Overview
In the supplied evidence, CPU fuzzing is characterized mainly through Cascade, a 2024 USENIX Security work titled Cascade: CPU Fuzzing via Intricate Program Generation. The strongest technical emphasis is on generating programs for CPUs under test and evaluating how generation cost interacts with fuzzing throughput.
Evidence-backed characteristics
Program generation is a first-class part of the technique
The Cascade evidence explicitly frames the technique as CPU fuzzing via intricate program generation. Its evaluation breaks execution time down into intermediate program construction, asymmetric ISA pre-simulation, and RTL simulation, showing that input construction is not incidental but part of the core workflow.
Inputs can be reused across related CPU targets
The PDF excerpt states that, by construction, Cascade's inputs are reusable across designs that share compatible ISA extensions, and across CPU generations. In the paper's framing, this makes input generation a one-time cost that can be amortized when fuzzing multiple related targets.
Throughput depends on the tradeoff between program length and generation cost
Cascade evaluates fuzzing instructions executed per second while including program generation time. The evidence notes that longer programs can improve raw fuzzing throughput, but they also cost more to generate because they require managing a wider memory range. In the reported results, programs of about 10k instructions generally provide the best effective fuzzing throughput once both execution speed and generation overhead are considered.
Low runtime overhead is highlighted in the provided evidence
The same evaluation excerpt contrasts Cascade with prior CPU fuzzers. It reports that Cascade incurs no runtime overhead by design. For comparison, the excerpt cites DifuzzRTL overheads of 6.1% to 6.9% for control-register coverage and 97% for multiplexer-select coverage, and a 71% runtime overhead reported for TheHuzz.
The evidence spans multiple CPU design complexities
The provided PDF excerpt says Cascade was tested on CPUs ranging from PicoRV32, described there as a simple minimal 32-bit integer core, to BOOM, described there as an application-class Linux-capable out-of-order core. This supports a view of CPU fuzzing, in this evidence set, as applicable across substantially different processor implementations.
Tooling and literature in the evidence
- Cascade is the directly linked implementation in the entity graph.
- The Cascade publication is listed as a USENIX Security 2024 paper by Flavien Solt, Katharina Ceesay-Seitz, and Kaveh Razavi.
- The evaluation excerpt names RFUZZ and DifuzzRTL as open-source generic CPU fuzzers used as baselines, and says TheHuzz was not open source at the time of writing, so paper-reported results were used instead.
- The excerpt also states that Cascade was implemented as 6k lines of Python code.
Cross-domain context from the public evidence
A later public-context paper, CuFuzz, treats state-of-the-art CPU fuzzing tools as the basis for a compiler/runtime approach that transforms CUDA programs into CPU programs for fuzzing. In that source, CPU fuzzing is presented as an established and effective reference point, while equivalent GPU fuzzing support is described as lacking.
Scope note
This article is intentionally narrow and reflects only the supplied evidence. Most of that evidence describes CPU fuzzing through the design, evaluation, and positioning of Cascade.