Searcharxiv⌕ Search

arXiv subjects

Qiaoyun Huang

Publications and source records attributed to Qiaoyun Huang.

2 recordsLinked to original sources

CCZ-Equivalence and Enumeration of Triprojective APN Functions

We classify all admissible parameters of the G"ologlu--K"olsch triprojective construction of almost perfect nonlinear (APN) functions up to Carlet--Charpin--Zinoviev (CCZ) equivalence. The construction has three coefficients in $K=\mathbb{F}_{2^m}$ and a Frobenius exponent $k$ coprime to $m$. For every $m>1$, we give a necessary-and-sufficient criterion that includes changes of both the coefficients and the exponent. Each parameter choice determines one of the two irreducible cubic polynomials over $\mathbb{F}_2$. Two functions are equivalent precisely when their exponents and cubics agree, or when the exponents are negatives modulo $m$ and the cubics are reciprocal. When $7\nmid m$, every admissible member is equivalent to a Li--Kaleyski representative: the larger coefficient space adds no CCZ classes. When $7\mid m$, those representatives are inadmissible; we construct replacements and classify the full family. There are exactly $φ(m)$ CCZ classes, extending the previously known count for the older subfamilies to all admissible coefficients and all degrees. We also count the parameter triples and compute canonical representatives and explicit equivalence maps in deterministic polynomial time for every degree, including degrees divisible by seven. The proof combines a reduction to classical semilinear conjugacy with an intrinsic recovery of the scalar field from the polar bilinear map. The reduction from arbitrary EL equivalence is algebraic in every degree, including degrees three and six.

cs.CR↗

AdaRare: Telemetry-Guided Joint Profile Control for Greybox Fuzzing

Greybox fuzzers combine interacting queue, mutation, dictionary, energy, and comparison-solving control surfaces, while prior adaptive systems typically optimize other decision objects or control layers. We present AdaRare, an AFL++ extension that coordinates five internal actuation mechanisms as one bounded in-process profile updated every 5,000 ms. Completed-window, action-induced telemetry feeds an arm-local recency-weighted linear scorer and a profile-conditioned controller target. The scorer borrows the algebraic structure of disjoint LinUCB, but serves as a closed-loop profile-ranking mechanism rather than a calibrated contextual-bandit action-value estimator or statistical confidence bound. Across three sequential repeated-trial phases, Main provides broad integrated-system evidence: AdaRare has higher median edge coverage than vanilla AFL++ on all eight targets, with five Holm-significant comparisons. In the strongest matched result, Full AdaRare has higher median edge coverage than CmpLog-matched AFL++ on all five follow-up targets, with four Holm-significant comparisons. Batch A finds higher medians for telemetry-guided selection than fixed-context, random, and round-robin schedules in all 15 target-control comparisons, with 13 Holm-significant comparisons. The experiments do not establish independent No-A6-versus-Shadow or scarcity-bundle effects; A6 evidence is target-dependent and weakens under batch-wide correction. In an unmatched firmware case study, AdaRare-generated inputs exposed five distinct memory-corruption findings, each reproduced in a separate environment and later assigned a CVE identifier. Controller-boundary compute P99 medians are below 6.5 ms for a five-second window; complete-boundary P99 medians including synchronous logging are below 14.7 ms. These measurements characterize boundary latency, not total system overhead.

cs.CR↗