Skip to content
STIMSMITH

Interdependent data/control-flow entangled instruction generation

Technique WIKI v1 · 6/24/2026

Interdependent data/control-flow entangled instruction generation is a hardware-fuzzing input-generation technique, implemented in ChatFuzz, that produces pseudo-random machine-code instruction sequences whose data- and control-flow dependencies are mutually entangled so that executing one instruction influences the operands and branching behavior of others. The technique pairs an LLM-based input generator with reinforcement learning driven by RTL/ISA simulation coverage feedback, enabling fuzzer-generated programs to drive a CPU design toward deep, hard-to-reach regions rather than only syntactically valid but semantically independent instruction streams.

Overview

Interdependent data/control-flow entangled instruction generation is the test-input synthesis strategy at the core of ChatFuzz, an ML-based hardware fuzzer introduced at DATE 2024. The technique trains large language models (LLMs) on machine code and then samples from them to emit sequences of pseudo-random yet interconnected instructions whose data-flow and control-flow dependencies are deliberately entangled, instead of producing instruction streams that are individually valid but mutually independent.

Background and Motivation

Classical processor fuzzers such as DifuzzRTL and TheHuzz rely on code coverage and control-register coverage as feedback, generate seeds by random instruction emission, and mutate the instruction sequences of the current input. Hybrid fuzzers such as HyPFuzz and PSOFuzz combine fuzzing with formal methods or optimization but still inherit these seed-generation and mutation engines. While the seed generator and mutation engine in these fuzzers can identify valid instructions from the ISA, they do not have well-defined feedback to determine a meaningful sequence of instructions that will lead to deep design regions.

State-of-the-art fuzzers also struggle to achieve comprehensive coverage of intricate hardware designs within a practical timeframe, often falling short of a 70% coverage threshold on complex hardware such as a RISC-V RocketCore processor.

Technique Description

The technique, as realized in ChatFuzz, has three interlocking pieces:

  1. LLM-based Input Generator. An LLM is trained on machine language (specifically, machine codes) and is used to generate sequences of pseudo-random yet interconnected instructions for fuzzing the targeted CPU. Unlike existing methods, ChatFuzz prioritizes creating interdependent data/control flow and entangled instruction sequences.
  2. RTL/ISA Simulators and coverage feedback. The RTL Simulator executes the generated input on the targeted CPU and reports coverage information; an ISA Simulator runs the same input on the golden model. The recorded execution traces are used by a Mismatch Detector to compare behavior, and the RTL coverage is fed back to the LLM-based Input Generator to optimize the input-generation process.
  3. Reinforcement-learning-guided generation. RL is integrated to steer the input-generation process by rewarding inputs using code coverage metrics, so that the LLM progressively learns to emit instruction sequences that drive the design toward uncovered regions.

The paper formulates this as a three-step training process: (i) unsupervised learning to understand machine-language structures; (ii) reinforcement learning with a disassembler as the reward agent to enforce valid instruction generation; and (iii) further reinforcement learning that uses the RTL simulation as the reward agent to improve coverage.

Why Entanglement Matters

By making data-flow dependencies (operands consumed by later instructions) and control-flow dependencies (branches whose outcomes depend on earlier arithmetic or memory operations) mutually entangled, a single mutation cannot trivially invalidate the program: the generated stream is more likely to exercise coherent execution paths, allowing coverage-guided feedback to push the fuzzer into deep design regions rather than spending budget on instruction streams that crash early or repeat shallow behavior.

Reported Results

Using the open-source RISC-V-based RocketCore and BOOM cores as the testbed, ChatFuzz was reported to:

  • achieve 75% condition coverage on RocketCore in 52 minutes, versus a 30-hour timeframe required by state-of-the-art fuzzers for comparable coverage;
  • reach 79.14% condition coverage on RocketCore after approximately 199k test cases;
  • accomplish 97.02% condition coverage on BOOM in 49 minutes;
  • identify all detected bugs by TheHuzz, including two new bugs in RocketCore, plus discrepancies from the RISC-V ISA Simulator.

Implementation

This technique is implemented by ChatFuzz.

LINKED ENTITIES

1 links
ChatFuzz IMPLEMENTS

CITATIONS

5 sources
5 citations
[1] ChatFuzz trains large language models on machine code to generate pseudo-random yet interconnected instruction sequences prioritizing interdependent data/control flow and entangled instruction sequences. Beyond Random Inputs: A Novel ML-Based Hardware Fuzzing (DATE 2024)
[2] The technique uses RTL simulation coverage as a reward signal for reinforcement learning that guides LLM-based input generation. Beyond Random Inputs: A Novel ML-Based Hardware Fuzzing (DATE 2024)
[3] Traditional processor fuzzers such as DifuzzRTL and TheHuzz use code and control-register coverage feedback, generate random-instruction seeds, and mutate current-input instructions, but lack well-defined feedback to determine instruction sequences that reach deep design regions. Beyond Random Inputs: A Novel ML-Based Hardware Fuzzing (DATE 2024)
[4] ChatFuzz reports 75% condition coverage on RocketCore in 52 minutes (vs. ~30 hours for state-of-the-art fuzzers), 79.14% condition coverage on RocketCore after ~199k test cases, and 97.02% condition coverage on BOOM in 49 minutes. Beyond Random Inputs: A Novel ML-Based Hardware Fuzzing (DATE 2024)
[5] The training process is structured in three steps: unsupervised learning of machine-language structures, RL with a disassembler for valid instruction generation, and RL with RTL simulation as the reward agent for coverage improvement. Beyond Random Inputs: A Novel ML-Based Hardware Fuzzing (DATE 2024)