{"id":"https://openalex.org/W7166650844","doi":"https://doi.org/10.48550/arxiv.2606.29124","title":"CornerCase: Automated Extremal Testing of Protocol Implementations using LLMs","display_name":"CornerCase: Automated Extremal Testing of Protocol Implementations using LLMs","publication_year":2026,"publication_date":"2026-06-28","ids":{"openalex":"https://openalex.org/W7166650844","doi":"https://doi.org/10.48550/arxiv.2606.29124"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.29124","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.29124","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.29124","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5114592970","display_name":"Rathin Singha","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Singha, Rathin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139714504","display_name":"Kuan Qian","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Qian, Kuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5119982502","display_name":"Srinath Saikrishnan","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Saikrishnan, Srinath","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139662694","display_name":"Tracy Zhao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhao, Tracy","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5038689485","display_name":"Soheil Abbasloo","orcid":"https://orcid.org/0000-0002-0036-7107"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Abbasloo, Soheil","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075133765","display_name":"Ryan Beckett","orcid":"https://orcid.org/0000-0001-7844-2026"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Beckett, Ryan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5077950054","display_name":"Siva Kesava Reddy Kakarla","orcid":"https://orcid.org/0009-0006-2694-4685"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kakarla, Siva Kesava Reddy","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139669905","display_name":"Todd Millstein","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Millstein, Todd","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5102730096","display_name":"George Varghese","orcid":"https://orcid.org/0000-0002-8218-5701"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Varghese, George","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9617000222206116,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9617000222206116,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.010499999858438969,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.008299999870359898,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.802299976348877},{"id":"https://openalex.org/keywords/implementation","display_name":"Implementation","score":0.682699978351593},{"id":"https://openalex.org/keywords/protocol","display_name":"Protocol (science)","score":0.6399999856948853},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.5317999720573425},{"id":"https://openalex.org/keywords/boundary","display_name":"Boundary (topology)","score":0.5},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.47760000824928284},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.46970000863075256},{"id":"https://openalex.org/keywords/debugging","display_name":"Debugging","score":0.39340001344680786},{"id":"https://openalex.org/keywords/isolation","display_name":"Isolation (microbiology)","score":0.38510000705718994},{"id":"https://openalex.org/keywords/tree","display_name":"Tree (set theory)","score":0.3799999952316284}],"concepts":[{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.802299976348877},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7892000079154968},{"id":"https://openalex.org/C26713055","wikidata":"https://www.wikidata.org/wiki/Q245962","display_name":"Implementation","level":2,"score":0.682699978351593},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.6399999856948853},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.5317999720573425},{"id":"https://openalex.org/C62354387","wikidata":"https://www.wikidata.org/wiki/Q875399","display_name":"Boundary (topology)","level":2,"score":0.5},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.47760000824928284},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.46970000863075256},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.4494999945163727},{"id":"https://openalex.org/C168065819","wikidata":"https://www.wikidata.org/wiki/Q845566","display_name":"Debugging","level":2,"score":0.39340001344680786},{"id":"https://openalex.org/C2775941552","wikidata":"https://www.wikidata.org/wiki/Q25212305","display_name":"Isolation (microbiology)","level":2,"score":0.38510000705718994},{"id":"https://openalex.org/C113174947","wikidata":"https://www.wikidata.org/wiki/Q2859736","display_name":"Tree (set theory)","level":2,"score":0.3799999952316284},{"id":"https://openalex.org/C128942645","wikidata":"https://www.wikidata.org/wiki/Q1568346","display_name":"Test case","level":3,"score":0.35989999771118164},{"id":"https://openalex.org/C12269588","wikidata":"https://www.wikidata.org/wiki/Q132364","display_name":"Communications protocol","level":2,"score":0.35440000891685486},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3529999852180481},{"id":"https://openalex.org/C169485995","wikidata":"https://www.wikidata.org/wiki/Q42283","display_name":"File Transfer Protocol","level":3,"score":0.3431999981403351},{"id":"https://openalex.org/C76844732","wikidata":"https://www.wikidata.org/wiki/Q4072285","display_name":"Conformance testing","level":3,"score":0.33469998836517334},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.33059999346733093},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.3118000030517578},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.31060001254081726},{"id":"https://openalex.org/C110251889","wikidata":"https://www.wikidata.org/wiki/Q1569697","display_name":"Model checking","level":2,"score":0.3050999939441681},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.3009999990463257},{"id":"https://openalex.org/C2983609787","wikidata":"https://www.wikidata.org/wiki/Q10534782","display_name":"Software implementation","level":3,"score":0.29809999465942383},{"id":"https://openalex.org/C133112747","wikidata":"https://www.wikidata.org/wiki/Q7251931","display_name":"Protocol analysis","level":2,"score":0.2978000044822693},{"id":"https://openalex.org/C4924752","wikidata":"https://www.wikidata.org/wiki/Q184148","display_name":"Plug-in","level":2,"score":0.29670000076293945},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.2856999933719635},{"id":"https://openalex.org/C184670325","wikidata":"https://www.wikidata.org/wiki/Q512604","display_name":"Loop (graph theory)","level":2,"score":0.2854999899864197},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.2842000126838684},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.2809000015258789},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.2727999985218048},{"id":"https://openalex.org/C157486923","wikidata":"https://www.wikidata.org/wiki/Q1376436","display_name":"String (physics)","level":2,"score":0.2721000015735626},{"id":"https://openalex.org/C1009929","wikidata":"https://www.wikidata.org/wiki/Q179550","display_name":"Software bug","level":3,"score":0.2694999873638153},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.2662999927997589},{"id":"https://openalex.org/C131275738","wikidata":"https://www.wikidata.org/wiki/Q7445023","display_name":"Security bug","level":5,"score":0.26350000500679016},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.26330000162124634},{"id":"https://openalex.org/C147873670","wikidata":"https://www.wikidata.org/wiki/Q11182","display_name":"Network address translation","level":4,"score":0.25540000200271606},{"id":"https://openalex.org/C2777267654","wikidata":"https://www.wikidata.org/wiki/Q3519023","display_name":"Test (biology)","level":2,"score":0.25429999828338623}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.29124","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.29124","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.29124","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.29124","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Many":[0],"software":[1],"bugs":[2,185],"in":[3,25,29,101],"network":[4],"protocol":[5,97],"implementations":[6,138],"arise":[7],"near":[8,114],"specification":[9],"boundaries,":[10],"such":[11,56,73],"as":[12,57,184],"inputs":[13,44],"just":[14],"within":[15],"or":[16,20,113],"outside":[17],"allowed":[18],"ranges,":[19],"messages":[21],"that":[22,70],"are":[23,110,122],"valid":[24],"isolation":[26],"but":[27],"invalid":[28],"a":[30,102,158],"given":[31],"state.":[32],"From":[33],"the":[34,115,153],"SSL":[35],"Heartbleed":[36],"exploit":[37],"to":[38,80,172,178],"TCP":[39],"Christmas":[40],"Tree":[41],"packets,":[42],"boundary":[43,74,116],"have":[45,181],"repeatedly":[46],"exposed":[47],"critical":[48],"weaknesses,":[49],"yet":[50],"remain":[51],"under-tested":[52],"by":[53],"existing":[54],"techniques":[55],"fuzzing":[58],"and":[59,127,144,174,186],"model-based":[60],"testing.":[61],"We":[62,132],"present":[63],"CornerCase,":[64],"an":[65],"automated":[66],"extremal":[67,107],"testing":[68,129],"approach":[69],"systematically":[71],"targets":[72],"behaviors.":[75],"Our":[76],"key":[77],"idea":[78],"is":[79],"decompose":[81],"test":[82,108],"generation":[83],"into":[84],"two":[85],"stages:":[86],"first,":[87],"large":[88],"language":[89],"models":[90],"(LLMs)":[91],"extract":[92],"explicit":[93],"validity":[94],"constraints":[95],"from":[96],"specifications":[98],"(e.g.,":[99],"RFCs)":[100],"structured,":[103],"section-by-section":[104],"manner;":[105],"second,":[106],"cases":[109],"generated":[111],"at":[112],"of":[117,139],"each":[118],"constraint.":[119],"These":[120],"tests":[121],"executed":[123],"across":[124],"multiple":[125],"implementations,":[126],"differential":[128],"identifies":[130],"inconsistencies.":[131],"evaluate":[133],"CornerCase":[134,171],"on":[135],"widely":[136],"used":[137,170],"HTTP,":[140],"DNS,":[141],"BGP,":[142],"SMTP,":[143],"QUIC,":[145],"uncovering":[146],"many":[147],"previously":[148],"unknown":[149],"bugs.":[150],"For":[151],"example,":[152],"HTTP":[154],"server":[155],"h2o":[156],"enters":[157],"redirect":[159],"loop":[160],"when":[161],"processing":[162],"URLs":[163],"containing":[164],"encoded":[165],"null":[166],"bytes.":[167],"Overall,":[168],"we":[169],"identify":[173],"file":[175],"42":[176],"anomalies;":[177],"date":[179],"26":[180],"been":[182],"acknowledged":[183],"18":[187],"fixed,":[188],"with":[189],"others":[190],"under":[191],"active":[192],"investigation":[193]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-07-01T00:00:00"}