Skip to content
STIMSMITH

Differential fuzz testing

Technique WIKI v2 · 6/28/2026

Differential fuzz testing uses generated inputs to expose behavioral discrepancies. In the common form shown by the cited systems, the same input is run on multiple implementations or on a target and a reference model, and mismatches are investigated as potential bugs; the literature here also includes a looser single-model variant that maximizes prediction differences. Representative applications in the evidence include Ethereum Virtual Machines, deep learning systems, and CPU RTL validation.

Differential fuzz testing

Overview

Differential fuzz testing is a fuzzing strategy that treats behavioral differences as the signal of interest. In the common cross-implementation form, the same generated input is executed on multiple implementations, or on a target and a golden/reference model, and discrepancies in outputs or architectural state are reported for triage. The evidence here also shows a broader usage of the term in deep learning, where the objective is to maximize the prediction difference between an original input and a mutated input inside a single model.

Common structure

Across the cited examples, differential fuzz testing typically combines:

  • Input generation or mutation to produce new test cases.
  • A differential oracle based on cross-referencing peer implementations, a golden model, or behavior differences under mutation.
  • Domain-specific feedback metrics to guide search toward interesting cases.
  • Mismatch triage to separate real bugs from benign discrepancies.

Representative applications

Ethereum Virtual Machine fuzzing

EVMFuzz applies differential fuzz testing to EVM implementations. Its core idea is to continuously generate seed contracts for different EVMs, maximize inconsistencies among execution results, and use output cross-referencing to discover vulnerabilities. It uses internal inconsistency indicators such as executed opcode sequence and gas usage, builds seed contracts with predefined mutators, and uses dynamic priority scheduling to guide seed selection. In the reported evaluation, 36,295 real-world contracts were mutated into 253,153 contracts; 66.2% showed differential performance, 1,596 triggered inconsistent output, and manual root-cause analysis found 5 previously unknown security bugs in four widely used EVMs, all entered in CVE.

Deep learning testing

DLFuzz uses the term differential fuzzing for a different setup: it mutates inputs to maximize both neuron coverage and the prediction difference between the original and mutated input. Unlike cross-implementation approaches, it does not require manual labeling or peer deep learning systems as cross-referencing oracles. The paper reports more adversarial inputs, smaller perturbations, slightly higher neuron coverage, and lower time consumption than DeepXplore.

CPU RTL validation

In hardware validation, the cited work shows differential fuzz testing used to uncover CPU design bugs. DIFUZZRTL is described as an RTL fuzzer for CPU RTLs that uses register-coverage-guided fuzzing to identify RTL state transitions efficiently and correctly. The paper also highlights RTL-specific techniques including cycle-sensitive register coverage, asynchronous interrupt handling, a unified CPU input format with Tilelink protocols, and drop-in-replacement designs for multiple CPU RTLs. Its evaluation covered OpenRISC Mor1kx Cappuccino, RISC-V Rocket Core, and RISC-V Boom Core, and reported 16 new bugs confirmed by development communities and vendors, with 6 assigned CVEs.

A related processor-validation setup in the evidence compares architectural state changes between a target CPU and a golden model running the same input, then produces reports of uniquely identified discrepancies. That setup also allows engineers to filter mismatches by architectural state values. The same evidence notes that not every mismatch is functionally meaningful: one observed RocketCore discrepancy involved attempted writes to the R0 register in traces, while not affecting functional behavior.

Strengths and limitations

Strengths

  • Can reduce or avoid hand-written test oracles through cross-referencing.
  • Adapts well to domain-specific guidance, such as opcode/gas inconsistency, neuron coverage, or register coverage.
  • Has demonstrated practical bug-finding results in EVMs and CPU RTLs.

Limitations

  • Differential results still need investigation; in EVMFuzz, bug discovery relied on manual root-cause analysis after inconsistencies were found.
  • Some mismatches may be trace-level or otherwise benign rather than exploitable bugs.
  • Effectiveness depends on the quality of the comparison target, whether that is a peer implementation, a golden model, or a behavior-based differential objective.

LINKED ENTITIES

2 links
DiFuzzRTL IMPLEMENTS
DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs USES

CITATIONS

11 sources
11 citations
[1] Cross-implementation differential fuzzing runs the same input on multiple systems or on a target and golden model, then reports output or state discrepancies. DATE 2024 PDF excerpt ; EVMFuzz: Differential Fuzz Testing of Ethereum Virtual Machine
[2] EVMFuzz uses differential fuzz testing across EVMs and relies on output cross-referencing rather than manual checking of execution output. EVMFuzz: Differential Fuzz Testing of Ethereum Virtual Machine
[3] EVMFuzz uses opcode sequence and gas used as inconsistency indicators, and combines predefined mutators with dynamic priority scheduling. EVMFuzz: Differential Fuzz Testing of Ethereum Virtual Machine
[4] EVMFuzz mutated 36,295 real contracts into 253,153 contracts; 66.2% showed differential performance; 1,596 triggered inconsistent output; 5 unknown bugs were found and entered in CVE. EVMFuzz: Differential Fuzz Testing of Ethereum Virtual Machine
[5] DLFuzz maximizes neuron coverage and prediction difference between original and mutated inputs, without manual labeling or peer-model cross-referencing oracles. DLFuzz: Differential Fuzzing Testing of Deep Learning Systems
[6] DLFuzz reported 338.59% more adversarial inputs, 89.82% smaller perturbations, 2.86% higher neuron coverage, and 20.11% less time consumption than DeepXplore. DLFuzz: Differential Fuzzing Testing of Deep Learning Systems
[7] DifuzzRTL applies differential fuzz testing to CPU RTLs and introduces a register-coverage metric tailored for RTL designs to guide state exploration. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs ; FuSS: Coverage-Directed Hardware Fuzzing with Selective Symbolic Execution
[8] DifuzzRTL adds cycle-sensitive register coverage, asynchronous interrupt handling, a unified CPU input format with Tilelink protocols, and drop-in-replacement designs. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[9] DifuzzRTL was evaluated on Mor1kx Cappuccino, Rocket Core, and Boom Core, and reported 16 new bugs confirmed by communities/vendors, with 6 assigned CVEs. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[10] One processor-validation setup compares architectural state changes between a target CPU and golden model and lets engineers filter mismatches by architectural state values. DATE 2024 PDF excerpt
[11] Some differential findings can be benign trace-level discrepancies, such as attempted RocketCore writes to R0 that did not affect functionality. DATE 2024 PDF excerpt

VERSION HISTORY

v2 · 6/28/2026 · gpt-5.4 (current)
v1 · 6/24/2026 · minimax/minimax-m3