Coverage-Guided Fuzzing
TechniqueCoverage-guided fuzzing (CGF) is a feedback-driven testing technique that uses execution feedback, most commonly code coverage, to steer input mutation toward unexplored program behavior. Public research describes CGF as effective at finding many bugs, while cautioning that higher coverage does not necessarily imply better fault detection because triggering a bug may require reaching a relevant program state in addition to exercising a path. The technique has been applied to software, hardware/processor verification (e.g., RFUZZ, DifuzzRTL, TheHuzz, ChatFuzz, FuSS, GoldenFuzz, ReFuzz, Fuzzilicon), and LLM-based multi-agent systems (FLARE), with active research on alternative feedback signals (e.g., mutation scores, microcode-level feedback, contextual-bandit-driven seed reuse) to escape coverage plateaus.
First seen 5/25/2026
Last seen 7/19/2026
Evidence 60 chunks
Wiki v7
WIKI
Overview
Coverage-guided fuzzing (CGF) is a testing technique that uses execution feedback, commonly code coverage, to guide input mutation toward inputs that explore more program behavior. Public research describes CGF as an effective technique that has detected many bugs across software applications and as a technique that focuses on maximizing code coverage during fuzzing. However, the same research cautions that higher coverage does not necessarily imply better fault detection: triggering a bug can require both exercising a particular path and reaching an interesting program state on that path. [CGF definition and coverage caveat]
Feedback signals
NEIGHBORHOOD
4 nodes · 5 edgesgraph · Coverage-Guided Fuzzing · depth=1
RELATIONSHIPS
36 connectionslibFuzzer is a library for coverage-guided fuzz testing.
AFL implements coverage-guided fuzzing using branch coverage as feedback.
The paper proposes a novel coverage-guided fuzzing approach for ISS verification.
Employs coverage-guided fuzzing to verify instruction set simulators.
It relies on coverage feedback to steer mutations.
Coverage-guided fuzzing uses seed inputs that are mutated based on coverage feedback.
The CGF approach uses a specialized mutator tailored for ISS verification.
Functional coverage is integrated as part of the coverage-guided fuzzing approach.
Coverage-guided fuzzing uses branch coverage as a metric to guide exploration.
The FuSS framework implements coverage-guided fuzzing as a core component.
Coverage-guided fuzzing uses code coverage as feedback for test case generation.
The CGF approach transforms bytestreams into ELF binaries for execution.
Coverage-guided fuzzing leverages feedback on code paths explored during execution.
Coverage-guided fuzzing uses state coverage to guide mutation.
Cross-level processor verification via endless randomized instruction stream generation with coverage-guided aging ← compares with 85% 2e
The paper compares its approach to coverage-guided fuzzing
Seed trimming is a step in coverage-guided fuzzing for efficient configuration management.
Coverage-guided fuzzing uses input mutation to explore new execution paths.
Fuzzilicon combines microcode-level instrumentation with coverage-guided fuzzing.
Fuzzware uses coverage feedback to guide the fuzzing process.
Aurora-Fuzz implements coverage-guided fuzzing inherited from Fuzzware, measuring translation blocks visited.
The paper mentions coverage-guided fuzzing tailored for ISS-level verification as a related research direction.
Coverage-guided fuzzing has been used for testing Instruction Set Simulators.
Efficient Cross-Level Testing for Processor Verification: A RISC-V Case-Study ← compares with 85% 1e
The paper discusses coverage-guided fuzzing as a related approach and notes its limitations.
Uses code and register coverage to guide input mutations.
Its methodology is explicitly coverage-directed.
MorFuzz is described as a coverage-guided processor fuzzer.
The philosophy statement clarifies that DifuzzRTL adopts a coverage-guided fuzzing approach to drive its testing process.
Register-coverage is presented as the coverage signal that steers fuzzing, aligning with the coverage-guided fuzzing technique employed by DifuzzRTL.
Coverage-guided fuzzing employs mutation-based techniques on randomly created data.
The proposed CGF approach integrates functional coverage to complement code coverage.
DeepVerifier: Learning to Update Test Sequences for Coverage-Guided Verification ← compares with 85% 1e
The paper discusses coverage-guided fuzzing as a related competing approach for hardware verification.
Fuzzilicon applies coverage-guided fuzzing to commercial x86 CPUs.
BugsBunny is a directed hardware fuzzer that implements coverage-guided fuzzing.
AFL is a well-known coverage-guided fuzzer.
Coverage-guided fuzzing is a specific type of fuzzing technique.
The paper discusses coverage-guided fuzzing as a related approach for processor verification.
LINKED ENTITIES
1 linksCITATIONS
7 sources7 citations — click to expand
[1] CGF is described as effective at detecting many bugs while cautioning that higher coverage does not necessarily imply better fault detection, because triggering a bug may require both exercising a specific path and reaching an interesting program state on that path. Investigating Coverage Guided Fuzzing with Mutation Testing
[2] FLARE applies coverage-guided fuzzing to LLM-based multi-agent systems by extracting specifications and behavioral spaces from agent definitions, building test oracles, and fuzzing to expose failures, reporting 96.9% inter-agent coverage, 91.1% intra-agent coverage, and 56 previously unknown failures on 16 open-source applications. FLARE: Agentic Coverage-Guided Fuzzing for LLM-Based Multi-Agent Systems
[3] Verifying instruction set simulators using coverage-guided fuzzing has been investigated, treating the ISS as the target under test. A RISC-V Test Sequences Generation Method Based on Instruction ...
[4] DifuzzRTL is a differential fuzz testing framework for CPU verification that introduces a register-coverage metric to comprehensively capture RTL design states and guide input generation, cross-checks RTL simulation results against an ISA simulator, and automatically instruments register-coverage into target RTL designs. DifuzzRTL — CPU RTL Differential Fuzzer | Open Awesome
[5] ReFuzz selects and mutates highly effective tests from historic processor designs using contextual bandits to improve vulnerability detection and coverage efficiency on new target processors. NDSS 2026 hardware security research announcement (ReFuzz)
[6] Fuzzilicon is the first framework to perform post-silicon fuzzing on x86 CPUs with deep microcode-level instrumentation, extracting feedback directly from the processor's internal microcode execution and combining it with coverage-guided fuzzing to uncover subtle microarchitectural vulnerabilities. NDSS 2026 hardware security research announcement (Fuzzilicon)
[7] GoldenFuzz introduces a two-stage fuzzing strategy that decouples test refinement from vulnerability exploration using a fast golden-reference model of the device, achieving high coverage and discovering new high-severity vulnerabilities across RISC-V processors. NDSS 2026 hardware security research announcement (GoldenFuzz)