LLM-Guided Semantic Mutation for Lua Interpreter Fuzzing: A Coverage-Driven Approach
Resumo
Fuzzing is a crucial technique for finding vulnerabilities in software, but its effectiveness in scripting languages such as Lua is limited by the difficulty of generating semantically valid test inputs. This work proposes a methodology that uses Large Language Models (LLMs) to generate semantically rich mutations for fuzzing Lua scripts. Our approach involves developing a fuzzer prototype that leverages an LLM’s in-context learning capabilities to create syntactically and semantically plausible code variations. We will validate this methodology by evaluating the code coverage gain of mutations relative to original seeds, the effectiveness in bug identification, and the execution time of the process, aiming to demonstrate the feasibility of using LLMs for the security of systems utilizing Lua.
Palavras-chave:
Fuzzing, LLM, Lua, Software Testing, Security
Referências
Dinesh Deckker and Subhashini Sumanasekara. 2025. The Role of ChatGPT in Software Development and Code Generation: A Review of Opportunities, Challenges, and Future Directions. TechRxiv Preprints (May 2025). Preprint, disponível em: [link].
Jueon Eom, Seyeon Jeong, and Taekyoung Kwon. 2024. CovRL: Fuzzing JavaScript Engines with Coverage-Guided Reinforcement Learning for LLM-based Mutation. arXiv preprint arXiv:2402.12222v1 (Feb 2024). [link]
Patrice Godefroid. 2020. Fuzzing: Hack, Art, and Science. Commun. ACM 63, 2 (2020), 70–76. DOI: 10.1145/3376122
Yu Huang, Zhiqiang Zuo, Zeyu Sun, Liangcheng Yu, and Tianwei Zhang. 2024. Large Language Models Based Fuzzing Techniques: A Survey. arXiv preprint arXiv:2401.08753 (2024). [link]
Roberto Ierusalimschy. 2016. Programming in Lua (4th ed.). Feisty Duck.
Roberto Ierusalimschy. 2020. Lua 5.4 Reference Manual. PUC-Rio. [link] Documentação oficial da linguagem Lua.
Yuancheng Jiang, Chuqi Zhang, Bonan Ruan, Jiahao Liu, Manuel Rigger, Roland H. C. Yap, and Zhenkai Liang. 2025. Fuzzing the PHP Interpreter via Dataflow Fusion. arXiv preprint arXiv:2410.21713v2 (Feb 2025). [link]
Anton Lozhkov, Raymond Li, Loubna Ben Allal, Federico Cassano, Joel Lamy-Poirier, Nouamane Tazi, Ao Tang, Dmytro Pykhtar, Jiawei Liu, Yuxiang Wei, et al. 2024. StarCoder 2 and The Stack v2: The Next Generation. arXiv preprint arXiv:2402.19173 (2024). [link]
Lua.org. 2025. About Lua. [link] Acesso em May. 2025.
Valentin J. M. Manès, HyungSeok Han, Choongwoo Han, Sang Kil Cha, Manuel Egele, Edward J. Schwartz, and Maverick Woo. 2021. The Art, Science, and Engineering of Fuzzing: A Survey. IEEE Transactions on Software Engineering 47, 11 (2021), 2312–2331. DOI: 10.1109/TSE.2019.2946563
Marbux. 2021. Where Lua is Used. [link] Lista arquivada de casos de uso da linguagem Lua.
Humza Naveed, Asad Ullah Khan, Shi Qiu, Muhammad Saqib, Saeed Anwar, Muhammad Usman, Naveed Akhtar, Nick Barnes, and Ajmal Mian. 2024. A Comprehensive Overview of Large Language Models. Elsevier Preprint (October 2024). Preprint, disponível em: [link].
Xianfei Ou, Cong Li, Yanyan Jiang, and Chang Xu. 2024. The Mutators Reloaded: Fuzzing Compilers with Large Language Model Generated Mutation Operators. In Proceedings of the 29th ACM International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS ’24). ACM, La Jolla, CA, USA, 298–312. DOI: 10.1145/3622781.3674171
Siberoloji. 2021. Basics of Lua Programming for Nmap NSE. [link] Introdução prática ao uso de Lua com Nmap.
Jianxun Wang and Yixiang Chen. 2023. A Review on Code Generation with LLMs: Application and Evaluation. In Proceedings of the 2023 IEEE International Conference on Medical Artificial Intelligence (MedAI). IEEE, Shanghai, China, 284–290. DOI: 10.1109/MedAI59581.2023.00044
Chunqiu Steven Xia, Matteo Paltenghi, Jia Le Tian, Michael Pradel, and Lingming Zhang. 2024. Fuzz4All: Universal Fuzzing with Large Language Models. In Proceedings of the 46th International Conference on Software Engineering (ICSE). IEEE/ACM. DOI: 10.1109/ICSE48619.2024.00050
Wenzhang Yang, Cuifeng Gao, Xiaoyuan Liu, Yuekang Li, and Yinxing Xue. 2024. Rust-twins: Automatic Rust Compiler Testing through Program Mutation and Dual Macros Generation. In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering (ASE). ACM. DOI: 10.1145/3691620.3695059
Jueon Eom, Seyeon Jeong, and Taekyoung Kwon. 2024. CovRL: Fuzzing JavaScript Engines with Coverage-Guided Reinforcement Learning for LLM-based Mutation. arXiv preprint arXiv:2402.12222v1 (Feb 2024). [link]
Patrice Godefroid. 2020. Fuzzing: Hack, Art, and Science. Commun. ACM 63, 2 (2020), 70–76. DOI: 10.1145/3376122
Yu Huang, Zhiqiang Zuo, Zeyu Sun, Liangcheng Yu, and Tianwei Zhang. 2024. Large Language Models Based Fuzzing Techniques: A Survey. arXiv preprint arXiv:2401.08753 (2024). [link]
Roberto Ierusalimschy. 2016. Programming in Lua (4th ed.). Feisty Duck.
Roberto Ierusalimschy. 2020. Lua 5.4 Reference Manual. PUC-Rio. [link] Documentação oficial da linguagem Lua.
Yuancheng Jiang, Chuqi Zhang, Bonan Ruan, Jiahao Liu, Manuel Rigger, Roland H. C. Yap, and Zhenkai Liang. 2025. Fuzzing the PHP Interpreter via Dataflow Fusion. arXiv preprint arXiv:2410.21713v2 (Feb 2025). [link]
Anton Lozhkov, Raymond Li, Loubna Ben Allal, Federico Cassano, Joel Lamy-Poirier, Nouamane Tazi, Ao Tang, Dmytro Pykhtar, Jiawei Liu, Yuxiang Wei, et al. 2024. StarCoder 2 and The Stack v2: The Next Generation. arXiv preprint arXiv:2402.19173 (2024). [link]
Lua.org. 2025. About Lua. [link] Acesso em May. 2025.
Valentin J. M. Manès, HyungSeok Han, Choongwoo Han, Sang Kil Cha, Manuel Egele, Edward J. Schwartz, and Maverick Woo. 2021. The Art, Science, and Engineering of Fuzzing: A Survey. IEEE Transactions on Software Engineering 47, 11 (2021), 2312–2331. DOI: 10.1109/TSE.2019.2946563
Marbux. 2021. Where Lua is Used. [link] Lista arquivada de casos de uso da linguagem Lua.
Humza Naveed, Asad Ullah Khan, Shi Qiu, Muhammad Saqib, Saeed Anwar, Muhammad Usman, Naveed Akhtar, Nick Barnes, and Ajmal Mian. 2024. A Comprehensive Overview of Large Language Models. Elsevier Preprint (October 2024). Preprint, disponível em: [link].
Xianfei Ou, Cong Li, Yanyan Jiang, and Chang Xu. 2024. The Mutators Reloaded: Fuzzing Compilers with Large Language Model Generated Mutation Operators. In Proceedings of the 29th ACM International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS ’24). ACM, La Jolla, CA, USA, 298–312. DOI: 10.1145/3622781.3674171
Siberoloji. 2021. Basics of Lua Programming for Nmap NSE. [link] Introdução prática ao uso de Lua com Nmap.
Jianxun Wang and Yixiang Chen. 2023. A Review on Code Generation with LLMs: Application and Evaluation. In Proceedings of the 2023 IEEE International Conference on Medical Artificial Intelligence (MedAI). IEEE, Shanghai, China, 284–290. DOI: 10.1109/MedAI59581.2023.00044
Chunqiu Steven Xia, Matteo Paltenghi, Jia Le Tian, Michael Pradel, and Lingming Zhang. 2024. Fuzz4All: Universal Fuzzing with Large Language Models. In Proceedings of the 46th International Conference on Software Engineering (ICSE). IEEE/ACM. DOI: 10.1109/ICSE48619.2024.00050
Wenzhang Yang, Cuifeng Gao, Xiaoyuan Liu, Yuekang Li, and Yinxing Xue. 2024. Rust-twins: Automatic Rust Compiler Testing through Program Mutation and Dual Macros Generation. In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering (ASE). ACM. DOI: 10.1145/3691620.3695059
Publicado
08/09/2026
Como Citar
SOUZA, Richard Facin; BRAGA, Andrei De Almeida Sampaio; FEITOSA, Samuel Da Silva; SALTON, Giancarlo Dondoni.
LLM-Guided Semantic Mutation for Lua Interpreter Fuzzing: A Coverage-Driven Approach. In: SIMPÓSIO BRASILEIRO DE LINGUAGENS DE PROGRAMAÇÃO (SBLP), 30. , 2026, São Paulo/SP.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2026
.
p. 71-79.
DOI: https://doi.org/10.5753/sblp.2026.28540.
