Locus: Agentic Predicate Synthesis for Directed Fuzzing

Jie Zhu, Chihao Shen, Ziyang Li, Jiahao Yu, Yizheng Chen, Kexin Pei. 2025. arXiv.org.

Read the paper · doi:10.1145/3744916.3773102 · arXiv:2508.21302

What this paper does with SQLancer

One citation, in a discussion of feedback signals being too sparse or indirect to measure progress. Locus improves directed fuzzing, where the goal is an input reaching a specified program state. The authors argue branch distances do not precisely capture progress toward a deeply nested target and manual constraints do not generalise. Locus synthesises predicates marking semantically meaningful intermediate states as milestones, instrumented into the program to reject executions unlikely to reach the target. It sped up eight fuzzers by 41.6x on average and found nine unpatched bugs. Written by claude-opus-5 from the 1 place this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — no

SQLancer is cited, not used; nothing in the mentions describes reusing its code.

extends technique — no

No technique is extended; the citation is background.

compares with — no

No empirical comparison against SQLancer is reported in the mentions.

describes as state of the art — no

The citation does not characterise SQLancer as the state of the art.

SQLancer publications it cites (1)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#	Entry	Matched as
73	Manuel Rigger and Zhendong Su. 2020. Finding bugs in database systems via query partitioning.Proceedings of the ACM on Programming Languages(2020).	sqlancer publication · TLP

Every place it refers to SQLancer (1)

1 sentence, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id	Sentence	Found by	Where
M1	However, such feedback is sometimes too sparse or indirect to reliably measure the progress, especially when there is a long chain ofimplicitpreconditions guarding the target program states [ 2,26,36,44,45,66,73,80, 106].	citation marker background	1 Introduction page 1

This page is rendered from _data/papers/paper_doi_10_1145_3744916_3773102.json, extracted from arxiv. 13 pages, 111 references parsed.