Adaptive Security for Complex Software Systems: Runtime Decision Making in Fuzzing and LLM Agents

The Hong Kong University of Science and Technology
Department of Computer Science and Engineering


MPhil Thesis Defence


Title: "Adaptive Security for Complex Software Systems: Runtime
Decision Making in Fuzzing and LLM Agents"

By

Mr. Hung-chun CHIU


Abstract:

Security systems often make decisions before complete information becomes 
available. A greybox fuzzer allocates executions before mutation shows whether 
a seed can reach new code. A tool-using large language model (LLM) agent may 
need a tool result that also carries an untrusted instruction. This thesis 
asks when runtime observations should change decisions in these settings.

BeliefFuzz records seed discovery in a planning tree and ranks seeds by 
reachable uncovered code, selection history, and confidence. It ends a 
mutation round when discovery intervals show that new paths arrive too slowly. 
Titan builds target-specific reachability summaries; static synergy inference 
classifies overlap, conflict, and independence to guide synergy-aware seed 
scheduling and multi-target-oriented mutation. At matched coverage, BeliefFuzz 
ran 2.12-5.63× faster and used 1.18-2.77× fewer executions than the evaluated 
baselines. Its real-world campaigns found 31 previously unseen bugs, 18 with 
CVE identifiers. Titan averaged a 21.4× speedup across baselines; against 
AFLGo, it used 95.0% fewer executions. Campaigns on updated program versions 
found one new bug and nine incomplete fixes; two findings received CVE 
identifiers.

An unsuccessful fuzzing execution can inform the next allocation. DRIFT must 
instead intervene before an unsafe action takes effect or a conflicting 
instruction enters memory. The Secure Planner builds request-derived control 
and data constraints, the Dynamic Validator checks proposed calls and 
evaluates deviations before execution, and the Injection Isolator masks 
conflicting instructions before a tool result enters memory. On AgentDojo with 
GPT-4o-mini, DRIFT reduced attack success from 30.7% without defense to 1.4%. 
Its utility exceeded CaMeL by 18.9 percentage points on benign tasks and 15.5 
points under attack. The comparison distinguishes fuzzing allocations that can 
be revised after execution from agent actions and memory updates that require 
prior control.


Date:                   Wednesday, 26 August 2026

Time:                   2:00pm - 4:00pm

Venue:                  Room 5566
                        Lifts 27-28

Chairman:               Prof. Ke YI

Committee Members:      Prof. Charles ZHANG (Supervisor)
                        Dr. May FUNG