Coverage-guided fuzzing

Coverage-guided fuzzing (CGF) is a family of fuzzing techniques that replace purely random input generation with a feedback loop driven by code coverage. The fuzzer instruments the target program to record which basic blocks, edges, or paths each input exercises; inputs that trigger new coverage are retained and mutated, while inputs that merely revisit known territory are deprioritized. This transforms the fuzzer from a blind shotgun into an adaptive explorer that hill-climbs toward the most remote corners of the program's behavior space.

The canonical implementation is American Fuzzy Lop (AFL), which uses compile-time instrumentation to build a bitmap of edge transitions. The insight behind CGF is that coverage acts as a proxy for semantic novelty: an input that reaches a previously unexecuted branch is likely to reveal behavior that the developer did not anticipate. Whether this proxy is reliable — whether all critical bugs lie on discoverable coverage frontiers — remains an open empirical question.