Aug 2026· Journal of King Saud University: Computer and Information Sciences· Vol 38· 0 citations· 63 references
TL;DR
RL-LLMfuzzer, a reinforcement learning and LLM-based differential fuzzing framework that has successfully unearthed 28 officially confirmed vulnerabilities in GCC and LLVM/Clang, establishing a highly efficient and scalable paradigm for LLM-driven compiler validation.
Abstract
Compiler fuzzing faces a fundamental dilemma: traditional rule-based generators easily fall into coverage bottlenecks due to rigid grammar constraints, while Large Language Models (LLMs), despite synthesizing semantically rich code, suffer from extremely low validity rates in their raw outputs, causing a severe waste of inference resources. To resolve this contradiction, this paper proposes RL-LLMfuzzer, a reinforcement learning and LLM-based differential fuzzing framework. The core innovation lies in its pioneering dual-model decoupled architecture: it utilizes a Multi-Armed Bandit (MAB) algorithm to drive a high-capacity prompt evolution model, dynamically optimizing high-level testing intents based on coverage feedback; subsequently, a local code generation model instantiates these intents. To overcome the inherent syntactic fragility and inference latency of LLMs, the framework integrates a lightweight heuristic repair module and a deterministic AST mutation engine, structurally amplifying valid seeds before differential evaluation. Extensive experiments on GCC and Clang demonstrate superior testing efficacy: verified across multiple independent 24-hour trials, RL-LLMfuzzer achieved a statistically significant 32.1% increase in average compiler backend line coverage in the C-language benchmark compared to the state-of-the-art LLM fuzzer Fuzz4All (p<0.001\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$p < 0.001$$\end{document}). The generated corpus significantly outperforms baseline tools like Csmith, YARPGen, and GrayC in multi-dimensional diversity. To date, RL-LLMfuzzer has successfully unearthed 28 officially confirmed vulnerabilities in GCC and LLVM/Clang, establishing a highly efficient and scalable paradigm for LLM-driven compiler validation.
DHRCL decomposes feedback into syntax validation, execution success, unit-test pass rate, and AST-based structural similarity, and organizes these signals through a three-stage Syntax, Execution, Pass&Structural curriculum, and introduces stage-aware probability-based token credit redistribution.
This thesis proposes a unified two-axis framework that organizes SFT and RL methods along a data axis (off-policy to on-policy) and a loss function axis (positive-only to positive-plus-negative to GRPO) and enables controlled ablations of individual components.
G. Kim, Chair Chenyan Xiong, Aditi Raghunathan· 0 citations
Traditional automated feature engineering (AFE) minimizes human intervention but often neglects semantic relationships among original features, resulting in redundant or uninterpretable transformations. While recent methods leverage the domain knowledge and reasoning capabilities of Large Language Models (LLMs), they typically constrain the search space via predefined mathematical operators or suffer from poor exploration-exploitation balance due to exclusive reliance on validation feedback. To address these limitations, we propose MORE-FE, an evolutionary AFE framework that integrates multi-operator exploration with Reinforcement Learning with Verifiable Rewards (RLVR). MORE-FE treats feature transformation programs as hypotheses and evolves them using evolutionary operators that explore semantically coherent and logically structured features through various prompting strategies. Moreover, it employs RLVR to align LLM reasoning with structured evolutionary exploration using a composite reward that balances quality and diversity. Extensive experiments on multiple classification and regression datasets demonstrate that MORE-FE consistently outperforms state-of-the-art AFE methods, highlighting the effectiveness of balancing quality and diversity in feature engineering.
Chang-Yu Chao, Bryan Andersen, Xiao Xi Tan et al.· Proceedings of the 32nd ACM...· 0 citations
Empirical findings suggest that CudaPerf significantly outperforms strong baselines, including Qwen-3-32B and CUDA Agent by achieving up to 5X and 3.32X improvements in speedup, and 17%&7% improvements in correctness, respectively.
Q. I. Mahmud, Nesreen K. Ahmed, Ali Jannesari· 0 citations
Differential compiler testing requires automatically generated programs that are not only diverse and bug-revealing, but also semantically well-defined and reproducible. Rule-based generators provide strong validity guarantees but offer limited control over semantic variation, while large language models (LLMs) can synthesize expressive programs without principled mechanisms for balancing competing testing objectives. This paper proposes LMOEC, a constrained multi-objective evolutionary framework that integrates code language models as semantic genetic operators within an NSGA-II search process. Instead of using the LLM as a one-shot generator, we employ it for population initialization, crossover, and mutation at the program level, enabling semantics-aware recombination while preserving strict admissibility constraints. Compiler test generation is formulated as a multi-objective optimization problem that simultaneously promotes structural diversity, cross-configuration output inconsistency, semantic complexity, and robustness to mutation. A constraint-driven acceptance pipeline enforces syntactic validity, deterministic execution, bounded runtime, and avoidance of undefined behavior before evolutionary selection. By maintaining a Pareto front of non-dominated programs, LMOEC preserves multiple high-value test archetypes reflecting different trade-offs between bug exposure and reproducibility. The framework demonstrates how expressive code models can be systematically embedded into evolutionary multi-objective optimization for reliability-critical software testing.
Lang Hong Nguyet Anh, Ho Viet Duc Luong, Vu Van An· Annual Conference on Genetic...· 0 citations
A solver-informed diagnosis mechanism that exploits fine-grained solver statistics as verbal gradients for targeted refinement and a structured memory abstracts prior experience into reusable modeling strategies, avoiding redundant exploration while enabling zero-shot transfer to unseen problems and bootstrapping smaller LLMs.
Haofeng Yuan, Ji-Ming Peng, Jieyi Bi et al.· 0 citations
