Skip to content
STIMSMITH

Differential fuzz testing

Technique

Differential fuzz testing uses generated inputs to expose behavioral discrepancies. In the common form shown by the cited systems, the same input is run on multiple implementations or on a target and a reference model, and mismatches are investigated as potential bugs; the literature here also includes a looser single-model variant that maximizes prediction differences. Representative applications in the evidence include Ethereum Virtual Machines, deep learning systems, and CPU RTL validation.

First seen 6/11/2026
Last seen 6/28/2026
Evidence 7 chunks
Wiki v2

WIKI

Differential fuzz testing

Overview

Differential fuzz testing is a fuzzing strategy that treats behavioral differences as the signal of interest. In the common cross-implementation form, the same generated input is executed on multiple implementations, or on a target and a golden/reference model, and discrepancies in outputs or architectural state are reported for triage. The evidence here also shows a broader usage of the term in deep learning, where the objective is to maximize the prediction difference between an original input and a mutated input inside a single model.

Common structure

Across the cited examples, differential fuzz testing typically combines:

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

6 connections
DiFuzzRTL ← implements 100% 4e
DIFUZZRTL is a differential fuzz testing tool for CPU RTLs.
Golden Reference Model uses → 90% 2e
Differential fuzz testing relies on a golden reference model for comparison.
ChatFuzz ← uses 92% 1e
Compares ISA and RTL traces to find discrepancies.
The paper mentions differential fuzz testing as used by DifuzzRTL.
The study applies differential fuzz testing to find CPU bugs.
Register Coverage Metric implements → 90% 1e
DifuzzRTL implements a register coverage metric for RTL designs to guide fuzzing.

CITATIONS

11 sources
11 citations — click to expand
[1] Cross-implementation differential fuzzing runs the same input on multiple systems or on a target and golden model, then reports output or state discrepancies. DATE 2024 PDF excerpt ; EVMFuzz: Differential Fuzz Testing of Ethereum Virtual Machine
[2] EVMFuzz uses differential fuzz testing across EVMs and relies on output cross-referencing rather than manual checking of execution output. EVMFuzz: Differential Fuzz Testing of Ethereum Virtual Machine
[3] EVMFuzz uses opcode sequence and gas used as inconsistency indicators, and combines predefined mutators with dynamic priority scheduling. EVMFuzz: Differential Fuzz Testing of Ethereum Virtual Machine
[4] EVMFuzz mutated 36,295 real contracts into 253,153 contracts; 66.2% showed differential performance; 1,596 triggered inconsistent output; 5 unknown bugs were found and entered in CVE. EVMFuzz: Differential Fuzz Testing of Ethereum Virtual Machine
[5] DLFuzz maximizes neuron coverage and prediction difference between original and mutated inputs, without manual labeling or peer-model cross-referencing oracles. DLFuzz: Differential Fuzzing Testing of Deep Learning Systems
[6] DLFuzz reported 338.59% more adversarial inputs, 89.82% smaller perturbations, 2.86% higher neuron coverage, and 20.11% less time consumption than DeepXplore. DLFuzz: Differential Fuzzing Testing of Deep Learning Systems
[7] DifuzzRTL applies differential fuzz testing to CPU RTLs and introduces a register-coverage metric tailored for RTL designs to guide state exploration. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs ; FuSS: Coverage-Directed Hardware Fuzzing with Selective Symbolic Execution
[8] DifuzzRTL adds cycle-sensitive register coverage, asynchronous interrupt handling, a unified CPU input format with Tilelink protocols, and drop-in-replacement designs. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[9] DifuzzRTL was evaluated on Mor1kx Cappuccino, Rocket Core, and Boom Core, and reported 16 new bugs confirmed by communities/vendors, with 6 assigned CVEs. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[10] One processor-validation setup compares architectural state changes between a target CPU and golden model and lets engineers filter mismatches by architectural state values. DATE 2024 PDF excerpt
[11] Some differential findings can be benign trace-level discrepancies, such as attempted RocketCore writes to R0 that did not affect functionality. DATE 2024 PDF excerpt