SeedSmith: LLM-Driven Seed Synthesis for Directed Fuzzing

2026-07-13 · Source: cs.SE updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Software Development & Engineering · Depth: Expert, extended

Summary

SeedSmith is an agentic LLM pipeline designed to enhance directed fuzzing by synthesizing high-quality initial seed corpora. It addresses two key challenges: incomplete static analysis of indirect calls (C1) and lack of semantic guidance for crash preconditions (C2). SeedSmith replicates a security analyst's workflow, iteratively exploring codebases, resolving indirect calls, identifying crash preconditions, and generating concrete inputs. Operating as a fuzzer-agnostic front-end, it significantly improves downstream mutation-based fuzzers. On Magma, fuzzers using SeedSmith seeds achieved geometric mean crash-time speedups of 11.51x (AFL++) to 14.66x (AFLGo) over default seeds. On ARVO, SeedSmith enabled fuzzers to trigger 16 previously unreachable bugs across 10 projects with diverse input formats, demonstrating its ability to unlock new vulnerabilities.

Key takeaway

For security engineers or AI scientists focused on vulnerability discovery, SeedSmith offers a powerful approach to overcome common directed fuzzing limitations. By leveraging agentic LLMs for intelligent seed generation, you can significantly accelerate crash discovery and unlock previously unreachable bugs, especially in projects with complex input formats or pervasive indirect calls. Consider integrating SeedSmith into your fuzzing pipeline to provide high-quality initial seed corpora, reducing the burden on downstream fuzzers and improving overall campaign effectiveness.

Key insights

SeedSmith uses an agentic LLM to synthesize crash-triggering seeds, overcoming static analysis limits and semantic blind spots in fuzzing.

Principles

• Incomplete static analysis (C1) and lack of semantic guidance (C2) hinder directed fuzzing.
• High-quality initial seeds shift fuzzing from blind exploration to local refinement.
• Agentic LLMs can replicate security analyst workflows for vulnerability discovery.

Method

SeedSmith's two-stage agentic pipeline involves an Analysis Agent for path reconstruction and precondition identification, followed by a Seed Generation Agent that produces Python scripts for test input construction.

In practice

• Integrate SeedSmith as a fuzzer-agnostic front-end to improve any mutation-based fuzzer.
• Use context-aware code search to resolve indirect calls and extract crash preconditions.
• Employ LLMs to generate programmatic seed scripts for complex input formats.

Topics

• Directed Fuzzing
• Seed Generation
• Large Language Models
• Vulnerability Discovery
• Agentic AI
• Static Analysis Limitations
• Code Comprehension

Code references

• vusec/magma-directed
• n132/ARVO-Meta
• jiezhuzzz/Locus

Best for: Research Scientist, AI Scientist, AI Engineer, Security Engineer

Related on AIssential

• DIG: Oracle-Guided Directed Input Generation for One-Day Vulnerabilities — Patch analysis with LLMs can synthesize explicit vulnerability preconditions, guiding effective PoC generation.
• PBFuzz: Agentic Directed Fuzzing for PoV Generation — PBFuzz leverages agentic LLMs and property-based testing to bridge semantic understanding and efficient PoV input generation.
• Fuck You, Show Me The Prompt. — Many LLM frameworks, such as Guardrails, Guidance, Langchain, Instructor, and DSPy, aim to improve model outputs by rewriting or constructing prompts, often disintermediating users from the underlying prompt logic.
• Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice? — LLM security review repeatability varies significantly, with reference-matched findings stable but additional reports highly inconsistent.
• Building an Agentic Security Pipeline That Finds, Proves, and Patches Vulnerabilities — LLM-powered agentic pipelines can automate finding, proving, and patching vulnerabilities in complex codebases.
• Code-Augur: Agentic Vulnerability Detection via Specification Inference — Code-Augur improves agentic vulnerability detection by explicitly inferring and continuously validating LLM assumptions about code security.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.SE updates on arXiv.org.