Skip to content
STIMSMITH

Differential Fuzzing

Technique

Differential fuzzing is a guided randomized testing technique that compares the behavior of two or more implementations of the same specification on the same input; an implementation is flagged as potentially erroneous when its outputs or behaviors diverge from another implementation's on that input. It replaces traditional fuzzer oracles such as crashes, hangs, or unsound memory accesses with a difference oracle, and has been applied to cryptography, complex format parsers (e.g., PDF, ELF), CPU instruction decoder testing, CPU RTL fuzzing, side-channel detection in Java libraries, and functional equivalence checking of LLM-generated code refactorings.

First seen 6/6/2026
Last seen 7/2/2026
Evidence 15 chunks
Wiki v1

WIKI

Differential Fuzzing

Definition

Differential fuzzing is a software testing and bug-finding technique in which multiple implementations of the same specification are executed on the same randomized inputs and their outputs or behaviors are compared. An implementation is treated as potentially erroneous when its behavior differs from another implementation's behavior on the same input [1]. The technique replaces traditional fuzzer oracles (such as crashes, hangs, or unsound memory accesses) with a difference oracle, in which agreement among implementations is treated as evidence of correctness and disagreement is treated as evidence of a bug [1].

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

8 connections
DiFuzzRTL ← implements 100% 5e
DifuzzRTL uses differential fuzzing by comparing CPU output with an ISS.
Mishegos ← implements 100% 3e
MISHEGOS implements differential fuzzing to discover decoding discrepancies.
golden model uses → 100% 2e
Differential fuzzing uses a golden model to compare against RTL execution results.
Cross-Checking Execution Results uses → 100% 1e
Differential fuzzing relies on cross-checking execution results to identify discrepancies.
The paper applies differential fuzzing to x86-64 instruction decoders.
Difference Oracle uses → 1e
Differential fuzzing uses a difference oracle instead of traditional crash-based oracles.
Instruction Set Simulator uses → 100% 1e
Differential fuzzing uses an ISS as a golden reference model to compare against CPU under test.
Instruction Set Simulator (ISS) uses → 100% 1e
Differential fuzzing uses an ISS as a golden reference model for comparison

CITATIONS

7 sources
7 citations — click to expand
[1] Differential fuzzing replaces traditional fuzzer oracles such as crashes, hangs, or unsound memory accesses with a difference oracle, where an implementation of a specification is said to be potentially erroneous if its behavior differs from another implementation's on the same input. Differential analysis of x86-64 instruction decoders
[2] Differential fuzzing has been applied successfully to cryptography software and complex application format parsers like PDF and ELF. Differential analysis of x86-64 instruction decoders
[3] MISHEGOS produces hundreds of millions of decoder tests per hour on modest hardware and has been used to discover hundreds of errors in popular x86-64 instruction decoders without relying on a hardware decoder for ground truth. Differential analysis of x86-64 instruction decoders
[4] Differential fuzzing operates as a guided randomized search, aiming to find (similar) inputs that lead to a maximum difference in software outputs or their behaviors. Risk Estimation in Differential Fuzzing via Extreme Value Theory
[5] EVT-based extrapolation outperformed baseline statistical methods (Markov's, Chebyshev's, Bayes factor) in 14.3% of cases and tied in 64.2% of cases, enabling an average saving of tens of millions of bytecode executions via early stop. Risk Estimation in Differential Fuzzing via Extreme Value Theory
[6] A differential-fuzzing-based equivalence checker found that 19–35% of LLM refactorings (CodeLlama, Codestral, StarChat2, Qwen-2.5, Olmo-3, GPT-4o) are functionally non-equivalent, and about 21% of these are undetected by existing test suites. A Differential Fuzzing-Based Evaluation of Functional Equivalence in LLM-Generated Code Refactorings
[7] DifuzzRTL uses an ISS as a reference model for differential fuzzing of CPU RTL implementations, and most executed instructions in its generated programs are overhead/setup instructions rather than fuzzing instructions. Cascade: CPU Fuzzing via Intricate Program Generation