Execution Divergence Graphs:Effective Discovery of Control-Flows from Execution Traces as Fuzzing Feedback

• URL: http://arxiv.org/abs/2607.03396v1
• Date: Fri, 03 Jul 2026 14:57:27 GMT
• Title: Execution Divergence Graphs:Effective Discovery of Control-Flows from Execution Traces as Fuzzing Feedback
• Abstract summary: Efficient testing strategies rely on execution feedback to guide the input generation process.<n>We discuss approaches to guide the fuzzer using feedback derived from a control-flow-graph-like structure constructed from runtime execution.<n>We show that our approach enables effective fuzzing of a number of obfuscated targets, and compare its performance in scenarios where static instrumentation is impossible.
• Score: 6.458018883486992
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Fuzz testing is a popular approach to the security testing of proprietary software. Efficient testing strategies rely on execution feedback to guide the input generation process, particularly when the basic blocks in the binary can be directly observed and instrumented. Unfortunately, collecting such feedback is impossible in scenarios such as in-situ fuzzing of black-box devices and the fuzzing of obfuscated compiled binaries. In this work, we discuss approaches to guide the fuzzer using feedback derived from a control-flow-graph-like (CFG-like) structure constructed from runtime execution. We start by outlining a simple divergence-detection approach that identifies unique execution traces, and then present an improved approach based on an Execution Divergence Graph (EDG). We implement both approaches and demonstrate that they outperform a baseline blind fuzzer. In addition, we discuss particular challenges, such as repeated code execution in loops, and show that the EDG-based approach handles them effectively. We then demonstrate that our approach enables effective fuzzing of a number of obfuscated targets, and compare its performance in scenarios where static instrumentation is impossible. While we focus on a scenario in which full instruction traces are directly observable by the attacker, our scheme can also be applied in scenarios with other feedback channels, such as power consumption.

Related papers

• What Resolve Rate Hides: Trajectory Structure Diagnostics for Coding Agents [14.988334585821939]
  Coding agents are ranked almost entirely by resolve rate.<n>A single pass/fail label says nothing about why a run failed or why an accepted run spent extra steps, time, or tokens.<n>We present TraceProbe, a trajectory-diagnostic framework that recovers what resolve rate hides.
  arXiv  Detail & Related papers  (2026-07-07T12:09:46Z)
• From Open Loop to Closed Loop: A Test-Time Iterative Optimization Framework for Reference-Consistent Image Generation [108.02425846269234]
  controllable image generation has made significant strides by incorporating visual reference conditions.<n>Existing methods predominantly operate as open-loop systems.<n>We propose a novel test-time iterative optimization framework that reformulates reference-consistent generation as a closed-loop dynamic tracking problem.
  arXiv  Detail & Related papers  (2026-07-06T05:36:30Z)
• SDLLMFuzz: Dynamic-static LLM-assisted greybox fuzzing for structured input programs [6.165429775333409]
  SDLLMFuzz is a dynamic-static LLM-assisted greybox fuzzing framework for structured-input programs.<n>Our approach integrates structure-aware seed generation with static crash analysis, forming a unified feedback loop.<n> Experimental results show that SDLLMFuzz significantly outperforms traditional greybox fuzzers.
  arXiv  Detail & Related papers  (2026-04-20T03:10:31Z)
• Analyzing Chain of Thought (CoT) Approaches in Control Flow Code Deobfuscation Tasks [39.1560117358229]
  Chain-of-Thought (CoT) prompting is guided through explicit, step-by-step reasoning tailored for code analysis.<n>We focus on control flow obfuscation, including Control Flow Flattening (CFF), Opaque Predicates, and their combination.<n>We show that CoT prompting significantly improves deobfuscation quality compared with simple prompting.
  arXiv  Detail & Related papers  (2026-04-16T06:08:07Z)
• DuET: Dual Execution for Test Output Prediction with Generated Code and Pseudocode [56.14374797825548]
  We introduce LLM-based pseudocode execution, which grounds prediction on more error-resilient pseudocode.<n>We propose DuET, a dual-execution framework that combines both approaches by functional majority voting.<n>On LiveCodeBench, DuET achieves the state-of-the-art performance, improving Pass@1 by 13.6 pp.
  arXiv  Detail & Related papers  (2026-04-13T14:18:58Z)
• A Physical Agentic Loop for Language-Guided Grasping with Execution-State Monitoring [5.437966695589128]
  We reformulate language-guided grasping as a bounded embodied agent operating over grounded execution states.<n>We introduce a physical agentic loop that wraps an unmodified learned manipulation primitive.<n>We validate the resulting loop on a mobile manipulator with an eye-in-hand D405 camera.
  arXiv  Detail & Related papers  (2026-04-08T08:01:35Z)
• Beyond Input Guardrails: Reconstructing Cross-Agent Semantic Flows for Execution-Aware Attack Detection [32.301679396929536]
  We propose SysName, a framework that shifts the defensive paradigm from static input filtering to execution-aware analysis.<n>SysName synthesizes fragmented operational primitives into contiguous behavioral trajectories, enabling a holistic view of system activity.<n> Empirical evaluations demonstrate that SysName effectively detects over ten distinct compound attack vectors, achieving F1-scores of 85.3% and 66.7% for node-level and path-level end-to-end attack detection, respectively.
  arXiv  Detail & Related papers  (2026-03-04T01:59:16Z)
• FuzzRDUCC: Fuzzing with Reconstructed Def-Use Chain Coverage [6.827408090670258]
  Binary-only fuzzing often struggles with achieving thorough code coverage and uncovering hidden vulnerabilities.<n>We introduce FuzzRDUCC, a novel fuzzing framework that employs symbolic execution to reconstruct definition-use (def-use) chains directly from binary executables.
  arXiv  Detail & Related papers  (2025-09-05T09:47:34Z)
• Execution Guided Line-by-Line Code Generation [48.996319645671605]
  We present a novel approach to neural code generation that incorporates real-time execution signals into the language model generation process.<n>Our method, Execution-Guided-Free Guidance, dynamically incorporates execution signals as the model generates code.<n> EG-CFG significantly improves code generation approaches, achieving state-of-the-art results across various levels of complexity.
  arXiv  Detail & Related papers  (2025-06-12T17:50:05Z)
• Towards Transformer-Based Aligned Generation with Self-Coherence Guidance [51.42269790543461]
  We introduce a training-free approach for enhancing alignment in Transformer-based Text-Guided Diffusion Models (TGDMs)<n>Existing TGDMs often struggle to generate semantically aligned images, particularly when dealing with complex text prompts or multi-concept attribute binding challenges.<n>Our method addresses these challenges by directly optimizing cross-attention maps during the generation process.
  arXiv  Detail & Related papers  (2025-03-22T07:03:57Z)
• Token-Level Adversarial Prompt Detection Based on Perplexity Measures and Contextual Information [67.78183175605761]
  Large Language Models are susceptible to adversarial prompt attacks. This vulnerability underscores a significant concern regarding the robustness and reliability of LLMs. We introduce a novel approach to detecting adversarial prompts at a token level.
  arXiv  Detail & Related papers  (2023-11-20T03:17:21Z)
• Towards General Visual-Linguistic Face Forgery Detection [95.73987327101143]
  Deepfakes are realistic face manipulations that can pose serious threats to security, privacy, and trust. Existing methods mostly treat this task as binary classification, which uses digital labels or mask signals to train the detection model. We propose a novel paradigm named Visual-Linguistic Face Forgery Detection(VLFFD), which uses fine-grained sentence-level prompts as the annotation.
  arXiv  Detail & Related papers  (2023-07-31T10:22:33Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.