Language Model-based Fuzzer

Overview

A language model-based fuzzer is a fuzzing technique that leverages a language model to generate syntactically and semantically structured test inputs—rather than purely random mutations—to expose bugs and vulnerabilities in a target system. By learning the structure of valid inputs, the language model produces test cases that are more likely to exercise meaningful behavior, enabling deeper exploration of the target's state space than purely random approaches.

Application in Hardware Fuzzing

In the context of hardware security, language model-based fuzzing has been adopted to address the difficulty of crafting valid machine-level inputs for processor designs. The GenHuzz framework utilizes a language model-based fuzzer to intelligently generate RISC-V assembly instructions, which are then dynamically refined through a Hardware-Guided Reinforcement Learning framework that incorporates real-time feedback from the hardware under test.

This combination allows the fuzzer to:

• Understand and exploit complex interdependences between instructions.
• Generate more subtle and effective test cases compared with existing fuzzers.
• Reframe fuzzing as an optimization problem, optimizing the fuzzing policy to maximize bug and vulnerability coverage.

Relation to Generative Hardware Fuzzing

When combined with reinforcement learning guided by hardware feedback, a language model-based fuzzer forms the core of a generative hardware fuzzing pipeline. Evaluations on three RISC-V cores have shown that this approach achieves significantly higher hardware coverage with fewer test cases than four state-of-the-art fuzzers, detects all known bugs reported in prior studies with fewer test cases, and has uncovered previously unknown hardware vulnerabilities—including several rated as highly severe under CVSS v3.

Related Concepts

• Generative hardware fuzzing: The paradigm in which a generative model produces test inputs.
• Hardware-Guided Reinforcement Learning: A learning loop that uses real-time signals from the hardware to steer the fuzzer's generative policy.
• RISC-V assembly instruction generation: The specific instantiation in which the language model produces RISC-V assembly instructions as structured test cases.