Coverage-Guided Fuzzing
TechniqueCoverage-guided fuzzing (CGF) is a feedback-driven testing technique that uses execution feedback, most commonly code coverage, to steer input mutation toward unexplored program behavior. Public research describes CGF as effective at finding many bugs, while cautioning that higher coverage does not necessarily imply better fault detection because triggering a bug may require reaching a relevant program state in addition to exercising a path. The technique has been applied to software, hardware/processor verification (e.g., RFUZZ, DifuzzRTL, TheHuzz, ChatFuzz, FuSS, GoldenFuzz, ReFuzz, Fuzzilicon), and LLM-based multi-agent systems (FLARE), with active research on alternative feedback signals (e.g., mutation scores, microcode-level feedback, contextual-bandit-driven seed reuse) to escape coverage plateaus.
First seen 5/25/2026
Last seen 8/9/2026
Evidence 74 chunks
Wiki v7
WIKI
Overview
Coverage-guided fuzzing (CGF) is a testing technique that uses execution feedback, commonly code coverage, to guide input mutation toward inputs that explore more program behavior. Public research describes CGF as an effective technique that has detected many bugs across software applications and as a technique that focuses on maximizing code coverage during fuzzing. However, the same research cautions that higher coverage does not necessarily imply better fault detection: triggering a bug can require both exercising a particular path and reaching an interesting program state on that path. [CGF definition and coverage caveat]
Feedback signals
NEIGHBORHOOD
4 nodes · 4 edgesgraph · Coverage-Guided Fuzzing · depth=1
RELATIONSHIPS
43 connectionsAFL++ implements coverage-guided fuzzing to discover new code paths.
libFuzzer is a library for coverage-guided fuzz testing.
The paper proposes a novel coverage-guided fuzzing approach for ISS verification.
It relies on coverage feedback to steer mutations.
Employs coverage-guided fuzzing to verify instruction set simulators.
Coverage-guided fuzzing uses coverage metrics to direct test generation.
RFUZZ is a coverage-directed grey-box fuzzer for RTL.
The paper leverages coverage-guided fuzzing techniques based on LLVM libFuzzer.
Functional coverage is integrated as part of the coverage-guided fuzzing approach.
The coverage-guided fuzzing technique is implemented using LLVM libFuzzer.
Cross-level processor verification via endless randomized instruction stream generation with coverage-guided aging ← compares with 85% 2e
The paper compares its approach to coverage-guided fuzzing
Coverage-guided fuzzing uses state coverage to guide mutation.
Coverage-guided fuzzing uses code coverage as feedback for test case generation.
The CGF approach uses a specialized mutator tailored for ISS verification.
The CGF approach transforms bytestreams into ELF binaries for execution.
Coverage-guided fuzzing uses seed inputs that are mutated based on coverage feedback.
Coverage-guided fuzzing uses branch coverage as a metric to guide exploration.
The FuSS framework implements coverage-guided fuzzing as a core component.
SearchSYS employs coverage-guided fuzzing via AFL++ to explore simulator code.
The paper employs Coverage-Guided Fuzzing as one of its two core verification techniques.
Uses code and register coverage to guide input mutations.
Efficient Cross-Level Testing for Processor Verification: A RISC-V Case-Study ← compares with 85% 1e
The paper discusses coverage-guided fuzzing as a related approach and notes its limitations.
Coverage-guided fuzzing relies on Clang compiler instrumentation for coverage reporting.
DeepVerifier: Learning to Update Test Sequences for Coverage-Guided Verification ← compares with 85% 1e
The paper discusses coverage-guided fuzzing as a related competing approach for hardware verification.
Fuzzilicon applies coverage-guided fuzzing to commercial x86 CPUs.
BugsBunny is a directed hardware fuzzer that implements coverage-guided fuzzing.
AFL is a well-known coverage-guided fuzzer.
Coverage-guided fuzzing is a specific type of fuzzing technique.
The paper discusses coverage-guided fuzzing as a related approach for processor verification.
Aurora-Fuzz implements coverage-guided fuzzing inherited from Fuzzware, measuring translation blocks visited.
Seed trimming is a step in coverage-guided fuzzing for efficient configuration management.
Coverage-guided fuzzing uses input mutation to explore new execution paths.
Coverage-guided fuzzing has been used for testing Instruction Set Simulators.
LiFU uses coverage feedback to guide fuzzing.
Cross-level verification employs Coverage-Guided Fuzzing for unit-level verification.
The philosophy statement clarifies that DifuzzRTL adopts a coverage-guided fuzzing approach to drive its testing process.
Register-coverage is presented as the coverage signal that steers fuzzing, aligning with the coverage-guided fuzzing technique employed by DifuzzRTL.
MorFuzz is described as a coverage-guided processor fuzzer.
Fuzzilicon combines microcode-level instrumentation with coverage-guided fuzzing.
Coverage-guided fuzzing employs mutation-based techniques on randomly created data.
The proposed CGF approach integrates functional coverage to complement code coverage.
Fuzzware uses coverage feedback to guide the fuzzing process.
The paper mentions coverage-guided fuzzing tailored for ISS-level verification as a related research direction.
LINKED ENTITIES
1 linksCITATIONS
7 sources7 citations — click to expand
[1] CGF is described as effective at detecting many bugs while cautioning that higher coverage does not necessarily imply better fault detection, because triggering a bug may require both exercising a specific path and reaching an interesting program state on that path. Investigating Coverage Guided Fuzzing with Mutation Testing
[2] FLARE applies coverage-guided fuzzing to LLM-based multi-agent systems by extracting specifications and behavioral spaces from agent definitions, building test oracles, and fuzzing to expose failures, reporting 96.9% inter-agent coverage, 91.1% intra-agent coverage, and 56 previously unknown failures on 16 open-source applications. FLARE: Agentic Coverage-Guided Fuzzing for LLM-Based Multi-Agent Systems
[3] Verifying instruction set simulators using coverage-guided fuzzing has been investigated, treating the ISS as the target under test. A RISC-V Test Sequences Generation Method Based on Instruction ...
[4] DifuzzRTL is a differential fuzz testing framework for CPU verification that introduces a register-coverage metric to comprehensively capture RTL design states and guide input generation, cross-checks RTL simulation results against an ISA simulator, and automatically instruments register-coverage into target RTL designs. DifuzzRTL — CPU RTL Differential Fuzzer | Open Awesome
[5] ReFuzz selects and mutates highly effective tests from historic processor designs using contextual bandits to improve vulnerability detection and coverage efficiency on new target processors. NDSS 2026 hardware security research announcement (ReFuzz)
[6] Fuzzilicon is the first framework to perform post-silicon fuzzing on x86 CPUs with deep microcode-level instrumentation, extracting feedback directly from the processor's internal microcode execution and combining it with coverage-guided fuzzing to uncover subtle microarchitectural vulnerabilities. NDSS 2026 hardware security research announcement (Fuzzilicon)
[7] GoldenFuzz introduces a two-stage fuzzing strategy that decouples test refinement from vulnerability exploration using a fast golden-reference model of the device, achieving high coverage and discovering new high-severity vulnerabilities across RISC-V processors. NDSS 2026 hardware security research announcement (GoldenFuzz)