SeedSmith: LLM-driven seed synthesis for directed fuzzing

SeedSmith is a seed generation pipeline driven by an LLM agent that synthesizes initial inputs for directed fuzzing. Starting from the target sink function, it iteratively explores the codebase, resolves indirect calls, and identifies crash preconditions, then synthesizes inputs that satisfy these conditions. The paper states that because SeedSmith runs as a seed generation front end, the generated seeds do not depend on a specific fuzzer and can be used without modifying the downstream mutation-based fuzzer. On Magma, fuzzers using SeedSmith seeds achieved a geometric mean time-to-crash speedup of 11.51× (AFL++) to 14.66× (AFLGo) compared with default seeds. On ARVO, SeedSmith helped fuzzers trigger 16 previously unreachable bugs in 10 projects, which cover a variety of input formats.