Fuzzing
TechniqueFuzzing (or fuzz testing) is a software and hardware testing technique in which a target is repeatedly exercised with random or mutated inputs drawn from a seed corpus, guided by a coverage feedback metric, with the goal of finding bugs, crashes, or security vulnerabilities. The technique has been applied to input parsers and software libraries, and more recently to processor and hardware designs (RTL), where it appears in two principal flavors: Coverage-Guided Graybox Fuzzing (CGF) for broad coverage, and Directed Graybox Fuzzing (DGF) for targeted, region-specific verification.
First seen 6/4/2026
Last seen 7/19/2026
Evidence 35 chunks
Wiki v2
WIKI
Fuzzing
Definition
Fuzzing (also called fuzz testing) is a testing technique that consists of repeatedly running a target with random or mutated inputs in order to find bugs, crashes, or security vulnerabilities. A typical coverage-guided fuzzing loop comprises:
NEIGHBORHOOD
3 nodes · 3 edgesgraph · Fuzzing · depth=1
RELATIONSHIPS
28 connectionsThe paper compares symbolic execution to fuzzing, noting that fuzzing is susceptible to missing corner-case bugs.
The paper presents a testing methodology based on fuzzing for CPU emulators.
TitanFuzz uses LLMs to generate and mutate human-like code for fuzzing deep learning libraries.
Fuzzing uses synthetically generated test-cases to stress-test the CPU emulator.
Coverage-guided fuzzing is a modern form of fuzzing that uses coverage to guide mutation.
Symbolic execution is contrasted with fuzzing, noted as a formal technique that can explore large state spaces more efficiently.
The repository is described as hosting fuzzing code for Cascade.
The paper mentions fuzzing as a related technique for RISC-V verification.
TestRIG includes a single-implementation mode that enables more traditional fuzzing.
Positions hardware fuzzing as an approach that builds on principles established by (software) fuzzing.
Coverage-guided fuzzing is a specific type of fuzzing technique.
ProcessorFuzz implements fuzzing for processor testing.
SIGFuzz implements fuzzing to discover timing side channels.
Fuzzing uses a mutation engine to generate mutated inputs.
Fuzzing uses coverage feedback to guide input generation.
LKL-fuzzer is a kernel fuzzing technique that generates eBPF programs to find correctness bugs.
BRF is a kernel fuzzing technique that generates eBPF programs passing the verifier to find correctness bugs.
BVF is a kernel fuzzing technique that generates eBPF programs passing the verifier to find correctness bugs.
Fuzz4All is a fuzzing tool that uses LLMs for input generation, similar in approach to TitanFuzz.
WADIFF generated test cases for each Wasm operator and then fuzzed them.
Wasmaker performs similar fuzzing to WADIFF but generates more complex binaries.
Fuzzing has become a powerful technique for vulnerability discovery.
Sandsifter uses depth-first-search-based fuzzing to determine x86 instruction lengths.
Hardware fuzzing is an adaptation of software fuzzing techniques applied to hardware verification.
UISFuzz is a hardware fuzzing method for CPU undocumented instruction searching.
Fuzzing is used to improve test case quality in verification contexts.
Fuzzing is an advanced software testing technique applied to processor verification.
Simulation-based approaches incorporate fuzzing to improve coverage.
LINKED ENTITIES
1 linksCITATIONS
8 sources8 citations — click to expand
[1] Fuzzing is an automated testing method that repeatedly generates inputs, often randomly or through guided mutation, to expose bugs, crashes, or unexpected behaviors. Intelligent Graybox Fuzzing via ATPG-Guided Seed Generation and Submodule Analysis
[2] Hardware fuzzing techniques emerged as a promising verification approach, inspired by well-established software fuzzing techniques, because traditional functional and formal verification methods struggle to scale with the growing complexity of hardware designs. Intelligent Graybox Fuzzing via ATPG-Guided Seed Generation and Submodule Analysis
[3] Coverage-Guided Graybox Fuzzing (CGF) is foundational in hardware fuzzing; input generation is directed by feedback from real-time code coverage, allowing the fuzzer to prioritize input mutations that reveal unexplored paths and improve functional coverage of RTL designs. Intelligent Graybox Fuzzing via ATPG-Guided Seed Generation and Submodule Analysis
[4] Directed Graybox Fuzzing (DGF) enables targeted fuzzing by steering test generation toward specific regions of interest, useful for patch validation, bug localization, or module-specific testing in incremental hardware design workflows. Intelligent Graybox Fuzzing via ATPG-Guided Seed Generation and Submodule Analysis
[5] DirectFuzz is a DGF-based implementation that aimed to bring directionality into the fuzzing process but exhibits four key limitations: (i) inability to capture hardware-specific semantics and structure, (ii) misaligned coverage metrics that do not align with established verification practices, (iii) limited scalability when targeting multiple design regions, and (iv) inability to perform targeted verification across multiple modules. Intelligent Graybox Fuzzing via ATPG-Guided Seed Generation and Submodule Analysis
[6] PROFUZZ is a hardware fuzzing framework based on DGF that operates directly at the hardware's native abstraction level, models inherent hardware behaviors, uses hardware-specific coverage metrics, and integrates with industry-standard Electronic Design Automation (EDA) tools. Intelligent Graybox Fuzzing via ATPG-Guided Seed Generation and Submodule Analysis
[7] Learn&Fuzz automates the construction of an input grammar suitable for input fuzzing using sample inputs and neural-network-based statistical machine-learning techniques, applied to the PDF parser embedded in Microsoft Edge. Learn&Fuzz: Machine Learning for Input Fuzzing
[8] PromptFuzz is a coverage-guided fuzzer that iteratively generates fuzz drivers to explore undiscovered library code, achieving 1.61× and 1.63× higher branch coverage than OSS-Fuzz and Hopper respectively on 14 real-world libraries, and detecting 33 genuine new bugs out of 49 crashes (30 confirmed by their communities). Prompt Fuzzing for Fuzz Driver Generation