# High-Throughput, Formal-Methods-Assisted Fuzzing for LLVM

DevFeed: [High-Throughput, Formal-Methods-Assisted Fuzzing for LLVM](<https://devfeed.tech/articles/high-throughput-formal-methods-assisted-fuzzing-for-llvm-39747.md>)

Original publisher: [Read original article](<https://blog.regehr.org/archives/2148>)

Author: regehr

Published: 2022-05-31T14:56:41Z

Content type: article

Language: en

Sources: [Embedded in Academia](<https://devfeed.tech/sources/embedded-in-academia.md>)

Topics: [Fuzzing/Fuzz testing](<https://devfeed.tech/topics/fuzzing.md>), [LLVM](<https://devfeed.tech/topics/llvm.md>), [Formal methods](<https://devfeed.tech/topics/formal-methods.md>), [Testing](<https://devfeed.tech/topics/testing.md>), [bug](<https://devfeed.tech/topics/bug.md>)

Tags: [bug](<https://devfeed.tech/tags/bug.md>), [formal-methods](<https://devfeed.tech/tags/formal-methods.md>), [fuzzing](<https://devfeed.tech/tags/fuzzing.md>), [llvm](<https://devfeed.tech/tags/llvm.md>), [mutation](<https://devfeed.tech/tags/mutation.md>), [testing](<https://devfeed.tech/tags/testing.md>), [uncategorized](<https://devfeed.tech/tags/uncategorized.md>)

## AI overview

The article describes mutation-based fuzzing for LLVM optimization passes, combining a custom LLVM IR mutator with the formal methods tool Alive2 to check whether optimizations are correct or buggy. The authors report that generic mutation with radamsa produced mostly invalid or semantically unchanged tests and found no bugs after several days, motivating a structure-aware mutator that preserves LLVM IR invariants.

## Source excerpt

[This piece is coauthored by Yuyou Fan and John Regehr] Mutation-based fuzzing is based on the idea that new, bug-triggering inputs can often be created by randomly modifying existing, non-bug-triggering inputs. For example, if we wanted to find bugs in a PDF reader, we could grab a bunch of PDF files off the web, mutate [...]