← ClaudeAtlas

fuzzgptlisted

Use when you want to fuzz any software target — library, compiler, interpreter, parser, kernel/syscall, DB engine, SMT solver, binary/file format, or network protocol — by priming an LLM with that target's HISTORICAL bug-triggering code to generate unusual, edge-case inputs (history-driven LLM fuzzing). FuzzGPT-derived: retrieval replaces fine-tuning (Deng et al., arXiv:2304.02014): mine bug reports → auto-label each snippet's buggy fuzz target → few-shot / zero-shot / retrieval generation → crash + differential oracles. Trigger on "FuzzGPT", "fuzz this library/compiler/parser/protocol", "generate edge-case test programs", "history-driven fuzzing", or when pairing with vuln-research to turn a target's bug history into fresh fuzzing inputs. Target-agnostic: the "fuzz target" is whatever unit you point generation at — an API in the paper's DL study, but equally a compiler flag, SQL feature, syscall, opcode, or protocol field.
Lu1sDV/skillsmd · ★ 2 · AI & Automation · score 63
Install: claude install-skill Lu1sDV/skillsmd
# FuzzGPT — History-Driven LLM Fuzzing > **FuzzGPT-derived: retrieval replaces fine-tuning.** The original paper's FS and ZS > variants are reproduced faithfully. Fine-tuning (FT) is replaced by an > embedding-retrieval pathway (RT) — see `references/retrieval.md`. **Core hypothesis (the whole skill rests on this):** historical bug-triggering programs contain rare, valuable *code ingredients* — special values (`NaN`, `inf`, `INT_MAX`, empty/oversized inputs), edge-case shapes/sizes/lengths, 0-size dimensions, unconventional use of the target — that ordinary LLM generation never produces. LLMs trained on GitHub generate *typical* programs; fuzzing wants *unusual* ones. FuzzGPT closes that gap by priming the LLM with real past bugs instead of asking it to be "creative." This is the unusual-input engine. It pairs with `vuln-research` (which decides *what* to target and triages findings); FuzzGPT decides *how* to generate inputs that actually hit edge cases. ## The unit you fuzz: the "fuzz target" FuzzGPT steers generation toward one **fuzz target** at a time — the specific unit of functionality you want to stress (here, *the unit you point generation at*, not a libFuzzer harness). In the paper's DL-library study the fuzz target is an **API** (e.g. `torch.gather`), and the references use API examples throughout, but the method is unit-agnostic. Map "fuzz target" to your domain: | Domain | A "fuzz target" is… | Example | |--------|---------------------|---------| | DL / nume