AdaRare: Telemetry-Guided Joint Profile Control for Greybox Fuzzing

AdaRare: Telemetry-Guided Joint Profile Control for Greybox Fuzzing (Preprint) Jingchuan Ma, Tongan Liu, Yanhua Liu, and Qiaoyun Huang

arXiv:2608.18187v1 [cs.CR] 18 Aug 2026

Department of Computer Engineering, Fuzhou University Zhicheng College Fuzhou, Fujian, China kiciot@qq.com, darkank@qq.com, Lyhwa@fzu.edu.cn, huangqy@fdzcxy.edu.cn

Abstract—Greybox fuzzers combine interacting queue, mutation, dictionary, energy, and comparison-solving control surfaces, while prior adaptive systems typically optimize other decision objects or control layers. We present AdaRare, an AFL++ extension that coordinates five internal actuation mechanisms as one bounded in-process profile updated every 5,000 ms. Completed-window, action-induced telemetry feeds an arm-local recency-weighted linear scorer and a profile-conditioned controller target. The scorer borrows the algebraic structure of disjoint LinUCB, but serves as a closed-loop profile-ranking mechanism rather than a calibrated contextual-bandit action-value estimator or statistical confidence bound. Across three sequential repeated-trial phases, Main provides broad integrated-system evidence: AdaRare has higher median edge coverage than vanilla AFL++ on all eight targets, with five Holm-significant comparisons. In the strongest matched result, Full AdaRare has higher median edge coverage than CmpLog-matched AFL++ on all five follow-up targets, with four Holm-significant comparisons. Batch A finds higher medians for telemetryguided selection than fixed-context, random, and roundrobin schedules in all 15 target–control comparisons, with 13 Holm-significant comparisons. The experiments do not establish independent No-A6-versus-Shadow or scarcitybundle effects; A6 evidence is target-dependent and weakens under batch-wide correction. In an unmatched firmware case study, AdaRare-generated inputs exposed five distinct memory-corruption findings, each reproduced in a separate environment and later assigned a CVE identifier. Controllerboundary compute P99 medians are below 6.5 ms for a five-second window; complete-boundary P99 medians including synchronous logging are below 14.7 ms. These measurements characterize boundary latency, not total system overhead. I. Introduction Coverage-guided greybox fuzzing is a fixed-budget securitytesting process. AFL++ combines queue management, power schedules, dictionaries, havoc mutations, favored-seed logic, and comparison solving in one high-throughput execution substrate [1], [2]. These mechanisms interact: comparison solving

consumes execution budget, queue bias changes which program regions receive attention, and dictionary-heavy mutations can be especially valuable under particular parser states. Under a fixed CPU budget, these control choices determine how much potentially security-relevant program behavior a campaign can explore. Runtime adaptation is not new. AFLFast and EcoFuzz adapt seed energy [3], [5]; MOpt and DARWIN adapt mutation distributions [6], [25]; SLOPT applies bandit optimization to mutation schemes inside AFL++ [26]; T-Scheduler adapts seed selection [7]; MobFuzz jointly selects objective combinations and power schedules [22]; SYZVEGAS coordinates task and seed selection [23]; SEAMFuzz learns seed-cluster-specific mutation distributions [24]; autofz and KRAKEN allocate parallel resources [29], [31]; and xFUZZ composes inputand mutation-scheduling plugins [30]. These systems typically optimize a local policy, a plugin combination, or an external resource-allocation layer. AdaRare instead studies a systems question: can multiple interacting AFL++ control surfaces be coordinated as one bounded, low-frequency, in-process control object without replacing the underlying execution substrate? AdaRare divides a campaign into 5,000 ms windows. Each effective profile jointly sets dictionary probability, havoc intensity, favored-entry preference, new-seed preference, and scarcityconditioned energy shaping. Completed-window telemetry is summarized into six dimensions and consumed by an arm-local recency-weighted linear scorer; a bounded profileconditioned controller target updates the selected meta-arm and, for A6, the delegated effective profile. Five base profiles encode interpretable campaign postures, while A6 is a delegated portfolio meta-arm. The telemetry vector 𝑥 𝑡 is generated under the current selected/effective profile and guides the next window. The linear scores are operational ranking quantities rather than calibrated counterfactual action values, and the paper does not propose a new bandit algorithm. Effectiveness is assessed through repeated system-level comparisons and diagnostic scheduling controls. Contributions. This paper makes three contributions. • Joint in-process actuation of multiple AFL++ control surfaces. Every five seconds, one bounded profile coordinates queue preferences, dictionary/mutation intensity, and

scarcity-conditioned energy shaping within the preserved AFL++ substrate. • An audit-logged telemetry-guided controller with a source-level specification. It distinguishes selected metaarms from effective profiles, uses arm-local recencyweighted scoring, and logs boundary updates including A6 delegation. • Matched system evidence, diagnostic controls, explicit negative results, and an unmatched deployment case study. The strongest controlled comparison evaluates Full AdaRare against a CmpLog-matched substrate; separate profile-control experiments diagnose dynamic selection against simple schedules. The paper reports unresolved No-A6-versus-Shadow and scarcity-bundle effects, batchwide multiplicity sensitivity, and five responsibly disclosed findings that later received CVE identifiers, without claiming comparative vulnerability yield.

algebra, nor runtime composition is novel in isolation; the linear scorer is an implementation mechanism rather than the paper’s algorithmic contribution. The systems contribution is the realization, observability, and controlled evaluation of a profile spanning queue-selection preferences, mutation/dictionary intensity, and energy shaping without replacing the execution substrate. Learning-guided fuzzers use richer models and feedback sources [17]–[21]; AdaRare instead emphasizes a compact auditable controller and evaluates external edge coverage rather than internal scoring quantities. Because fuzzing is stochastic and implementation details matter [13], [16], all inferential claims remain within target and batch. III. Background and Control Problem A. Coverage-Guided Greybox Fuzzing A coverage-guided greybox fuzzing (CGF) system instruments a target, observes feedback such as edge coverage, retains interesting inputs, and mutates the queue to explore new behavior. A typical AFL++ loop selects a queue entry, mutates it, executes the target, observes coverage and faults, and decides whether to save the input. Seed scheduling, power scheduling, mutation scheduling, dictionaries, and comparison solving all influence this loop. AdaRare does not replace them; it adds an outer controller that biases existing mechanisms according to recent campaign telemetry.

II. Related Work and Novelty Boundary

Prior fuzzers adapt different decision objects. Seed- and energy-oriented systems include AFLFast, Entropic, EcoFuzz, and T-Scheduler [3]–[5], [7]. MOpt and DARWIN optimize mutation-operator probabilities [6], [25]; SLOPT brings bandit optimization into AFL++ at the mutation-scheme layer [26]; MuoFuzz learns conditional mutator sequences to exploit operator-order interactions [27]; and SEAMFuzz conditions mutation distributions on seed clusters [24]. MobFuzz jointly B. Joint Profile-Control Layer adapts objective combinations and seed energy [22], and AdaRare controls a scheduling profile rather than a seed, SYZVEGAS jointly adapts kernel-fuzzing task and seed energy value, or mutation operator. This coarser layer is selection [23]. Accordingly, adaptive fuzzing, bandit use in deliberate: AdaRare keeps controller updates outside the AFL++, and multi-control adaptation are not novel in isolation. per-execution hot path and uses window-level telemetry to FOX formulates coverage-guided fuzzing as end-to-end summarize the recent campaign regime beyond a single seed. online stochastic control and couples frontier-branch scheduling This is a design choice rather than a claim that finer-grained with a branch-distance-guided custom mutator and modified online adaptation is infeasible. The window summary can instrumentation [28]. AdaRare does not introduce branch- capture whether coverage is still increasing, scarcity-weighted distance instrumentation or a replacement mutator; it uses activity is changing, favored seeds dominate, or timeouts are completed-window telemetry to coordinate existing AFL++ rising, and can then select the next meta-arm and resolve its queue, dictionary/mutation, and energy actuation paths. We do effective profile. not claim performance superiority over FOX without a direct C. Closed-Loop Profile-Control Formulation comparison. Composition and parallel systems operate at other layers. autLet a fuzzing campaign have wall-clock budget 𝑇, divided ofz assigns CPU time among complete fuzzers, and KRAKEN into windows 𝑡 = 1, 2, . . .. Let 𝑎 𝑡 ∈ A = {A1, . . . , A6} denote adapts parallel-fuzzing strategies and resources [29], [31]. the selected meta-arm, and let 𝑒 𝑡 ∈ E = {A1, . . . , A5} denote xFUZZ is the closest composition precedent: it selects runtime the effective base profile applied to AFL++ during window 𝑡. If combinations of independently switchable input- and mutation- 𝑎 𝑡 ≠ A6, then 𝑒 𝑡 = 𝑎 𝑡 ; when 𝑎 𝑡 = A6, 𝑒 𝑡 is sampled from A6’s scheduling plugins [30]. TrioFuzz addresses adaptation latency delegated top-𝑘 set. Let 𝑥 𝑡 ∈ R6 summarize telemetry from architecturally by decoupling a centralized learner from parallel the completed window, and let 𝑟 𝑡 denote the bounded profileexecution threads in a three-tier design, reducing its adaptation conditioned controller target called “reward” in the source and cycle to under one minute [32]. AdaRare instead retains audit logs. At the boundary, AdaRare attributes (𝑥 𝑡 , 𝑟 𝑡 ) to the control inside one AFL++ process and applies a compact joint selected decision, then uses 𝑥 𝑡 to rank 𝑎 𝑡+1 and, if needed, internal profile every five seconds. We treat TrioFuzz as an resolve delegated profile 𝑒 𝑡+1 . architectural precedent for low-latency adaptation and do not This is a closed-loop profile-control problem: the selected claim superiority without a direct comparison. meta-arm and effective profile directly affect the telemetry AdaRare’s technical boundary is joint in-process actuation observed later. Dictionary-heavy behavior changes comparison of five AFL++-internal actuation mechanisms through one low- activity, queue preferences change queue composition, and frequency closed-loop profile. Neither adaptive fuzzing, bandit profile choices affect throughput and scarcity-weighted activity.

2

TABLE I Decision-object taxonomy for representative adaptive fuzzers. The distinctions are architectural, not a performance ranking. Work

Decision object

Adaptation layer

Relation to AdaRare

AFLFast/EcoFuzz/TScheduler [3], [5], [7] MOpt/DARWIN/SLOPT/ MuoFuzz [6], [25]–[27] SEAMFuzz [24] MobFuzz [22] SYZVEGAS [23] autofz/KRAKEN [29], [31] xFUZZ [30] AdaRare

seed selection or energy

queue or power scheduling

adapts a local queue/power surface

mutation operators, schemes, or sequences

online mutation policy

seed-cluster mutation distribution objective combination and power schedule task and seed selection fuzzer/worker strategy and resources

cluster-conditioned mutation periodic multi-objective control online kernel-fuzzing policy parallel orchestration

input/mutation plugin composition joint profile over five AFL++-internal actuation mechanisms

sliding-window composition fixed 5-s in-process control

mutation-local adaptation; MuoFuzz models sequence interactions finer seed-conditioned mutation policy joint adaptation at a different objective layer joint task/seed decision object allocates effort outside one execution substrate closest strategy-composition precedent coordinates queue, mutation/dictionary, and energy surfaces

The controller therefore uses completed-window, action-induced telemetry as a regime summary for the next decision. Its internal scores are not interpreted as unbiased counterfactual rewards under exogenous pre-action contexts; the external objective remains fixed-budget coverage growth and repeated-trial final edge coverage.

appropriate, scaled, capped, and smoothed with an exponential moving average: 𝑥 𝑡 = (1 − 𝜆 𝑥 )𝑥 𝑡 −1 + 𝜆 𝑥 𝑧 𝑡 ,

(1)

where 𝑧 𝑡 is the raw feature vector for window 𝑡. The implementation uses 𝜆 𝑥 = 0.30. The six features are chosen to cover the main feedback loops D. Design Requirements that a greybox campaign exposes without target-specific static A practical AFL++ scheduler must adapt to non-stationary analysis: novelty discovery, discovery-scarcity-weighted path campaign phases, keep learning outside the target-execution activity, execution efficiency, queue pressure, AFL++ favoredhot path, prevent auxiliary proxy terms from dominating the entry concentration, and target instability. This keeps the bounded observable signals, and remain auditable through detertelemetry vector low-dimensional enough for auditable online ministic configuration, window logs, and numerical guardrails. updates while still representing campaign-level conditions that IV. AdaRare Overview can trigger profile changes. The features are collected through existing runtime telemetry. A. Workflow The timeout feature is not treated as inherently negative by the AdaRare is implemented as a window-level joint-control profile scorer; a slow window may still be valuable if it produces layer above the AFL++ core loop. Figure 1 gives the system coverage novelty, scarcity-weighted activity, or comparison overview. During a window, AFL++ performs its usual queue progress. The controller-target construction determines when selection, mutation, execution, coverage collection, and queue throughput cost is penalized. update. AdaRare accumulates window-level events. At the boundary, it constructs the telemetry vector, computes the C. Profile Arms profile-conditioned controller target, updates the arm-local AdaRare uses five base profile arms and one portfolio scorer, selects the next meta-arm, resolves effective profile arm. Each base profile specifies five bounded mechanisms: 𝑒 𝑡+1 , and writes that profile into the AFL++ control paths. dictionary-attempt probability, havoc multiplier, favored-entry The output of AdaRare is not a concrete input or a preference, new-seed preference, and scarcity-conditioned enreplacement mutator. It is a profile that changes the distribution ergy mode. A6 does not apply a fixed profile; it delegates to a of effort in the next window. Figure 2 details this internal selected base profile, which becomes the effective arm for the control path. This design keeps the integration local and makes window. the controller easy to disable, audit, and compare against Table V summarizes the main formal defaults. The Full vanilla AFL++. It also enables profile-level interpretation: the window logs expose when dictionary-heavy or queue- campaigns used the defaults specified by the frozen formal controller configuration labeled FORMAL-R1; controller-parameter exploration profiles are selected. environment overrides and per-target settings were not used. B. Telemetry Features RELEASE-R1 is the internal label for a packaged 15-file At the end of each window, AdaRare constructs a six- method-relevant source subset, not a public release or historicaldimensional telemetry vector. The features are coverage- image proof. Appendix F reports the evaluated controller bit discovery rate, discovery-scarcity-weighted activity rate, configuration, and Appendix G separates source-verifiable execution throughput, queue-relative density, favored-seed ratio, defaults, author-confirmed protocol facts, and unavailable run and timeout rate. Raw feature values are log-compressed where linkage.

3

Fig. 1. AdaRare as a joint profile controller over the preserved AFL++ execution substrate. Completed-window telemetry forms 𝑥 𝑡 and a bounded profile-conditioned controller target 𝑟 𝑡 . The profile scorer selects 𝑎 𝑡+1 and resolves 𝑒 𝑡+1 , directly for A1–A5 or by delegation for A6. The effective profile jointly controls queue selection, mutation/dictionary behavior, and scarcity-conditioned energy shaping for the next window. Each arm is initialized with 𝐴 𝑎 = 𝜆ridge 𝐼 and 𝑏 𝑎 = 0. Given completed-window telemetry 𝑥 𝑡 , the implementation borrows the algebraic structure of disjoint LinUCB [8]: √︃ score𝑡+1 (𝑎 | 𝑥 𝑡 ) = 𝑥 𝑡⊤ 𝜃 𝑎 + 𝛼 𝑥 𝑡⊤ 𝐴 𝑎−1 𝑥 𝑡 . (3)

A profile is intentionally coarser than an individual mutation. The small action space supports interpretation, allows one update per window, and reuses AFL++ mechanisms instead of introducing a replacement mutation engine.

V. Design and Implementation A. Windows, Warmup, and Selection Guards The first term is an arm-local fitted association between actionAdaRare evaluates its controller when monotonic induced telemetry and the profile-conditioned controller target. wall time closes a 5,000 ms window, configured by The second is a bounded exploration term used to avoid premature concentration. Because 𝑥 𝑡 is observed after the AFL_BANDIT_WINDOW_MS. Before telemetry-guided scoring, each arm receives two current profile acts, and because target scales and preferences warmup observations, and the least-observed eligible arm depend on the effective profile, these scores are not calibrated is preferred. Dwell is a one-window anti-switch guard, but counterfactual action values; the exploration term is not warmup, revisit, trend, and zero-signal emergency paths may interpreted as a statistical confidence bound. The scores only bypass it. We do not treat dwell as an independent mechanism. rank eligible profiles inside the implemented closed-loop Algorithm 1 gives the source-level ordering. The selected controller. All external effectiveness claims rely on repeated meta-arm 𝑎 𝑡 and effective base profile 𝑒 𝑡 are distinct when A6 system-level comparisons. A disjoint model preserves profile-specific response patterns delegates. Telemetry from window 𝑡 is attributed only after across throughput-first, dictionary-heavy, comparison-oriented, that window completes; the resulting vector ranks profiles for queue-exploration, and portfolio behavior. To limit stale history, window 𝑡 + 1. AdaRare discounts the arm-local statistics at each window, B. Recency-Weighted Telemetry-Guided Profile Scoring following the recency-weighting idea used in non-stationary For each selected meta-arm 𝑎, AdaRare maintains an arm- bandits [11], [12]. Let 𝛾 𝑑 ∈ (0, 1] be the discount factor and local design matrix 𝐴 𝑎 and response vector 𝑏 𝑎 . The fitted 𝜆ridge the ridge term: parameter vector is 𝜃 𝑎 = 𝐴 𝑎−1 𝑏 𝑎 . (2) 𝐴 𝑎 ← 𝛾 𝑑 𝐴 𝑎 + (1 − 𝛾 𝑑 )𝜆ridge 𝐼, (4)

4

Fig. 2. Internal architecture of AdaRare. Six runtime signals form action-induced telemetry 𝑥 𝑡 , while coverage novelty 𝐸 𝑡 , discovery-scarcity activity 𝐷 𝑡 , CmpLog progress 𝐶𝑡 , and throughput cost form profile-conditioned target 𝑟 𝑡 . The implementation’s disjoint linear scorer selects meta-arm 𝑎 𝑡+1 and resolves A1–A5 directly or A6 by delegation into effective profile 𝑒 𝑡+1 . 𝑏 𝑎 ← 𝛾𝑑 𝑏 𝑎 .

(5)

The implementation includes numerical guardrails. If matrix inversion fails, AdaRare falls back to a non-contextual UCBstyle ranking rule [9]. Exploration terms and final scores are bounded; matrix/vector values are rescaled if they grow too large; and finite-value checks prevent NaN or infinity propagation. These are implementation safeguards rather than independent mechanism claims.

Let 𝜌𝑡 ,𝑎 be the fraction of recorded window residence Í time assigned to selected meta-arm 𝑎, with 𝑎 𝜌𝑡 ,𝑎 = 1 in a complete window. Bookkeeping is normally one-hot. A recorded within-window transition is attributed through partial residence shares. These shares describe selected-meta-arm residence, not an effective-profile mixture. The selected-arm models are updated as follows: 𝐴 𝑎 ← 𝐴 𝑎 + 𝜌𝑡 ,𝑎 𝑥 𝑡 𝑥 𝑡⊤ ,

(6)

𝑏 𝑎 ← 𝑏 𝑎 + 𝜌𝑡 ,𝑎 𝑟 𝑡 𝑥 𝑡 .

(7)

C. Profile-Conditioned Controller Target and Scarcity Activity Discovery-scarcity-weighted activity. For execution 𝑖, let 𝑆𝑖 be the nonzero classified bitmap-byte slots.

For the normal full-window case, 𝜌𝑡 ,𝑎𝑡 = 1. If 𝑎 𝑡 = A6, A6 receives this ordinary selected-meta-arm update, while the delegated effective profile 𝑒 𝑡 receives the additional clipped update described below.

5

TABLE II Telemetry features used by AdaRare. Features are scaled, capped, and smoothed before use by the profile scorer. Here, 𝑄 𝑡 is the queue size, 𝐴𝑡 is the number of active non-skipped queue entries, and 𝐹𝑡 is the number of entries marked favored by AFL++ in window 𝑡. Dim.

Feature

Definition

Intuition

𝑥0

New coverage-bit rate

clip(log(1 + Δbits𝑡 /𝜏𝑡 ) · 𝑠0 , 0, 𝑋cap )

𝑥1

Scarcity-weighted activity rate

clip(log(1 + 𝐷 𝑡 ) · 𝑠1 , 0, 𝑋cap )

𝑥2

Execution throughput

clip(log(1 + 𝑁𝑡exec /𝜏𝑡 ) · 𝑠2 , 0, 𝑋cap )

𝑥3

Queue-relative density

clip(log(1+𝑄 𝑡 /max( 𝐴𝑡 , 1)) · 𝑠3 , 0, 𝑋cap )

𝑥4

Favored-seed ratio

clip((𝐹𝑡 /max(𝑄 𝑡 , 1)) · 𝑠4 , 0, 𝑋cap )

𝑥5

Timeout rate

clip(log(1 + 𝑁𝑡to /max(𝑁𝑡exec , 1)) · 𝑠5 , 0, 𝑋cap )

Measures recent bitmap novelty. This is an internal signal, distinct from final FuzzBench edge coverage. Measures path activity in slots with low historical virgin-bucket discovery counts; it is neither execution-frequency rarity nor a novelty count. Captures the efficiency of the current profile. Summarizes queue pressure relative to active entries. Measures the fraction of queue entries marked favored by AFL++. Captures instability or excessive execution cost.

TABLE III AdaRare profile arms. A1–A5 are base profiles; A6 delegates all five mechanism values to a top-𝑘 base profile. Havoc values are per-site factors. Arm Profile

dict (%) havoc/site

A1 A2

throughput-first havoc dictionary-heavy

A3

CmpLog synergy

A4

favored exploitation

A5 A6

queue exploration top-𝑘 portfolio

5 45

1.20 1.05

favored

new

0 0

1 0

energy mode

Scheduling bias

linear-soft, cap 2 logarithmic, cap 5 20 1.10 1 0 linear-medium, cap 3 12 1.18 1 0 thresholded, cap 3 8 0.95 -1 1 flat, cap 1 delegated delegated delegated delegated delegated

Let 𝐻𝑠 be the campaign-lifetime count of previously virgin buckets/bits discovered at slot 𝑠. The count 𝐻𝑠 changes only when a new bucket/bit is exposed; it is neither an execution-hit count nor a path frequency. The evaluated configuration uses the following path-length-normalized mass:

broad, throughput-oriented exploration token injection for structured inputs comparison and favored-entry emphasis concentrated favored-entry exploitation new and less-favored queue exploration stochastic delegation using routing statistics

Here, 𝑔𝑖 is the bounded execution-time gate defined below. Every nonempty execution can therefore contribute positive mass even without new coverage. Let 𝜏𝑡 denote the completed-window duration in seconds. The completed-window activity rate is Í 𝑀𝑖 𝐷 𝑡 = 𝑖 ∈𝑡 . (9) 𝜏𝑡

rarity. Window accumulation resets at each boundary; the 𝐻𝑠 table persists without decay. The same normalized per-execution observation also updates the current queue entry’s bounded scarcity score. At energy assignment, that score is decayed by 0.995, capped at 109 , normalized by a sampled P90, and mapped through the effective profile’s bounded energy mode from Table III. This fifth profile mechanism is distinct from the window-level controller target. No-scarcity-bundle (display label: No-scarcity; historical runtime label: No-rarity) disables the combined scarcity telemetry feature, controller-target term, signal-guard input, and energy-shaping bundle. For source and log correspondence, we retain the implementation notation 𝑟 𝑡 and the term “reward,” but interpret it as a profile-conditioned controller target rather than a shared cross-profile utility. Its three nonnegative inputs are

This rate is a discovery-scarcity-weighted activity signal, not novelty progress and not standard low-execution-frequency

𝐸𝑡 =

𝑀𝑖 = 𝑔𝑖

∑︁ 1 1 . √ max(|𝑆𝑖 |, 1) 𝑠∈𝑆 𝐻𝑠 + 1

(8)

𝑖

6

Δbits𝑡 , 𝜏𝑡

Í 𝐷𝑡 =

𝑖∈𝑡 𝑀𝑖

, 𝜏𝑡

𝐶𝑡 =

Δcmplog𝑡 . (10) 𝜏𝑡

TABLE IV Runtime semantics of the five profile-controlled mechanisms. They are AFL++-internal controls built on existing queue, mutation, dictionary, and power-scheduling mechanisms, not five pre-existing command-line knobs. Mechanism

Neutral/base behavior

Profile values

Exact runtime effect

Dictionary probability

100 permits each native dictionary attempt 1.0 leaves the current perf_score unchanged at each site

integer 0–100

0 accepts the alias-sampled entry 0 accepts the alias-sampled entry

−1, 0, 1

Accept the attempt when a uniform integer in [0, 99] is below the profile value; 0 disables the attempt. The same factor is applied at two sequential score-scaling sites. The first result is integer-converted; the second uses upward-rounded percentage arithmetic. Each site caps perf_score at 100×HAVOC_MAX_MULT = 6400. Prefer non-favored, neutral, or favored entries through at most eight rejection retries; alias weights are unchanged. When enabled, prefer entries with !was_fuzzed or zero fuzz level. If favored and new preferences are both active, both predicates must hold until the eight-retry cap, after which the current valid candidate is accepted. Normalize the queue entry’s discovery-scarcity score by a sampled P90 and multiply perf_score by the effective profile’s bounded boost; A6 inherits the delegated base mode.

Havoc factor

Favored preference New-seed preference

Scarcity-conditioned energy

native perf_score before AdaRare shaping

positive per-site factor

0, 1

arm-specific bounded mode

TABLE V Main AdaRare defaults. Values are fixed unless explicitly varied by a named control variant. Component

Evaluated default

Role

Window and telemetry

5,000 ms; telemetry EMA 0.30

Warmup and dwell

two pulls per arm; one-window dwell threshold with guarded bypasses 𝛼 = 0.6; ridge 10; discount 0.999

Coarse boundary control and smoothing outside the per-execution hot path. Limits cold start and immediate unguarded switching.

Linear profile scorer Running P90 scaling

1024-sample uniform reservoirs; post-warmup and 32 positive samples

Controller target and signal guard CmpLog A6

raw caps [ −0.25, 1.25]; model target [0, 1]; zero-signal term 0.015 minimum gain 0.25; clip 8.0; fallback scale 10 top-𝑘 = 2; temperature 1.20; pre-normalization floor fraction 0.05; sharing clip 2.0

Arm-local association, bounded exploration, conditioning, and recency weighting. Per-effective-profile engineering scales for coverage, scarcity activity, and CmpLog; a current positive observation is inserted before its window’s P90 is evaluated. Bounds the audit value and yields a zero, never a negative, model target when positive terms are absent. Bounded post-execution comparison-map advancement. Bounded stochastic delegation and additional executed-base credit.

𝐸 𝑡 measures coverage-bit novelty, 𝐷 𝑡 the scarcity-weighted activity above, and 𝐶𝑡 post-execution comparison-map progress. For the effective base profile 𝑒 𝑡 , separate size-1024 reservoirs maintain uniform samples of positive observations seen so far [10]. A positive current-window rate is inserted before P90 evaluation and can therefore affect the scale used for the same window. After warmup and 32 positive samples, the running P90 replaces fallback scales 50, 5, and 10 for 𝐸 𝑡 , 𝐷 𝑡 , and 𝐶𝑡 ; otherwise the fallbacks apply. The reservoirs are not rolling, decayed, or phase-local. Define

TABLE VI Raw controller-target preferences of the effective base profiles. Each row is normalized by its nonnegative sum before use.

𝜈𝑒 = tanh(𝐸 𝑡 /𝑆 𝑒,𝑒𝑡 ),

(11)

𝜈𝑠 = tanh(𝐷 𝑡 /𝑆 𝑠,𝑒𝑡 ),

(12)

𝜈𝑐 = tanh(𝐶𝑡 /𝑆 𝑐,𝑒𝑡 ).

(13)

Controller-target preference weights are indexed by 𝑒 𝑡 . If A6 delegates to A3, both scales and weights come from A3; the resulting target updates selected A6 and gives delegated A3 an additional clipped update. A6 uses no separate preference row. Table VI lists the five effective-profile rows.

These are per-effective-profile engineering scales, not crossprofile calibration factors.

7

Profile

𝜔𝑒

𝜔𝑠

𝜔𝑝

𝜔𝑐

A1 A2 A3 A4 A5

0.55 0.35 0.45 0.70 0.40

0.15 0.50 0.40 0.20 0.35

0.30 0.15 0.15 0.10 0.25

0.35 0.35 0.70 0.35 0.35

Algorithm 1 Window-boundary controller update and nextConsequently, an active window containing such an execution sig profile selection normally has 𝐷 𝑡 > 0 and hence 𝐼𝑡 = 1. The indicator therefore Require: completed window 𝑡 under selected meta-arm 𝑎 𝑡 and primarily distinguishes inactive or telemetry-empty windows; effective profile 𝑒 𝑡 it is not a coverage-progress or novelty gate. 1: Return unless monotonic wall time closes window 𝑡 Equation (18) defines the evaluated execution-time gate:   2: Freeze (𝑎 𝑡 , 𝑒 𝑡 ) and derive completed-window telemetry 1 𝑔𝑖 = clip , 𝑔min , 1 . (18) 3: Index edge, scarcity-activity, and CmpLog reservoirs by 𝑒 𝑡 1 + 𝜂𝑔 max(exec𝑖 /baseline𝑖 − 1, 0) 4: Insert the current positive rates by uniform reservoir Here, 𝜂𝑔 = 1 and 𝑔min = 0.05. The execution-time baseline is sampling 5: Then evaluate per-𝑒 𝑡 running P90 post-warmup after 32 initialized from the first measured execution and, before the corresponding gate evaluation, updated on later executions as positive samples; otherwise use fixed scales 𝐵𝑖 = 0.99𝐵𝑖−1 + 0.01 exec𝑖 ; the gate uses baseline𝑖 = 𝐵𝑖 . Let 6: Compute bounded controller-target components 𝑔 ¯ 𝑡 be the window mean and 7: Apply the observable-signal guard, headroom cap, and raw zero-signal term 𝑏 𝑡 = clip(0.02 log(1 + 𝑔¯ 𝑡 ), 0, 0.15) . (19) 8: Clip the audit value to [−0.25, 1.25] and model target 𝑟 𝑡 + With positive-target cap 𝑅max = 1.25, define the remaining to [0, 1] positive headroom 9: Discount all arm histories
+ 10: Build and EMA-smooth action-induced telemetry 𝑥 𝑡 ℎ𝑡 = max 𝑅max − (𝑟 𝑡+ − cost𝑡 ), 0 . (20) 11: Update selected-meta-arm models using residence shares The effective multiplicative bonus is 𝜌𝑡 ,𝑎 (
sig 12: if 𝑎 𝑡 = A6 then min 𝑏 𝑡 , ℎ𝑡 /𝑟 𝑡+ , 𝐼𝑡 = 1 and 𝑟 𝑡+ > 10−4 , eff (21) 𝑔 = 𝑡 13: Update A6 routing statistics 0, otherwise. 14: Give 𝑒 𝑡 the guarded clipped update 𝑤 𝑡 of Eq. (26) Under the evaluated defaults, 𝑔𝑖 ≤ 1 implies 𝑔¯ 𝑡 ≤ 1, so 15: end if 𝑏 𝑡 ≤ 0.02 log 2 ≈ 0.0139. Row normalization also bounds the 16: Rank eligible next meta-arms and apply warmup/revisit positive term by its largest profile-wise positive-weight share, fallbacks attained by A4: 𝑟 𝑡+ ≤ (0.70 + 0.20 + 0.35)/(0.70 + 0.20 + 0.10 + 17: Enforce dwell unless an implemented guard bypasses it 0.35) = 25/27 ≈ 0.9259. Since cost𝑡 ≥ 0, whenever 𝑟 𝑡+ > 0 18: Select 𝑎 𝑡+1 and, for A6, sample 𝑒 𝑡+1 from its top-𝑘 set we have ℎ𝑡 /𝑟 𝑡+ ≥ 0.35. Thus neither the configured 1.15 hard (𝑘 = 2 here) factor cap nor the positive-headroom cap is binding under the 19: Emit the completed-window audit record evaluated defaults; before subsequent raw/model clipping the 20: Save (𝑎 𝑡+1 , 𝑒 𝑡+1 ) and apply queue/mutation/energy controls multiplicative bonus is at most 1 + 0.02 log 2 ≈ 1.0139. The 21: Reset window accumulators raw audit value and model target are 𝑟 𝑡raw = 𝑟 𝑡+ (1 + 𝑔𝑡eff ) − cost𝑡 − (1 − 𝐼𝑡 )𝑃zs , sig

After row normalization, the positive controller-target term and throughput cost are 𝑟 𝑡+ = 𝜔˜ 𝑒 𝜈𝑒 + 𝜔˜ 𝑠 𝜈𝑠 + 𝜔˜ 𝑐 𝜈𝑐 ,

(14)

cost𝑡 = 𝜔˜ 𝑝 𝑃𝑡eff ,   thrpt𝑡 𝑃𝑡 = max 0, 1 − , thrptref

(15) thrptref > 0.

(22)

𝑟ˆ𝑡 = min(max(𝑟 𝑡raw , −0.25), 1.25),

(23)

𝑟 𝑡 = min(max(𝑟ˆ𝑡 , 0), 1),

(24)

with 𝑃zs = 0.015. When no positive signal is present, the raw value is negative but the model target is floored to zero. The zero-signal term therefore affects audit telemetry and guard state; it does not inject a negative linear-model target.

(16)

The implementation sets 𝑃𝑡 = 0 if the reference is nonpositive. D. Closed-Loop Signal Semantics The throughput reference uses asymmetric updates. Several AdaRare signals are action-induced. For example, The current-sample weight is 0.1 when throughput rises a dictionary-heavy profile can change comparison activity, a sig (and during warmup) and 0.001 when it falls. Let 𝐼𝑡 denote favored-seed profile can change queue composition, and a slow the presence of any configured positive observable signal: profile can affect both throughput telemetry and throughput new coverage, new coverage bits, positive scarcity activity, penalty. This is intentional: the controller observes completedor positive CmpLog progress. Because 𝐷 𝑡 may be positive window telemetry after executing an effective profile and then without novelty, this is deliberately a signal indicator, not a selects the next meta-arm and resolves its effective profile. It progress or novelty indicator. also means that internal scoring signals must not be interpreted The effective throughput cost is as external outcomes. ( sig AdaRare constrains this feedback loop in three ways. First, 0.10, 𝐼𝑡 = 1, 𝑃𝑡eff = 𝑃𝑡 (17) external evaluation uses repeated-trial FuzzBench edge coverage sig 1, 𝐼𝑡 = 0. rather than the internal controller target. Second, bounded Every execution with a nonempty classified bitmap has 𝑀𝑖 > 0. scaling, clipping, and finite-value checks constrain each term.

8

Third, window logs expose bounded target components and selected/effective profiles. Scarcity-weighted activity can itself create a positive auxiliary term without new coverage; we therefore do not describe the guard as proving progress or preventing all activity-only reward. The controlled campaigns, not the internal coefficients or controller target, support the external effectiveness claims.

target. The inverse-probability form is only a heuristic credit multiplier for unequal delegation probabilities; clipping bounds individual-sample influence. Neither the unclipped nor clipped form is interpreted as an unbiased off-policy estimator. We therefore call the mechanism clipped delegated-sample sharing rather than a full off-policy estimator.

F. Integration and Observability E. CmpLog Progress and the A6 Portfolio Arm AdaRare is a local AFL++ extension. It receives coverage, AdaRare uses CmpLog as a post-execution progress signal. discovery-scarcity activity, execution, timeout, slow-execution, It does not predict which comparisons will be useful before and CmpLog events, and writes profile parameters for dictionary mutation. The real CmpLog child execution first fills cmp_map. probability, havoc intensity, favored/new-entry preference, and AdaRare then examines observed comparison behavior and scarcity-conditioned energy shaping. Default profiles do not accumulates progress only when a comparison site improves alter trimming. The prototype is based on AFL++ 4.35c. It exports over the best state seen in the current runtime tracker. This signal is derived solely from comparison-map advancement. .adarare_bandit.csv, .adarare_overhead.csv, Queue growth and ordinary coverage discovery are recorded .adarare_config.json, and optional verify/debug logs. The bandit CSV records source-named context and reward comseparately and are not counted as CmpLog progress. For instruction comparisons, AdaRare records reductions ponents, scaling values, selected arms, delegated A6 probabiliin best integer absolute distance when the width is at most ties, throughput penalties, zero-signal state, and numerical falleight bytes and the comparison is not floating-point. It also back counters. The overhead sidecar records window-boundary records improvements in equal-byte matches over up to 32 timing fields, including telemetry construction, controllerbytes. For comparison-function entries, it records equal-byte target computation, profile scoring, model update, profile improvements over up to 32 bytes. The raw comparison progress application, audit-log emission, campaign-level execution rate, and selected/effective arm identifiers. The JSON file records is compressed as static controller configuration when archived. These outputs log(1 + Δdist𝑡 ) + 0.5 log(1 + Δmatch𝑡 ), (25) are not used for decision-making, but they are necessary for then filtered by a minimum-gain threshold and capped. This sig- reproducibility, ablation analysis, controller-activation checks, nal complements new coverage by adding controller-target mass boundary-latency measurement, and failure diagnosis. when inputs move closer to satisfying structured comparisons VI. Evaluation before they unlock new edges. We ask five controlled-evaluation questions: RQ1 what A6 is designed to reduce dependence on any single base broad integrated-system coverage evidence Main provides; RQ2 profile as campaign conditions change. When A6 is selected, whether that separation persists across repeated trials and time; AdaRare builds a top-𝑘 set of base arms using discounted mean RQ3 how dynamic telemetry-guided selection compares with controller targets as routing statistics; the default is 𝑘 = 2. It simple schedules within the fixed A1–A5 action space; RQ4 samples from that set by softmax, applies a pre-normalization whether the integrated result survives a matched CmpLog floor, and renormalizes before delegation. The delegated arm substrate and what the mechanism diagnostics establish; and supplies the effective profile applied to AFL++ during that RQ5 how large the controller-boundary latency is, with endwindow. to-end execution rates reported only as context. We separately Both normalization reservoirs and controller-target preference report an unmatched real-world deployment case study. weights are indexed by the delegated effective profile 𝑒 𝑡 . The resulting target is then used for A6’s ordinary selected-meta- A. Datasets, Provenance, and Statistics arm update. Let 𝑗 = 𝑒 𝑡 denote the delegated base arm. It Table VII separates three sequential evaluation phases. We receives an additional clipped delegated-sample update: first ran the eight-target Main study, then added the 500  campaign Batch A profile-control follow-up, and finally the 1 𝑤 𝑡 = min , 𝑤 , (26) 300-campaign Batch B fairness/mechanism follow-up. The max max(𝜋𝑡 ( 𝑗), 10−6 ) integrated Full controller semantics and A1–A6 profiles were where 𝜋𝑡 ( 𝑗) is the renormalized delegation probability, the unchanged; intervening commits added experimental control denominator guard is 10−6 , and 𝑤 max = 2.0. The delegated modes, FuzzBench/environment wiring, and packaging. Each arm then receives controlled batch fixed one revision across its compared variants. ⊤ We nevertheless analyze every phase independently and never 𝐴 𝑗 ← 𝐴 𝑗 + 𝑤 𝑡 𝑥𝑡 𝑥𝑡 , (27) pool absolute edge counts across batches. 𝑏 𝑗 ← 𝑏 𝑗 + 𝑤 𝑡 𝑟𝑡 𝑥𝑡 . (28) The Main export contains 800 campaigns. The aligned sevenfuzzer analysis uses 560 campaigns. The other 240 form three This rule is narrower than a general importance-sampling complete 80-campaign legacy matrices (No-Cmp, No-Context, estimator. It credits only the base profile that actually controlled and No-IPS). the window; unexecuted profiles receive no synthetic controller

9

TABLE VII Final experimental phases. All exports contain ten trials per cell and complete 900-second snapshots through 86,400 seconds; “Primary endpoint” identifies the endpoint used for each phase’s inferential families. Phase

Targets

Variants used

Campaigns used

Duration

Main A B

8 5 5

7 10 6

560 500 300

24 h 24 h 24 h

Primary endpoint

Purpose

86,400 s 85,500 s 85,500 s

broad integrated-system evidence scheduling-policy diagnostics and A6 strongest matched evidence and mechanism diagnostics

We exclude complete cells rather than individual trials be- copied across all six variants for each target. CmpLog-matched cause those historical variants lack the same-commit attribution enables the same -c substrate while disabling the controller. controls used in the follow-ups. Shadow performs telemetry and controller-target construction, The five-target controlled subset was selected after Main. model updates, candidate selection, and logging but suppresses Its original selection rationale was not preserved in a pre- profile application. No-A6 keeps active telemetry-guided A1– outcome protocol, so Batches A and B are controlled follow-up A5 control and disables only the A6 portfolio. No-scarcityevidence rather than an outcome-blind replication. The subset bundle (displayed as No-scarcity; historical runtime label: contains three Main-significant targets (curl, lcms, and No-rarity) is based on No-A6 and disables the scarcity openh264) and two Main-nonsignificant targets (proj4 and telemetry feature, controller-target contribution, signal-guard sqlite3); this does not remove selection-bias risk. It spans contribution, and scarcity-conditioned energy adjustments network/structured parsing, color processing, media decoding, while retaining coverage, CmpLog, throughput, model update, selection, and profile application. These variant semantics geospatial processing, and database processing. The Main study uses the complete 86,400-second endpoint. are author-confirmed from the frozen experiment definitions Batches A and B retain the 85,500-second inferential and smoke/runtime checks; Appendix G records the retained endpoint recorded in the preserved analysis protocol; their evidence and missing run linkage. complete 86,400-second observations are sensitivity analyses B. RQ1: Broad Integrated-System Coverage in Appendix A. We do not claim that 85,500 seconds is At 86,400 seconds, the integrated AdaRare configuration has intrinsically preferable to a full day. Directions and withina higher median than vanilla AFL++ on all eight targets; five family Holm-significance counts are unchanged. Secondary are Holm-significant. Gains range from 1.54% on freetype2 views use 6 hours, 12 hours, and normalized area under the to 48.01% on lcms. The three nonsignificant targets are coverage curve through the corresponding primary endpoint. freetype2, proj4, and sqlite3; we report them as Tests use SciPy 1.17.0 two-sided Mann–Whitney U with positive but inconclusive. Because Main is not CmpLogmethod=auto; at 10-versus-10, this is the asymptotic branch. matched, it is broad integrated-system evidence rather than Tie and default continuity corrections are applied. Holm scheduler-only attribution. correction is applied within each estimand-defined family; Heterogeneous scheduler results are provided in Appendix D unless stated otherwise, significance means Holm-adjusted as context and are not used for a superiority claim. The strongest 𝑝 < 0.05 in the specified family. We interpret MWU as a controlled claim is the matched Full/CmpLog comparison in rank/distribution comparison; median gains are descriptive RQ4; Main provides broader integrated-system context, and the rather than the tested null [14], [15]. We report Cliff’s 𝛿 for prepared artifact package retains the full seven-scheduler time the primary AdaRare/AFL++ comparison. series, final-trial distributions, and per-comparison statistics. The prepared artifact package retains Vargha–Delaney 𝐴ˆ 12 for the other comparisons. Deterministic 10,000-resample C. RQ2: Repeated-Trial Stability independent percentile bootstrap intervals are descriptive only. Figure 3 shows that the separation is not confined to the Appendix C also applies one conservative Holm correction to final snapshot: the AdaRare median and IQR usually separate all 45 Batch A or 35 Batch B contrasts. All ten trials in every progressively from AFL++. Table VIII also shows compact analyzed cell are retained; none is deleted or imputed. IQRs on bloaty, curl, openh264, and systemd. lcms The Main phase used a rented cloud allocation reported as combines the largest median gain with a wider IQR than 128 CPUs/vCPUs, 256 GB RAM, and 2 TB storage; its CPU AFL++, so we describe it as a high-gain, higher-variance case. model was not retained. Batches A and B used a rented alloca- Stability is not equated with low variance alone; a consistently tion reported as AMD EPYC 9754, 96 CPUs/vCPUs, 120 GB low-coverage scheduler can be stable but ineffective. RAM, and 1.12 TB storage. These are author-retained allocation records rather than machine-verified topology. OS/kernel, D. RQ3: Diagnostic Profile-Selection Controls (Batch A) pinning, and per-campaign worker-allocation metadata were Batch A fixes A1–A5 and disables A6 in the controller not preserved. controls. No-A6 retains the six-dimensional dynamic telemetry Within Batch B, one canonical builder produced the target, vector. CmpLog binary, dictionaries, and effective time-zero corpus

10

Fig. 3. Median edge coverage over 24 hours for the Main-phase integrated AdaRare/AFL++ comparison; bands show the interquartile range across ten trials. Color, line style, and marker shape redundantly encode each system for grayscale readability. TABLE VIII Integrated AdaRare versus vanilla AFL++ at 86,400 seconds in the aligned 560-campaign, seven-scheduler subset of the 800-campaign Main export. Each cell reports median edge coverage with IQR width in brackets over ten trials. 𝑝 𝐻 is Holm-adjusted across eight targets; 𝛿 is Cliff’s delta. Target

AdaRare

AFL++

Gain

𝑝𝐻

bloaty 6531.5 [52.5] 6367 [76] +2.58% 0.0013 curl 11567 [137.5] 11208 [118.2] +3.20% 0.0023 freetype2 11729.5 [877.5] 11552 [396.8] +1.54% 0.6232 lcms 2347.5 [472] 1586 [396.8] +48.01% 0.0016 openh264 9828 [23.2] 9460.5 [89.8] +3.88% 0.0013 proj4 7896.5 [226.8] 7612 [331.5] +3.74% 0.3637 sqlite3 19398 [1351.5] 18472 [958.2] +5.01% 0.3637 systemd 246 [1.8] 239 [2.2] +2.93% 9.5e-04

TABLE IX Batch A profile-control results at the frozen 85,500-second inferential endpoint. The first three rows are corrected jointly within the 15-test controller family; Full versus No-A6 uses the separate five-test A6 family.

𝛿 Result 1.00 0.92 0.14 0.96 1.00 0.42 0.42 1.00

sig. sig. n.s. sig. sig. n.s. n.s. sig.

They use random choice or cyclic selection over A1–A5, respectively; the five Static variants hold one base profile for the campaign. All controls retain the five-second cadence, runtime telemetry, controller-target construction, model bookkeeping, common A1– A5 definitions, and profile application; each Static arm also retains its profile-specific scarcity-conditioned energy mode. Comparison Higher Holm sig. Gain range At 85,500 seconds, No-A6 has a higher median than ConstantNo-A6 vs Constant 5/5 4/5 4.84–8.73% No-A6 vs Random 5/5 5/5 10.34–15.54% context, Random, and Round-robin on every target. HolmNo-A6 vs Round-robin 5/5 4/5 3.70–14.17% significant counts are 4/5, 5/5, and 4/5, respectively. Full vs No-A6 5/5 2/5 1.37–4.56% Together, 13/15 comparisons are Holm-significant in the joint controller family. Against all five static arms, No-A6 has a higher median in Constant-context replaces dynamic telemetry with the fixed 24/25 target–arm comparisons, with 21/25 Holm-significant vector (1, 0, 0, 0, 0, 0) for both model updates and next-profile comparisons. When the highest-median static arm is selected scoring. It otherwise preserves the arm-local linear models, separately for each target, its median is lower than No-A6 on controller-target and parameter updates, fitted-association and 4/5 targets; the exception is lcms with Static A2. Full has exploration terms, candidate selection, and A1–A5 profile a higher median than No-A6 on all five targets, but the A6 application. Random and Round-robin replace the telemetryincrement is Holm-significant on two. guided guarded scorer.

11

Within the fixed A1–A5 action space, all 15 fixed-context, random, and round-robin target–control comparisons have higher medians under dynamic telemetry-guided selection, and 13 are Holm-significant. Most fixed-profile comparisons also favor dynamic selection. These are diagnostic results within the implemented action space, not evidence of superiority over alternative adaptive algorithms. A6 remains target-dependent in this batch. E. RQ4: Strongest Matched Evidence and Mechanism Diagnostics (Batch B)

from -27.99% to +44.83% because they combine CmpLog, policy-induced paths, dictionary activity, queue decisions, energy shaping, and logging; fixed wall-clock coverage remains the relevant effectiveness metric. G. Unmatched Real-World Deployment Case Study Beyond FuzzBench, an unmatched embedded-firmware deployment produced AdaRare-generated inputs that exposed five distinct memory-corruption findings. Each was reproduced in a separate environment and later assigned a CVE identifier. Identifying details are omitted from this public preprint because they remain disclosure-sensitive. The cases provide evidence of practical applicability, but the deployment was not a matched vulnerability-yield experiment against AFL++ or another fuzzer.

Full has a higher median than default AFL++ on four targets, each Holm-significant; sqlite3 is near-equal and non-significant. This is the paper’s strongest matched system-level result: VII. Discussion and Limitations Full has higher median edge coverage than CmpLog-matched AFL++ on all five targets, with four Holm-significant com- Claim–evidence boundary. Full AdaRare has higher median parisons and median gains from 0.54% to 25.56%. Within edge coverage than a CmpLog-matched AFL++ substrate on Batch B’s matched substrate, supplying -c and incurring all five controlled follow-up targets, with four Holm-significant the CmpLog execution cost alone does not reproduce Full comparisons; this is the strongest controlled claim. Main is broader integrated-system evidence, and Batch A is diagnostic AdaRare’s coverage result. The remaining mechanism results are more nuanced. No-A6 evidence for telemetry-guided selection within A1–A5. Batch has a higher median than Shadow on four targets, but none of B does not establish independent No-A6-versus-Shadow or the five rows for this pair is significant after Holm correction scarcity-bundle effects; A6 evidence is target-dependent and within the 15-test system-fairness family. Shadow and CmpLog- weaker under global correction. We claim neither calibrated matched are also close: only two targets have a higher Shadow action values, superiority over unexecuted adaptive systems, median and none is significant. We therefore do not claim that nor comparative vulnerability yield. Phases are analyzed separately; absolute edge levels are not controller computation alone helps, or that applying A1–A5 compared across them. The five-target follow-up was chosen without A6 has an independently significant effect in Batch B. after Main without a preserved pre-outcome rationale, so it is No-A6 has a higher median than No-scarcity on only three not outcome-blind and remains subject to selection bias despite targets, and none of the five comparisons is significant. This including three Main-significant and two Main-nonsignificant does not establish an independent scarcity-bundle effect; the targets. Main uses 86,400 seconds; Batches A/B retain the bundle may interact with A6 or campaign phase, and the matrix protocol-recorded 85,500-second endpoint, with 86,400-second lacks an A6-enabled/no-scarcity cell. sensitivity. The present five-target experiment does not isolate a stable The implementation borrows disjoint LinUCB algebra, but independent coverage contribution from the combined scarcity action-induced telemetry and profile-conditioned targets make telemetry feature, controller-target term, signal guard, and the scorer an arm-local ranking mechanism, not a calibrated energy shaping. Those four subcomponents remain unresolved. contextual-bandit estimator. The mixed-domain normalizer, In contrast, Full has a higher median than No-A6 on all five dormant escalation checks, unused legacy telemetry, and targets, with three Holm-significant comparisons and median nonbinding caps specify the evaluated implementation; none gains of 0.31–10.82%. Batch B therefore provides the clearest, is an independently validated mechanism. but target-dependent, incremental evidence for A6 in this Evidence levels differ: the packaged subset does not identify incomplete factorial matrix. every historical runtime image; some variant semantics and Figure 4 shows the key estimand-defined contrasts. override absences are author-confirmed, while run-linked F. RQ5: Controller-Boundary Latency and End-to-End Rate wrappers, exact environments, and complete hardware records are missing (Appendix G). Parameters are fixed engineering Context Controller-compute medians are 317–824 𝜇s; run-level choices without a complete retained pre-Main sensitivity record compute P99 medians are 740–6491 𝜇s, at most about 0.13% of and are not claimed optimal. With ten trials per cell, nonsignificance is not equivalence. a 5,000 ms window. Per-target run-level quantiles and campaignCoverage is not a bug oracle. The unmatched firmware case rate summaries are retained in the prepared artifact package. study produced five separately reproduced, CVE-assigned Complete-boundary P99 medians, including synchronous findings but was not matched against other fuzzers, so neither logging, are below 14.7 ms, or 0.30% of the window; auditstudy estimates comparative vulnerability yield. log-write P99 medians are below 13.9 ms. These measurements characterize only the five-second boundary path, not total AdaRare overhead. Retained campaign-rate summaries vary

12

TABLE X Batch B estimand-defined comparison families at the frozen 85,500-second inferential endpoint. “Higher” counts targets with a higher treatment median; Holm correction is applied separately within the system-fairness (15 tests), substrate-diagnostic (10), scarcity-bundle (5), and A6 (5) families. Family

Comparison

Higher Holm sig. Median-gain range

system fairness system fairness system fairness substrate diagnostics substrate diagnostics scarcity bundle A6

Full vs AFL++ default Full vs CmpLog-matched No-A6 vs Shadow CmpLog-matched vs Default Shadow vs CmpLog-matched No-A6 vs No-scarcity Full vs No-A6

4/5 5/5 4/5 4/5 2/5 3/5 5/5

4/5 4/5 0/5 2/5 0/5 0/5 3/5

-0.07–+43.41% +0.54–+25.56% -0.40–+19.79% -0.60–+30.76% -2.72–+0.63% -0.24–+17.59% +0.31–+10.82%

Fig. 4. Selected Batch B contrasts at 85,500 seconds. Points show relative median gain and horizontal bars show deterministic 95% bootstrap confidence intervals. Filled markers indicate Holm-adjusted significance within the estimand-defined family; open markers are not significant. Intervals are independent percentile bootstrap summaries and are descriptive. Panel axes use separate scales to preserve small effects. The remaining open limitations are direct contemporary adaptive baselines, a complete A6-by-scarcity factorial design, broader predeclared targets, later AFL++ versions, and groundtruth bug benchmarks.

findings, supporting practical applicability but not comparative yield.

VIII. Conclusion

OpenAI GPT-5.6 Thinking and GPT-5.6 Pro assisted with manuscript organization, language revision, the anonymized description of the real-world findings, and portions of the Python analysis/plotting code. The authors specified and independently verified all technical content, supplied the method, implementation, experimental design, and raw data, executed all experiments, and accept responsibility for the manuscript. No generative tool produced experimental observations, benchmark binaries, vulnerability evidence, or runtime evidence.

AdaRare provides telemetry-guided joint closed-loop control of five AFL++ surfaces. Full has higher median edge coverage than a CmpLog-matched substrate on all five follow-up targets; Main supplies broader integrated evidence and Batch A diagnostic evidence over simple schedules. Independent scarcitybundle and No-A6-versus-Shadow effects are unestablished, and A6 evidence is target-dependent. An unmatched firmware deployment yielded five responsibly disclosed, CVE-assigned

13

IX. Generative AI Use Disclosure

X. Ethics Considerations The benchmark and firmware tests ran in isolated, locally controlled environments; no production service was targeted. For the real-world findings, we minimized and deduplicated triggering inputs, reproduced each behavior in a separate environment, inspected sanitizer output and stack traces, and used coordinated disclosure channels before public release. All five findings later received CVE identifiers. Identifiers, vendor/product details, endpoints, function names, advisory links, proof-of-concept inputs, and exploit steps are omitted from this public preprint because they remain disclosuresensitive. The prepared artifact package excludes credentials, private server locations, raw crash inputs, and disclosuresensitive materials. References [1] A. Fioraldi, D. Maier, H. Eißfeldt, and M. Heuse. AFL++: Combining Incremental Steps of Fuzzing Research. In 14th USENIX Workshop on Offensive Technologies (WOOT), 2020. [2] V. J. M. Manès, H. Han, C. Han, S. K. Cha, M. Egele, E. J. Schwartz, and M. Woo. The Art, Science, and Engineering of Fuzzing: A Survey. IEEE Transactions on Software Engineering, 47(11):2312–2331, 2021. [3] M. Böhme, V.-T. Pham, and A. Roychoudhury. Coverage-based Greybox Fuzzing as Markov Chain. In Proceedings of the 23rd ACM SIGSAC Conference on Computer and Communications Security (CCS), 2016. [4] M. Böhme, V. J. M. Manès, and S. K. Cha. Boosting Fuzzer Efficiency: An Information Theoretic Perspective. In Proceedings of the 28th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE), 2020. [5] T. Yue, P. Wang, Y. Tang, E. Wang, B. Yu, K. Lu, and X. Zhou. EcoFuzz: Adaptive Energy-Saving Greybox Fuzzing as a Variant of the Adversarial Multi-Armed Bandit. In 29th USENIX Security Symposium, 2020. [6] C. Lyu, S. Ji, C. Zhang, Y. Li, W.-H. Lee, Y. Song, and R. Beyah. MOpt: Optimized Mutation Scheduling for Fuzzers. In 28th USENIX Security Symposium, 2019. [7] S. Luo, A. Herrera, P. Quirk, M. Chase, D. C. Ranasinghe, and S. S. Kanhere. Make out like a (Multi-Armed) Bandit: Improving the Odds of Fuzzer Seed Scheduling with T-Scheduler. In Proceedings of the 19th ACM Asia Conference on Computer and Communications Security (AsiaCCS), 2024. [8] L. Li, W. Chu, J. Langford, and R. E. Schapire. A Contextual-Bandit Approach to Personalized News Article Recommendation. In Proceedings of the 19th International Conference on World Wide Web (WWW), 2010. [9] P. Auer, N. Cesa-Bianchi, and P. Fischer. Finite-time Analysis of the Multiarmed Bandit Problem. Machine Learning, 47:235–256, 2002. [10] J. S. Vitter. Random Sampling with a Reservoir. ACM Transactions on Mathematical Software, 11(1):37–57, 1985. [11] A. Garivier and E. Moulines. On Upper-Confidence Bound Policies for Switching Bandit Problems. In Algorithmic Learning Theory (ALT), 2011. [12] F. Trovò, S. Paladino, M. Restelli, and N. Gatti. Sliding-Window Thompson Sampling for Non-Stationary Settings. Journal of Artificial Intelligence Research, 68:311–364, 2020. [13] J. Metzman, L. Szekeres, L. Simon, R. Sprabery, and A. Arya. FuzzBench: An Open Fuzzer Benchmarking Platform and Service. In Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE), 2021. [14] G. Klees, A. Ruef, B. Cooper, S. Wei, and M. Hicks. Evaluating Fuzz Testing. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 2123–2138, 2018. [15] M. Schloegel, N. Bars, N. Schiller, L. Bernhard, T. Scharnowski, A. Crump, A. Ale-Ebrahim, N. Bissantz, M. Muench, and T. Holz. SoK: Prudent Evaluation Practices for Fuzzing. In 2024 IEEE Symposium on Security and Privacy (SP), pages 1974–1993, 2024. [16] M. Böhme, C. Cadar, and A. Roychoudhury. Fuzzing: Challenges and Reflections. IEEE Software, 38(3):79–86, 2021.

14

[17] K. Böttinger, P. Godefroid, and R. Singh. Deep Reinforcement Fuzzing. In 2018 IEEE Security and Privacy Workshops (SPW), pages 116–122, 2018. [18] M. Wang, J. Liang, C. Zhou, Z. Wu, J. Fu, Z. Su, Q. Liao, B. Gu, B. Wu, and Y. Jiang. Data Coverage for Guided Fuzzing. In 33rd USENIX Security Symposium, 2024. [19] K. Zhang, X. Zhu, X. Xiao, M. Xue, C. Zhang, and S. Wen. ShapFuzz: Efficient Fuzzing via Shapley-Guided Byte Selection. In Network and Distributed System Security Symposium (NDSS), 2024. [20] H. Rong, W. You, X. Wang, and T. Mao. Toward Unbiased MultipleTarget Fuzzing with Path Diversity. In 33rd USENIX Security Symposium, 2024. [21] P. Borrello, A. Fioraldi, D. C. D’Elia, D. Balzarotti, L. Querzoni, and C. Giuffrida. Predictive Context-sensitive Fuzzing. In Network and Distributed System Security Symposium (NDSS), 2024. [22] G. Zhang, P. Wang, T. Yue, X. Kong, S. Huang, X. Zhou, and K. Lu. MobFuzz: Adaptive Multi-objective Optimization in Gray-box Fuzzing. In Network and Distributed System Security Symposium (NDSS), 2022. [23] D. Wang, Z. Zhang, H. Zhang, Z. Qian, S. V. Krishnamurthy, and N. AbuGhazaleh. SyzVegas: Beating Kernel Fuzzing Odds with Reinforcement Learning. In 30th USENIX Security Symposium, pages 2741–2758, 2021. [24] M. Lee, S. Cha, and H. Oh. Learning Seed-Adaptive Mutation Strategies for Greybox Fuzzing. In 45th IEEE/ACM International Conference on Software Engineering (ICSE), 2023. [25] P. Jauernig, D. Jakobovic, S. Picek, E. Stapf, and A.-R. Sadeghi. DARWIN: Survival of the Fittest Fuzzing Mutators. In Network and Distributed System Security Symposium (NDSS), 2023. [26] Y. Koike, H. Katsura, H. Yakura, and Y. Kurogome. SLOPT: Bandit Optimization Framework for Mutation-Based Fuzzing. In 38th Annual Computer Security Applications Conference (ACSAC), pages 519–533, 2022. [27] K. Kitsios, M. Böhme, and A. Bacchelli. On Interaction Effects in Greybox Fuzzing. In 48th IEEE/ACM International Conference on Software Engineering (ICSE), 2026. [28] D. She, A. Storek, Y. Xie, S. Kweon, P. Srivastava, and S. Jana. FOX: Coverage-guided Fuzzing as Online Stochastic Control. In Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 765–779, 2024. [29] Y.-F. Fu, J. Lee, and T. Kim. autofz: Automated Fuzzer Composition at Runtime. In 32nd USENIX Security Symposium, pages 1901–1918, 2023. [30] D. Yu, Y. Wang, C. Zhang, Y. Lan, Z. Jiang, S. Gan, Z. Ma, and W. Tan. xFUZZ: A Flexible Framework for Fine-Grained, Runtime-Adaptive Fuzzing Strategy Composition. Proceedings of the ACM on Software Engineering, 2(ISSTA):69–91, 2025. [31] A. Zhou, H. Huang, and C. Zhang. KRAKEN: Program-Adaptive Parallel Fuzzing. Proceedings of the ACM on Software Engineering, 2(ISSTA):274–296, 2025. [32] R. Dong, Y. Wang, K. Zhang, D. Yu, X. Zhu, S. Wang, S. Wang, C. Zhang, S. Wen, and Y. Xiang. TrioFuzz: A Three-Tier Architecture for Adaptive Strategy Selection in Fuzzing. In 35th USENIX Security Symposium, 2026.

Appendix A Endpoint Sensitivity

All three exports contain the complete 86,400-second row for every campaign. Main uses 86,400 seconds as its primary endpoint. Batches A and B retain 85,500 seconds as their frozen inferential endpoint; their complete 86,400-second observations are reported only as a sensitivity analysis. Directions and withinfamily Holm-significance counts are unchanged.

TABLE XI Endpoint sensitivity. Entries are “higher-median tests / Holm-significant tests.” Main uses 86,400 seconds as its primary endpoint; Batches A and B use 85,500 seconds as their frozen primary endpoint, with the other column serving as the endpoint sensitivity. Comparison family

85,500 s

86,400 s

Main: AdaRare vs AFL++ 8/8, 5/8 8/8, 5/8 Batch A: controller 15/15, 13/15 15/15, 13/15 Batch A: A6 5/5, 2/5 5/5, 2/5 Batch B: system fairness 13/15, 8/15 13/15, 8/15 Batch B: substrate diagnostics 6/10, 2/10 6/10, 2/10 Batch B: scarcity bundle 3/5, 0/5 3/5, 0/5 Batch B: A6 5/5, 3/5 5/5, 3/5

Appendix B Secondary Time-Scale Checks The 6-hour, 12-hour, and normalized-AUC views support the same cautious interpretation. Main and Batch A profileselection directions are already broad early in the run. Batch B continues to support Full against the matched controls and A6, while scarcity-bundle removal remains non-significant at every reported scale.

15

TABLE XII Secondary time-scale checks. Entries are “higher-median tests / Holm-significant tests.” AUC is the trapezoidal area under edge coverage divided by the corresponding primary time budget (86,400 seconds for Main and 85,500 seconds for Batches A and B). Comparison family

6h

12 h

Main: AdaRare vs AFL++ 8/8, 4/8 7/8, 4/8 Batch A: controller 15/15, 12/15 15/15, 12/15 Batch A: A6 5/5, 1/5 4/5, 2/5 Batch B: system fairness 12/15, 8/15 14/15, 8/15 Batch B: substrate 5/10, 2/10 4/10, 3/10 Batch B: scarcity bundle 3/5, 0/5 3/5, 0/5 Batch B: A6 5/5, 4/5 5/5, 4/5

Appendix C Multiplicity Sensitivity The primary families are defined by estimand: Batch A has 15 controller, 25 static-profile, and five A6 contrasts; Batch B has 15 system-fairness, ten substrate-diagnostic, five scarcity-bundle, and five A6 contrasts. A global sensitivity deliberately treats all contrasts in a batch as one family. At 85,500 seconds, four Batch A contrasts lose significance under global correction because their adjusted 𝑝-values rise above 0.05: proj4 No-A6 vs Constant, lcms No-A6 vs Random, lcms No-A6 vs Static A4, and curl Full vs No-A6. In Batch B, the adjusted 𝑝-value for proj4 Full vs No-A6 likewise rises above 0.05. Complete raw, estimand-defined-Holm, and global-Holm values are retained in the prepared artifact package under generated/. TABLE XIII Multiplicity sensitivity at the controlled-batch primary endpoint of 85,500 seconds. Estimand-defined Holm families are reported; “Global” applies one correction to all 45 Batch A or 35 Batch B contrasts. Contrast group

Estimand-defined Global

Batch A controller Batch A static Batch A A6 Batch B fairness Batch B substrate Batch B scarcity bundle Batch B A6

13/15 21/25 2/5 8/15 2/10 0/5 3/5

11/15 20/25 1/5 8/15 2/10 0/5 2/5

Batch A total Batch B total

36/45 13/35

32/45 12/35

Appendix D Heterogeneous Scheduler Context The six additional implementations provide heterogeneous scheduler context rather than a controlled SOTA ranking. Their per-target medians are reported below; full time series and pairwise statistics are retained in the prepared artifact package and are not used for a superiority claim.

16

Primary endpoint Normalized AUC 8/8, 5/8 15/15, 13/15 5/5, 2/5 13/15, 8/15 6/10, 2/10 3/5, 0/5 5/5, 3/5

8/8, 5/8 15/15, 12/15 5/5, 2/5 13/15, 8/15 6/10, 3/10 4/5, 0/5 5/5, 4/5

TABLE XIV Median edge coverage at 86,400 seconds for the aligned seven-fuzzer main evaluation (ten trials per cell). Bold marks the highest median per target. These heterogeneous implementations provide scheduler context; only AdaRare versus AFL++ is treated as the primary integrated comparison. Target

AdaRare AFL++ AFLFast EcoFuzz Entropic MOpt T-Sched.

bloaty 6531.5 6367 curl 11567 11208 freetype2 11729.5 11552 lcms 2347.5 1586 openh264 9828 9460.5 proj4 7896.5 7612 sqlite3 19398 18472 systemd 246 239

5976.5 5757.5 5939 6124 4962.5 9188.5 8973 8731 9596.5 10240 7878 8148 10364.5 7985 11607.5 559.5 946 2058.5 847 2057 9556 9322 9559.5 9536.5 9575.5 734 774.5 7993 768.5 6424.5 18816 13084.5 17472 18969 19430.5 220 213.5 174 220 234.5

Appendix E Batch B Cell Medians and Average Ranks At 85,500 seconds the descriptive average ranks are Full 1.4, No-A6 3.0, No-scarcity 3.8, CmpLog-matched 3.8, Shadow 3.9, and default AFL++ 5.1. Ranks are computed within target and averaged only descriptively; absolute edge counts are never pooled across targets.

17

TABLE XV Batch B matched-control medians at 85,500 seconds (ten trials per cell). Bold marks the highest median per target. All variants share byte-identical target, CmpLog, dictionary, and effective initial-corpus artifacts within each target. Target

Full

No-A6 No-scarcity CmpLog-matched Shadow AFL++

curl 12557.5 11331 lcms 2031.5 1885.5 openh264 9730 9557.5 proj4 7755.5 7195.5 sqlite3 20234 20170.5

11300.5 1603.5 9563 7172.5 20219

Appendix F Evaluated Controller Configuration FORMAL-R1 denotes the frozen formal controller configuration that specifies the evaluated defaults. RELEASE-R1 is the internal label for the packaged 15-file method-relevant source subset; it does not denote a public release. Neither label establishes byte identity with every historical runtime image. The Full campaigns used the defaults specified by FORMAL-R1. Apart from AdaRare activation, explicit variant switches, telemetry/audit controls, CmpLog activation, and ordinary FuzzBench launch settings, the protocol did not override profile definitions, telemetry scales, controller-target parameters, the signal guard, P90 estimators, energy shaping, linear-scorer constants, or A6 constants. The profiles were not retuned after Main and no per-target parameterization was used. This is author-confirmed protocol evidence; the sourcedefault structure is independently specified, but run-linked exact_env.tsv files were not retained. The queue-entry energy normalizer is separate from the per-effective-profile controller-target rate reservoirs. One global size-1024 auxiliary score reservoir receives queue-entry scarcity scores during energy assignment and one raw audit-target observation per completed window (named reward in the source/logs). It uses uniform reservoir sampling, requires 32 observations for a valid empirical P90, falls back to 1.0 otherwise, and resets every 256 windows. Thus the energy denominator mixes two internal score domains and is not interpreted as a calibrated queue-scarcity quantile. Selection guards use controller-target and log(1 + edge-rate) EMAs with coefficient 0.20 and slope EMAs with coefficient 0.25. After at least eight selections, both absolute slopes below 0.002 and 0.005 mark a stagnating trend. New coverage/bits reset the stagnation counter; otherwise it rises under a stagnating trend and decays by one outside it. In the formal configuration, the effective revisit threshold is 24 windows throughout. The source contains nominal 72- and 192-window escalation checks keyed to discounted total_rounds; however, initialized at 𝑅0 = 0, with discount 0.999 and one unit of aggregate pull credit per completed window, the state satisfies 𝑅𝑡+1 = 0.999𝑅𝑡 + 1 and hence 𝑅𝑡 = 1000(1 − 0.999𝑡 ) < 1000 for every finite 𝑡, so the 2000/10,000 checks are unreachable in the reported runs. After a 180-second cooldown, a threshold crossing revisits the non-current arm with the highest discounted mean controller target. During cooldown, stagnation

18

11314 11318.5 1618 1574 9566 9557 7071.5 7041.5 20125.5 20251.5

11126 1479.5 9557 5408 20248

can raise the exploration bonus to at most 1.35×. Slow-arm and repeated-zero-signal guards multiply candidate scores by bounded factors no lower than 0.80. The packaged snapshot source also updates a legacy mix_p telemetry state, but the formal A6 top-𝑘/softmax routing path does not consume it; it is therefore not listed as an evaluated routing mechanism.

TABLE XVI Evaluated controller configuration. Values are specified by FORMAL-R1; they are fixed engineering choices, not claimed optima, and no per-target controller parameters were used. Subsystem

Evaluated values

Operational meaning

Window/telemetry

5000 ms; EMA 0.30; scales (0.2, 0.5, 0.2, 1.0, 2.0, 1.0); feature cap 3.0 path-length normalization 1/max( |𝑆 |, 1); campaign-lifetime 𝐻𝑠 ; no 𝐻𝑠 decay observation EMA 1.0; selection-time decay 0.995; cap 109 per-effective-profile uniform reservoirs, size 1024; post-warmup and 32 positive samples; edge/scarcity/CmpLog fallbacks 50/5/10

Six action-induced features, transformed and smoothed once per completed window. Per-execution activity of nonzero slots, weighted by historical virgin-bucket discovery counts. Queue-entry state consumed by bounded energy shaping. Running P90 engineering scales; a current positive observation is inserted before that window’s P90 is evaluated; not rolling, decayed, or phase-local. Receives queue scarcity observations and one raw audit-target observation/window (source/log label: reward); its P90 is a mixed-domain engineering normalizer, not a calibrated scarcity quantile. Disjoint arm-local models with finite-value checks; matrix cap 1012 and rescale factor 10 −6 . Negative raw audit values are floored to zero before the arm-local model update. Asymmetric EMA provides a slowly decreasing cost reference. The first measured execution initializes the baseline; later executions update it before gate evaluation as 𝐵𝑖 = 0.99𝐵𝑖−1 + 0.01 exec𝑖 . Row normalization gives 𝑟𝑡+ ≤ 25/27 and ℎ𝑡 /𝑟𝑡+ ≥ 0.35 when active, while 𝑏𝑡 ≤ 0.02 log 2 ≈ 0.0139; neither cap binds. 𝑧 divides the queue score by the auxiliary-reservoir P90; A6 inherits the delegated base mode. The packaged source consumes the same profile havoc factor at two sequential score-scaling sites; Table III reports the per-site value. Favored/new predicates are conjunctive during retries; after eight failures, the current valid candidate is accepted. Dwell can be bypassed by warmup, forced revisit, active trend, or emergency paths. Nominal 72/192 escalation checks are unreachable under the formal discounted round state; eligible stagnation revisits the non-current arm with the highest discounted mean controller target. Guardrails multiply exploration bonuses or candidate scores; they do not change the external metric. K𝑡 is the current top-𝐾 base-arm set ranked by discounted mean controller target; the probability floor is applied before renormalization, and lower arm index resolves exact mean ties. Selected A6 receives the ordinary selected-meta-arm update; only the delegated effective profile receives clipped additional credit using the same controller target. Integer-distance/equal-byte improvements only; ordinary coverage and queue growth are separate.

Scarcity activity Queue scarcity score Controller-target rate scales

Auxiliary energy normalizer one global size-1024 reservoir; minimum 32; fallback 1.0; reset every 256 windows

Recency-weighted linear scorer Controller-target bounds Throughput reference Execution-time gate

Profile energy modes Queue/mutation bounds

Warmup/dwell Trend/revisit guards

Score guards A6 routing

𝛼 = 0.6; ridge 10; discount 0.999; exploration-term cap 2; score cap 5 raw interval [ −0.25, 1.25]; model target [0, 1]; zero-signal term sig 0.015; cost factor 0.10 when 𝐼𝑡 = 1 update weight 0.1 when throughput rises or during warmup; 0.001 when it falls 𝜂𝑔 = 1; 𝑔min = 0.05; execution-time EMA current-sample weight 0.01; bonus multiplier 0.02; hard factor cap 1.15; positive threshold 10 −4 A1 1 + 0.5𝑧 (cap 2); A2 1 + 2 log(1 + 2𝑧) (cap 5); A3 1 + 𝑧 (cap 3); A4 1 + 2(𝑧 − 0.8) + (cap 3); A5 1 dictionary 0–100; havoc factor 0.95–1.20 per scaling site; final perf_score cap 100×HAVOC_MAX_MULT = 6400; queue rejection cap 8

two pulls/arm; dwell threshold one window; zero-signal emergency streak 3 controller-target/edge EMA 0.20; slope EMA 0.25; minimum 8; slope thresholds 0.002/0.005; effective formal stagnation threshold 24; cooldown 180 s stagnation bonus cap 1.35; slow ratio 0.70; repeated slow/zero-signal score-factor floor 0.80 top-𝐾 = 2; softmax 𝑇 = 1.20; for 𝑗 ∈ K𝑡 , Í 𝑝˜ 𝑗 = max( 𝑝 𝑗 , 0.05/| K𝑡 | ), then 𝑝 ′𝑗 = 𝑝˜ 𝑗 / ℓ ∈K𝑡 𝑝˜ ℓ

A6 delegated sharing

𝑤 = min(1/max( 𝜋, 10 −6 ) , 2)

CmpLog

producer after real CmpLog child; minimum gain 0.25; window clip 8; fallback scale 10

Appendix G Evidence Status The evidence table prevents source-level specification, archived runtime evidence, and author confirmation from being conflated. In particular, the packaged source subset labeled RELEASE-R1 does not by itself prove the identity of every historical runtime image.

19

TABLE XVII Evidence status for central reproducibility and attribution claims. “Author-confirmed” is intentionally separated from independently archived run linkage. Claim

Preserved evidence

Limitation

Export completeness and reported statistics packaged projections, hashes, deterministic scripts, raw cloud storage metadata is redacted or not retained complete cells/snapshots original variant wrapper and runtime-image digest are absent Batch B artifact manifest and SHA-256 equality within target/CmpLog/dictionary/effective-corpus target identity CmpLog-matched -c activation archived runtime argument/configuration evidence complete image-to-source mapping is absent and author confirmation Shadow computes but does not apply author-confirmed frozen semantics and run-linked wrapper source is not retained profiles smoke/runtime counters (candidate > 0, applied = 0) No-A6 and No-scarcity semantics (runtime author-confirmed frozen definitions and the preserved evidence does not independently reconstruct label No-rarity) smoke/runtime feature gates every disabled path Batch A frozen Batch A fixed-context definition plus original run-linked wrapper/image mapping is incomplete; Constant/Random/Round-robin/Static source/config policy semantics and complete-cell shared-substrate strength is not upgraded beyond preserved semantics data evidence Formal controller parameters and no source-default structure plus author-confirmed run-linked exact_env.tsv and pre-run override manifest post-Main tuning protocol; no per-target values are not retained Prepared artifact source and navigation complete E04 AFL++ source tree plus 15 neither source package establishes identity with every subset method-navigation files and hashes in historical runtime image source_release/RELEASE-R1 Hardware allocation author-retained cloud allocation records OS/kernel, pinning, topology, and worker allocation are not machine-verified Boundary-latency design redacted matched-environment manifest and trials were not paired by seed, host slot, or pair identifier independent analysis

Appendix H Standard Data, Source, and Reproduction

The prepared artifact package contains the complete E04 AFL++ source tree. For method navigation, we also provide the packaged 15-file subset labeled RELEASE-R1 under A separate prepared artifact package includes anonymized source_release/, together with a source-level specifiprojections of the three standard exports under data/, de- cation and file hashes. The integrated controller semantics terministic analysis and plotting code under analysis/, were maintained across sequential phases, while intervening complete statistical outputs under generated/, and the TeX commits added controls and FuzzBench/environment wiring. tables and plots used by the manuscript. The projections Complete runtime-image-to-source cryptographic mappings remove private or analysis-irrelevant metadata while preserving were not retained, so the snapshot is not presented as proof of revision label, fuzzer, benchmark, trial, snapshot time, edge every historical executable image. Parameter and variant author coverage, crash key, and bug-count fields. Crash-key and bug- confirmations, along with their independent-verification limits, count columns are retained for completeness but are not are preserved under provenance/. analyzed because they do not constitute a validated ground-truth vulnerability oracle. Their SHA-256 values are: Main 800-campaign projection: feebf5f8cbdbd481e 88bd7ec56df3149948d7a2b1d52067eb2c0599 e664e8eb2. • Batch A 500-campaign projection: 836057133f9dd8a 50044716da6026a6feb3a6d9b6b0aaea78042b 57d82928778. • Batch B 300-campaign projection: 8758649cb552e57 6356225f8d16bf675f33a7de816c3ad7619520 a24ba687c2f. •

Each has 97 snapshots per campaign from 0 through 86,400 seconds, ten trials per cell, no duplicate benchmark–variant– trial–time rows, and monotonically non-decreasing edge coverage. The standard raw Batch A export has SHA-256 7a3 920bd49e75bad640ba0fccb7ea2426652012c60be9 1c77fca42f7587424bc; the packaged Batch A file is its anonymized analysis projection.

20

Related documents

• SDLLMFuzz: Dynamic-static LLM-assisted greybox fuzzing for structured input programs#120427
• Fuzzbox: blending fuzzing into emulation for binary-only embedded targets#171288
• TraceLib: System-Call Bitmap Feedback Mechanism for Language-Agnostic Web Fuzzing#1129399
• TraceLib: System-Call Bitmap Feedback Mechanism for Language-Agnostic Web Fuzzing#1108829
• PeAR: A Static Binary Rewriting Framework for Binary-Only Fuzzing#246425