@@ -409,7 +409,7 @@ Therefore, the expected (mean) length of such a sequence is $E(l) = 1/p = x$, an

%often a value close to $n$ is picked for $m$, in the hope that the test set contains at least some counterexamples.

%Then, for each next hypothesis, $m$ is assumed to be larger than before, and eventually one hopes to obtain a correct estimate for $m$.

In some cases, however, the shortest counterexample for the current hypothesis is simply too long.

%In some cases, however, the shortest counterexample for the current hypothesis is simply too long.

%Let us illustrate this with (an adaptation of) our running example (\autoref{fig:fsm}).

%A $3$-complete test set would contain any permutation of the sequence 10 20 20, which is a counterexample for the hypothesis in \autoref{fig:hyp}.

%Therefore, we are likely to find a counterexample in this case.

...

...

@@ -419,7 +419,7 @@ In some cases, however, the shortest counterexample for the current hypothesis i

%In the hypothetical case described above, instead of applying a $3$-complete test set exhaustively, one can randomly sample a $10$-complete set.

%Whilst this does not guarantee that we would find a counterexample, it at least provides us with the possibility of finding one.

%Still, however, it is easy to see that the probability of finding a counterexample is fairly low.

Therefore, alternative methods for finding counterexamples might yield better results.

%Therefore, alternative methods for finding counterexamples might yield better results.

\subsection{Fuzzing}\label{sec:fuzzing}

A \emph{fuzzer} is a program that applies a set of tests (i.e.\ input sequences) to a target program, and then iteratively \emph{mutates} (i.e.\ modifies) these tests to monitor if `something interesting' happens.