Mutating structure, not bytes: nelli's IR-aware fuzzing

I expected byte mutation to lose because its mutants die at the decoder. Measured, they decode fine. About 83% of them decode to the value you already had. nelli mutates the typed choice sequence instead, and reaches 18 edges of a parser where byte mutation reaches 2.

September 16, 2026 · 9 min · Corey Leavitt

nelli: one engine for property testing, fuzzing, and symbolic execution

nelli is a Nim testing library built on a choice-sequence engine. Because a test input is just a recorded sequence of typed choices, the same engine drives property testing, coverage-guided fuzzing, and SMT-backed symbolic execution.

August 26, 2026 · 13 min · Corey Leavitt