Google Project Zero has published an analysis of mutational grammar fuzzing, a technique that pairs traditional mutation-based fuzzing with a formal grammar. The grammar defines the structure that valid samples must follow, giving the fuzzer a clear model of what inputs are acceptable.
When the fuzzer mutates a seed sample, it does so in a way that the resulting sample still conforms to the grammar rules. This means the generated inputs remain structurally valid, rather than being randomly broken in ways that parsers might reject immediately.
The post assesses how effective this approach is in practice. Since this is a single analysis from Project Zero, the conclusions reflect their specific testing methodology and should not be read as a general verdict on all fuzzing techniques.