Skip to content
STIMSMITH

Coverage-Guided Fuzzing (CGF)

Technique WIKI v1 · 9/21/2026

Coverage-Guided Fuzzing (CGF) is a simulation-based verification technique that adaptively generates and mutates inputs to maximize coverage metrics, widely applied to software and hardware (notably processor) verification. CGF excels at exposing edge cases but can plateau when functional coverage requires deep semantic understanding, motivating hybrid approaches that combine CGF with directed, formal, or LLM-based methods such as FLAME.

Overview

Coverage-Guided Fuzzing (CGF) is a verification technique that combines random input generation with feedback from coverage metrics to iteratively steer testing toward unexplored code, states, or functionalities. It builds on classical fuzzing, where inputs are continuously mutated, but adds coverage signals so that inputs reaching new coverage are retained and used as seeds for further mutation. CGF has been used to detect a very large number of bugs in software and, more recently, to verify hardware designs and processor implementations.

Origins and core principles

CGF adapts the classical fuzzing loop: an input corpus is maintained, each input is mutated to produce new candidates, candidates are executed against the system under test, and feedback from coverage signals is used to prioritize promising inputs. Modern CGF representatives in the software domain include the LLVM-based libFuzzer and American Fuzzy Lop (AFL). CGF is described as a scalable simulation-based technique that complements more formal approaches such as concolic testing, which can suffer from path explosion and complex symbolic constraints.

Application domains

Software testing

In software engineering, CGF is an effective testing technique that has detected hundreds of thousands of bugs across various applications by focusing on maximizing code coverage to reveal more bugs. However, empirical studies note that higher code coverage does not necessarily imply better fault detection capability, because triggering a bug requires not only exercising a specific program path but also reaching interesting program states along that path. To address this, mutation testing has been used as additional feedback to guide fuzzing toward bug detection rather than code coverage alone; the state-of-the-art baseline Zest was improved in both code coverage and bug detection using mutation-score feedback on five benchmarks.

Processor and hardware verification

CGF methods are widely used for processor functional verification, where the goal is to cover functional points (FPs)—fine-grained design features such as the execution of a specific branch instruction or a CSR write-protection check—organized hierarchically into functional groups (FGs). CGF tests processors by adaptively generating random inputs and mutating seed inputs guided by coverage metrics, excelling at exposing edge cases and uncovering hidden design issues before production.

In the context of RISC-V virtual prototyping, a fuzzing-based test generation engine creates instruction sequences in a coverage-driven way as a complement to positive testing approaches such as the RISC-V Torture generator. The resulting test suite is compiled into RISC-V ELF binaries that are executed on both the simulator under test (the virtual prototype) and the official RISC-V reference simulator SPIKE; differences in their memory-dump signatures indicate bugs. CGF has also been combined with SystemC-based virtual prototypes to verify embedded RISC-V software binaries, using two coverage metrics simultaneously: one from the embedded software and one from the SystemC-based peripherals of the virtual prototype, bridging the gap between software and hardware in the fuzzing engine. This approach has been effective for analyzing bare-metal and Zephyr-based RISC-V embedded software.

For hardware designs more generally, coverage-guided methods help explore designs more effectively, but they can struggle to focus on specific parts of a hardware description. Directed Gray-box Fuzzing (DGF) techniques such as DirectFuzz attempt to target specific regions, but face drawbacks including limited hardware description language support, poor scalability to large circuits, and abstraction mismatches. Frameworks such as PROFUZZ combine DGF with Automatic Test Pattern Generation (ATPG), leveraging structural analysis to generate precise input seeds targeting specific design regions while maintaining fuzzing throughput. Experiments report that PROFUZZ scales 30× better than DirectFuzz for multiple target sites, improves coverage by 11.66%, and runs 2.76× faster.

Strengths and limitations

CGF is scalable and effective at exposing edge cases and improving reliability before production. However, because traditional CGF techniques have only limited interaction with and understanding of the functional coverage model, they often hit bottlenecks in functional coverage growth. Uncovered FPs in such cases represent scenarios that are particularly challenging to test comprehensively in processor design. Another commonly cited limitation is that CGF tends to generate test cases that are too simple; this has motivated follow-on work such as Cascade, which constructs test cases with more complex data and control flows by using an instruction set simulator (ISS) to entangle control flow with randomized data flow, emitting ELF programs as input to the processor design.

Relationship to other techniques

  • Constrained Random Verification (CRV): Both are simulation-based techniques for processor verification. CRV fills the gap left by engineer-driven directed testing by generating large numbers of random inputs guided by constraints, but it still leaves a portion of FPs inefficiently covered; CGF was introduced in part to alleviate that problem.
  • Directed Gray-box Fuzzing (DGF): A related approach that, like CGF, uses coverage feedback but is aimed at reaching specific targets rather than maximizing global coverage.
  • Concolic Testing (CT): A formal method that tracks symbolic constraints on top of concrete execution to generate new inputs that explore new paths; CGF complements CT by providing scalable, simulation-based exploration where CT suffers from path explosion.
  • Learning-based methods (e.g., Design2Vec, LMT): Use graph neural networks, random forests, or GANs to learn representations of submodules and improve last-mile coverage, but typically focus on submodules or abstract representations rather than the full processor architecture.
  • FLAME: An LLM-based processor functional verification technique that integrates retrieval-augmented generation, chain-of-thought prompting, and functional-coverage-guided feedback to generate test cases that cover uncovered FPs. FLAME is compared against CGF among other baselines, and covers on average 34.25% to 220% more target FPs across four open-source RISC-V processor designs (IBEX in two versions, CVA6, CV32E40P), while reducing the time required to achieve the same functional coverage by up to 86.13%.
  • Directed Testing: An engineer-driven approach in which testers craft specific scenarios to validate known functionalities; as designs grow complex, directed testing alone becomes costly and insufficient, motivating CRV and CGF.

Future directions

Research directions involving CGF include:

  • Combining CGF with symbolic simulation and formal methods to create a unified verification approach that seamlessly switches at runtime between formal and simulation-based techniques, providing both deep and broad state-space coverage.
  • Developing stronger coverage metrics that combine code coverage with functional coverage and account for complex features such as interrupts and threads.
  • Hybrid feedback such as mutation-score-guided fuzzing to improve bug detection beyond what coverage alone provides.
  • Integration with Large Language Models (e.g., FLAME) to leverage semantic understanding of uncovered functional points and produce more valid and effective test cases.
  • Hardware-targeted seed generation (e.g., PROFUZZ) that fuses coverage-guided fuzzing with structural ATPG analysis for directed hardware fuzzing.

Comparison with FLAME

FLAME was proposed to address the functional-coverage bottleneck of CGF in processor verification. CGF is one of FLAME's five baselines, alongside CRV, a state-of-the-art processor fuzzing technique (Cascade), and two LLM-based techniques. In the FLAME evaluation on four real-world open-source RISC-V designs, FLAME covered substantially more target FPs than the baselines on average and reduced time-to-coverage significantly. Ablation analysis in FLAME further highlights that its functional-coverage-guided iterative feedback is essential for the gains over plain CGF-style approaches. This positions CGF as a strong but coverage-limited baseline that LLM-based methods like FLAME can improve upon when deep semantic understanding of uncovered functional points is required.

LINKED ENTITIES

1 links
FLAME COMPARES_WITH

CITATIONS

10 sources
10 citations
[1] CGF is a well-established verification technique that tests processors by adaptively generating random inputs and mutating seed inputs guided by coverage metrics, excelling at exposing edge cases and uncovering hidden design issues. FLAME: Enhancing Functional Coverage in Processor Verification via LLMs
[2] CGF has only limited interaction with and understanding of the functional coverage model and often hits bottlenecks in functional coverage growth; uncovered FPs represent scenarios that are particularly challenging to test comprehensively. FLAME: Enhancing Functional Coverage in Processor Verification via LLMs
[3] CGF is one of FLAME's five baselines (alongside CRV, a state-of-the-art processor fuzzing technique, and two LLM-based techniques), and FLAME covers 34.25% to 220% more target FPs on average across four RISC-V designs while reducing time-to-coverage by up to 86.13%. FLAME: Enhancing Functional Coverage in Processor Verification via LLMs
[4] Modern CGF continuously mutates randomly created data to produce new inputs and is guided by code coverage; notable CGF representatives in the SW domain are the LLVM-based libFuzzer and AFL. Advanced virtual prototyping for cyber-physical systems
[5] A fuzzing-based test generation engine creates instruction sequences in a coverage-driven way as a complement to positive testing approaches like RISC-V Torture, with ELF binaries executed on the virtual prototype and the SPIKE reference simulator and compared via memory-dump signatures. Advanced virtual prototyping for cyber-physical systems
[6] CGF has been combined with SystemC-based virtual prototypes to verify embedded RISC-V software binaries using two coverage metrics—one from the embedded SW and one from the SystemC peripherals—and has been effective for bare-metal and Zephyr-based binaries. Advanced virtual prototyping for cyber-physical systems
[7] Cascade is the latest processor fuzzing technique that addresses CGF's limitation of generating overly simple test cases by using an ISS to entangle control flow with randomized data flow, producing ELF programs for the processor design. FLAME: Enhancing Functional Coverage in Processor Verification via LLMs
[8] Coverage-guided fuzzing is an effective software testing technique that has detected hundreds of thousands of bugs; higher code coverage does not necessarily imply better fault detection because bugs require reaching interesting program states, motivating mutation-score-guided fuzzing that improved Zest on five benchmarks. Investigating Coverage Guided Fuzzing with Mutation Testing
[9] Directed Gray-box Fuzzing (DGF) techniques like DirectFuzz can target specific hardware regions but suffer from limited HDL support, poor scaling to large circuits, and abstraction mismatches; PROFUZZ combines DGF with ATPG, scales 30× better than DirectFuzz on multiple target sites, improves coverage by 11.66%, and runs 2.76× faster. Intelligent Graybox Fuzzing via ATPG-Guided Seed Generation and Submodule Analysis
[10] Future research directions include combining CGF with symbolic simulation and formal methods into a unified verification approach, and developing stronger coverage metrics that combine code and functional coverage and account for complex features such as interrupts and threads. Advanced virtual prototyping for cyber-physical systems