Fuzzing

Fuzzing systematically explores the vast input space of AI models to find boundary conditions where logic fails. Unlike human-driven testing, fuzzers generate millions of permutations:

• Mutation-based fuzzing: Takes valid inputs (seed prompts, images) and applies bit flips, byte insertions, or token swaps
• Generation-based fuzzing: Builds inputs from scratch using grammar models or protocol specifications
• Coverage-guided fuzzing: Instruments the model to track which code paths or neural activations are triggered, prioritizing inputs that reach new logic branches

This is particularly effective against models with complex input parsing, such as multimodal systems accepting text, images, and audio simultaneously.

Language models are vulnerable to tokenization boundary attacks where fuzzing tools manipulate the byte-pair encoding process:

• Inserting Unicode control characters (zero-width spaces, bidirectional text markers) to split tokens unexpectedly
• Exploiting whitespace normalization differences between training and inference pipelines
• Generating adversarial token sequences that cause the tokenizer to produce out-of-vocabulary or merged tokens
• Testing special token injection (e.g., <|endoftext|>, <|im_start|>) to prematurely terminate context windows

These techniques often bypass string-matching safety filters because the malicious payload is fragmented across token boundaries invisible to regex-based guardrails.

Fuzzing production inference endpoints reveals resilience gaps in model serving infrastructure:

• Malformed JSON payloads: Missing required fields, type mismatches, or deeply nested objects that trigger deserialization errors
• Boundary value analysis: Inputs at min/max token limits, empty strings, or null bytes that cause unexpected tensor shapes
• Concurrency fuzzing: Rapid-fire requests with overlapping long and short contexts to expose race conditions in KV-cache management
• Encoding confusion: Sending UTF-16 when UTF-8 is expected, or mixing base64-encoded blobs with raw text in multimodal endpoints

These tests often uncover denial-of-service vectors where a single crafted request causes OOM kills or GPU memory fragmentation.

Differential fuzzing compares outputs from multiple models or model versions to detect regressions and inconsistencies:

• Running identical fuzzed inputs through GPT-4, Claude, and Llama to find inputs where one model produces harmful content while others refuse
• Comparing quantized vs. full-precision model variants to identify numerical instability in compressed representations
• Testing fine-tuned vs. base models to verify that safety alignment persists under edge-case inputs
• Detecting semantic divergence where models produce factually contradictory outputs for minimally perturbed inputs

This technique is essential for continuous automated red teaming (CART) pipelines that must detect safety regressions with each model update.

Vision-language and audio-language models introduce cross-modal attack surfaces that text-only fuzzers miss:

• Image pixel fuzzing: Single-pixel perturbations, adversarial noise patterns, or corrupted EXIF metadata that cause vision encoders to produce anomalous embeddings
• Audio sample manipulation: Inaudible frequency injections, sample rate mismatches, or truncated waveforms that confuse speech-to-text preprocessing
• Interleaved modality attacks: Alternating between text and image tokens in ways that violate the model's expected input format
• File format fuzzing: Corrupted PNG headers, truncated MP4 streams, or malformed WAV chunks that crash preprocessing pipelines before inference

These attacks exploit the fact that multimodal models often concatenate embeddings from separate encoders, creating intermediate representations never seen during safety training.

Specialized fuzzers target safety classifier models and output filters to find bypasses systematically:

• Instrumenting the guardrail model's internal activations to measure which neurons fire for different input categories
• Generating inputs that maximize toxic content probability while minimizing detection confidence scores
• Fuzzing the interaction between multiple guardrails (e.g., input filter + output filter + keyword blocklist) to find gaps where one layer passes content that another assumes is already blocked
• Testing multi-turn conversation flows where harmful content is distributed across messages to evade single-turn classifiers

This approach treats the safety stack itself as the system under test, applying traditional fuzzing methodology to AI-specific defense mechanisms.