Adaptive Security for Complex Software Systems: Runtime Decision Making in Fuzzing and LLM Agents

The Hong Kong University of Science and Technology
Department of Computer Science and Engineering


MPhil Thesis Defence


Title: "Adaptive Security for Complex Software Systems: Runtime
Decision Making in Fuzzing and LLM Agents"

By

Mr. Hung-chun CHIU


Abstract:

Security systems often make decisions before complete information becomes 
available. A greybox fuzzer allocates executions before mutation shows 
whether a seed can reach new code. A tool-using large language model (LLM) 
agent may need a tool result that also carries an untrusted instruction. This 
thesis asks when runtime observations should change decisions in these 
settings.

BeliefFuzz records seed discovery in a planning tree and ranks seeds by 
reachable uncovered code, selection history, and confidence. It ends a 
mutation round when discovery intervals show that new paths arrive too 
slowly. Titan builds target-specific reachability summaries; static synergy 
inference classifies overlap, conflict, and independence to guide 
synergy-aware seed scheduling and multi-target-oriented mutation. At matched 
coverage, BeliefFuzz ran 2.12-5.63x faster and used 1.18-2.77x fewer 
executions than the evaluated baselines. Its real-world campaigns found 31 
previously unseen bugs, 18 with CVE identifiers. Titan averaged a 21.4x 
speedup across baselines; against AFLGo, it used 95.0% fewer executions. 
Campaigns on updated program versions found one new bug and nine incomplete 
fixes; two findings received CVE identifiers.

An unsuccessful fuzzing execution can inform the next allocation. DRIFT must 
instead intervene before an unsafe action takes effect or a conflicting 
instruction enters memory. The Secure Planner builds request-derived control 
and data constraints, the Dynamic Validator checks proposed calls and 
evaluates deviations before execution, and the Injection Isolator masks 
conflicting instructions before a tool result enters memory. On AgentDojo 
with GPT-4o-mini, DRIFT reduced attack success from 30.7% without defense to 
1.4%. Its utility exceeded CaMeL by 18.9 percentage points on benign tasks 
and 15.5 points under attack. The comparison distinguishes fuzzing 
allocations that can be revised after execution from agent actions and memory 
updates that require prior control.


Date:                   Wednesday, 26 August 2026

Time:                   2:00pm - 4:00pm

Venue:                  Room 5566
                        Lifts 27-28

Chairman:               Prof. Ke YI

Committee Members:      Prof. Charles ZHANG (Supervisor)
                        Dr. May FUNG