Coverage Feedback

Technique

Coverage feedback is a fuzzing technique that uses program or hardware coverage metrics—such as branch conditions, statements, control registers, or signal toggles—to steer test-input generation toward unexplored regions of the design or program under test. It underlies modern mutation-based fuzzers (e.g., AFL-style tools), hardware fuzzers (e.g., TheHuzz, DifuzzRTL, HyPFuzz, PSOFuzz), and hybrid systems that integrate coverage signals into reinforcement-learning reward functions for LLM-driven generators such as ChatFuzz and CovRL-Fuzz.

First seen 6/24/2026

Last seen 6/24/2026

Evidence 3 chunks

Wiki v1

WIKI

Coverage Feedback

Definition

Coverage feedback is a fuzzing technique in which signals derived from instrumentation of the target program or hardware design—such as branch conditions, statements, control registers, or multiplexer signals—are reported back to the input generator. These signals guide mutation and generation toward previously unexplored code paths or hardware states [8c432232].

READ FULL ARTICLE →

NEIGHBORHOOD

4 nodes · 5 edges

graph · Coverage feedback · depth=1

RELATIONSHIPS

2 connections

ChatFuzz ← uses 95% 2e

Coverage metrics are used to compute rewards and steer input generation.

Beyond Random Inputs: A Novel ML-Based Hardware Fuzzing ← uses 93% 2e

Coverage information guides the optimization of generated inputs.

LINKED ENTITIES

2 links

ChatFuzz USES Extracted graph relationship

Beyond Random Inputs: A Novel ML-Based Hardware Fuzzing USES Extracted graph relationship

CITATIONS

8 sources

8 citations — click to expand

[1] Coverage feedback uses signals such as branch conditions, statements, control registers, and multiplexer signals reported by instrumented simulators to guide test-input generation. Beyond Random Inputs: A Novel ML-Based Hardware Fuzzing

[2] Traditional processor fuzzers such as DifuzzRTL and TheHuzz, and hybrid fuzzers such as HyPFuzz and PSOFuzz, rely on code coverage and control-register coverage as feedback to guide mutation. Beyond Random Inputs: A Novel ML-Based Hardware Fuzzing

[3] State-of-the-art hardware fuzzers often fall short of a 70% coverage threshold on complex designs such as a RISC-V RocketCore processor. Beyond Random Inputs: A Novel ML-Based Hardware Fuzzing

[4] ChatFuzz's three-step training includes a final PPO-based RL phase in which the refined generator is trained through a reward function based on coverage information attained through RTL simulation. Beyond Random Inputs: A Novel ML-Based Hardware Fuzzing

[5] The RTL Simulator in ChatFuzz reports coverage information for each test input, which is utilized by the LLM-based Input Generator to optimize the input generation process. Beyond Random Inputs: A Novel ML-Based Hardware Fuzzing

[6] ChatFuzz achieves 75% condition coverage on RocketCore in 52 minutes (vs. 30 hours for state-of-the-art fuzzers), up to 79.14% over ~199k test cases, and 97.02% on BOOM in 49 minutes. Beyond Random Inputs: A Novel ML-Based Hardware Fuzzing

[7] CovRL-Fuzz integrates coverage feedback directly into the LLM via a TF-IDF weighted coverage map used as the RL reward signal, and identified 48 real-world security-related bugs (39 unknown, 11 CVEs) in JavaScript engines. CovRL: Fuzzing JavaScript Engines with Coverage-Guided Reinforcement Learning for LLM-based Mutation

[8] Squirrel combines language validity with coverage feedback to test DBMSs and explores 2.0x–10.9x more new edges than mutation-based tools. SQUIRREL: Testing Database Management Systems with Language Validity and Coverage Feedback