You could likely also combine the LLM with a coverage tool to provide additional guidance when regenerating the fuzzer: "Your fuzzer missed lines XX-YY in the code. Explain why you think the fuzzer missed those lines, describe inputs that might reach those lines in the code, and then update the fuzzer code to match your observations."
This approach could likely also be combined with RL; the code coverage provides a decent reward signal.
Comments
You could likely also combine the LLM with a coverage tool to provide additional guidance when regenerating the fuzzer: "Your fuzzer missed lines XX-YY in the code. Explain why you think the fuzzer missed those lines, describe inputs that might reach those lines in the code, and then update the fuzzer code to match your observations."
This approach could likely also be combined with RL; the code coverage provides a decent reward signal.
To me, if it detects bugs (and fixing those makes the others reachable), that seems like a pretty acceptable iterative step
It's less academically pure, but as an engineer who wants to fix bugs it seems ok