable of generating syntactically correct, context-aware C/C++ code reached practical quality only in the last two years, making automated driver generation feasible rather than theoretical. At the same time, coverage-guided fuzzing infrastructure — particularly libFuzzer and OSS-Fuzz, Google's open infrastructure for continuously fuzzing open-source projects — has matured enough to serve as a reliable evaluation baseline. The combination of better code-generating models and a stable evaluation ecosystem is what makes this paper possible now.
What's New
Earlier automated fuzz driver systems, such as CarpetFuzz and Hopper, either rely on static analysis heuristics or use LLMs with minimal context about how library functions are actually called together. Those approaches frequently produce drivers that invoke APIs in isolation or in unrealistic orderings, missing the state-dependent branches that hide most bugs. MASFuzzer adds two layers prior tools lack: it mines mutation-propagation paths (sequences of API calls where the output of one feeds meaningfully into the next) and uses semantic similarity to cluster related usage patterns before handing them to the LLM, producing drivers that reflect real-world call sequences rather than random combinations.
The Counter
The core claim — that mining real API usage patterns helps LLMs write better fuzz drivers — is intuitive but the evidence base is narrow. Twelve libraries is a small sample, and the authors chose which libraries to test, introducing potential selection bias toward cases where their technique shines. The 8.54% coverage improvement sounds meaningful, but coverage is a proxy metric; what matters is whether new vulnerabilities are found at a rate that justifies the added infrastructure complexity over simply running more fuzzing hours. The paper finds 16 new bugs, which is a real result, but extensively tested libraries like libpng or OpenSSL have already absorbed millions of fuzzing CPU-hours through OSS-Fuzz — finding bugs there is impressive, but the paper does not tell us how many fuzzing hours MASFuzzer consumed relative to the baseline, making efficiency comparisons impossible. Finally, the approach still requires an LLM inference call for every driver generated; at scale, that adds latency and cost that a simpler mutation-only approach would not.
Longs
None listed.
Shorts
- Manual penetration testing firms whose library audit practices depend on hand-written fuzz harnesses — automation of that step compresses billable hours
- Vendors of static-analysis-only security tools who have not integrated fuzzing, since results like this widen the gap between static and dynamic approaches
Enablers (Picks & Shovels)
- OSS-Fuzz — Google's open continuous fuzzing infrastructure, used as both a baseline and a deployment target in this class of work
- libFuzzer — the LLVM coverage-guided fuzzing engine that underlies most modern library fuzzing evaluations
- OpenAI and Anthropic APIs — the LLMs used for driver code generation; better code-generation models directly improve output quality
- GitHub code search and open-source repositories — the source of API usage examples that MASFuzzer mines for context
Private Watchlist
- Mayhem Security (ForAllSecure) — sells automated fuzzing as a service to enterprise software teams and directly benefits if this technique improves driver quality
- Semgrep — static and dynamic analysis platform that could integrate automated driver generation as a library-auditing feature
The Paper
Fuzz testing of software libraries relies on fuzz drivers to invoke library APIs. Traditionally, these drivers are written manually by developers - a process that is time-consuming and often inadequate for exercising complex program behaviors. While recent studies have explored the use of Large Language Models (LLMs) to automate fuzz driver generation, the resulting drivers often fail to cover deep program branches. To address these challenges, we propose MASFUZZER, a fuzzing framework that integrates multidimensional API sequence construction with adaptive fuzzing scheduling strategies to improve library testing. At its core, MASFUZZER synthesizes context-relevant API call sequences by referring to API usage examples from the codebase and applying mutation-propagation-based and semantic-aware API sequence mining. These multidimensional API sequences serve as the basis for LLMs to generate effective initial drivers. In addition, MASFUZZER incorporates a coverage-guided scheduler that prioritizes testing time for the most promising drivers, along with a driver mutation strategy to evolve them. This enables systematic generation of fuzz drivers to explore previously untested code regions. We evaluate MASFUZZER on 12 widely used open-source libraries. The results show that MASFUZZER achieves 8.54 percent higher code coverage than state-of-the-art techniques. Moreover, MASFUZZER uncovers 16 previously unknown vulnerabilities in extensively tested libraries, with 14 confirmed by developers and 9 assigned CVE identifiers. These results indicate that MASFUZZER provides an efficient and practical approach for fuzzing software libraries.