USENIX Security 2025 · Distinguished Paper Award

FlowFusion vs AFL++

Animated comparison of fuzzing strategies. FlowFusion continuously fuses pairs of PHP test seeds via dataflow interleaving. AFL++ applies sequential bit/byte mutations to a single seed guided by coverage feedback.

FlowFusion
dataflow fusion

Picks two .phpt seeds → extracts dataflows → interleaves them via a bridge variable $fusion → produces a semantically new test case. ~20K seeds → 400M+ pairwise combinations.

0
fused cases
0
bugs found
0%
coverage
generation process
Line cov.
0%
AFL++
coverage-guided mutation

Selects one seed → trims it → applies deterministic stages (bit/byte flip, arithmetic, known ints) then stochastic havoc → retains inputs that hit new edges.

0
executions
0
new paths
0%
coverage
mutation process · initialising
mutation log
Line cov.
0%
Speed: