Coverage-Guided Fuzzing (CGF)

Technique

Coverage-Guided Fuzzing (CGF) is a simulation-based verification technique that adaptively generates and mutates inputs to maximize coverage metrics, widely applied to software and hardware (notably processor) verification. CGF excels at exposing edge cases but can plateau when functional coverage requires deep semantic understanding, motivating hybrid approaches that combine CGF with directed, formal, or LLM-based methods such as FLAME.

First seen 8/25/2026

Last seen 9/21/2026

Evidence 8 chunks

Wiki v1

WIKI

Overview

Coverage-Guided Fuzzing (CGF) is a verification technique that combines random input generation with feedback from coverage metrics to iteratively steer testing toward unexplored code, states, or functionalities. It builds on classical fuzzing, where inputs are continuously mutated, but adds coverage signals so that inputs reaching new coverage are retained and used as seeds for further mutation. CGF has been used to detect a very large number of bugs in software and, more recently, to verify hardware designs and processor implementations.

Origins and core principles

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

6 connections

Advanced Virtual Prototyping for Cyber-Physical Systems Using RISC-V ← uses 100% 2e

The paper presents coverage-guided fuzzing as one of the VP-based verification approaches

FLAME compares with → 86% 2e

CGF represents adaptive fuzzing guided by coverage, used as a baseline category.

libFuzzer ← implements 100% 1e

libFuzzer is a notable coverage-guided fuzzing tool

AFL ← implements 100% 1e

AFL is a notable coverage-guided fuzzing tool

RISC-V VP ← uses 100% 1e

The RISC-V VP is combined with CGF for verification of embedded RISC-V SW binaries

Concolic Testing ← compares with 90% 1e

CGF is presented as a scalable complement to concolic testing

LINKED ENTITIES

1 links

FLAME COMPARES_WITH Extracted graph relationship

CITATIONS

10 sources

10 citations — click to expand

[1] CGF is a well-established verification technique that tests processors by adaptively generating random inputs and mutating seed inputs guided by coverage metrics, excelling at exposing edge cases and uncovering hidden design issues. FLAME: Enhancing Functional Coverage in Processor Verification via LLMs

[2] CGF has only limited interaction with and understanding of the functional coverage model and often hits bottlenecks in functional coverage growth; uncovered FPs represent scenarios that are particularly challenging to test comprehensively. FLAME: Enhancing Functional Coverage in Processor Verification via LLMs

[3] CGF is one of FLAME's five baselines (alongside CRV, a state-of-the-art processor fuzzing technique, and two LLM-based techniques), and FLAME covers 34.25% to 220% more target FPs on average across four RISC-V designs while reducing time-to-coverage by up to 86.13%. FLAME: Enhancing Functional Coverage in Processor Verification via LLMs

[4] Modern CGF continuously mutates randomly created data to produce new inputs and is guided by code coverage; notable CGF representatives in the SW domain are the LLVM-based libFuzzer and AFL. Advanced virtual prototyping for cyber-physical systems

[5] A fuzzing-based test generation engine creates instruction sequences in a coverage-driven way as a complement to positive testing approaches like RISC-V Torture, with ELF binaries executed on the virtual prototype and the SPIKE reference simulator and compared via memory-dump signatures. Advanced virtual prototyping for cyber-physical systems

[6] CGF has been combined with SystemC-based virtual prototypes to verify embedded RISC-V software binaries using two coverage metrics—one from the embedded SW and one from the SystemC peripherals—and has been effective for bare-metal and Zephyr-based binaries. Advanced virtual prototyping for cyber-physical systems

[7] Cascade is the latest processor fuzzing technique that addresses CGF's limitation of generating overly simple test cases by using an ISS to entangle control flow with randomized data flow, producing ELF programs for the processor design. FLAME: Enhancing Functional Coverage in Processor Verification via LLMs

[8] Coverage-guided fuzzing is an effective software testing technique that has detected hundreds of thousands of bugs; higher code coverage does not necessarily imply better fault detection because bugs require reaching interesting program states, motivating mutation-score-guided fuzzing that improved Zest on five benchmarks. Investigating Coverage Guided Fuzzing with Mutation Testing

[9] Directed Gray-box Fuzzing (DGF) techniques like DirectFuzz can target specific hardware regions but suffer from limited HDL support, poor scaling to large circuits, and abstraction mismatches; PROFUZZ combines DGF with ATPG, scales 30× better than DirectFuzz on multiple target sites, improves coverage by 11.66%, and runs 2.76× faster. Intelligent Graybox Fuzzing via ATPG-Guided Seed Generation and Submodule Analysis

[10] Future research directions include combining CGF with symbolic simulation and formal methods into a unified verification approach, and developing stronger coverage metrics that combine code and functional coverage and account for complex features such as interrupts and threads. Advanced virtual prototyping for cyber-physical systems