CAROL: Context-Aware Online Learning for Fuzzer Scheduling

C AROL: Context-Aware Online Learning for Fuzzer Scheduling Mengfan Xu1 Juan Zhai1 Shenglong Yao2 Shiqing Ma1 1 University of Massachusetts Amherst {zliu,mengfanxu,juanzhai,shiqingma}@umass.edu 2 Georgia Institute of Technology syao84@gatech.edu

arXiv:2609.06772v1 [cs.SE] 6 Sep 2026

Zirui Liu1

Abstract

1

Ensemble fuzzing runs several fuzzers on one target and relies on a scheduler to divide CPU time among them. Existing ensemble schedulers make these decisions from compact summaries of past performance and decision rules fixed before the campaign. Our measurements point to two limitations. First, summaries of past rewards do not reliably capture how fuzzer performance evolves: after accounting for estimation noise, the agreement between consecutive-window rankings is statistically indistinguishable from the ranking’s within-window self-agreement. Second, the signals that predict reward vary across targets: a weighting learned from eight other targets predicts reward worse than one learned on the current target on eight of nine targets. We then introduce C AROL, which uses each fuzzer’s current context to guide online scheduling. The context is already available to the dispatch loop and captures how the fuzzer’s reward is evolving, how long it has waited or remained on a plateau, what code it is reaching, and the uncertainty in its estimate. We develop two ways to use this context. A domainguided method identifies whether a fuzzer is rising or rotting and applies a learning rule tailored to that phase. A learned method models how reward depends on 15 context signals and uses its predictions and uncertainty to select fuzzers online. Across nine Magma targets, C AROL triggers more unique bugs than each of three ensemble-scheduling baselines on every target where they differ and fewer on none, reaching a mean of 34.20 unique bugs compared with 28.40, 28.80, and 29.00. It gains 11.8% over the strongest baseline on each target and exceeds an oracle that selects the best single fuzzer per target after the fact (32.00). An ablation without context eliminates the gain, and the additional bugs are concentrated among those the baselines trigger rarely or never. Run unchanged on five widely used C++ programs, C AROL finds 120 previously unknown crashing defects, deduplicated by site, fault, and entry point, all reported to their maintainers through each project’s stated disclosure channel.

Introduction

Greybox fuzzing runs a program on mutated inputs, keeps the ones that reach new code and reports the ones that crash. No single fuzzer wins everywhere: a decade of measurement has established that a fuzzer’s advantage is target-specific [17, 25, 35]. The response has been ensemble fuzzing: run several fuzzers on one target, share a seed corpus, and let a scheduler divide CPU time among them [10, 13, 16, 37, 46]. Choosing a fuzzer becomes choosing how to divide the budget, at every free core and for the whole campaign, and giving time to the wrong fuzzer leaves the ensemble worse than its best member. It is online resource allocation under uncertainty about how each fuzzer will perform on this target. Online learning is particularly well suited to fuzzer scheduling: it makes decisions in microseconds compared with fuzzing turns that last seconds, learns continuously from the current campaign without pretraining on the target, and produces quantities that can be inspected and interpreted. Prior work has already shown the value of this approach in fuzzing. BandFuzz [45] and LEGION [56] use online learning for fuzzer scheduling, while F OX [44] applies online stochastic control within a single fuzzer. Together, these methods establish online learning as a lightweight and effective framework for adaptive fuzzing. Turning specifically to ensemble scheduling, several prominent schedulers already use online learning. BandFuzz [45, 46] uses Thompson sampling to allocate effort among fuzzers, L EGION [56] uses a modified upper-confidence-bound rule over multiple performance signals, and AUTOFZ [13] selects fuzzers based on a preparation window. Earlier systems established the ensemble and seed-sharing setting [10, 16]. However, to the best of our knowledge, existing schedulers share two limitations. First, they ultimately rank each fuzzer using a compact summary of its past rewards, which omits information about its current situation and how its performance is changing. When we divide a campaign into twelfths, the rankings in two adjacent time windows have a mean Kendall correlation of only 0.059, where a higher correlation indicates

1

greater agreement in the fuzzer ordering. For comparison, two random halves of the same window have a correlation of 0.057. Thus, the ranking from one window predicts the next no better than two noisy estimates formed within the same window (§2.2). Second, existing schedulers use a decision rule fixed before the campaign and shared across targets. Our measurements show that the importance of individual signals varies substantially across targets (§5.1). These observations motivate learning how each fuzzer’s current context predicts its next reward on the target being fuzzed. Our key insight. A fuzzer’s reward history tells only part of the story. What it will find next also depends on its current context: it may be stuck on a plateau, have just received new seeds from its peers, or be exploring code it has not seen before. The dispatch loop already observes signals that distinguish these situations. For example, in the 90 minutes before a rarely triggered bug, plateau and freshness signals change sharply even while the coverage rate remains below its campaign average. This behavior is widespread: a fuzzer’s reward typically rises as it explores new ground and then decays toward a plateau, with the raw per-turn rate falling in 96.7% of 1,841 (campaign, fuzzer) pairs across all nine targets (§2.2). This motivates developing online learning methods that use each fuzzer’s current context to predict its next reward and guide better scheduling decisions. We explore two ways to incorporate this context into online learning. Method I (§4) encodes domain knowledge about how fuzzing rewards evolve: it classifies each fuzzer as rising or rotting from its recent rewards and applies a learning rule tailored to that phase [34, 43]. Method II (§5) automatically learns how reward depends on 15 signals describing different aspects of each fuzzer’s current situation, and uses the resulting predictions and uncertainty to select fuzzers online. Comparing the two reveals how far domain-guided context can go and what is gained by learning the context-reward relationship directly. C AROL uses Method II as its main scheduler, with Method I as the domain-guided comparison. To summarize, the main contributions are as follows:

pends on 15 signals describing different aspects of each fuzzer’s current situation, using the resulting predictions and uncertainty to select fuzzers online. A model fitted on eight targets predicts the ninth worse than one learned within that target on eight of nine targets, and the two rank a different fuzzer first on a median 51.0% of decisions (§5.1). A construction also shows that context can be necessary: policies using only each fuzzer’s own pull counts and realized rewards can incur linear regret when an observable context signal changes its future reward (§5.4). • Ground-truth evaluation of context-aware scheduling. Across ten 24-hour campaigns per configuration on nine Magma targets, C AROL triggers more unique bugs than each of three ensemble-scheduling baselines on every target where they differ and fewer on none, with summed gains of 20.4%, 18.8%, and 17.9%. An oracle selecting the best of the six fuzzers per target reaches 32.00 unique bugs, compared with 34.20 for C AROL. An ablation without context eliminates the gain (§6, §7). • 120 previously unknown crashing defects in five C++ programs. Running the same C AROL scheduler and configuration on MNN, Arm NN, Krita, ncnn, and FreeCAD finds 120 previously unknown crashing defects, all reported to their maintainers through each project’s stated security channel (§6.5).

2 2.1

Background Ensemble fuzzing

From fixed ensembles to adaptive allocation. E N F UZZ [10] demonstrated that a diverse set of seed-sharing fuzzers can outperform its individual members. C UPID [16] searches offline for an effective ensemble composition, while C OLLAB F UZZ [37] provides a broker that coordinates fuzzers under pluggable policies. These systems established the value of combining complementary fuzzers and sharing their discoveries. Later systems adapt the allocation during the campaign. AUTOFZ [13] alternates between a preparation phase that measures current performance and a focus phase that favors the leaders. BandFuzz [45, 46] maintains a Beta posterior over each fuzzer’s coverage reward and uses Thompson sampling [48] to select the next fuzzer. RCF UZZER [36] samples a posterior over a branch-difficulty-weighted coverage score, while AUTO F UZZ [14] schedules fuzzer-and-sanitizer pairs with an estimator for rewards that may change over time. L E GION [56] combines several performance dimensions using a modified upper-confidence-bound rule and updates their weights each round. Together, these systems show that online scheduling can adapt an ensemble using coverage, recent performance, and complementary measures of fuzzing progress.

• Empirical evidence that fuzzer scheduling requires context. We show that a compact summary of past rewards does not fully capture a fuzzer’s evolving situation. The raw per-turn reward falls on 96.7% of 1,841 (campaign, fuzzer) pairs across all nine targets. At the decision timescale, rankings in adjacent reward windows have nearly the same agreement as two estimates formed within the same window, showing that past rewards alone provide little information about how the ranking will evolve (§2.2). • Two context-aware online-learning methods for fuzzer scheduling. Method I incorporates domain knowledge by identifying whether each fuzzer is rising or rotting and applying a learning rule tailored to that phase. Method II automatically learns how reward de2

Contextual learning within a fuzzer. Context already guides decisions at a finer granularity. Methods have used online learning to select seeds, mutation operators, and energy within one fuzzer [5, 22, 23, 30, 50, 54, 55]. CMF UZZ [51] selects mutation operators from properties of the current seed, C ERE BRO [29] prioritizes seeds using the code they reach, and R E F UZZ [8] models the provenance of tests reused across processors. M EUZZ [9] learns from program and seed features when choosing work for a concolic engine. In each case, the context describes the input, seed, or operation being scheduled. These schedulers differ in how they construct their scores, but each ultimately ranks a fuzzer from its own observed output. Ensemble scheduling presents a different context: while a fuzzer waits, its peers change its future opportunity by adding seeds to the shared store. CAROL represents this live situation using signals already available to the dispatch loop and learns how they predict the fuzzer’s next reward on the current target. To our knowledge, CAROL is the first ensemble scheduler to learn this per-fuzzer context-to-reward relationship online. A construction in §5.4 formalizes why a fuzzer’s own pull counts and realized rewards can be insufficient under this shared-store coupling. Learning with changing rewards. Online-learning methods provide several models for rewards that move over time. Sliding-window and discounted estimators track changes of unrestricted direction [15, 40], while rising [34] and rotting [27, 43] models capture one-directional change. Contextual regression instead predicts reward from observed features [1,4,12]. These lines provide the two foundations used in this paper: Method I supplies the reward phase from domain expertise, while Method II learns the complete context-toreward relationship from the campaign. The next subsection examines how fuzzing rewards move and why phase is useful but not sufficient.

2.2

poppler, mopt mean reward

libxml2, darwin

mid end campaign % of raw rate retained

start

start

mid end campaign

0.7

0

23.8 4.5

4

3.6 3.1

3

0

l r f e a g 3 p 2 ple xml ndfil penss lu qlite libtif ibpn ph p o l b s s o p li lib Figure 1: Left, the shape §2.2 describes: mopt on poppler rises as it covers code its peers reached, then rots. Right, a case it does not: darwin on libxml2 never rises. Each curve is one fuzzer’s reward, averaged over that target’s campaigns and over each tenth of its own turns; Method I assumes the left panel. Below, the fall across the suite: the median (campaign, fuzzer) pair’s raw per-turn rate over a campaign’s second half, as a percentage of its first, latched before any scaling. Method I uses this phase as context supplied by domain expertise. The contrasting curve shows why phase alone cannot describe every fuzzer and target. Reward decay across the benchmark. The decline extends beyond the two examples. The raw per-turn rate falls in 96.7% of 1,841 (campaign, fuzzer) pairs across all nine targets, ranging from 88.6% to 100% by target. The median pair retains 23.8% of its first-half rate on poppler and less than 5% on each of the other eight targets, including no retained rate on libpng and php (Figure 1). We compute this rate from the raw weighted contribution underlying the reward, before normalization, and separately for each (campaign, fuzzer) pair. The measurement therefore describes the signal consumed by the schedulers rather than a change introduced by its running scale. Coverage rewards are exhaustible by construction; the measurement establishes how consistently and how sharply that exhaustion appears for individual fuzzers inside a seed-sharing ensemble. Rankings from reward histories. Schedulers act on the ordering of fuzzers rather than on a decline shared by all of them. We therefore divide each campaign into equal wallclock windows and rank the fuzzers by the raw rate of the turns they complete in each window. At the half-campaign width, consecutive-window rankings have a mean Kendall correlation of 0.081, while two estimates formed from random halves of the same window agree at 0.085. Their paired

Reward dynamics as context

Seed sharing creates changing opportunities. While a fuzzer waits, its peers continue adding seeds to the shared store. When the fuzzer next runs, those seeds may expose code it has not explored itself, allowing its reward to rise as it converts the new opportunities into coverage. Its reward then falls as those opportunities are exhausted and the shared corpus approaches a plateau. This interaction differs from a recovering-reward model, where recovery depends only on idle time [38]: under seed sharing, it also depends on which peers ran and what they found. The resulting trajectory is useful but not universal. Figure 1 shows both cases. On poppler, mopt first rises and then rots as the newly available coverage is consumed. On libxml2, darwin begins by declining and never enters a rising phase. We call these phases rising and rotting, following onlinelearning models of one-directional reward change [27, 34, 43]. 3

difference is 0.004 with a 95% interval of [−0.08, 0.09]. The same pattern appears at quarter- and twelfth-campaign widths (§A.29). After accounting for estimation noise, the agreement between consecutive-window rankings is statistically indistinguishable from the ranking’s within-window self-agreement. Summaries of past reward therefore do not reliably capture how the fuzzer ordering evolves across the measured windows. From phase to full context. Reward direction supplies one useful context: it distinguishes a fuzzer whose reward is rising from one whose reward is rotting toward a plateau. Method I encodes that distinction using domain expertise. Direction alone does not describe how long the fuzzer has waited, how long it has remained on a plateau, what code it is reaching, where the campaign stands, or how well its reward estimate is determined. Method II keeps these signals and learns their relationship to the next reward online. The two methods therefore answer the same scheduling question with different amounts of context: one is told which context matters, while the other learns it from the campaign.

3

and bug-based evaluations can disagree on which fuzzer is better [6]. Thus, coverage is the online learning signal and unique bugs are the evaluation objective. Design goals. G1 Encode general structure; learn target-specific behavior. The design should make this boundary explicit: general structure in reward evolution may be encoded, while target-specific relationships between context and reward are learned within the campaign. G2 Learn the allocation. CPU shares should follow from online estimates of each fuzzer’s next reward and the evidence behind them, without fuzzer-specific shares fixed before the campaign. G3 Deploy on a new target. Every decision should use signals available to the dispatch loop and information learned during the current campaign, with no bug oracle, source annotations, benchmark harness, or target-specific pretraining. G4 Tie design choices to measured outcomes. Questions about predictive information should be evaluated on heldout reward, while choices that affect the security outcome should be evaluated on full-campaign unique bugs.

Problem

Setting. We consider a fixed wall-clock fuzzing campaign on one target with a pool of K fuzzers, A = {1, . . . , K}. Each fuzzer is one arm. All fuzzers instrument the same target build and exchange interesting inputs through a shared seed store. Whenever a core becomes available, the scheduler selects one fuzzer to run on it. Available observations. The scheduler makes each decision from information produced during the campaign and already maintained by the dispatch loop: coverage of the shared map, turn timing, observed crashes, static properties of the code reached, and uncertainty estimated from prior observations. Ground-truth bug identities are reserved for evaluating completed campaigns. Threat model. We assume an attacker who supplies one untrusted file to a parser, such as a model, an image, a mesh or a document. The defects we seek are the memory-safety and input-validation failures on that path: out-of-bounds reads and writes, dereference of a pointer the file leaves null, use of uninitialized or freed memory, and an unvalidated quantity from the file used as an index, a divisor or an allocation size. Objective. We evaluate a completed campaign by the number of distinct known bugs it triggers. This metric measures the security outcome directly and counts repeated triggers of the same defect once, following established guidance for fuzzing evaluations [25]. During the campaign, coverage supplies the dense feedback needed for online scheduling. After the campaign, Magma’s per-bug oracle identifies the known defects that were triggered. We also report edge coverage, but use distinct bugs for comparisons because coverage-based

4

Method I: A Single Context Guided by Domain Expertise

Method I represents each fuzzer’s context by the phase of its reward trajectory. Domain expertise defines two scheduling phases: rising for a new or upward-trending reward sequence, and rotting for a flat or downward-trending sequence. The phase enters online learning by selecting the estimator used to predict the fuzzer’s next reward. Within that phase, the scheduler learns the reward level and its uncertainty from the current campaign. Method I therefore uses a single context variable—reward phase—whose meaning is supplied by domain expertise. This section builds the scheduler in three steps. §4.1 defines how a scheduling decision becomes a fuzzing turn and a reward observation. §4.2 defines that reward and explains why its changing mean carries scheduling information. §4.3 converts the recent reward sequence into a phase, applies the corresponding estimator, and selects the next fuzzer.

4.1

The dispatch loop

A worker is the process that owns one core and executes fuzzing turns. The scheduler receives a request whenever a worker becomes available and selects the fuzzer for its next turn. Method I occupies this scheduling component in Figure 2; the workers, fuzzers, shared seed store, coverage map, and evaluator form the surrounding execution substrate.

4

workers, one per core

Algorithm 1: The phase-aware scheduler. Params :trend window w = 84, phase threshold τ = 3.5, exploration α = 1; horizons H = {2, 4, 8, . . . } ∪ {w} Input: per-fuzzer reward windows Ra , pull counts na , decision count t Output: one fuzzer to run on the calling worker’s core

scheduler phase-aware reward phase → estimator → fuzzer

foreach fuzzer a ∈ A do // a fuzzer without a full window is treated as rising 2 risinga ← |Ra | < w or M ANN K ENDALL Z(Ra ) > τ // rank trend, tie- and continuity-corrected 3 if risinga then // rising: one-step forecast, widened by what the trend leaves open 4 ŝa ← T HEIL S EN S LOPE(Ra ) p c ŝa ) 5 va ← mean(Ra ) + ŝa + α logt · var( 6 else // rotting (a plateau counts as rotting): best sustained level, horizon by maximum h i p
7 va ← max h ∈ H , h≤|Ra | mean last h of Ra + α logt/h

1

AFL++

DARWIN

honggfuzz

MOPT

laf-intel

Radamsa

shared seed store · coverage map · evaluator Figure 2: Method I in the dispatch loop. A worker requests a fuzzer from the phase-aware scheduler, executes its turn, and returns the resulting reward through the shared evaluator.

8

One worker runs on each core. After receiving fuzzer a, the worker executes ca = ⌊TI /d¯a ⌋ of its internal cycles, where d¯a is the running mean duration of one such cycle and TI = 120 s is the target duration of a turn. It then sends the interesting inputs to the shared evaluator and reports the resulting reward. Selection requests are serialized, while the selected turns run concurrently and their rewards arrive when they finish. For each request, Method I classifies every fuzzer’s reward phase, computes the corresponding reward estimate and uncertainty, independently perturbs each estimate, and selects the largest. Repeating this decision across workers turns individual selections into a CPU allocation: a fuzzer’s expected share is the probability that its perturbed estimate ranks first. Its share therefore follows from the phase, reward evidence, and uncertainty accumulated during the campaign, as required by goal G2. §4.3 defines this selection rule, and §6.4 measures the resulting allocation.

4.2

9 10

end p c a )/|Ra | + (1/12)/na sa ← var(R εa ∼ N (0, 1); ṽa ← va + α εa sa

// drawn per worker

end 12 return arg maxa∈A ṽa 11

whose mean is stationary within each two-hour interval and resets the posterior at the interval boundary. The measurements in §2.2 show that reward evolves within this timescale. Method I represents that evolution directly: the recent reward trend determines the phase, and the phase determines the estimator for the next reward. Because most turns contribute no new edge while occasional turns produce large bursts, the phase test uses reward ranks rather than magnitudes.

4.3

Phase and estimator

Phase classification. For fuzzer a, Ra contains its w = 84 most recent rewards. Until the window is full, Method I initializes the fuzzer’s phase as rising. Once the window is full, it computes the standardized Mann–Kendall statistic with continuity and tie corrections [24, 31]. The fuzzer is rising when this statistic exceeds τ = 3.5 and rotting otherwise. Mann–Kendall uses the ordering of reward pairs, so the magnitude of an isolated coverage burst does not dominate the phase classification. The binary context groups flat and downward-trending sequences as rotting because both use the same recent-level estimator in the next step. The phase therefore records the decision-relevant distinction between an upward trend and a reward that has stopped rising. Phase-specific reward estimates. The reward phase is the context input to Method I: it selects the estimator that produces fuzzer a’s index va . For a rising fuzzer, Method I combines the recent reward level with a robust estimate of its

How reward guides scheduling

Reward links a scheduling decision to the progress produced by its fuzzing turn. If the next reward of every fuzzer were known, the scheduler could select the most productive next turn directly. Online learning estimates these unknown rewards from observed turns, so the structure assumed for reward evolution determines how past evidence informs the next choice. Every scheduler in our comparison receives the coverage reward defined by BandFuzz [45, 46]. For each new edge covered during turn t, the evaluator adds t − t p , where t p is the round in which the edge’s predecessor block was first discovered. The sum is min–max normalized to [0, 1] using running campaign-wide bounds shared by all fuzzers. Using one reward definition holds the feedback constant while the scheduling rule changes. BandFuzz summarizes this reward with a Beta posterior 5

upward trend:

The pool is six fuzzers: AFL++ [11], DARWIN [20], honggfuzz [47], MOPT [30], laf-intel [26] and Radamsa [18]. A control channel starts, runs and stops each for a bounded number of its own internal cycles without losing what it has learned, so a turn is a suspension rather than a restart. laf-intel is an instrumentation pass rather than a mutator: it drives AFL++ against a build whose multi-byte comparisons are split, so each target is compiled once per instrumentation family. All fuzzers publish interesting inputs into one seed store and import from it before each turn, each input at most once per fuzzer, and every turn’s reward is measured on one neutral build carrying a runtime no fuzzer uses for its own guidance. Every fuzzed target runs under a fixed address-space limit no healthy target on these benchmarks approaches, and a persistent-mode fuzzer paired with a leaking harness is contained at the process that causes it. One configuration ran on every Magma target and every real-world program; §7 measures what each setting is worth.

q c ŝa ), logt var( vrise = mean(R ) + ŝ + α a a a where ŝa is the Theil–Sen slope [42]. The level and slope capture the direction in which the reward is moving, while the final term increases the index when that direction is uncertain, following the rising-reward construction of Metelli et al. [34]. For a rotting fuzzer, Method I estimates the strongest reward level sustained over a ladder of recent horizons: # " r
logt rot va = max mean lasth (Ra ) + α . h h∈H h≤|Ra |

Here H = {2, 4, 8, . . .} ∪ {w}. Each horizon balances a recent reward level against the amount of evidence behind it. The horizon ladder and its uncertainty term follow RAWUCB [43]; Method I takes the maximum across horizons to retain the strongest recent evidence, whereas RAW-UCB takes the tightest bound. §A.19 derives how the shipped constants affect the reachable horizons and the ordering between phases. Selection under uncertainty. After computing the phasespecific index va , each worker independently perturbs it: ṽa = va + α εa sa , where

s sa =

5

Method II models each fuzzer’s expected next reward as an unknown function of its current context: E[rt,a | xt,a ] = fa (xt,a ).

εa ∼ N (0, 1),

At decision t, every fuzzer a presents a context xt,a . A model learned from the current campaign predicts its next reward and the uncertainty of that prediction. The scheduler selects a fuzzer using these quantities, observes the reward produced by its turn, and updates that fuzzer’s model. Context therefore enters directly as the input to the learned reward function. Method I supplies one context variable—reward phase— from domain expertise. Method II instead retains the 15dimensional context and learns which combinations of its signals predict reward on the target being fuzzed. This section builds the method in four steps. §5.1 defines the context signals and establishes why they are retained without a low-rank projection. §5.2 learns one context-to-reward function per fuzzer. §5.3 combines each prediction with its uncertainty to select the next fuzzer. §5.4 states the concurrent, delayed-feedback setting and shows why observable context can be necessary when fuzzers interact through the shared seed store.

c a ) 1/12 var(R + . |Ra | na

The first term estimates uncertainty in the observed reward mean. The second uses the variance of a uniform prior on [0, 1] and decreases with the fuzzer’s pull count na , preserving uncertainty when its observed rewards are sparse or constant. The worker runs arg maxa∈A ṽa . Within a phase, the independent perturbations allow uncertainty to change the fuzzer ordering across concurrent workers, while their scale decreases as the campaign accumulates evidence. The resulting CPU allocation therefore combines the domain-guided phase, the phase-specific reward estimate, and the uncertainty learned online. Method I uses the same configuration w = 84, τ = 3.5, and α = 1 on every Magma target. Algorithm 1 summarizes the complete decision rule, and §A.19 derives the behavior of its indices and uncertainty term.

4.4

Method II: Context-Aware Online Learning

5.1

Context signals

Context definition. At each decision, the scheduler constructs one 15-dimensional context for every fuzzer from quantities already maintained by the dispatch loop. The signals describe five aspects of its current situation: recent productivity; reward trend and short-term horizons; plateau duration and freshness; properties of the code it has recently reached; and the quality of its current estimate. Table 3 defines every signal.

Implementation

C AROL replaces one function of an ensemble dispatch loop, the choice of which fuzzer runs next. Every scheduler compared in this paper, ours and the three baselines, is that same loop with a different rule in that one place and everything else held fixed, BandFuzz’s own reward definition included. 6

Turn-derived signals are latched when the fuzzer’s preceding turn ends. Only the two clock-based signals advance while it waits. The context used to predict a turn therefore contains no outcome from that turn. All signals are available on a new target: code properties are read from the instrumented binary, crashes are ordinary observed crash counts, and no signal uses a bug oracle, source annotation, or benchmark harness. Retaining the context. Two rules fixed before the campaigns remove one invariant signal and five exact arithmetic functions of retained quantities, leaving the 15 signals in Table 3. In leave-one-campaign-out prediction, the signals that carry information differ by target, and no tested low-rank projection improves on the complete context on any target. Method II therefore retains the full context (§A.10, §A.8). Learning the weighting on the current target. Method II learns how the context signals combine from the campaign being scheduled. We measure the need for this target-specific weighting in two complementary ways. First, replaying each decision after replacing one feature by its standardized mean identifies a different dominant signal across targets (Table 10). Second, we compare the same estimator under two sources of training data. One model is fitted on campaigns from the other eight targets and transferred to the held-out target; the other is fitted within that target. The transferred weighting has significantly higher held-out prediction error on eight of the nine targets after Holm correction and lower error on none. It is worse on 66.7% to 97.4% of each target’s held-out campaigns. The difference reaches the scheduling decision: the transferred and within-target models select different topranked fuzzers on 26.8% to 60.4% of decisions per target, with a median of 51.0%. These held-out analyses test whether one weighting transfers across targets. The deployed scheduler initializes its models from the current campaign and learns the weighting online, satisfying goal G3. Representation boundary. Proposition 1 uses an ideal indicator of whether the preceding shared-store publication opened code new to a fuzzer. The implemented context instead records consequences visible to the dispatch loop, including productivity, plateau duration, freshness, and properties of the code reached. The proposition establishes the information need; §7 measures the value of the context Method II implements.

5.2

using that fuzzer’s running mean and variance and clamped to ±5 standard deviations. The scheduler then applies the fixed random-Fourier representation [39] "r φ(x) =

2 cos(ω⊤1 x + b1 ), . . . , D

r

2 cos(ω⊤D x + bD ), 1 D

#⊤ ,

where the final component is the intercept. We use D = 16, bandwidth σ = 4, ω j ∼ N (0, σ−2 I), and b j ∼ Unif[0, 2π]. The frequencies and phases are drawn once and then held fixed. Each fuzzer carries ridge sufficient statistics initialized at Aa = λI and ba = 0, with λ = 10. When one of its turns completes with representation φa and reward r, Method II updates Aa ← Aa + φa φ⊤a ,

ba ← ba + rφa .

Its parameter and predicted reward at the next context are ϑa = A−1 a ba ,

µa (xt,a ) = ϑ⊤a φ(xt,a ).

The standardizers and models begin with each campaign and are updated only from that campaign’s completed turns, satisfying goal G3. At the data volumes reached during a campaign, this representation has 6.9%–36.1% lower held-out prediction error than a model linear in the raw context on both targets where the comparison is measured (§A.9). In the live comparison, the two representations differ by 0.20 mean unique bugs, which the full-campaign test does not distinguish (§7). Using the full campaign history. Method II gives equal weight to every completed turn in the current campaign. Forgetting factors γ = 0.995 and γ = 0.99 both increase held-out prediction error on all nine targets after Holm correction and reduce it on none, so Method II retains the full campaign history. Elapsed time, idle time, and freshness let a fixed coefficient vector express systematic change, although residual drift remains on three targets. §6.4 places that drift alongside the direct comparison between the methods; §A.16 gives the full weighting analysis.

5.3

Selection

Combining prediction and uncertainty. For each fuzzer, Method II pairs its predicted reward with the ridge width q ua = φ⊤a A−1 a φa .

The model

The width is large in representation directions supported by few observations and shrinks as similar contexts accumulate. It therefore identifies where the current campaign provides the model with the least evidence. At each decision, each worker independently draws

One online model per fuzzer. Method II maintains a separate reward model for every fuzzer. This allows each model to learn the fuzzer’s persistent productivity and its response to context; the selected arm already supplies fuzzer identity, so identity is not repeated as a context feature. For fuzzer a, each component of xt,a ∈ R15 is standardized

µ̃a = µa (xt,a ) + εa ua , 7

εa ∼ N (0, 1),

store and thereby change the opportunities available to every fuzzer. A fuzzer’s context can therefore evolve while it waits, and its next reward reflects both its own recent behavior and the consequences of its peers’ work. Online-learning formulations with context model reward conditioned on observed context [28,49], while restless and recovering formulations model rewards that evolve over time [38, 53]. Ensemble fuzzing combines these properties with concurrent feedback and shared-store coupling. Method II models the context-to-reward relationship as fixed within a campaign while allowing the contexts themselves to evolve after every turn. §5.2 measures this choice and quantifies the residual drift that the context does not capture. Immediate-reward objective. Method II selects the fuzzer with the strongest randomized estimate of its next-turn reward. A long-horizon policy would additionally model how each selection changes the shared store and all future contexts; Method II does not estimate that transition or value function. §A.15 examines this design choice using retained reward and alternative reward definitions. Shared-store coupling nevertheless makes context necessary for the immediate decision: a fuzzer’s own pull counts and realized rewards do not reveal the opportunities its peers created while it waited. Proposition 1 isolates this missing information.

Algorithm 2: The context-aware scheduler. Aa is initialized to λI. Params :ridge λ = 10, random-Fourier width D = 16, bandwidth σ = 4 Input: per-fuzzer ridge accumulators (Aa , ba ), running standardizers Output: one fuzzer to run on the calling worker’s core foreach fuzzer a ∈ A do xa ← S TANDARDIZEa (C ONTEXT(a)) // 15 features, clamped to ±5 p D // ω, b 2/D cos(ω⊤j xa + b j ) j=1 ∥ 1 3 φa ← frozen at start 4 ϑa ← A−1 // one model per fuzzer a ba q ⊤ 5 µa ← ϑa φa ; ua ← φ⊤a A−1 a φa 6 εa ∼ N (0, 1); µ̃a ← µa + εa ua // drawn per worker 7 end ⋆ 8 a ← arg maxa∈A µ̃a ; record φa⋆ for the update

1

2

// on the turn’s completion, with realized reward r ⊤ 9 Aa⋆ ← Aa⋆ + φa⋆ φa⋆ ; ba⋆ ← ba⋆ + r φa⋆ ⋆ 10 return a

for every fuzzer and selects the largest draw. The predicted mean favors fuzzers expected to produce high immediate reward, while the perturbation keeps fuzzers with weakly observed contexts in contention. Independent draws also allow concurrent workers to make different selections from the same model state. This mean-plus-Gaussian-width rule follows randomized exploration in contextual online learning [2]. We fix the perturbation multiplier to one for every target, so its scale is determined by the ridge width at the current context rather than by a separate fuzzing-specific exploration coefficient. The exploration term is consequential: removing it reduces mean unique bugs by 1.00 per target, or 9.00 across the nine targets, and reduces edge coverage by 16%. In that ablated configuration, a passed-over fuzzer regains the highest prediction zero times across all learned decisions (§7, §A.17).

5.4

Proposition 1. For every horizon H, there is an instance satisfying the monotone coupling of §2.2 in which every policy whose decisions use only the fuzzers’ own pull counts and realized rewards has expected cumulative reward 3H/4. A policy that additionally observes which fuzzers can exploit the preceding shared-store publication attains expected cumulative reward 7H/8. The history-only policies therefore incur expected regret H/8 relative to this context-informed policy. The construction makes the preceding shared-store publication independently useful to each of two fuzzers. Pull counts and realized rewards do not identify which fuzzer can exploit the current publication, while one observable indicator does. §A.20 gives the full construction, proof, and scope. Method II uses the dispatch-loop signals of §5.1, not the construction’s direct indicator. Replacing those signals with an intercept while holding the remaining design fixed lowers summed mean unique bugs from 34.20 to 28.00, below BandFuzz’s 28.40; the implemented context therefore carries the entire measured advantage and more (§7). The proposition establishes the information requirement, and the full-campaign comparison measures the deployed scheduler under concurrent, delayed feedback.

The setting

Concurrent, coupled decisions. At decision t, an available worker chooses one of the K fuzzers. Every fuzzer a presents its current context xt,a , and the selected fuzzer runs for TI seconds. Up to six worker turns can be in flight at once. A model is updated only when its turn completes, so later decisions can be made before earlier selections have produced feedback, and completed turns can arrive out of selection order. Each completed turn can publish inputs to the shared seed

8

6

Evaluation

6.1

Setup

Method II against the baselines. The context-aware scheduler triggers more unique bugs than each baseline on every target where they differ and fewer on none. Summed across the nine targets, it triggers 34.20 mean unique bugs against BandFuzz’s 28.40 (+20.4%), AUTOFZ’s 28.80 (+18.8%), and L E GION ’s 29.00 (+17.9%). The strongest-baseline composite sums to 30.60: Method II leads it on six targets, ties on three, and gains 11.8% (exact sign p = 0.031). The resolved gaps are libtiff, 5.00 versus 4.00 (Â12 = 1.00, pH = 0.0001), and sqlite3, 4.20 versus 3.40 (pH = 0.029). Every other non-tied effect favors Method II. Removing libtiff still leaves a 9.8% gain; normalized by reachable bugs, the composite reaches 45.4% and Method II 49.6%. Against BandFuzz, AUTOFZ, and L EGION individually, the exact sign probabilities are 0.0156, 0.031, and 0.0156. Every Method II campaign on libtiff triggers more bugs than every campaign of its strongest baseline, and all ten Method II campaigns on libpng trigger the same four bugs. Restricting the sum to the six targets where Method II and the composite differ gives a 19.4% gain. Method I and the comparison between the two designs. Method I sums to 30.50, improving on BandFuzz, AUTOFZ, and L EGION by 7.4%, 5.9%, and 5.2%. Its strongest resolved result is libpng: 3.90 versus AUTOFZ’s 3.20 (Â12 = 0.85, pH = 0.023), where reward decay is sharpest among separating targets (Figure 1). Method II improves on Method I by 12.1%, leading on seven targets and tying on two. The resolved pairwise effects are sqlite3 (Â12 = 0.88, pH = 0.016) and libtiff (Â12 = 0.80, pH = 0.025). Against the strongestbaseline composite, Method I leads on three targets, ties on two, and trails on four, summing to 30.50 against 30.60. Poppler is the next Method II–Method I comparison after the two resolved targets, with Â12 = 0.835 and pH = 0.069. Time to trigger difficult bugs. Kaplan–Meier estimates [17, 21] censor untriggered campaigns at 24 hours. Method II establishes medians absent from the strongest baseline for TIF008 (11.6 hours), XML009 (13.7), SQL020 (15.1), and XML001 (22.1); no bug shows the reverse (Table 5). Among the 30 bugs with medians under both, the median time difference is zero. An in-budget median requires at least five of ten campaigns to trigger the bug, so the timing gain comes from making four difficult bugs repeatable within the campaign budget rather than shifting the common bugs earlier. Edge coverage and bug-site reach. Method II covers more edges than the composite on five targets, ties on php, and covers fewer on three (Table 14). On libxml2 it covers 8,954 versus 9,210 edges yet triggers 3.20 versus 2.60 bugs. It nevertheless reaches more injected bug sites than every baseline on libtiff, libxml2, and sqlite3, ties on the other six, and loses on none (Table 15). The gain therefore tracks additional bug sites, not broader edge coverage alone.

Benchmark. We use the nine-target Magma release [17] and, for each target, the harness reaching the most injected bugs. Magma’s reached and triggered oracles score completed campaigns but are hidden from every scheduler. Campaigns start from Magma’s seed corpus without a dictionary. Campaign protocol. Each cell contains ten independent 24hour campaigns on six cores under the same limits (§4.4). Campaigns have distinct seeds, containers, and corpus directories, exchange no runtime state, and launch together by target. Mean cell wall-clock is 24.00–24.09 hours. The 118 cells comprise 45 scheduler–target, 54 standalone-fuzzer–target, nine context-ablation, and ten alternative-reward cells: 1,180 campaigns and 169,920 core-hours. Equal wall-clock and core allocation define the budget because scheduling itself changes each engine’s corpus and execution rate. Controlled scheduler comparison. All five schedulers share the fuzzers, harness, seeds, seed sharing, coverage map, reward, container, resources, and duration; only allocation changes. We implement BandFuzz [46], AUTOFZ [13], and L EGION [56] in the common loop with their stated inputs and constants, without target-specific tuning. The appendix maps every rule and the conversion of round-level shares to six whole cores (§A.27); where paper and released code differ, we follow the paper. Each fuzzer also runs alone under the same budget. For target-level summaries, the comparator is the highest observed baseline mean on that target—a postcampaign composite, not one deployable scheduler. Figure 4 also gives the analogous standalone-fuzzer composite. Outcomes and logs. The primary outcome is mean distinct Magma bugs over the ten campaigns, with standard deviation; edge coverage is secondary. Logs record each decision, selected fuzzer, reward, and, where produced, context, prediction, and randomized draw. Each offline analysis states the campaigns and fields it uses. Pairwise inference. For each target and pair, we report Vargha–Delaney Â12 and a two-sided Mann–Whitney U test [3, 32], Holm-corrected over the nine-target family [19]. A difference is resolved when its gap reaches its pair-specific permutation resolution and pH < 0.05; otherwise we report direction. An exact two-sided sign test evaluates the non-tied target directions (§A.25).

6.2

RQ1: Unique bugs

Table 1 reports the schedulers, Table 12 the standalone fuzzers, and Figure 3 the four separating trajectories. All schedulers trigger the same seven bugs on libsndfile and three on php despite additional reachable sites (Table 4); the other seven targets determine the directions below.

9

Table 1: Mean unique Magma bugs over ten 24-hour campaigns per cell. The three right-hand schedulers are the baselines, each reimplemented from its own paper with its own constants and run in this harness on the same six fuzzers. ∆ is what the context-aware scheduler makes over whichever of the three is strongest on that target, and pH a two-sided Mann–Whitney U test of it after Holm correction over the family of nine targets. Bold marks the highest mean in a row and additionally marks Method I when it exceeds all three baselines. In the gain columns, bold marks a ∆ at or above what its own pair resolves (§7) and pH < 0.05. Each fuzzer alone is Table 12, standard deviations Table 13, edge coverage Table 14 and every pair’s effect size Table 11. this paper

unique bugs

target

baseline

context-aware phase-aware BandFuzz AUTOFZ L EGION

∆

pH 0.235 1.000 0.0001 0.317 1.000 1.000 1.000 0.478 0.029

libpng libsndfile libtiff libxml2 lua openssl php poppler sqlite3

4.00 7.00 5.00 3.20 1.60 2.00 3.00 4.20 4.20

3.90 7.00 4.30 2.70 1.30 1.80 3.00 3.20 3.30

3.40 7.00 3.70 2.10 1.10 1.60 3.00 3.10 3.40

3.20 7.00 4.00 2.60 1.20 2.00 3.00 2.80 3.00

3.60 +0.40 7.00 +0.00 3.60 +1.00 2.20 +0.60 1.40 +0.20 1.60 +0.00 3.00 +0.00 3.60 +0.60 3.00 +0.80

summed mean

34.20

30.50

28.40

28.80

29.00 +11.8% over the strongest

3 2 1 0

4 2 0 12 24 hours context-aware

sqlite3

poppler

libxml2

libtiff

0

gain

4 2 0

4 2 0 0

12 hours phase-aware

0

24 L EGION

12 hours

24

AUTOFZ

0

12 hours BandFuzz

24

Figure 3: Unique bugs over the campaign on the four targets where the schedulers separate, as the mean over each cell’s ten campaigns, with a band of one standard deviation across them for the context-aware scheduler. The separation opens late: the curves run together through the first hours and are apart by the last.

6.3

RQ2: Which bugs

Against standalone fuzzers. Each fuzzer also runs alone under the same protocol (§A.12). The strongest fixed fuzzer sums to 28.40, and the post-campaign per-target composite reaches 32.00 (Figure 4). Method II reaches 34.20: 20.4% above the fixed choice and 6.9% above the composite, leading it on four targets, tying five, and losing none. Sqlite3 (Â12 = 0.92, pH = 0.0045) and libtiff (Â12 = 0.80, pH = 0.040) resolve after correction; the four non-tied directions give exact sign p = 0.125.

Table 2 decomposes the bug-count differences on libpng, libtiff, and sqlite3. Nine common bugs contribute equally. PNG001 produces libpng’s gain; TIF008 and TIF001, partly offset by TIF002, produce libtiff’s; and SQL020, SQL012, SQL013, and SQL015 produce sqlite3’s. Specifically, Method II triggers PNG001 in all ten campaigns against L EGION’s six. Relative to the strongest baseline on each target, it adds eight campaign triggers on TIF008 and three on TIF001, offset by one fewer on TIF002; on sqlite3 it adds two each on SQL020 and SQL012, three on SQL013, and one on SQL015. Bugs outside the baseline union. Method II triggers three bugs absent from every baseline campaign: SQL013 in three campaigns, PDF021 in one, and SQL015 in one (Table 5). Against each baseline separately, the absent-bug counts are six for BandFuzz, eleven for AUTOFZ, and nine for L EGION. The gain therefore includes new triggered-bug coverage as well as more reliable triggering of shared bugs.

6.4

RQ3: What each design needs

When the differentiating bugs arrive. The 25 bugs triggered by every campaign of every scheduler have medians within the first 11% of the budget, with a median at 2%. Seven of Method II’s differentiating bugs have medians from 5.6 to 22.1 hours, median 13.6; five arrive after the first quarter and XML001 in the final quarter (Table 5; §A.26). Domain-guided and learned context. Method I’s one phase

10

Table 2: Per-bug campaign counts for libpng, libtiff, and sqlite3: the two targets with resolved Method II gains and the target on which every Method II campaign triggers the same four bugs. Rows list every bug triggered by any scheduler in the table, and each entry is the number of that cell’s ten campaigns that trigger it. Dividing a column sum by ten gives the corresponding mean in Table 1. NEW marks a bug triggered by no baseline campaign. target

libpng

libtiff

mean unique bugs

sqlite3

8

bug

BandFuzz

AUTOFZ

L EGION

context-aware (this paper)

PNG003 PNG006 PNG007 PNG001

10 10 10 4

10 10 10 2

10 10 10 6

10 10 10 10

mean

3.40

3.20

3.60

4.00

TIF007 TIF012 TIF014 TIF002 TIF008 TIF001

10 10 10 4 2 1

10 10 10 10 0 0

10 10 10 6 0 0

10 10 10 9 8 3

mean

3.70

4.00

3.60

5.00

SQL002 SQL014 SQL018 SQL020 SQL012 SQL013 SQL015

10 10 10 3 1 0 0

10 10 10 0 0 0 0

10 10 10 0 0 0 0

10 10 10 5 3 3 1

mean

3.40

3.00

3.00

4.20

NEW NEW

campaigns, 37.0% of libxml2 campaigns, and 35.9% of poppler campaigns, versus below 10% on every other target. The direct comparison selects Method II for C AROL (§A.11). Allocation learned during the campaign. No method parameter names a fuzzer or fixes its CPU share (goal G2). Method II’s largest share rises from 92.1% to 96.6% across quarters on libtiff and from 37.6% to 76.4% on poppler, but stays near its initial level on sqlite3 and libxml2. The targetdependent allocation follows the online estimates. Method I’s concentration instead follows its first rotting verdict; BandFuzz’s largest share falls from 80.6% to 24.5% on libtiff and from 74.7% to 38.6% on sqlite3 (Figure 6; §A.7).

context-aware (34.20) strongest baseline (30.60) strongest fuzzer alone (32.00)

6 4 2 0

l r f e a 3 2 png fil tif ml lu penss php pple qlite o lib ibsnd lib libx s o p l Figure 4: Method II against two post-campaign composites. For each target, the baseline bar selects the highest mean among the three baselines, and the standalone-fuzzer bar selects the highest mean among the six fuzzers run alone. The legend reports the sums across targets; Table 12 gives every standalone-fuzzer cell.

6.5

RQ4: Unknown bugs

RQ4 evaluates deployment on new targets (goal G3). We run the shipped Method II configuration unchanged, without target-specific pretraining, on five C++ programs outside the Magma evaluation. The harnesses invoke documented file-parsing entry points, and each defines only its own main (§A.14). The unchanged deployment produces 120 previously unknown defect records: 62 in MNN, 42 in Arm NN, 14 in Krita, one in ncnn, and one in FreeCAD (Table 16). We deduplicate by faulting function, file, line, sanitizer-reported fault, and

signal gains 5.2%–7.4% over the baselines. Method II learns from 15 signals and gains another 12.1%, leading Method I on seven targets and tying two. The environment varies sharply: nonzero second-half reward ranges from 0.4% of turns on libpng to 40.3% on poppler, and a model frozen after the first half fails to describe the second half in 49.0% of sqlite3

11

−1.00

entry point after removing known and nonreproducing candidates. Every record crashes the corresponding uninstrumented build in five of five runs. MNN and Arm NN account for 104 defects reached through model conversion or deserialization, giving them a model-supply-chain exposure path (§A.28). We reported every record through the channel prescribed by the project’s security policy. Triage places 73 in the crash class and 47 in the withheld class for memory corruption or information disclosure; 42 crash-class records have public tracker issues with working reproducers, while Arm NN’s remaining 31 stay under vendor-requested coordination. The appendix reports the available weakness, location, function, and disclosure details without publishing a trigger or reproducing input. These results establish previously unknown, reproducible crashing defects; independent exploitability is outside the evidence evaluated here.

7

−0.69 form rank models ridge

−0.20 −0.20

held-out only 0.00 0.00

−1 −0.75 −0.5 −0.25 0 change in mean unique bugs per target Figure 5: Ablations of Method II. Each bar reports the change in mean unique bugs per target when one setting is replaced, with each pair run at full campaign length under the protocol of §7. Explore removes the Gaussian uncertainty term. Context replaces all 15 signals with an intercept and therefore also makes the context-derived confidence width identical across fuzzers. Form uses a linear instead of random-Fourier representation; rank uses a rank-3 projection; models shares one model across fuzzers; and ridge increases λ from 10 to 100. The colored bars mark context and exploration, the only components whose removal produces a difference resolved by at least one full-campaign pair. The remaining full-campaign replacements stay within their pairs’ resolution. Discounting is evaluated by held-out reward prediction and therefore carries no bar (§A.24).

Ablation

Goal G4 asks which components of Method II produce its full-campaign bug-count gain. Figure 5 identifies two: removing the context costs 0.69 mean unique bugs per target, and removing exploration costs 1.00. None of the other fullcampaign alternatives in the figure produces a difference that its pair resolves. We evaluate changes to the deployed scheduler on fullcampaign unique bugs using the pairwise protocol of §6.1. We evaluate choices about predictive information, such as discounting past observations, by leave-one-campaign-out held-out reward prediction. §A.24 gives the per-pair measurements and resolutions. The context. We isolate the context-aware decision by replacing all 15 signals with an intercept while retaining the same per-fuzzer ridge update, randomized selection rule, reward, substrate, and constants. This intercept-only scheduler runs for the full campaign on all nine targets with ten campaigns per cell. Because ctx_unc is one of the removed signals, the control also makes the confidence width identical across fuzzers; it measures the complete context-aware decision signal, including its context-derived uncertainty. The intercept-only scheduler triggers 28.00 mean unique bugs summed across the suite, compared with 34.20 for Method II and 28.40 for BandFuzz. Restoring the complete context-aware decision therefore adds 6.20 bugs, while the same learning rule without that signal is 0.40 below BandFuzz. The gain over the intercept-only scheduler reaches its pairspecific resolution on five targets: poppler at +1.60, libtiff at +1.40, libxml2 at +1.00, and sqlite3 and libpng at +0.80 each. The lua gap remains below its resolution; the pairs on openssl, libsndfile, and php admit no resolved difference (§A.24). Held-out prediction separates contextual information from the uncertainty signal. A model using only an intercept and

ctx_unc has 9.7% more prediction error at the median fold than the full context, performs worse on all nine targets after Holm correction, and performs better on none. Thus, the fullcampaign gain requires the complete context-aware decision, and the predictive gain extends beyond its pull-count-derived uncertainty signal. The exploration term. Removing the Gaussian uncertainty term reduces summed mean unique bugs from 34.20 to 25.20, a loss of 1.00 per target, and reduces edge coverage by 16%. This is the largest full-campaign ablation: without exploration, Method II trails every baseline and three of the six fuzzers run alone. The decision traces show the corresponding change in allocation. With selection based only on the current predicted mean, no passed-over fuzzer regains the highest prediction across any learned decision in any campaign. The scheduler consequently locks onto one fuzzer, whereas randomized uncertainty keeps fuzzers with weakly observed contexts in contention. Method II uses a perturbation multiplier of one on every target.√Increasing λ from 10 to 100 narrows the width by at most 10 yet changes mean unique bugs by 0.00 per target. The result therefore persists across the measured scale change. The basis width D, bandwidth σ, and multiplier itself were not varied; the experiment establishes the contribution of exploration without selecting an optimal scale (§A.17).

12

Remaining model choices. Increasing λ from 10 to 100 and replacing the per-fuzzer models with one shared model each changes mean unique bugs by 0.00 per target. A rank-3 projection and a linear representation each reduce the mean by 0.20; neither difference reaches its pair-specific resolution. Held-out prediction determines the choices that fullcampaign bug count does not separate. No tested low-rank projection improves on the full context on any target, and 34 of the 54 target-rank tests significantly favor the full context. Both tested forgetting factors increase prediction error on all nine targets after Holm correction and reduce it on none. At campaign-scale data volumes, the random-Fourier representation has 6.9%–36.1% lower error than the linear representation on both tested targets, and prediction also favors separate per-fuzzer models. The sweep does not vary D, σ, the one-turn warm-up, the ±5 clamp, the 84-decision reward window, or the perturbation multiplier. These remain fixed across targets; their roles are detailed in §A.21.

8

uler. Method II optimizes predicted next-turn reward under concurrent, delayed, and coupled feedback. Its performance evidence is the observed full-campaign bug count at the tested horizon; campaign-optimal scheduling remains open. The model-design analyses hold out campaigns within a target rather than entire targets. The real-world evaluation establishes unchanged deployment and validated findings rather than comparative gain. Finally, the two motivating target statistics have rank correlations of 0.20 and 0.00 with targetlevel gain. The evaluation therefore establishes the suite-level benefit of context but does not yet identify before a campaign which targets will benefit most.

9

Conclusion

Ensemble scheduling should respond to the situation each fuzzer is in, not only summarize what that fuzzer produced before. Across 1,841 campaign–fuzzer pairs, raw per-turn reward falls in 96.7% of them, while consecutive-window rankings are no more stable than two estimates formed within the same window. The useful weighting is also target-specific: a model learned from eight targets predicts the ninth worse than one learned within that target on eight of nine targets, and the two select different top-ranked fuzzers on a median 51.0% of decisions. C AROL turns these observations into two context-aware online-learning methods. Method I encodes the domainguided distinction between rising and rotting reward and improves summed mean unique bugs over the three baselines by 5.2% to 7.4%. Method II learns how the full context predicts reward during the current campaign. It improves on Method I by 12.1% and triggers 20.4%, 18.8%, and 17.9% more unique bugs than the three baselines, or 11.8% more than the strongest baseline selected separately for each target. Its additional yield includes bugs the baselines trigger rarely or never and continues into the final quarter. The ablations identify the complete context-aware decision and randomized uncertainty as the two components that produce the full-campaign result: replacing the context with an intercept costs 0.69 mean unique bugs per target, and removing exploration costs 1.00. The same Method II configuration deploys without target-specific pretraining on five widely used C++ programs, where it finds 120 previously unknown, reproducible crashing defects and reports all of them through the maintainers’ prescribed channels. Together, these results show that learning a target-specific mapping from observable context to reward produces a stronger ensemble than fixing how past fuzzer output is combined before the campaign.

Discussion

What to encode and what to learn. Goal G1 asks that general structure be encoded and target-specific behavior be learned. Method I encodes one such structure—whether a fuzzer’s reward is rising or rotting—and learns the resulting allocation online. This domain guidance alone improves summed mean unique bugs over the three baselines by 5.2% to 7.4%. Method II instead learns the weighting of the full context during the current campaign while treating the context-toreward relationship as fixed within that campaign. It improves on Method I by another 12.1%, leading on seven targets, tying on two, and trailing on none. This direct comparison selects Method II for C AROL. The same configuration runs on all nine Magma targets and deploys unchanged on the five realworld programs, where it reveals 120 previously unknown crashing defects. These results place the design boundary: encode that a fuzzer’s current context and the uncertainty behind its prediction govern scheduling, but learn how the context signals predict reward on the current target. Scope of the evidence. The comparative result covers nine Magma targets, 24-hour campaigns, and one pool of six fuzzers, four of them AFL-lineage. Running every policy in the common dispatch loop holds the harness, reward, seed sharing, resources, and campaign length fixed, isolating the scheduling rule. The comparison therefore concerns those rules under common conditions rather than end-to-end reproductions of the released systems. An equal-share ensemble is not among the comparators (§A.27). Proposition 1 establishes that context can be necessary; it does not provide a regret guarantee for the deployed sched-

13

Ethical Considerations This work identifies memory-safety defects in production software. We considered four stakeholder groups: maintainers who triage and fix reports, users of the affected software, the wider open-source community, and potential adversaries who could use a defect disclosed before a patch exists. Disclosure. We reported each defect as soon as it was triaged and minimized, following the security process published by the corresponding project. All 120 records reproduce as crashes without sanitizers or coverage instrumentation. The worst outcome observed across a defect’s runs determined its disclosure class. Of the 73 crash-class records, 42 appear in public issue trackers with working reproducers and 31 remain under vendor-requested coordination. The 47 records involving memory corruption or information disclosure were reported only through private security channels. Status snapshot. At the paper’s status snapshot, no defect had been fixed and no CVE identifier had been assigned. We did not request CVEs, following the recommendation that maintainers do so [41]. Eight public issues contain the 42 publicly filed records across MNN, Krita, and ncnn, grouping defects that share an entry point. Each issue records the program, version, weakness class, and fault location also reported in Tables 7 and 8. Vendor coordination. One vendor requested in writing that public disclosure be coordinated with it. Those records remain included in the totals of §6.5 and Table 16, but their locations, triggers, and reproducers do not appear in the paper or artifact. They remain withheld until the vendor issues its advisory. Publication boundary. The paper reports the affected program, version, and defect class for every record, and source locations for records outside the coordinated vendor. It publishes no trigger sequence or reproducing input. Public reproducers accompany the public crash-class reports; memorycorruption, information-disclosure, and coordinated vendor material remain withheld under the policy above. Every record was reported to its maintainer immediately after triage.

14

Open Science

policies; memory-corruption and information-disclosure reproducers remain restricted. The classification uses the worst outcome observed across a defect’s runs and was fixed at triage before reporting. Restricted inputs will be released after the affected project ships a fix or states that it will not act. If neither occurs, they remain restricted. Material covered by the vendor’s coordination request remains withheld until that vendor authorizes release. The public record still contains the harness, build configuration, symbolized fault location where permitted, and full sanitizer output. Where it lives, and when it was counted. The artifact is deposited in an anonymous GitHub repository during review. The archival release will be deposited as two stable records rather than depend on a source-hosting account. The public one will carry the schedulers, harnesses, configurations, percampaign data and the complete defect table; the restricted one will carry the withheld reproducers. Every status in Table 16 is a snapshot at the time of writing. Statuses change, and the projects’ own records are authoritative over this paper’s copy of them. A reduced protocol. The artifact ships a reduced protocol of one target and all five schedulers, at reduced repetition. It exercises every code path the full evaluation does on a single workstation. The complete per-campaign records ship with it, so the full table can be checked without re-running it.

The anonymous artifact is available at https://anonymou s.4open.science/r/CORAL-fuzzing/README.md. It contains the source, configurations, campaign records, and analysis scripts needed to reproduce the paper’s results. The link performs no tracking. On acceptance, the records will move to a stable public location under the authors’ names. Artifact 1: the schedulers and the harness. This artifact contains the complete C AROL source: both schedulers, the dispatch loop, all three baselines, adapters for all six fuzzers, the shared seed store, and the evaluator. Container definitions pin every fuzzer and target build, and the launcher reproduces a campaign end to end. These materials rerun any cell of Table 1. Artifact 2: benchmark configuration and per-campaign data. This artifact contains per-target configuration files for every scheduler and fuzzer alone, including every parameter value behind Table 1, and the per-campaign records behind the reported results. Each record holds its configuration, its coverage and unique-bug time series, and the Magma oracle’s per-bug trigger record. Table 1, Table 2, and Figure 1 are regenerated from these records by artifact scripts. results_table.py prints the main and reward comparisons, chat_report.py prints one campaign’s complete record, and the README gives the invocation for every remaining table and figure. Artifact 3: the offline design analyses. This artifact contains the per-decision logs and analysis scripts behind the context and exploration ablations and the setting sweep of §7. They cover the held-out reward-prediction comparison with and without the context, feature influence per feature, the linear-against-non-linear measurement at every training volume, the rank and leave-one-feature-out comparisons, the raw pre-scaling per-turn rate behind the decay measurement of §2.2, the permutation test for coefficient drift behind §6.4, and the frozen campaign list and leave-one-campaign-out protocol they all read. Artifact 4: the real-world harnesses and reports. This artifact contains the harness source for each of the five programs of §6.5, the exact configuration from each build’s cache, and the per-defect reports. Each report gives the weakness class, full sanitizer output, and the fault location for every defect outside the coordinated vendor. The public artifact contains minimized crashing inputs for the 42 publicly filed defects. Public reports record the corresponding project and status. The anonymous-review artifact omits direct tracker URLs; the post-review record will restore them as the authoritative maintainer records. The artifact states which channel carried every defect. Withheld material and release conditions. The public artifact excludes minimized inputs for the 47 records. Crash-class reproducers follow the affected projects’ public-reporting

15

References

Defenses (RAID), pages 77–92, 2020. https://www.usenix.org/conference/raid2020/ presentation/chen.

[1] Alekh Agarwal, Daniel Hsu, Satyen Kale, John Langford, Lihong Li, and Robert E. Schapire. Taming the monster: A fast and simple algorithm for contextual bandits. In 31st International Conference on Machine Learning (ICML), pages 1638–1646, 2014. https:// proceedings.mlr.press/v32/agarwalb14.html.

[10] Yuanliang Chen, Yu Jiang, Fuchen Ma, Jie Liang, Mingzhe Wang, Chijin Zhou, Xun Jiao, and Zhuo Su. EnFuzz: Ensemble fuzzing with seed synchronization among diverse fuzzers. In 28th USENIX Security Symposium (USENIX Security 19), pages 1967–1983, 2019. https://www.usenix.org/conference/usen ixsecurity19/presentation/chen-yuanliang.

[2] Shipra Agrawal and Navin Goyal. Thompson sampling for contextual bandits with linear payoffs. In International Conference on Machine Learning (ICML), 2013. https: //proceedings.mlr.press/v28/agrawal13.html.

[11] Andrea Fioraldi, Dominik Maier, Heiko Eißfeldt, and Marc Heuse. AFL++: Combining incremental steps of fuzzing research. In 14th USENIX Workshop on Offensive Technologies (WOOT 20), 2020. https://www.usenix.org/conference/woot20/pr esentation/fioraldi.

[3] Andrea Arcuri and Lionel Briand. A hitchhiker’s guide to statistical tests for assessing randomized algorithms in software engineering. Software Testing, Verification and Reliability, 24(3):219–250, 2014. https://doi.org/10.1002/stvr.1486.

[12] Dylan J. Foster and Alexander Rakhlin. Beyond UCB: Optimal and efficient contextual bandits with regression oracles. In 37th International Conference on Machine Learning (ICML), pages 3199–3210, 2020. https:// proceedings.mlr.press/v119/foster20a.html.

[4] Alberto Bietti, Alekh Agarwal, and John Langford. A contextual bandit bake-off. Journal of Machine Learning Research, 22(133):1–49, 2021. https://jmlr.org/papers/v22/18-863.html.

[13] Yu-Fu Fu, Jaehyuk Lee, and Taesoo Kim. autofz: Automated fuzzer composition at runtime. In 32nd USENIX Security Symposium (USENIX Security 23), pages 1901–1918, 2023. https://www.usenix.org/conference/usenixse curity23/presentation/fu-yu-fu.

[5] Marcel Böhme, Van-Thuan Pham, and Abhik Roychoudhury. Coverage-based greybox fuzzing as markov chain. In ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 1032–1043, 2016. https://doi.org/10.1145/2976749.2978428.

[14] Yijia Gao, Wenrui Zeng, Siyuan Liu, and Yingpei Zeng. AutoFuzz: Automatic fuzzer-sanitizer scheduling with multi-armed bandit. Software Quality Journal, 33(1):8, 2025. https://doi.org/10.1007/s11219-025-09707-6.

[6] Marcel Böhme, László Szekeres, and Jonathan Metzman. On the reliability of coverage-based fuzzer benchmarking. In 44th International Conference on Software Engineering (ICSE), pages 1621–1633, 2022. https://doi.org/10.1145/3510003.3510230.

[15] Aurélien Garivier and Eric Moulines. On upper-confidence bound policies for switching bandit problems. In 22nd International Conference on Algorithmic Learning Theory (ALT), pages 174–188, 2011. https: //doi.org/10.1007/978-3-642-24412-4_16.

[7] Junhui Cai, Ran Chen, Martin J. Wainwright, and Linda Zhao. Doubly high-dimensional contextual bandits: An interpretable model for joint assortment-pricing. Management Science, 2026. Articles in Advance. https://doi.org/10.1287/mnsc.2024.08311.

[16] Emre Güler, Philipp Görz, Elia Geretto, Andrea Jemmett, Sebastian Österlund, Herbert Bos, Cristiano Giuffrida, and Thorsten Holz. Cupid: Automatic fuzzer selection for collaborative fuzzing. In Annual Computer Security Applications Conference (ACSAC), pages 360–372, 2020. https://doi.org/10.1145/3427228.3427266.

[8] Chen Chen, Zaiyan Xu, Mohamadreza Rostami, David Liu, Dileep Kalathil, Ahmad-Reza Sadeghi, and Jeyavijayan Rajendran. ReFuzz: Reusing tests for processor fuzzing with contextual bandits. In Network and Distributed System Security Symposium (NDSS), 2026. https://doi.org/10.14722/ndss.2026.240118.

[17] Ahmad Hazimeh, Adrian Herrera, and Mathias Payer. Magma: A ground-truth fuzzing benchmark. Proceedings of the ACM on Measurement and Analysis of Computing Systems (POMACS), 4(3):1–29, 2020. https://doi.org/10.1145/3428334.

[9] Yaohui Chen, Mansour Ahmadi, Reza Mirzazade Farkhani, Boyu Wang, and Long Lu. MEUZZ: Smart seed scheduling for hybrid fuzzing. In International Symposium on Research in Attacks, Intrusions and 16

[18] Aki Helin. Radamsa: a general-purpose fuzzer. https://gitlab.com/akihe/radamsa, 2022.

Conference on World Wide Web (WWW), pages 661–670, 2010. https://doi.org/10.1145/1772690.1772758.

[19] Sture Holm. A simple sequentially rejective multiple test procedure. Scandinavian Journal of Statistics, 6(2):65–70, 1979. https://www.jstor.org/stable/4615733.

[29] Yuekang Li, Yinxing Xue, Hongxu Chen, Xiuheng Wu, Cen Zhang, Xiaofei Xie, Haijun Wang, and Yang Liu. Cerebro: Context-aware adaptive fuzzing for effective vulnerability detection. In ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE), pages 533–544, 2019. https://doi.org/10.1145/3338906.3338975.

[20] Patrick Jauernig, Domagoj Jakobovic, Stjepan Picek, Emmanuel Stapf, and Ahmad-Reza Sadeghi. DARWIN: Survival of the fittest fuzzing mutators. In Network and Distributed System Security Symposium (NDSS), 2023. https://doi.org/10.14722/ndss.2023.23159.

[30] Chenyang Lyu, Shouling Ji, Chao Zhang, Yuwei Li, Wei-Han Lee, Yu Song, and Raheem Beyah. MOPT: Optimized mutation scheduling for fuzzers. In 28th USENIX Security Symposium (USENIX Security 19), pages 1949–1966, 2019. https://www.usenix.org/conference/usenixse curity19/presentation/lyu.

[21] E. L. Kaplan and Paul Meier. Nonparametric estimation from incomplete observations. Journal of the American Statistical Association, 53(282):457–481, 1958. https: //doi.org/10.1080/01621459.1958.10501452. [22] Siddharth Karamcheti, Gideon Mann, and David Rosenberg. Adaptive grey-box fuzz-testing with thompson sampling. In 11th ACM Workshop on Artificial Intelligence and Security (AISec), pages 37–47, 2018. https://doi.org/10.1145/3270101.3270108.

[31] Henry B. Mann. Nonparametric tests against trend. Econometrica, 13(3):245–259, 1945. https://doi.org/10.2307/1907187. [32] Henry B. Mann and Donald R. Whitney. On a test of whether one of two random variables is stochastically larger than the other. The Annals of Mathematical Statistics, 18(1):50–60, 1947. https://doi.org/10.1214/aoms/1177730491.

[23] Siddharth Karamcheti, Gideon Mann, and David Rosenberg. Improving grey-box fuzzing by modeling program behavior. arXiv preprint arXiv:1811.08973, 2018. https://arxiv.org/abs/1811.08973. [24] Maurice G. Kendall. Rank Correlation Methods. Charles Griffin & Company Limited, 1948. https://search.worldcat.org/title/Rank-cor relation-methods/oclc/3641982.

[33] Nicolai Meinshausen and Peter Bühlmann. Stability selection. Journal of the Royal Statistical Society: Series B, 72(4):417–473, 2010. https: //doi.org/10.1111/j.1467-9868.2010.00740.x.

[25] George Klees, Andrew Ruef, Benji Cooper, Shiyi Wei, and Michael Hicks. Evaluating fuzz testing. In ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 2123–2138, 2018. https://doi.org/10.1145/3243734.3243804.

[34] Alberto Maria Metelli, Francesco Trovò, Matteo Pirola, and Marcello Restelli. Stochastic rising bandits. In 39th International Conference on Machine Learning (ICML), pages 15421–15457, 2022. https://procee dings.mlr.press/v162/metelli22a.html.

[26] laf intel. Circumventing fuzzing roadblocks with compiler transformations. https://lafintel.wordp ress.com/2016/08/15/circumventing-fuzzingroadblocks-with-compiler-transformations/, 2016.

[35] Jonathan Metzman, László Szekeres, Laurent Simon, Read Sprabery, and Abhishek Arya. FuzzBench: An open fuzzer benchmarking platform and service. In 29th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE), pages 1393–1403, 2021. https://doi.org/10.1145/3468264.3473932.

[27] Nir Levine, Koby Crammer, and Shie Mannor. Rotting bandits. In Advances in Neural Information Processing Systems 30 (NIPS), pages 3074–3083, 2017. https://proceedings.neurips.cc/paper/2017/ hash/97d98119037c5b8a9663cb21fb8ebf47-Abst ract.html.

[36] Hyeonmin Mo, Jongmun Yang, and Yunho Kim. RCFuzzer: Recommendation-based collaborative fuzzer. Journal of Systems and Software, 230:112564, 2025. https://doi.org/10.1016/j.jss.2025.112564.

[28] Lihong Li, Wei Chu, John Langford, and Robert E. Schapire. A contextual-bandit approach to personalized news article recommendation. In 19th International 17

collaborative fuzzing with reinforcement learning. In ACM/IEEE International Workshop on Search-Based and Fuzz Testing (SBFT), 2024. https://doi.org/10.1145/3643659.3648563.

[37] Sebastian Österlund, Elia Geretto, Andrea Jemmett, Emre Güler, Philipp Görz, Thorsten Holz, Cristiano Giuffrida, and Herbert Bos. CollabFuzz: A framework for collaborative fuzzing. In 14th European Workshop on Systems Security (EuroSec), pages 1–7, 2021. https://doi.org/10.1145/3447852.3458720.

[46] Wenxuan Shi, Hongwei Li, Jiahao Yu, Xinqian Sun, Wenbo Guo, and Xinyu Xing. Bandfuzz: An ml-powered collaborative fuzzing framework. arXiv preprint arXiv:2507.10845, 2025. https://arxiv.org/abs/2507.10845.

[38] Ciara Pike-Burke and Steffen Grünewälder. Recovering bandits. In Advances in Neural Information Processing Systems (NeurIPS), 2019. https://proceedings.ne urips.cc/paper/2019/hash/9a093d729036a5b d4736e03c5d634501-Abstract.html.

[47] Robert Swiecki. honggfuzz. https://honggfuzz.dev/, 2024.

[39] Ali Rahimi and Benjamin Recht. Random features for large-scale kernel machines. In Advances in Neural Information Processing Systems (NeurIPS), pages 1177–1184, 2007. https://proceedings.neurips. cc/paper/2007/hash/013a006f03dbc5392effeb8f 18fda755-Abstract.html.

[48] William R. Thompson. On the likelihood that one unknown probability exceeds another in view of the evidence of two samples. Biometrika, 25(3–4):285–294, 1933. https://doi.org/10.1093/biomet/25.3-4.285.

[40] Yoan Russac, Claire Vernade, and Olivier Cappé. Weighted linear bandits for non-stationary environments. In Advances in Neural Information Processing Systems (NeurIPS), 2019. https://proc eedings.neurips.cc/paper/2019/hash/263fc48a ae39f219b4c71d9d4bb4aed2-Abstract.html.

[49] Michal Valko, Nathan Korda, Rémi Munos, Ilias Flaounas, and Nello Cristianini. Finite-time analysis of kernelised contextual bandits. In Conference on Uncertainty in Artificial Intelligence (UAI), pages 654–663, 2013. https://arxiv.org/abs/1309.6869.

[41] Moritz Schloegel, Nils Bars, Nico Schiller, Lukas Bernhard, Tobias Scharnowski, Addison Crump, Arash Ale-Ebrahim, Nicolai Bissantz, Marius Muench, and Thorsten Holz. SoK: Prudent evaluation practices for fuzzing. In IEEE Symposium on Security and Privacy (S&P), 2024. https://doi.org/10.1109/SP54263.2024.00137.

[50] Jinghan Wang, Chengyu Song, and Heng Yin. Reinforcement learning-based hierarchical seed scheduling for greybox fuzzing. In Network and Distributed System Security Symposium (NDSS), 2021. https://doi.org/10.14722/ndss.2021.24486. [51] Xiajing Wang, Changzhen Hu, Rui Ma, Donghai Tian, and Jinyuan He. CMFuzz: Context-aware adaptive mutation for fuzzers. Empirical Software Engineering, 26(1), 2021. https://doi.org/10.1007/s10664-020-09927-3.

[42] Pranab Kumar Sen. Estimates of the regression coefficient based on kendall’s tau. Journal of the American Statistical Association, 63(324):1379–1389, 1968. https: //doi.org/10.1080/01621459.1968.10480934.

[52] Yanhao Wang, Xiangkun Jia, Yuwei Liu, Kyle Zeng, Tiffany Bao, Dinghao Wu, and Purui Su. Not all coverage measurements are equal: Fuzzing by coverage accounting for input prioritization. In Network and Distributed System Security Symposium (NDSS), 2020. https://doi.org/10.14722/ndss.2020.24422.

[43] Julien Seznec, Pierre Ménard, Alessandro Lazaric, and Michal Valko. A single algorithm for both restless and rested rotting bandits. In 23rd International Conference on Artificial Intelligence and Statistics (AISTATS), pages 3784–3794, 2020. https://proceedings.mlr. press/v108/seznec20a.html.

[53] Peter Whittle. Restless bandits: Activity allocation in a changing world. Journal of Applied Probability, 25A:287–298, 1988. https://doi.org/10.2307/3214163.

[44] Dongdong She, Adam Storek, Yuchong Xie, Seoyoung Kweon, Prashast Srivastava, and Suman Jana. FOX: Coverage-guided fuzzing as online stochastic control. In ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 765–779, 2024. https://doi.org/10.1145/3658644.3670362.

[54] Maverick Woo, Sang Kil Cha, Samantha Gottlieb, and David Brumley. Scheduling black-box mutational fuzzing. In ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 511–522, 2013. https://doi.org/10.1145/2508859.2516736.

[45] Wenxuan Shi, Hongwei Li, Jiahao Yu, Wenbo Guo, and Xinyu Xing. BandFuzz: A practical framework for 18

[55] Tai Yue, Pengfei Wang, Yong Tang, Enze Wang, Bo Yu, Kai Lu, and Xu Zhou. EcoFuzz: Adaptive energy-saving greybox fuzzing as a variant of the adversarial multi-armed bandit. In 29th USENIX Security Symposium (USENIX Security 20), pages 2307–2324, 2020. https://www.usenix.org/confe rence/usenixsecurity20/presentation/yue. [56] Yukai Zhao, Shaohua Wang, Jue Wang, Xing Hu, and Xin Xia. Ensemble fuzzing with dynamic resource scheduling and multidimensional seed evaluation. ACM Transactions on Software Engineering and Methodology, 2026. https://doi.org/10.1145/3834771.

19

A

Supplementary Material

A.1

The full context

A.2

Per-target bug ceilings

A.3

Time to trigger each bug

A.4

Real-world weakness classes

A.5

Where each defect is

A.6

Alternative reward definitions

A.7

Allocation by scheduler

tained without a context. An intercept-plus-ctx_unc model has 9.7% more held-out prediction error at the median fold than the full context. It performs worse on all nine targets after Holm correction and better on none. The predictive contribution of the context therefore extends beyond its pullcount-derived uncertainty signal. Context representation. We evaluate reward-supervised lowrank projections [7]. For each leave-one-campaign-out fold, we fit the per-fuzzer weight matrix Θ ∈ RK×15 , retain its top-r right singular directions, refit the ridge model on the projected columns, and compare held-out squared error with the unprojected model. One target and one rank form a two-sided Wilcoxon signed-rank test, Holm-corrected over six ranks within the target. The 532 campaigns yield 54 tests and 3,189 paired observations; three folds lack enough rows for one projected fit. No tested rank improves on the full context on any target. Thirty-four tests significantly favor the full context, spanning eight targets, and 72.0% of paired observations favor it. The direction remains when the projection selects its ridge from {1, 3, 10}. In the live comparison, a rank-3 scheduler reduces mean unique bugs by 0.20 per target, within the pair’s resolution. Method II therefore retains the complete context. Cost. One decision standardizes six contexts, expands each representation, scores the fuzzers, and draws a selection in 8.0 µs. This cost is negligible relative to the TI = 120 s turn it governs.

Concentration over time. The baseline trace diffuses: the largest fuzzer’s share falls from 81% in the first quarter to 25% in the last on libtiff and from 75% to 39% on sqlite3. Method II concentrates as evidence accumulates, moving from 92% to 97% on libtiff and from 38% to 76% on poppler, while remaining stable on sqlite3 and libxml2. Method I’s concentration follows its first rotting verdict (§4.3). Thus, each scheduler learns an allocation, but its evidence source differs: reward summaries for the baseline, an expertise-guided phase for Method I, and the learned context-to-reward relationship for Method II.

A.8

Ablation detail

Measurement scope. The leave-one-feature-out, transfer, pull-count, and low-rank tests use leave-one-campaign-out folds on all nine targets. The feature-influence replay in Table 10 reports six targets, while the decision totals in §5.1 cover all nine. The reward sweep covers five targets, the linear comparison covers two, and the full-campaign context ablation covers all nine at ten campaigns per cell. Full context against reward history. For each fuzzer, we fit a model on all but one campaign and score the held-out campaign, once with the full context and once with the rewardhistory signals win_mean, win_var, slope, mk_z, the three horizon ratios, and cov_velocity. The full context has lower error on all nine targets after Holm correction and higher error on none. It wins on 66.7% to 96.2% of each target’s held-out campaigns; reward history alone has 2.1% more squared error at the median fold. Because ctx_unc is one of the removed signals, the intercept-only scheduler also makes the context-derived confidence width identical across fuzzers. Its full-campaign difference therefore measures the complete context-aware decision signal, including that uncertainty term. Held-out prediction with an intercept and ctx_unc alone separates the remaining contextual information. Context beyond pull count. The ctx_unc signal is a function of a fuzzer’s pull count, an observable already main-

A.9

Linear against non-linear

We compare the two forms at the data volume available within a live campaign. Each is fitted on one fuzzer’s first n updates and scored on its next 25. The random-Fourier form has lower held-out error at every volume tested: on sqlite3 by 36.1%, 25.2%, 19.2%, 9.1%, and 6.9% at n = 12, 25, 40, 100, and 240, and on poppler by 34.2%, 30.1%, and 32.0% at the first three volumes. Both forms use the same input, standardization, and ±5 clamp and have nearly the same number of columns (16 and 17). They differ in column scale: a linear column is bounded by p the clamp, whereas a random-Fourier column is bounded by 2/D = 0.354. Under the same ridge penalty, a coefficient therefore moves a linear prediction three to eleven times farther than a random-Fourier prediction; the corresponding feature-vector norms are about 4–19.4 and about 1. These measurements support the bounded random-Fourier representation used by Method II, not a claim about nonlinear expressiveness. The live comparison is −0.20 unique bugs per target, within the pair’s resolution (Figure 5). A scalematched linear representation or a linear model with its own ridge penalty was not measured.

20

Table 3: The 15 context features, one vector per fuzzer per decision. Every one is computed from quantities the dispatch loop already maintains. None requires a bug oracle, a source annotation or a benchmark harness. Every window and code-property feature is latched when a fuzzer’s turn ends, so nothing computed from a turn’s outcome depends on the turn whose reward the decision is predicting. time_since_run and elapsed_frac are clocks and advance while a fuzzer waits, which is what makes the first a freshness signal. name

how it is computed

recent productivity win_mean win_var cov_velocity slope trend and horizon mk_z horizon_ratio horizon2_ratio horizon8_ratio

mean reward over the window variance of the reward there 1 − e−ρ , ρ the edges this fuzzer newly covered in the last 120 s of wall clock over the span of that window in seconds least-squares slope of the reward window tanh(z), z the Mann–Kendall statistic of the window standardized with the same continuity and tie corrections as §4.3 mean of the last 4 rewards over the window mean the same over the last 2 the same over the last 8

plateau and freshness rounds_since_improve rounds since it last added an edge, over the window length time_since_run time since this fuzzer last ran, over the campaign so far elapsed_frac fraction of the campaign budget consumed what the covered code looks like g_rarity exponential moving average, rate 0.3, over completed turns of the mean of 1/ log(2 + he ) across that turn’s newly covered edges, he the ensemble-wide hit count of edge e at that time g_sec exponential moving average, rate 0.3, of 1 − e−s̄ over completed turns, s̄ the mean over that turn’s newly covered edges of se , the count of memory-handling calls the block entered by e makes, read once from the instrumented binary at build time [52]; no source annotation and no bug oracle g_bug exponential moving average, rate 0.3, over completed turns of 1 − e−c , c the number of this fuzzer’s own inputs that crashed in that turn; a crash count, not a bug count, and no oracle reads it estimate quality ctx_unc

A.10

√ 1/ 1 + na , na this fuzzer’s turns so far

How the context was chosen

tion significantly worse in 28 tests and significantly better in 6. No feature is better removed on more than two targets, and the features that help on some targets overlap those that hurt on others. We therefore retain the fixed representation instead of selecting it on the campaigns reported here. horizon8_ratio is better removed on two targets and better retained on none. The security signals g_sec and g_bug do not improve held-out prediction on any target, and removing each helps on one. Their influence on flat targets can still break weakly determined ties, as Step 2 shows. Step 2: rank by feature influence. We replay every logged decision twice, once from the recorded contexts of all K fuzzers and once with one feature replaced by its standardized mean of zero, while holding the draw fixed. A feature’s influence is the fraction of decisions whose top-ranked fuzzer changes. The ranking reproduces across independent campaign subsets in the style of stability selection [33]; it is a diagnostic rather than a filter. Table 10 gives the four strongest features. The influence of

Step 1: enumerate and prune. Two rules reduce the 21 candidates of §5.1 to 15. Across 1,662,902 decision rows from the 540 campaigns with context vectors, Rule 1 removes the one candidate with exactly zero within-campaign range, the covered fraction of the map. Rule 2 removes five exact arithmetic identities of retained quantities, each with zero residual in double precision. Table 3 lists the resulting representation. We then evaluate each retained feature with leave-onecampaign-out prediction. For every target and feature, we fit the per-fuzzer ridge on the target’s other campaigns with all 15 features and with that feature removed, then compare reward-prediction error on the held-out campaign. A twosided Wilcoxon signed-rank test uses one paired observation per campaign, with Holm correction over features within each target. What the test says. The evaluation covers 135 target–feature tests over 532 campaigns. Removing a feature makes predic-

21

largest fuzzer’s share (%)

poppler

libtiff 100 75 50 25

sqlite3

100 75 50 25 Q1 Q2 Q3 Q4 campaign quarter

100 75 50 25 Q1 Q2 Q3 Q4 campaign quarter

100 75 50 25 Q1 Q2 Q3 Q4 campaign quarter

phase-aware

BandFuzz

libxml2

Q1 Q2 Q3 Q4 campaign quarter

context-aware

Figure 6: Allocation concentration by campaign quarter. Each point is the share of scheduling decisions received by the mostselected fuzzer in that quarter, averaged over the ten campaigns in the corresponding cell of Table 1; the fuzzer at the peak may change between quarters. Method I’s allocation follows its first rotting verdict, while Method II’s follows the context-to-reward relationship learned during the campaign (§4.3). scheduling decision.

Table 4: What was available to be found. injected is the number of bugs Magma re-introduces into the target; reachable is how many of those the Magma oracle records as reached through the single harness we fuzz. The second column bounds every number in Table 1. target

harness

libpng libpng_read libsndfile sndfile libtiff tiff_rgba libxml2 xml_reader lua lua openssl asn1 php exif poppler pdf sqlite3 sqlite3

A.11

How far the assumed shape carries. §6.4 names two measurements of target heterogeneity. First, non-zero rewards occupy 0.4% of libpng’s second-half turns and 40.3% of poppler’s. Second, we fit each campaign’s per-fuzzer coefficient matrix on its first half and score it on its second. We compare that error with the distribution obtained by fitting and scoring random halves of the same campaign; the ordered split fails when its error exceeds the 95th percentile. The fit fails in 49.0% of sqlite3 campaigns, 37.0% of libxml2 campaigns, and 35.9% of poppler campaigns. The rates on the other six targets are 9.5% for libtiff, 7.9% for lua, 5.9% for openssl, 2.5% for libsndfile, 0.7% for libpng, and zero for php. Thus both the remaining reward and within-campaign drift vary sharply by target. Their rank correlations with Method II’s gain are 0.20 and 0.00 (§A.13); the direct Method I–Method II comparison determines which design performs better. Plateau signature. We call a signal moved when its standardized value changes by more than one standard deviation across a window. For each trigger of a bug that contextaware scheduler reaches in more campaigns than BandFuzz, we take one window per fuzzer over the preceding 90 minutes. rounds_since_improve moves in 65% of windows (mean standardized change +0.61), time_since_run in 53% (+0.39), and cov_velocity in 12% while remaining below its campaign average. Over all bugs, the coverage signal moves more often and the plateau signals less often. These measurements describe trigger windows but do not supply a time-matched base rate. In particular, time_since_run rises with idleness. They therefore establish a contrast between the observed sets, not unusual plateau activity. rounds_since_improve is nevertheless observable context supplied to the model (Table 3).

injected reachable 7 18 14 17 4 20 16 22 20

What the difference is made of

6 8 9 10 4 4 5 17 14

the strongest ranges from 20.7% of decisions on libxml2 to 62.4% on libtiff. g_sec changes many rankings on libsndfile despite carrying no held-out predictive signal. libsndfile and php are the two targets on which no scheduler’s bug count differs (§6.2); weakly determined coefficients on these targets allow a feature to break ties without improving prediction. Step 3: is one weighting enough? We fit one per-fuzzer model on the other eight targets, freeze it, and compare it on this target’s held-out campaign with the model fitted within this target. Across the same 532 campaigns, the transferred weighting predicts significantly worse on eight of nine targets after Holm correction and better on none. On libtiff it is worse at the median without reaching significance. It is worse on 66.7% to 97.4% of each target’s held-out campaigns. Replaying the held-out campaigns converts the prediction comparison into decisions: the transferred and within-target weightings select different top-ranked fuzzers on 26.8% to 60.4% of a target’s decisions, median 51.0%. A fixed weighting therefore fails to transfer, and the difference reaches the

22

Table 5: Time to trigger, over every bug the context-aware scheduler and the baselines do not trigger equally often, hardest first. baseline is the strongest of the three on that bug, taken as the one that triggers it in the most campaigns and then the one that reaches its median soonest. camp is how many of that cell’s ten campaigns trigger the bug with a sampled trigger time, med the Kaplan–Meier median, — that fewer than half trigger it so no median falls in budget. baseline

A.12

target

bug

sqlite3 poppler sqlite3 libtiff sqlite3 poppler libtiff libxml2 lua lua sqlite3 libxml2 libpng poppler poppler libtiff

SQL013 PDF021 SQL015 TIF001 SQL012 PDF008 TIF008 XML001 LUA001 LUA003 SQL020 XML009 PNG001 PDF012 PDF018 TIF002

camp 0 0 0 1 1 1 2 2 2 2 3 4 6 6 8 10

Table 6: Weakness classes of the 120 real-world defects, taken from the class each defect document assigns from its sanitizer evidence and the source at the fault site. Five reports carry no class of their own and are counted as such. class

context-aware

med camp

med

3 1 1 3 3 0 8 5 3 3 5 6 10 8 10 9

— — — — — — 11.6 h 22.1 h — — 15.1 h 13.7 h 5.8 h 5.6 h 13.6 h 10.1 h

— — — — — — — — — — — — 18.7 h 10.8 h 11.2 h 10.6 h

Every fuzzer alone

CWE-476 null pointer dereference CWE-125 out-of-bounds read CWE-129 improper validation of an array index CWE-787 out-of-bounds write CWE-369 divide by zero CWE-789 memory allocation with an excessive size other (integer overflow, integer underflow, type confusion, use after free) no class in the report

54 34 11 6 3 3

total

120

4 5

• MNN: the converter’s format front ends, each reached by MNN::Cli::convertModel on a model of that format; • Arm NN: IDeserializer:: CreateNetworkFromBinary; • ncnn: ncnn::Net::load_param; • FreeCAD: MeshInput::LoadFormat; • Krita: loadFromDevice, KisAslReader::readFile and Compression::uncompress.

Sampling and association

A campaign enters the ordering measurement only when four fuzzers complete four turns in both windows of a pair. This selection favors less concentrated schedules. The same filter admits 1,841 campaign–fuzzer pairs to the decay measurement. Across the nine targets, the rank correlation between reward decay and Method II’s gain is 0.20; the correlation between within-window ranking agreement and that gain is 0.00. Two of the nine targets are flat, with no scheduler difference. These measurements do not establish a dose response between either motivating statistic and scheduler gain.

A.14

defects

8 perform a write access of any kind and 4 of those write past an allocation. The rest fault without writing anything we observed. These run-level observations differ from the weakness classes in Table 6, so the write count is lower than the table’s out-of-bounds-write row. They also do not partition the two disclosure channels of §6.5, whose criterion is the worst outcome observed for a defect across its runs rather than the address of one fault, and therefore do not add to 73 and 47. Targets and harnesses. We evaluate five widely used opensource C++ programs that parse untrusted files through documented entry points. Each harness is a minimal driver for one such entry point and defines only its own main:

Single-fuzzer protocol. Each single-fuzzer campaign uses the same dispatch loop, container image, target build, evaluator, shared seed store, Magma seed corpus, memory limit, six worker cores, 24-hour duration, and 120-second turns as the scheduler campaigns. Its roster contains one fuzzer. We run ten campaigns for each of the 54 target–fuzzer pairs.

A.13

weakness

Each target uses the revision in Table 16. From crashes to defects. We minimize crashing inputs and deduplicate them on faulting function, file, line, fault type, and entry point. Three sites in Tables 7 and 8 contain multiple records: two are separated by fault type and one by entry point. We remove candidates that fail to reproduce without sanitizers and coverage instrumentation or already appear in the project’s tracker, change history, or CVE record. 120 defects remain. Each is symbolized to a function, file, and line and reconfirmed in five of five runs on a build without coverage instrumentation or sanitizers.

The real-world harnesses

Observed failure modes. Across all 120 defects, 56 fault at an address below 0x10000, a page that cannot be mapped.

23

Table 7: Where each defect is, part 1 of 2. Each row gives the class its report carries, the file and line the sanitizer names, the function where it names one, the fault it reports, and the entry point that reached it. A dash in the class column marks a defect whose report carries no class, and in the entry column one whose trace does not name the format being parsed. Two rows carry a file without a line, function or fault, because the sanitizer attributes the fault to a translation unit rather than a statement; both are counted in Table 6 under the class their report carries. The last four fields are the deduplication rule of §6.5, and every row differs from every other in at least one of them. We print no trigger and no reproducing input.

A.15

program

CWE

file : line

function

fault

entry

MNN

125 125 476 125 476 125 125 476 125 476 129 369 476 129 129 476 476 787 476 476 125 476 476 129 129 129 129 787 476 787 787 369 476 476 476 476 787 416 190

liteConverter.cpp:421 liteConverter.cpp:421 Program.cpp:122 liteConverter.cpp:209 liteConverter.cpp:235 liteConverter.cpp:264 liteConverter.cpp:269 liteConverter.cpp:344 Expr.hpp:52 ConvolutionTflite.cpp:59 ConvolutionTflite.cpp:64 ConvolutionTflite.cpp:70 ConvolutionTflite.cpp:272 ConvolutionTflite.cpp:298 ConvolutionTflite.cpp:326 ConvolutionTflite.cpp:327 DepthwiseConv2DTflite.cpp:32 DepthwiseConv2DTflite.cpp:222 ConcatTflite.cpp:25 PoolingTflite.cpp:74 ResizeBilinear.cpp:55 TfliteUtils.cpp:107 liteOpConverter.cpp:11 liteConverter.cpp:212 liteConverter.cpp:214 liteConverter.cpp:250 liteConverter.cpp:270 liteConverter.cpp:319 ConvolutionTflite.cpp:451 MoveUnaryOpBeforeReshape.cpp:59 MoveUnaryOpBeforeReshape.cpp:66 TransformGroupConvolution.cpp:191 PostConverter.cpp:713 Expr.hpp:52 Expr.cpp:1287 Executor.cpp Tensor.hpp:275 TensorUtils.hpp:86 MNNMemoryUtils.cpp:24

readModel readModel create tflite2MNNNet tflite2MNNNet tflite2MNNNet tflite2MNNNet tflite2MNNNet VARP run run run run run run run _writeCommon run run run run convertDataFormatTflite getOpCode tflite2MNNNet tflite2MNNNet tflite2MNNNet tflite2MNNNet tflite2MNNNet run onExecute onExecute onExecute optimizeNet VARP save

wild pointer heap read wild pointer heap read wild pointer wild pointer heap read wild pointer heap read wild pointer wild pointer arith wild pointer wild pointer heap read wild pointer heap read heap read heap read wild pointer wild pointer wild pointer wild pointer heap read wild pointer heap read wild pointer heap read wild pointer heap read heap read arith wild pointer wild pointer wild pointer

setLength NativeInsideDescribe MNNMemoryAllocAlign

heap read wild pointer allocation of

tflite tflite – tflite tflite tflite tflite tflite tflite tflite tflite tflite tflite tflite tflite tflite tflite tflite tflite tflite tflite tflite tflite tflite tflite tflite tflite tflite tflite tflite – – – tflite – – – – –

Immediate-reward objective

produce significantly worse held-out prediction on all nine targets after Holm correction and better prediction on none. Method II therefore retains the full campaign history with γ = 1.

A campaign-optimal policy would model the shared seed store and the transition value of each decision. The dispatch loop observes per-fuzzer coverage volume, a lossy projection under which campaigns with different stores can look identical. Method II therefore selects the fuzzer with the highest predicted next-turn reward. The retained-rate measurement of §2.2 and the alternative rewards in Table 9 test the direction of this objective. No alternative reverses the ordering on the tested benchmark. The evidence supports the measured immediate-reward direction, not campaign-level optimality.

A.16

A.17

Selection-rule scale and assumptions

At the deployed constants, the standard self-normalized calculation uses D + 1 = 17 parameters per fuzzer, λ = 10, ∥φ∥2 ≤ 3 including the intercept, reward in [0, 1], 12 -subGaussian noise, ∥θ∥ ≤ 1, and δ = 0.05. It gives a regret bound near 12,200 over the approximately 4,320 decisions in a 24hour campaign, above the trivial 4,320 reward bound. It first falls below that trivial bound at approximately 76,000 decisions, more than 17 campaigns. The bound is therefore uninformative at the evaluated horizon. The deployed setting also has six concurrent selections whose rewards arrive after the TI -second turn, and the context–

Full-history weighting

The exponential weighting assigns an observation k decisions old weight γk . The swept settings γ = 0.995 and 0.99 have half-lives of approximately 139 and 69 decisions. Both

24

Table 8: Where each defect is, part 2 of 2. Each row gives the class its report carries, the file and line the sanitizer names, the function where it names one, the fault it reports, and the entry point that reached it. A dash in the class column marks a defect whose report carries no class, and in the entry column one whose trace does not name the format being parsed. Two rows carry a file without a line, function or fault, because the sanitizer attributes the fault to a translation unit rather than a statement; both are counted in Table 6 under the class their report carries. The last four fields are the deduplication rule of §6.5, and every row differs from every other in at least one of them. We print no trigger and no reproducing input. The 42 defects in Arm NN are absent because the report we sent that vendor undertakes to publish nothing about them until they agree, and a row here would be publishing. program

Krita

ncnn FreeCAD

CWE

file : line

function

fault

entry

129 129 843 – 129 – – 125 125 476 125 125 476 476 – – 125 476 125 125 125 125 125 125 125 789 125 125 476 787 476 125 476 789 789 125 125 369 191

ShapeConcat.cpp:62 DepthwiseConv2DTflite.cpp:83 CustomTflite.cpp:111 ConvolutionFloatFactory.cpp:269 FuseDupOp.cpp:122 ShapeConvolution.cpp:86 ConvolutionTiledExecutor.cpp:170 BufferAllocator.cpp:538 OnnxExtraManager.cpp:57 Expr.cpp:240 OnnxConvolutionMerge.cpp:328 OnnxPooling.cpp:76 Expr.hpp:52 Expr.hpp:123 ShapePool.cpp:74 TransformGroupConvolution.cpp:191 GemmAVX2FMA.cpp:73 repeated_ptr_field.h:857 onnxConverter.cpp onnxOpConverter.cpp:333 onnxOpConverter.cpp:342 onnxOpConverter.cpp:358 onnxOpConverter.cpp:412 kis_gbr_brush.cpp:236 kis_gbr_brush.cpp:256 kis_gbr_brush.cpp:188 kis_gbr_brush.cpp:141 kis_abr_brush_collection.cpp:47 kis_abr_brush_collection.cpp:48 kis_abr_brush_collection.cpp:95 kis_asl_reader.cpp:427 kis_asl_reader.cpp:561 kis_brushes_pipe.h:47 compression.cpp:90 compression.cpp:367 compression.cpp:258 compression.cpp:276 multiheadattention.cpp:59 MeshKernel.cpp:396

onComputeSize run run create onExecute onComputeSize turnIm2ColToBlitInfo free operator create onExecute onExecute VARP expr onComputeSize onExecute _AVX_MNNComputeMatMulForE_1FMA TypeHandler>

wild pointer wild pointer wild pointer arith wild pointer arith arith use after free wild pointer wild pointer heap read wild pointer wild pointer wild pointer arith arith heap read wild pointer

convertTensorToBlob convertTensorToBlob convertTensorToBlob convertTensorToBlob init init init init convertToQImage convertToQImage rle_decode readVirtualArrayList< readPattern< lastBrush decompress decompress psd_unzip_with_prediction<unsigned char> psd_unzip_with_prediction<unsigned short> load_param Merge

heap read heap read heap read heap read heap read heap read allocation of wild pointer heap read wild pointer heap read wild pointer wild pointer wild pointer allocation of allocation of heap read heap read arith heap read

– tflite tflite onnx tflite onnx onnx onnx onnx onnx onnx onnx onnx onnx onnx onnx onnx onnx onnx onnx onnx onnx onnx – – – – – – – – – – – – – – – –

Since two means of a [0, 1] reward differ√ by at most √ 1, horizon h becomes unreachable once logt > (1/ 2 − 1/ h)−2 . Over the 4,320 turns an 24-hour campaign holds, that retires h = w after turn 17 and h = 16 after turn 120, and retires neither h = 8, which would need t > 2,981, nor h = 4, which would need t > 1.3 × 1010 . A three-rung ladder survives. h = 8 is reachable only where the last eight rewards average 0.95 above the last two and h = 4 only where the last four average 0.56 above them. So this branch reads the mean of the fuzzer’s two most recent rewards, except on decisions where its recent rewards differ that sharply.pWe have not measured how often that is. The draw’s scale 1/12 + 1/12 = 0.408 is itself a bound only once a fuzzer has four rewards to its name, since the largest sample variance of m points in [0, 1] is m/(4(m − 1)). Method I has exactly two phases. Rising sequences use the

reward map can drift within a campaign (§A.11). We evaluate the selection rule empirically qunder this concurrency, delay, and drift. Its width is ua = φ⊤a A−1 a φa . The basis width D, bandwidth σ, and ridge λ affect this quantity through the effective dimension of Aa and the rate at which the kernel decorrelates contexts; only λ is swept. The ridge also makes Aa = λI + ∑ φφ⊤ invertible from the first observation and shrinks a fuzzer’s D + 1 parameters while data is scarce.

A.18

The main table in full

A.19

The phase-aware scheduler in detail

The horizon ladder, rung by rung. With α = 1 and a reward in [0, 1], h = 2 is selected over √ the last h rewards √ h unless √ average more than logt (1/ 2 − 1/ h) above the last two. 25

Table 9: The reward the scheduler optimizes, swept on the context-aware scheduler. coverage_interval is BandFuzz’s definition and the one every other result in this paper uses. frontier_branch credits a turn for branches at the edge of the shared map, and rarity_density for the rarity of the edges it covers. Mean unique bugs over ten campaigns per cell, read against the context-aware row of Table 1. No alternative leads on any target. The other schedulers were not re-run under them. target

coverage_interval frontier_branch rarity_density

4.00 5.00 2.00 4.20 4.20

libpng libtiff openssl poppler sqlite3

3.40 4.20 1.40 3.60 3.40

A.20

Construction and scope

The construction in full. Take two fuzzers and a shared store. Whichever fuzzer runs on a turn publishes an input into the store, and that input opens ground new to fuzzer 1 with probability 12 and, independently, ground new to fuzzer 2 (a)

with probability 12 . Let zt ∈ {0, 1} record whether the store gained, during turn t − 1, an input opening ground new to (a) fuzzer a, and let fuzzer a return 12 + 21 1[zt = 1]. Covering ground a peer has just opened raises the reward. The coupling is endogenous, since the publication is produced by the turn the policy chose to run, and monotone as §2.2 requires, since a publication can only raise a fuzzer’s reward and never lower it. Its law is nonetheless the same under every policy, because some fuzzer runs on every turn and what the publication opens (1) (2) does not depend on which fuzzer produced it. zt and zt are independent fair coins whatever the schedule. That invariance is a requirement rather than a convenience. Suppose what a publication opened depended on which fuzzer produced it, say a turn of fuzzer 2 opened ground new to fuzzer 1 and a turn of fuzzer 1 opened nothing. A policy that knows its own play history would then know the conditional law of zt , and after (1) a turn of fuzzer 1 would know zt = 0 outright, recovering from its own record the quantity the construction withholds. What a fuzzer’s own history provably cannot reach is therefore exactly the part of the coupling its own choices do not steer, and that is the part this instance isolates; on the remainder a context-blind policy is uninformed rather than provably lost. A policy that does not observe them selects at t from quantities measurable with respect to rewards realized before t. Those are functions of z1 , . . . , zt−1 and independent of zt , so it earns 1 1 1 3 2 + 2 · 2 = 4 per turn whatever it does, whatever it reads of its own history, in whatever order, and however long it collects. A policy that observes zt runs a fuzzer whose indicator is 1 whenever one exists, which happens with probability 1 − 14 , and earns 34 · 1 + 41 · 12 = 78 . The gap is 18 a turn, so the regret is linear in the horizon. The proposition scopes the information available to the policy, not the amount of history it retains. Because zt is independent of everything realized before round t, the order of

lua

libsndfile

php

libpng

libtiff

feature

libxml2

Table 10: How far each of the four strongest context features governs the decision, named as in Table 3: the percentage of logged decisions whose selected fuzzer changes when that one feature is replaced by its mean. Bold marks each target’s own strongest signal. Neither its identity nor how far it governs the decision is constant across targets, which is why the weighting is learned per target.

3.40 4.40 1.60 3.60 4.00

g_rarity 20.7 62.4 51.5 59.3 20.9 36.4 mk_z 17.1 47.8 46.9 55.4 14.5 7.9 rounds_since_improve 6.9 20.1 56.3 42.2 25.3 3.4 g_sec 3.7 8.6 14.3 37.0 44.8 10.6

rising estimator; flat and downward sequences both use the rotting estimator. The phase is a one-bit context supplied by domain expertise, and it selects the estimator. Online uncertainty then orders fuzzers within the selected phase. The two index forms originate in models whose rewards change with an arm’s pull count [27] or with global time [43]. Fuzzer reward also changes with inputs published by peers, so Method I uses the estimators without importing those models’ guarantees. The gap between a rising and a rotting index is wider than the p range of a reward mean. A draw whose scale is at most 1/12 + 1/12 = 0.408 crosses that gap only in the Gaussian tail. Thus, the phase supplies most of the allocation decision and learned uncertainty orders fuzzers within a phase; the crossing rate was not measured. This expertise-guided context improves summed mean unique bugs by 5.2%–7.4% over the three baselines. Method II learns from the full context and improves on Method I by 12.1%, leading on seven targets and tying on two. The comparison shows that the one-bit prior is useful and that learning from the complete context is stronger.

26

Table 11: Each of this paper’s schedulers against each baseline, per target. Â12 is the Vargha–Delaney effect size, the probability that a randomly chosen campaign of ours triggers more bugs than a randomly chosen campaign of that scheduler, ties counted as half. pH is a two-sided Mann–Whitney U test after Holm correction over the family of nine targets, one family per pair. Bold marks pH < 0.05. context-aware scheduler

phase-aware scheduler

vs BandFuzz

vs AUTOFZ

vs L EGION

vs BandFuzz

vs AUTOFZ

target

Â12

pH

Â12

pH

Â12

pH

Â12

pH

Â12

pH

Â12

pH

libpng libsndfile libtiff libxml2 lua openssl php poppler sqlite3

0.80 0.50 1.00 0.96 0.75 0.70 0.50 0.88 0.84

0.025 1.000 0.0004 0.0012 0.101 0.101 1.000 0.017 0.022

0.90 0.50 1.00 0.74 0.70 0.50 0.50 0.89 1.00

0.0031 1.000 0.0001 0.264 0.331 1.000 1.000 0.012 0.0003

0.70 0.50 1.00 0.92 0.60 0.70 0.50 0.71 1.00

0.202 1.000 0.0004 0.0035 1.000 0.202 1.000 0.382 0.0003

0.75 0.50 0.70 0.67 0.56 0.60 0.50 0.55 0.45

0.226 1.000 0.595 0.775 1.000 1.000 1.000 1.000 1.000

0.85 0.50 0.60 0.52 0.51 0.40 0.50 0.65 0.65

0.023 1.000 1.000 1.000 1.000 1.000 1.000 1.000 0.614

0.65 0.50 0.74 0.63 0.42 0.60 0.50 0.39 0.65

1.000 1.000 0.385 1.000 1.000 1.000 1.000 1.000 0.614

summed mean

+20.4%

+18.8%

+17.9%

+7.4%

+5.9%

vs L EGION

+5.2%

Table 12: Every fuzzer alone, mean unique Magma bugs over ten 24-hour campaigns per cell, on the same harness, seeds, cores and budget as every scheduler in Table 1. The last row is the strongest of them on each target, a choice made after the campaigns have run. Bold marks the highest mean in a column. fuzzer

libpng libsndfile libtiff libxml2

php poppler sqlite3

sum

1.40 1.00 1.00 1.20 1.00 1.40

2.40 3.00 2.80 3.00 3.00 3.00

3.00 3.00 2.20 2.80 3.00 4.20

3.20 1.20 2.00 3.00 2.80 1.60

28.40 23.80 19.80 27.80 26.60 21.80

2.00 3.00

4.20

3.20 32.00

AFL++ DARWIN honggfuzz laf-intel MOPT Radamsa

2.20 1.60 4.00 2.20 2.60 1.40

7.00 7.00 1.20 7.00 7.00 6.40

4.40 3.00 3.00 4.00 3.20 1.60

2.80 2.40 2.00 2.60 2.00 1.20

strongest, per target

4.00

7.00

4.40

2.80 1.40

earlier plays also reveals nothing about it. The construction does not identify sufficient observables or predict deployed performance. The signals in §5.1 measure consequences of the coupling, and §7 evaluates their contribution. The deployed setting remains empirical because its selections are concurrent and rewards are delayed (§5.4).

A.21

lua openssl 2.00 1.60 1.60 2.00 2.00 1.00

A.22

The real-world census

A.23

The reward sweep

Alternative rewards. We sweep two alternatives on five targets with ten campaigns per cell: frontier_branch, which credits branches at the edge of the shared map, and rarity_density, which credits rare covered edges. The comparison is directional. Neither alternative leads the shipped reward on any of the five targets. On libtiff and sqlite3, where Method II’s main result survives correction, the shipped reward leads both alternatives. The measured direction therefore persists across these reward definitions; the experiment does not rank reward functions.

The constants outside the sweep

Fixed constants. Method II fixes six constants outside the sweep: basis width D = 16, bandwidth σ = 4, one warmup turn per fuzzer, the ±5 clamp, the 84-decision reward window, and perturbation multiplier one. The window also defines Method I’s trend test and horizon ladder. Method II’s Gaussian perturbation multiplier is distinct from Method I’s α coefficient. The TI = 120 s turn budget is inherited from BandFuzz and held fixed across schedulers. The reported results do not establish insensitivity to these constants.

A.24

Full-campaign ablations by pair

Every comparison in Figure 5 is a pair of cells. The pairspecific resolution is the smallest attainable difference in means whose two-sided permutation tail is at most 0.05 (§6.1). For the full context against the intercept-only scheduler, the resolutions are 1.00 on poppler; 0.80 on libtiff, libxml2, and sqlite3; and 0.60 on libpng and lua. No attainable difference resolves on openssl, libsndfile, or php. The intercept-only 27

Table 13: Standard deviation of unique bugs across the ten campaigns of each cell of Table 1. Bold marks the largest spread in a column. scheduler or fuzzer libpng libsndfile libtiff libxml2

lua openssl

php poppler sqlite3

context-aware phase-aware

0.00 0.32

0.00 0.00

0.00 0.82

0.42 0.52 0.95 0.67

0.00 0.00 0.42 0.00

0.79 0.63

0.42 0.48

BandFuzz L EGION

0.52 0.42 0.52

0.00 0.00 0.00

0.48 0.00 0.52

0.32 0.32 0.84 0.42 0.42 0.52

0.52 0.00 0.00 0.00 0.52 0.00

0.57 0.79 0.84

0.52 0.00 0.00

AFL++ DARWIN honggfuzz laf-intel MOPT Radamsa

0.42 0.52 0.00 0.42 0.52 0.52

0.00 0.00 0.42 0.00 0.00 0.52

0.52 0.00 0.00 0.67 0.42 0.52

0.79 0.52 0.00 0.52 0.00 0.42

0.00 0.52 0.52 0.00 0.00 0.00

1.26 0.00 0.42 0.00 0.00 0.00

0.00 0.00 0.42 0.42 0.00 0.79

0.42 1.23 0.00 0.00 0.79 1.07

AUTOFZ

0.52 0.00 0.00 0.42 0.00 0.52

Table 14: Mean edge coverage for every cell of Table 1, reported for reference and never used to decide a comparison. Bold marks the highest mean in a column. scheduler or fuzzer libpng libsndfile libtiff libxml2

lua openssl

php poppler sqlite3

context-aware phase-aware

1,469 1,467

2,496 3,889 2,578 3,834

8,954 5,126 8,452 5,159

8,500 3,945 8,450 3,944

22,242 13,101 22,189 11,903

BandFuzz L EGION

1,465 1,467 1,463

2,509 3,729 2,462 3,714 2,439 3,669

8,810 5,118 9,210 5,127 8,276 5,144

8,468 3,945 8,469 3,944 8,452 3,944

22,132 12,272 22,089 11,597 22,201 11,236

AFL++ DARWIN honggfuzz laf-intel MOPT Radamsa

1,194 1,113 1,469 1,203 1,222 1,026

2,527 2,515 1,675 2,481 2,565 2,365

8,544 6,396 5,794 8,054 7,932 7,007

8,477 8,452 8,419 8,447 8,484 8,440

22,180 13,269 22,344 6,844 22,023 9,581 22,032 12,111 22,547 11,282 21,977 8,260

AUTOFZ

3,881 3,207 3,081 3,811 3,719 2,848

5,103 5,067 4,911 5,094 5,103 5,120

A.25

scheduler’s target-level gaps over BandFuzz are −0.20 on libpng, 0.00 on libsndfile, −0.10 on libtiff, +0.10 on libxml2, +0.30 on lua, 0.00 on openssl, 0.00 on php, −0.50 on poppler, and 0.00 on sqlite3. None resolves, and the summed mean is 28.00 against BandFuzz’s 28.40. Method II reaches 34.20, a +6.20 gain. Because the control removes ctx_unc and its contribution to the width, this comparison measures the complete context-aware decision rather than semantic context alone. Removing exploration costs 1.00 mean unique bug per target: the ablated scheduler sums to 25.20 over the nine targets, against Method II’s 34.20. Without the Gaussian term, a passed-over fuzzer regains the top prediction zero times across all learned decisions in this configuration, and the scheduler locks onto one fuzzer. The settings of §5 that no row of Figure 5 covers are named in §A.21.

3,740 3,907 3,942 3,928 3,930 3,904

Pairwise permutation resolution

For each two-cell comparison, we pool its 20 campaign-level bug counts and enumerate every assignment of ten observations to each cell. The pair’s resolution is the smallest attainable absolute difference in means whose two-sided permutation tail is at most 0.05. Against the baseline with the highest observed mean on each target, Method II’s resolution is 0.6 bug on libtiff and lua, 0.8 on libxml2 and sqlite3, and 1.0 on poppler. On libpng, openssl, libsndfile, and php, the permutation distribution admits no attainable threshold at 0.05.

A.26

Arrival time in full

Arrival time. The 25 bugs triggered by every campaign of every scheduler have median first-arrival times within the first 11% of the campaign, with a median of 2% of the budget. The seven differentiating bugs with in-budget medians range from 5.6 to 22.1 hours, with median 13.6 hours; five arrive after the first quarter and one in the final quarter. On libxml2, 28

Table 15: Mean injected bugs reached per campaign for every cell of Table 1, from the Magma oracle’s own reached record. A bug is reached when a campaign executed its site, whether or not the input that got there met the condition that trips it, so this column bounds the bug counts of Table 1 from above and Table 4 bounds it in turn. Bold marks the highest mean in a column. scheduler or fuzzer libpng libsndfile libtiff libxml2 6.00 6.00

8.00 8.00

7.90 7.40

8.50 4.00 8.40 4.00

4.00 5.00 4.00 5.00

16.00 15.90

12.10 11.20

BandFuzz L EGION

6.00 6.00 6.00

8.00 8.00 8.00

6.90 6.80 6.80

8.10 4.00 8.20 4.00 8.20 4.00

4.00 5.00 4.00 5.00 4.00 5.00

15.60 15.60 16.00

11.40 10.60 10.20

AFL++ DARWIN honggfuzz laf-intel MOPT Radamsa

6.00 6.00 6.00 6.00 6.00 6.00

8.00 8.00 7.00 8.00 8.00 8.00

7.20 5.40 5.00 7.00 6.40 5.00

8.60 5.40 5.00 8.40 7.60 7.60

4.00 4.00 4.00 4.00 4.00 4.00

16.00 16.00 15.00 16.00 16.00 15.80

11.20 8.60 10.00 10.80 10.20 8.80

program

version

MNN Arm NN Krita ncnn FreeCAD

19af6da v26.07 6.0.3 c189d88 1.1.3

found crash withheld 62 42 14 1 1

33 31 8 1 0

29 11 6 0 1

120

73

47

4.00 4.00 3.00 4.00 4.00 4.00

4.00 5.00 5.00 5.00 5.00 5.00

the preparation phase, unique-path allocation, focus phase, and additive-increase multiplicative-decrease threshold with the paper’s Tprep , Tfocus , initial threshold, and 30-second short interval. Per-fuzzer unique paths use the shared map’s record of the engine that first covered each edge, which implements the stated intersection subtraction. L EGION [56] uses 600second rounds, five seed-evaluation dimensions, spread-based adaptive weights, and bounded-exploitation softmax. Deep edges come from the target’s call graph and rare edges from the shared map’s per-edge hit counts. AUTOFZ and L EGION assign core shares for a round rather than selecting one fuzzer per worker request. We convert each share to whole core counts that sum to six and assign successive decisions cyclically. Each fuzzer therefore receives exactly its requested core count over every cycle of six decisions. Both use the wall clock specified by their papers: AUTOFZ alternates phases and L EGION rescores each round. All implementations share this paper’s reward definition, seed sharing, harnesses, and execution loop, so the comparison isolates scheduling rules rather than reproducing the complete systems or their published numbers. We do not tune the baselines or expose the Magma oracle. The artifact includes the three implementations, rule-correspondence records, and configuration tests.

Table 16: The 120 real-world defects, by program. Found counts distinct faulting sites under the rule of §6.5. Every one crashes a build with no sanitizer and no coverage instrumentation, on five runs out of five. The two right-hand columns give the class we assigned at triage, from the worst outcome we observed across a defect’s runs. Crash is a fault at an unmappable address or an arithmetic fault. Withheld is memory corruption or information disclosure. Every defect went to its maintainers through the channel that project’s policy prescribes. Of the 73 in the crash column, 42 carry an issue on the project’s own tracker with a working reproducer. Arm NN’s 31 do not, because that vendor asked that any public disclosure of its defects be coordinated with it, and we agreed. No defect in the withheld column carries a reproducer here.

the two universal bugs arrive by 15 minutes, while the two differentiating bugs arrive under context-aware scheduler at medians of 13.7 and 22.1 hours. BandFuzz reaches one in a single campaign and never reaches the other.

A.27

php poppler sqlite3

context-aware phase-aware AUTOFZ

total

lua openssl

A.28

Exposure paths

Krita’s style, brush, and document readers execute when a user opens or imports a file, including files received by mail, download, or shared drive. FreeCAD’s mesh reader is exposed through its import path. ncnn’s parameter loader executes when an application loads a model at run time. MNN’s converter and Arm NN’s deserializer account for 104 of the 120 defects. Their exposure is model supply chain: MNN processes a model during developer-facing conversion, and Arm NN processes a serialized network when an application loads

Baseline implementations

We reimplement all three baselines inside the common dispatch loop. For each, we map the paper’s algorithm and, when available, its released code to the implementation rule by rule, following the paper when the two differ. BandFuzz uses the algorithm and constants of [46]. AUTOFZ [13] implements 29

it.

A.29

Ordering-measurement interpretation

The leader reading. A campaign’s two halves name different leaders in 78.5% of the 144 pairs and the two halves of a single window in 78.5% as well, 59.6% against 64.1% at quarters and 35.9% against 39.0% at twelfths. Every paired difference’s interval crosses zero. The unmatched reading is 70.4% of the 203 against the 82.0% a leader drawn at random among the 5.6 fuzzers this measurement admits on average would give. It is coarser than the rank correlation because it discards everything below first place, which is why §2.2 reports it for direction only. Adjacent-window agreement and within-window agreement are both low, and their paired differences are statistically indistinguishable. Correcting their ratio for attenuation gives 0.95 at halves, 0.82 at quarters, and 1.0 at twelfths, but each ratio divides two small, noisy quantities; the half-window paired difference has a 95% interval of [−0.08, 0.09]. The measurement therefore cannot distinguish a changing true ranking from a stable ranking estimated poorly at this timescale. The main text reports this indistinguishability. Method II differs from BandFuzz in two relevant ways: it pools the full history with γ = 1 and conditions predictions on context. The intercept-only control also pools the history but removes both semantic context and the context-derived confidence width (§7); it isolates the complete context-aware decision rather than conditioning alone.

A.30

Compute

Every benchmark campaign ran for 24 hours on six cores of one 188-core machine. The real-world campaigns ran on the same machine without a fixed duration. The real-world evaluation reports defects found, not a discovery rate.

30

Related documents

• Dynamic Context Scheduling: Learning Beyond the Static Universe#659348
• Dynamic Context Scheduling: Learning Beyond the Static Universe#657212
• Equally Good, Yet Different: Benchmarking Rashomon sets in AutoML packages#1132171
• No Attack Required: Semantic Fuzzing for Specification Violations in Agent Skills#180594
• ContextRender: From Execution Dependencies to Agent Context#1142054