bit-flip mutation — STIMSMITH

Bitflip Mutation

Concept

A predefined fuzzing mutation operator that inverts (flips) individual bits of an input. It is one of the core mutation primitives of AFL and is reused (as an 'AFL-like' mutation) by processor-instruction fuzzers such as TheHuzz, where it operates on the binary encoding of test instructions to explore both data-path and opcode variations.

First seen 6/14/2026

Last seen 8/8/2026

Evidence 5 chunks

Wiki v2

WIKI

Overview

Bitflip mutation is a predefined mutation technique used in fuzzing in which individual bits of an input are inverted to produce new test inputs. It is listed alongside other predefined AFL operations (such as clone, swap, arithmetic, and havoc) as one of the core input-modification primitives employed by mutation-based fuzzers. In AFL, the bitflip mutation "flips a variety number of bits" of the input.

Role in AFL

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

2 connections

TheHuzz ← uses 100% 1e

TheHuzz uses bit-flip mutation as one of its AFL-like mutation techniques.

AFL ← uses 100% 1e

AFL uses bitflip mutations as one of its mutation strategies.

LINKED ENTITIES

1 links

AFL USES Extracted graph relationship

CITATIONS

7 sources

7 citations — click to expand

[1] In AFL, the bitflip mutation flips a variety (variable) number of bits of an input, and is one of the notable mutations alongside arithmetic and havoc mutations. Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing

[2] TheHuzz's mutation engine mutates test instructions (TIs) using AFL-like mutations (including bitflip), operating on the binary representation of instructions. TheHuzz: Instruction Fuzzing of Processors Using Golden Reference Models

[3] TheHuzz classifies mutations into data-only mutations (mutating data bits while keeping opcode unchanged, increasing coverage on nearby data paths) and opcode mutations (mutating opcode bits, which can generate illegal instructions). TheHuzz: Instruction Fuzzing of Processors Using Golden Reference Models

[4] TheHuzz's feedback engine uses coverage logs from RTL simulation for each mutated TI, retains the best-performing instruction–mutation pairs, and discards underperforming ones. TheHuzz: Instruction Fuzzing of Processors Using Golden Reference Models

[5] In TheHuzz, only the test instructions (TIs) are mutated; configuration instructions (CIs) are left untouched to preserve correct processor initialization. TheHuzz: Instruction Fuzzing of Processors Using Golden Reference Models

[6] In the cross-level CGF approach, bitflip is used in a mutation prephase (together with RISC-V instruction insertion) to cover possible instruction arguments and uncover unknown instructions, and the two operations are iterated until no new test vectors are found. Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing

[7] The bitflip prephase has low overhead because RV32I has only ~40 instructions, the prephase operations are applied only to test vectors reaching new coverage, and bitflip itself was merely moved earlier in the AFL mutation flow rather than added on top. Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing