Introduction
Fuzz testing is a software testing technique that's been around for a while now. But, despite being nearly forty years old, this technique has not been widely adopted by software development teams. While it's commonly used in specialized fields like penetration testing, it's often seen as niche by the mainstream sector.
However, in an era of growing AI adoption, fuzz testing is proving more relevant than ever. Its ability to introduce unpredictability into systems and applications is particularly well suited to a time when non-deterministic software has become widespread. In this article, we'll take a close look at this technique and why it could prove more valuable than ever, as generative AI continues to reshape the software landscape.
What is fuzz testing?
Fuzz testing, or fuzzing, as it's sometimes called, is an automated software testing technique where unexpected or invalid inputs are used to uncover bugs or vulnerabilities, as described by the IEEE. This typically happens at scale, with hundreds of permutations of unexpected inputs. It's a way of load-testing an application to check whether it might behave unexpectedly when faced with data it wasn't designed for.
Fuzz testing can give development teams a deeper understanding of application behavior and security, beyond more static testing approaches like static application security testing (SAST) or software composition analysis (SCA). While SAST and SCA focus on bugs and risks in source code, fuzzing tests input fields or parameters in deployed web applications. Even the most rigorous SAST testing can't give you visibility into how inputs might make your application behave when faced with real-world data.
Fuzz testing shares some similarities with dynamic application security testing (DAST), but there are also subtle differences. DAST generally involves simulating attacks to identify known vulnerabilities, while fuzz testing is much better suited to finding unknown issues that would otherwise be difficult to uncover during testing.
It's important to note that fuzz testing is not an alternative to other testing techniques. It really should be used alongside other approaches when and where relevant. If edge cases are a particular concern for the resilience and security of your software, fuzzing can be a genuinely valuable addition to a development team's security practices.
Different types of fuzz testing
It's also important to note that fuzz testing isn't a single technique, but rather encompasses a number of related approaches. They can be distinguished by:
By existing knowledge of the software
Black-box fuzzing, where testing is carried out with no knowledge of how the target software works (this is probably the most common type of fuzzing in the industry today, typically carried out by penetration testers or bug hunters).. White-box fuzzing, where you'll have a much deeper, more detailed knowledge of the software. Gray-box fuzzing, which sits somewhere between the two.
By how the fuzzing data is generated
Mutation (or "dumb") fuzzing, where input data is modified (i.e., mutated) indiscriminately (for example, by iterating over a static list such as the Big List of Naughty Strings).. Generation (or "smart") fuzzing, where input data is more deliberately crafted, based on the specifics of the format or protocol. Fuzzing libraries such as FuzzDB break down lists of fuzzable inputs by use case.
Ultimately, the right approach to use will depend on context. It will depend on the type of software you're testing, what you're looking to uncover, and the risks you're looking to mitigate, not to mention delivery constraints and business requirements.
Why does fuzz testing remain a niche technique?
Fuzz testing is niche in software development for the simple reason that it's ultimately chaotic and, used in the wrong contexts, dangerous. It's understandable, then, that many teams don't see it as a technique worth pursuing.
Very real operational hurdles
Indeed, there are a number of challenges and drawbacks tied to fuzzing:
Setting up fuzzing environments can be complex and time-consuming. Complexity and resource requirements don't scale well, making it difficult to run fuzz testing on particularly large applications and systems. It doesn't necessarily deliver consistent, conclusive, or complete results. Although automated in its implementation, it still requires human oversight and expertise to analyze and evaluate the results. It's not relevant to all software: fuzz testing is useful for uncovering vulnerabilities in input validation and error handling; your software may not have any, and even if it does, you still need to run other tests to find other types of bugs and vulnerabilities (in the code, for example).
These issues explain why, as we've already noted, it's very clearly a specialized technique used by practitioners in fields like penetration testing, where pushing systems and applications to their limits is a fundamental goal.
However, there's a good argument that in today's software landscape, dominated by generative AI and LLMs, innovative and unconventional approaches to testing need to be explored by more than just specialists.
Perhaps it's worth software developers rediscovering the benefits and power of fuzzing?
How can AI power effective fuzz testing?
To some extent, AI, and specifically generative AI, can help make fuzz testing more accessible to teams that wouldn't normally consider it part of their testing arsenal. Generating novel combinations of words or other sequences at scale is, after all, the basis of fuzzing, and we know generative AI excels at this.
OSS-Fuzz: generating and triaging fuzz cases with LLMs
This work is happening right now: in November 2024, a team at Google wrote a blog post explaining how its open-source fuzz testing platform, OSS-Fuzz, found a number of significant vulnerabilities in open-source projects by leveraging generative AI. The post explains that the team has been experimenting with what it calls "AI-powered fuzzing," where the generative capabilities of LLMs are used to create fuzz cases (in other words, random and unexpected inputs) to improve test coverage.
The benefits of such an approach go well beyond test generation and coverage. The team also notes it can be useful in the triage and analysis stages, to identify genuine vulnerabilities. They write that "an LLM can be prompted with relevant context (stack traces, fuzz target source code, relevant project source code) to perform this triage."
The AI-powered fuzzing framework built for OSS-Fuzz has been open source since January 2024, and the track record has grown since: the initiative now credits AI-generated fuzz targets with uncovering more than 26 previously unknown vulnerabilities in open-source projects, including a critical flaw in OpenSSL (CVE-2024-9143), with measured coverage gains across more than 270 C/C++ projects and hundreds of thousands of newly tested lines of code.
BandFuzz: choosing the strategy through reinforcement learning
While generative AI can clearly play a valuable role in fuzz testing, as demonstrated by the Google team, other AI techniques and approaches can also be useful.
In 2024, for example, a team from Northwestern University took first place at an international fuzz testing conference with their AI-powered tool, BandFuzz. BandFuzz doesn't use generative AI but instead relies on reinforcement learning to select the most effective fuzzing strategy for a given situation.
There's no doubt we'll keep seeing AI integrated into fuzz testing. Given the long-standing challenges of implementing it effectively, particularly in terms of time, using AI to generate test cases and triage issues means fuzz testing should become more accessible and appealing to software development and security teams.
How can fuzz testing load-test AI applications and systems?
Generative AI is, at some level at least, an input-and-output technology. Prompting, after all, has become a discipline in its own right within the space of a few months. But there's obviously much more at play: AI systems are made up of a range of different components interacting with each other, from varied data sources to algorithmic models.
These interconnected parts, and the inherent unpredictability of these systems, make testing difficult but critical. This is where fuzz testing can help: because the technique uses randomness and unpredictability as its modus operandi, it can uncover weaknesses and vulnerabilities in similarly unpredictable, non-deterministic technologies.
In fact, this isn't hypothetical; fuzz testing is used in the context of AI testing today. For example, one company uses it to identify vulnerabilities in image-recognition models by injecting corrupted or adversarial images. Researchers have also written about the value of fuzzing AI systems; in one paper, the authors discuss using fuzz testing in a Python project. "By applying fuzzing to ML frameworks," they write, "it is possible to identify security vulnerabilities that might not be found by traditional testing methods."
However, the paper also stresses that fuzz testing needs to be part of a broader workflow that includes evaluation and analysis steps such as "crash triage" and "severity estimation." This is, of course, important for fuzzing to be done effectively in any context, but it's particularly critical when dealing with complex and opaque machine learning or AI systems.
How to get started with fuzz testing
With growing AI integration, fuzzing should become easier and faster. However, as may be obvious, it's essential to remember that fuzzing still requires human oversight. Rushing into AI-powered fuzzing without a solid understanding of how the practice should be conducted is extremely dangerous. To reiterate the point made earlier, don't run fuzz testing on an environment containing elements you can't afford to see completely destroyed. Limited, local experimentation is a good place to start.
On a similar note, it's essential to stress (once again) that fuzz testing is only one part of a team's security arsenal. Other techniques and methods, such as static code analysis, unit testing, and manual testing, are just as important. To be effective, they need to be used together at the right time. This is also where good security practices come into play, shifting security left and making sure security concerns are a priority throughout the development lifecycle are essential foundations, without which fuzz testing becomes not only difficult but potentially even ineffective.
Bridging the past and the future
While fuzz testing's failure to become a mainstream software testing technique is partly a symptom of its chaotic and somewhat risky nature, it also reflects the priorities and pressures placed on software development teams. However, its use in specialized testing and security contexts demonstrates that it offers something other established techniques can't.
And, in an era of highly complex and often opaque systems, fuzz testing's ability to properly load-test applications gives it relevance beyond the domains where it has largely been used in recent years.
Exploring how fuzz testing could play a role in your existing testing arsenal might, in 2026, make a lot of sense.
Disclaimer: The statements and opinions expressed in this article are those of the author and do not necessarily reflect the positions of Adservio.
STAY POSTED
Get our next analyses and field notes straight to your inbox.
