MetaFOE: LLMs boost fuzz testing by 18.7% with 1,528 crashes

A new study from researchers introduces MetaFOE, a framework that leverages large language models to automatically generate and integrate metamorphic oracles into existing fuzz drivers for greybox fuzzing. Traditional fuzz drivers rely on crash-based oracles, which miss many functional bugs. Metamorphic oracles, based on metamorphic relations (MRs), can detect deeper logic flaws but require heavy domain knowledge to construct. MetaFOE automates this process using three modern LLMs and five prompt strategies, generating 3,475 MRs (77.3% applicable) and 12,351 meta drivers (6,228 valid).

In just three hours of fuzzing, the valid meta drivers improved edge coverage by an average of 18.7% and triggered 1,528 unique crashes—demonstrating a significant leap in bug detection capability. The work is the first systematic study of metamorphic-based fuzz oracle enhancement (MFOE) and shows that LLMs can effectively reduce the manual effort required to build intelligent oracles. This opens the door to more comprehensive software security testing, catching both security vulnerabilities and functional defects that crash-based oracles miss.