Security researcher & Fuzzer developer & Rustacean
Joined February 2016
- Tweets28
- Following285
- Followers129
- Likes184
spinpx retweeted
🔥 Today, we are truly excited to announce our technical prototype, the Generative World Simulation system, which integrates JING（镜）, an interactive experience model, with DAO（道）, a computable shared-world engine.
The coupled model and engine connect first-person experience with a shared world that continues to evolve beyond any individual observer.
Conditioned on actions and observation history, JING enables agent navigate, manipulate, and communicate from a first-person perspective in the world. Watch our demo video to see it in action!
On the official WBench leaderboard as of September 17, 2026, XGEN-JING ranked #1 on the Full split, and #2 on the Navi split. 🎉
DAO maintains shared world state and rules, computes the consequences of actions, and provides JING with only what the current observer can perceive. It also supports autonomous agent decision-making, enabling agents to act independently within an evolving shared world.
Together, DAO and JING move beyond generating the next frame toward simulating the world behind it. This marks a small step towards OASIS: not just a world that responds to you, but a world—and a society—that evolves with and without you. 💪
Explore XGEN Labs～:
🔗 Website: xgenlabs.ai/
🤗 HF: huggingface.co/XGENlabs/XGEN…
🦊 GitHub: github.com/XGEN-Labs/XGEN-JI…
spinpx retweeted
Happy to share our work "Cottontail: LLM-Driven Concolic Execution for Structured Test Input Generation" will appear in S&P'26!
Paper: haoxintu.github.io/files/sp2…
Code: github.com/Cottontail-Proj/c…
Special thanks to @nim_gnoes_eel, @JNUYUXIAN, @spinpx, @LingxiaoJiang, and @mboehme_ ♥️
(Prompt) Fuzzing is fundamentally a form of inference scaling law. arxiv.org/abs/2312.17677
spinpx retweeted
What happens if you write buggy code and misconfigure the experimental setup when evaluating a fuzzer’s performance? Wrong and misleading conclusion!
We found several fatal bugs and wrong experimental settings in MLFuzz (arxiv.org/pdf/2309.16618, a revisit work on NEUZZ published on a top tier software engineering conference ASE 2023, @AndreasZeller, @ASE_conf ). These following bugs lead to wrong and misleading conclusions in MLFuzz.
• An initialization bug ⇒ Failure setup of persistent mode fuzzing.
• A program crash ⇒ Unexpected early termination of NEUZZ.
• An error in training dataset collection ⇒ A poorly-trained neural network model.
• An error in result collection ⇒ Incomplete code coverage report
We confirmed these bugs with the MLFuzz’s authors and write a rebuttal paper(arxiv.org/pdf/2409.04504) to explain the errors in MLFuzz and summarize the lessons on a fair and scientific fuzzing experiment/revisit.
1. Ensure the correctness of code implementation. Careful and rigorous debugging is needed. If you would like to patch a prior work, double-check your setting or patch is correct and seek help from original developer if needed. MLFuzz introduced 3 implementation bugs that led to wrong experimental results and conclusions.
2. Diverse benchmark selection. Try to evaluate your fuzzer on multiple benchmarks, like FuzzBench, Magma, UniFuzz.
3. Uniform code coverage metric. Covert different code coverage metrics like AFL XOR hash, LLVM coverage sanitizer (pruned), LLVM coverage sanitizer (no-pruned), AFL++ code coverage into a uniform one by replaying
4. Complete test case collection. Be sure to collect all the test cases generated by the fuzzer.
5. Uniform fuzzing mode. Ensure all fuzzer are running under same modes, either the default mode or the faster persistent mode. An apple-to-banana comparison like MLFuzz only leads to wrong conclusions.
6. Open-source your fuzzing corpus. Fuzzing is an optimization and different seed corpus (starting point) can lead to drastically variant results.
arxiv.org/pdf/2401.05529.pdf I and Wei Cao did most of this work and wrote the first draft while we were at Ant Group. However, they removed us from the author list. Sad story. This work is shepherd by Alex Liu. However, he is not in the list, too.
spinpx retweeted
Andreas, you are a renowned researcher in the fuzzing community, and your fuzzing book is amazing. But this work draws a completely WRONG conclusion due to the careless comparison of file-retrieval fuzzer against in-memory fuzzer, where the fuzzing throughput gap is up to 10X
Hopper is released at: github.com/FuzzAnything/hopp…
We presented HOPPER, which generates fuzzing test cases for libraries automatically via interpretative fuzzing. It transforms the problem of library fuzzing into the problem of interpreter fuzzing. The paper can be found at spinpx.com/papers/Hopper.pdf
binutils, tcpdump, mupdf, ffmpeg are the most popular programs in evaluation of fuzzing papers. 🙂🙂github.com/AngoraFuzzer/Fuzz…
spinpx retweeted
Congrats to my @TalosSecurity colleague @emd3l and the other accomplished authors of papers accepted at IEEE S&P
csdl.computer.org/csdl/proce…
spinpx retweeted
Angora: Efficient Fuzzing by Principled Search. arxiv.org/abs/1803.01307
spinpx retweeted
“We figured out a way to trick your voice assistants to respond to our commands but since it might be too obvious to you if we do that, we embedded our commands in songs, and everytime your voice assistant hears our songs it executes our commands”.
🔥 This is fine 🔥 xitter.cf/arxiv_org/status/95791…
CommanderSong: A Systematic Approach for Practical Adversarial Voice Recognition. arxiv.org/abs/1801.08535
spinpx retweeted
The list of #NDSS18 accepted papers has it all! #privacy, #security, #automation, #IoT, #TLS, and so much more! ow.ly/Klyc30hPJ8d
spinpx retweeted
Isolation, indeed, this is what @spacemacs is all about regarding configuration of hundreds of packages. xitter.cf/joeerl/status/94883642…
