Interdependent data/control-flow entangled instruction generation

Technique

Interdependent data/control-flow entangled instruction generation is a hardware-fuzzing input-generation technique, implemented in ChatFuzz, that produces pseudo-random machine-code instruction sequences whose data- and control-flow dependencies are mutually entangled so that executing one instruction influences the operands and branching behavior of others. The technique pairs an LLM-based input generator with reinforcement learning driven by RTL/ISA simulation coverage feedback, enabling fuzzer-generated programs to drive a CPU design toward deep, hard-to-reach regions rather than only syntactically valid but semantically independent instruction streams.

First seen 6/24/2026

Last seen 6/24/2026

Evidence 2 chunks

Wiki v1

WIKI

Overview

Interdependent data/control-flow entangled instruction generation is the test-input synthesis strategy at the core of ChatFuzz, an ML-based hardware fuzzer introduced at DATE 2024. The technique trains large language models (LLMs) on machine code and then samples from them to emit sequences of pseudo-random yet interconnected instructions whose data-flow and control-flow dependencies are deliberately entangled, instead of producing instruction streams that are individually valid but mutually independent.

Background and Motivation

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

1 connections

ChatFuzz ← implements 90% 2e

The approach emphasizes producing entangled instruction sequences rather than random ones.

LINKED ENTITIES

1 links

ChatFuzz IMPLEMENTS Extracted graph relationship

CITATIONS

5 sources

5 citations — click to expand

[1] ChatFuzz trains large language models on machine code to generate pseudo-random yet interconnected instruction sequences prioritizing interdependent data/control flow and entangled instruction sequences. Beyond Random Inputs: A Novel ML-Based Hardware Fuzzing (DATE 2024)

[2] The technique uses RTL simulation coverage as a reward signal for reinforcement learning that guides LLM-based input generation. Beyond Random Inputs: A Novel ML-Based Hardware Fuzzing (DATE 2024)

[3] Traditional processor fuzzers such as DifuzzRTL and TheHuzz use code and control-register coverage feedback, generate random-instruction seeds, and mutate current-input instructions, but lack well-defined feedback to determine instruction sequences that reach deep design regions. Beyond Random Inputs: A Novel ML-Based Hardware Fuzzing (DATE 2024)

[4] ChatFuzz reports 75% condition coverage on RocketCore in 52 minutes (vs. ~30 hours for state-of-the-art fuzzers), 79.14% condition coverage on RocketCore after ~199k test cases, and 97.02% condition coverage on BOOM in 49 minutes. Beyond Random Inputs: A Novel ML-Based Hardware Fuzzing (DATE 2024)

[5] The training process is structured in three steps: unsupervised learning of machine-language structures, RL with a disassembler for valid instruction generation, and RL with RTL simulation as the reward agent for coverage improvement. Beyond Random Inputs: A Novel ML-Based Hardware Fuzzing (DATE 2024)