Co-GRFuzz: Shared-Corpus Cooperative Fuzzing for Python Libraries
Main Article Content
Abstract
Parallel fuzzing can exchange successful inputs, but the behavior of different Python mutation strategies under a shared corpus is not well characterized. We evaluate four Pythonfuzz-anchored two-worker configurations-PP, PD, PO, and PG-on five Python libraries and compare them with isolated single-process references under one common sys.settrace-based line-transition coverage representation. The observed outcomes are target-dependent and do not favor GRPO as a cooperative partner. On python-dateutil, PD and PO each reach a global union of 3407 edges, whereas PG reaches 2913 despite similar local coverage of the learning-guided worker. On cryptography, PD and PO reach a 47-edge union while PG shows no union gain. A provenance-enabled PG run records 106 global-first discoveries whose direct parent was produced by the peer worker, documenting within-run seed reuse without establishing a causal benefit of sharing. Each configuration is represented by one six-hour campaign; the reported values are therefore individual campaign observations rather than statistical comparisons. Two previously undocumented exceptions are also reported as qualitative bug-finding evidence.
Keywords
fuzzing, mutation-based, coverage-guided, deep reinforcement learning
Article Details
This work is licensed under a Creative Commons Attribution 4.0 International License.
References
[2] A. Zeller, R. Gopinath, M. B¨ohme, G. Fraser, and C. Holler, The Fuzzing Book, 2019. [Online]. Available: https : / /www. fuzzingbook . org/. Accessed on: May 6, 2025.
[3] M. Zalewski, American Fuzzy Lop (AFL), 2015. [Online]. Available: https://lcamtuf.coredump.cx/afl/. Accessed on: May 2, 2025.
[4] LLVM Project, libFuzzer: A library for coverage-guided fuzz testing, 2018. [Online]. Available: https://llvm.org/ docs/LibFuzzer.html. Accessed on: May 4, 2025.
[5] K. B¨ottinger, P. Godefroid, and R. Singh, Deep reinforcement fuzzing, in 2018 IEEE Security and Privacy Workshops (SPW), 2018, pp. 116–122.
[6] Z. Zhang, B. Cui, and C. Chen, Reinforcement learning-based fuzzing technology, in International Conference on Innovative Mobile and Internet Services in Ubiquitous Computing, June 2020, pp. 244–253.
[7] L. Binosi, L. Rullo, M. Polino, M. Carminati, S. Zanero, et al., Rainfuzz: Reinforcement-learning-driven heat maps for boosting coverage-guided fuzzing, in ICPRAM, 2023, pp. 39–50.
[8] V.-A. Le-Minh, H.-A. Tran, H.-H. Nguyen, N.-T. Hoang, and T. X. Tran, GRFuzz: A deep reinforcement learning approach to Python library fuzzing with GRPO, in 2025 IEEE International Conference on Information Reuse and Integration and Data Science (IRI), 2025, pp. 13–18.
[9] B. P. Miller, L. Fredriksen, and B. So, An empirical study of the reliability of UNIX utilities, Communications of the ACM, vol. 33, no. 12, pp. 32–44, 1990. https://doi.org/10.1145/96267.96279
[10] M. B¨ohme, V.-T. Pham, and A. Roychoudhury, Coverage-based greybox fuzzing as Markov chain, in Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2016, pp. 1032–1043.
[11] S. Lukasczyk and G. Fraser, Pynguin: Automated unit test generation for Python, in 44th IEEE/ACM International Conference on Software Engineering: Companion Proceedings (ICSE Companion), 2022, pp. 168–172.
[12] Y. Pats, Pythonfuzz: Coverage-guided fuzz testing for Python, GitLab, 2020. [Online]. Available: https://gitlab. com/ gitlab - org/ security- products / analyzers / fuzzers / pythonfuzz. Accessed on: Oct. 14, 2026.
[13] Google, Atheris: A coverage-guided, native Python fuzzer, 2020. [Online]. Available: https://github.com/ google/atheris. Accessed on: May 13, 2025.
[14] M. Rajpal,W. Blum, and R. Singh, Not all bytes are equal: Neural byte sieve for fuzzing, arXiv, 2017. [Online]. Available: https://arxiv.org/abs/1711.04596. Accessed on: Oct. 14, 2026.
[15] Z. Shao, P.Wang, Q. Zhu, R. Xu, J. Song, X. Bi, H. Zhang, M. Zhang, Y. Li, Y. Wu, and D. Guo, DeepSeekMath: Pushing the limits of mathematical reasoning in open language models, arXiv, 2024. [Online]. Available: https: //arxiv.org/abs/2402.03300. Accessed on: Oct. 14, 2026.
[16] Y. Chen, Y. Jiang, F. Ma, J. Liang, M. Wang, C. Zhou, X. Jiao, and Z. Su, EnFuzz: Ensemble fuzzing with seed synchronization among diverse fuzzers, in 28th USENIX Security Symposium (USENIX Security 19), Santa Clara, CA, Aug. 2019, pp. 1967–1983.
[17] J. Liang, Y. Jiang, Y. Chen, M.Wang, C. Zhou, and J. Sun, PAFL: Extend fuzzing optimizations of single mode to industrial parallel mode, in Proceedings of the 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, 2018, pp. 809–814.
[18] E. Gu¨ler, P. Go¨rz, E. Geretto, A. Jemmett, S. O¨ sterlund, H. Bos, C. Giuffrida, and T. Holz, Cupid: Automatic fuzzer selection for collaborative fuzzing, in Annual Computer Security Applications Conference (ACSAC 2020), 2020, pp. 360–372.
[19] Y.-F. Fu, J. Lee, and T. Kim, autofz: Automated fuzzer composition at runtime, in 32nd USENIX Security Symposium (USENIX Security 23), Anaheim, CA, Aug. 2023, pp. 1901–1918.
[20] A. Fioraldi, D. Maier, H. Eißfeldt, and M. Heuse, AFL++: Combining incremental steps of fuzzing research, in 14th USENIX Workshop on Offensive Technologies (WOOT 20), Aug. 2020.
[21] A. Fioraldi, D. C. Maier, D. Zhang, and D. Balzarotti, LibAFL: A framework to build modular and reusable fuzzers, in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, 2022, pp. 1051–1065.
[22] G. Klees, A. Ruef, B. Cooper, S. Wei, and M. Hicks, Evaluating fuzz testing, in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, 2018, pp. 2123–2138.
[23] J. Metzman, L. Szekeres, L. M. R. Simon, R. T. Sprabery, and A. Arya, FuzzBench: An open fuzzer benchmarking platform and service, in Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, 2021, pp. 1393–1403.
[24] M. Schloegel, N. Bars, N. Schiller, L. Bernhard, T. Scharnowski, A. Crump, A. Ale-Ebrahim, N. Bissantz, M. Muench, and T. Holz, SoK: Prudent evaluation practices for fuzzing, in 2024 IEEE Symposium on Security and Privacy (SP), 2024, pp. 1974–1993.
[25] A. Arcuri and L. Briand, A practical guide for using statistical tests to assess randomized algorithms in software engineering, in Proceedings of the 33rd International Conference on Software Engineering, 2011, pp. 1–10.
[26] A. Vargha and H. D. Delaney, A critique and improvement of the CL common language effect size statistics of McGraw and Wong, Journal of Educational and Behavioral Statistics, vol. 25, no. 2, pp. 101–132, 2000. https://doi.org/10.3102/10769986025002101.