Coverage-Guided Fuzzing
TechniqueCoverage-guided fuzzing (CGF) is a feedback-driven software/hardware testing technique that uses execution feedback, most commonly code coverage, to steer input mutation toward unexplored program or design behavior. Public research describes CGF as effective across software applications, but warns that higher coverage does not necessarily imply better fault detection: triggering a bug requires both reaching a path and entering a relevant state on that path. Active research investigates alternative feedback signals (mutation scores, microcode-level feedback, contextual-bandit seed reuse, coverage-guided aging) to escape coverage plateaus and to better couple coverage with bug detection. The technique has been applied to processor/hardware verification (DifuzzRTL, TheHuzz, RFUZZ, Cascade, ChatFuzz, FuSS, GoldenFuzz, ReFuzz, Fuzzilicon) and to LLM-based multi-agent systems (FLARE).
First seen 5/25/2026
Last seen 9/28/2026
Evidence 83 chunks
Wiki v9
WIKI
Overview
Coverage-guided fuzzing (CGF) is a testing technique that uses execution feedback, commonly code coverage, to guide input mutation toward inputs that explore more program behavior. Public research describes CGF as an effective technique that has detected many bugs across software applications and as a technique that focuses on maximizing code coverage during fuzzing. However, the same research cautions that higher coverage does not necessarily imply better fault detection: triggering a bug can require both exercising a particular path and reaching an interesting program state on that path. [CGF definition and coverage caveat]
Feedback signals
NEIGHBORHOOD
5 nodes · 4 edgesgraph · Coverage-Guided Fuzzing · depth=1
RELATIONSHIPS
47 connectionsAFL++ implements coverage-guided fuzzing to discover new code paths.
libFuzzer is a library for coverage-guided fuzz testing.
The paper proposes a novel coverage-guided fuzzing approach for ISS verification.
Coverage-guided fuzzing uses branch coverage as a feedback metric.
Employs coverage-guided fuzzing to verify instruction set simulators.
Coverage-guided fuzzing uses coverage metrics to direct test generation.
It relies on coverage feedback to steer mutations.
Coverage-guided fuzzing uses state coverage to guide mutation.
The CGF approach uses a specialized mutator tailored for ISS verification.
Functional coverage is integrated as part of the coverage-guided fuzzing approach.
Cross-level processor verification via endless randomized instruction stream generation with coverage-guided aging ← compares with 85% 2e
The paper compares its approach to coverage-guided fuzzing
Coverage-guided fuzzing uses code coverage as feedback for test case generation.
The CGF approach transforms bytestreams into ELF binaries for execution.
The paper employs Coverage-Guided Fuzzing as one of its two core verification techniques.
The coverage-guided fuzzing technique is implemented using LLVM libFuzzer.
Coverage-guided fuzzing uses seed inputs that are mutated based on coverage feedback.
The paper leverages coverage-guided fuzzing techniques based on LLVM libFuzzer.
RFUZZ is a coverage-directed grey-box fuzzer for RTL.
The FuSS framework implements coverage-guided fuzzing as a core component.
SearchSYS employs coverage-guided fuzzing via AFL++ to explore simulator code.
Coverage-guided fuzzing has been used for testing Instruction Set Simulators.
LiFU uses coverage feedback to guide fuzzing.
Cross-level verification employs Coverage-Guided Fuzzing for unit-level verification.
Coverage-guided fuzzing monitors finite-state machines as part of its coverage feedback.
The paper lists coverage-guided fuzzing among related techniques used to generate tests.
Unified hw/sw coverage: A novel metric to boost coverage-guided fuzzing for virtual prototype based hw/sw co-verification ← uses 90% 1e
It proposes a metric specifically aimed at boosting coverage-guided fuzzing, implying its use in the work.
The paper mentions coverage-guided fuzzing tailored for ISS-level verification as a related research direction.
The title explicitly states the approach employs coverage-guided fuzzing.
Efficient Cross-Level Testing for Processor Verification: A RISC-V Case-Study ← compares with 85% 1e
The paper discusses coverage-guided fuzzing as a related approach and notes its limitations.
Coverage-guided fuzzing relies on Clang compiler instrumentation for coverage reporting.
Uses code and register coverage to guide input mutations.
MorFuzz is described as a coverage-guided processor fuzzer.
The philosophy statement clarifies that DifuzzRTL adopts a coverage-guided fuzzing approach to drive its testing process.
Register-coverage is presented as the coverage signal that steers fuzzing, aligning with the coverage-guided fuzzing technique employed by DifuzzRTL.
Coverage-guided fuzzing employs mutation-based techniques on randomly created data.
The proposed CGF approach integrates functional coverage to complement code coverage.
DeepVerifier: Learning to Update Test Sequences for Coverage-Guided Verification ← compares with 85% 1e
The paper discusses coverage-guided fuzzing as a related competing approach for hardware verification.
Fuzzilicon applies coverage-guided fuzzing to commercial x86 CPUs.
BugsBunny is a directed hardware fuzzer that implements coverage-guided fuzzing.
AFL is a well-known coverage-guided fuzzer.
Coverage-guided fuzzing is a specific type of fuzzing technique.
The paper discusses coverage-guided fuzzing as a related approach for processor verification.
Seed trimming is a step in coverage-guided fuzzing for efficient configuration management.
Coverage-guided fuzzing uses input mutation to explore new execution paths.
Fuzzilicon combines microcode-level instrumentation with coverage-guided fuzzing.
Fuzzware uses coverage feedback to guide the fuzzing process.
Aurora-Fuzz implements coverage-guided fuzzing inherited from Fuzzware, measuring translation blocks visited.
LINKED ENTITIES
6 linksUnified hw/sw coverage: A novel metric to boost coverage-guided fuzzing for virtual prototype based hw/sw co-verification USES Extracted graph relationship
Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing USES Extracted graph relationship
DiFuzzRTL EXAMPLE_OF DifuzzRTL is explicitly described in the evidence as applying coverage-guided fuzzing to differential RTL testing and as the baseline for Cascade's control-register coverage comparison.
RFUZZ EXAMPLE_OF RFUZZ is described in the evidence as coverage-directed fuzz testing of RTL on FPGAs, used as a baseline for Cascade's multiplexer-select coverage.
TheHuzz EXAMPLE_OF TheHuzz is named in the evidence as a processor fuzzer using golden-reference models whose coverage metrics Cascade compares against.
Cascade EXAMPLE_OF Cascade is detailed in the evidence as a CPU fuzzer that entangles data/control flow and is compared against DifuzzRTL and RFUZZ for coverage.
CITATIONS
8 sources8 citations — click to expand
[1] CGF is effective for finding bugs across software applications but higher coverage does not imply better fault detection because triggering a bug requires reaching interesting program states, not just exercising paths. Investigating Coverage Guided Fuzzing with Mutation Testing
[2] Using mutation scores as feedback to guide CGF improved both code coverage and bug detection in Zest-based modified techniques on 5 benchmarks. Investigating Coverage Guided Fuzzing with Mutation Testing
[3] Cascade achieves the same control-register coverage as DifuzzRTL in 30 minutes (15 minutes with a pre-generated corpus) versus 48 hours for DifuzzRTL on the legacy Rocket core, corresponding to 97x and 186x speedups. Cascade: CPU Fuzzing via Intricate Program Generation
[4] Cascade compares against DifuzzRTL using control-register coverage, against RFUZZ using multiplexer-select coverage, and additionally reports the commercial-simulator metrics used by TheHuzz (branches, conditions, expressions, FSM states and transitions, statements, toggles). Cascade: CPU Fuzzing via Intricate Program Generation
[5] Cross-level RISC-V processor verification via endless randomized instruction stream generation with coverage-guided aging uses an ISS as a functional reference, updates coverage continuously from ISS state, and supports arbitrary combinations of load/store and CSR instructions as well as infinite loops; experiments on the 32-bit pipelined MINRES The Good Core (TGC) show more regular coverage distribution via coverage-guided aging. RISC-V Processor Verification with Coverage-guided Aging
[6] Google's open-source RISC-V Design Verification framework uses constraint-based specification in SystemVerilog, co-simulation against an ISS, and symbolic execution but does not employ runtime coverage information, relying instead on simple randomized test generation that struggles to continuously achieve broad and deep test coverage in endless instruction streams. RISC-V Processor Verification with Coverage-guided Aging
[7] FLARE applies coverage-guided fuzzing to LLM-based multi-agent systems, extracting specifications and behavioral spaces from agent definitions to build test oracles, and reports 96.9% inter-agent coverage, 91.1% intra-agent coverage, and 56 previously unknown failures across 16 open-source applications. FLARE: Agentic Coverage-Guided Fuzzing for LLM-Based Multi-Agent Systems
[8] The Scale4Edge project at Universität Bremen produced the cross-level CGF, unified hw/sw coverage metric, and coverage-guided aging publications cited above. Liste der Publikationen im Scale4Edge Projekt der Universität Bremen