Cascade
ToolCascade is the subject of the 2024 USENIX Security paper "Cascade: CPU Fuzzing via Intricate Program Generation" by Flavien Solt, Katharina Ceesay-Seitz, and Kaveh Razavi. The available evidence also documents an artifact workflow centered on Questasim experiments, including building the Rocket core, generating ELF files for DifuzzRTL and Cascade, and running a comparison script that produces `modelsim.png`.
First seen 6/10/2026
Last seen 9/1/2026
Evidence 119 chunks
Wiki v3
WIKI
Overview
Cascade is presented in the paper "Cascade: CPU Fuzzing via Intricate Program Generation" by Flavien Solt, Katharina Ceesay-Seitz, and Kaveh Razavi. USENIX lists it as a paper in the 33rd USENIX Security Symposium (USENIX Security 24), published in August 2024, on pages 5341-5358.[C1] The paper title itself directly characterizes Cascade in terms of CPU fuzzing and intricate program generation.[C2]
Artifact-documented Questasim workflow
NEIGHBORHOOD
12 nodes · 31 edgesgraph · Cascade · depth=1
RELATIONSHIPS
50 connectionsDifuzzRTL and Cascade are compared in terms of bug detection performance.
The Cascade paper introduces the Cascade tool for CPU fuzzing via intricate program generation.
Cascade is evaluated against TheHuzz in terms of coverage and speed
Cascade is evaluated against RFUZZ on multiplexer select coverage
Cascade executes programs on RTL simulations of CPUs under test
Cascade constructs programs as sequences of basic blocks
Cascade uses progressive and strong memory allocation strategies during program generation
Cascade uses Spike as its ISS for asymmetric pre-simulation
GoldenFuzz is compared against Cascade as a prior state-of-the-art hardware fuzzer.
Cascade implements the asymmetric ISA pre-simulation technique for entangling control and data flows.
RISCSmith is directly compared with Cascade in experiments, outperforming it in bugs found and coverage.
Cascade is used to evaluate the openC910 RTL.
The title ties Cascade directly to CPU fuzzing, implying the tool embodies that technique.
Cascade includes an automated program reduction technique for minimizing bug-triggering programs
Cascade uses asymmetric ISA pre-simulation to entangle control and data flows
Cascade is used to evaluate the openC906 RTL.
Cascade is a CPU fuzzing tool.
Cascade uses program non-termination as a design-agnostic bug detection mechanism
HiFuzz was compared against Cascade as a constructive fuzzing baseline.
Cascade entangles data and control flows to detect bugs via non-termination
Cascade uses an ISA simulator as a reference model for bug detection.
Cascade identifies and handles cf-ambiguous instructions specially during program construction
Cascade is designed to achieve high fuzzing prevalence compared to prior work
GenHuzz is benchmarked against Cascade on coverage metrics across three RISC-V cores.
Cascade found a critical bug in Yosys synthesizer
RISCover is compared to Cascade for bug-finding efficacy on open-source RISC-V cores.
Cascade uses an ISS (Spike) to pre-simulate programs during ultimate program construction
Cascade is designed to generate programs that complete execution, with non-completion indicating a bug
Cascade supports data flow-dependent privilege transitions in generated programs
Cascade is evaluated on BOOM
Cascade uses offset register construction to entangle data and control flows.
The README specifies an optional QuestaSim-based experiment for coverage comparison.
Cascade generates programs that operate under randomized CSRs.
Cascade supports complex FPU operations in generated programs.
Cascade is evaluated on PicoRV32
Cascade relies on program non-termination as its bug detection mechanism.
Cascade handles cf-ambiguous instructions specially during program generation to control program flow.
Cascade uses an ISS to execute intermediate programs and collect data-flow dependent values for constructing ultimate programs.
Cascade generates valid RISC-V programs targeting the RISC-V ISA.
Lyra: A Hardware-Accelerated RISC-V Verification Framework with Generative Model-Based Processor Fuzzing ← compares with 100% 2e
The paper compares Lyra against Cascade in empirical evaluations.
Cascade is evaluated on VexRiscv and finds bugs in it
Cascade is evaluated on Kronos
Cascade is described as a state-of-the-art RISC-V RTL CPU fuzzer.
Cascade uses intermediate program construction as a core step in generating ultimate programs.
Lyra is empirically compared against Cascade in coverage and throughput.
The paper evaluates Cascade using the ENCARSIA framework and EnCorpus.
Cascade implements an automated program reduction technique to find minimal bug-triggering programs.
Cascade discovers bugs undetected by HypFuzz
Cascade analyzes dependency chain lengths in generated programs as a quality metric.
Cascade generates programs with highly randomized and interdependent data and control flows.
CITATIONS
7 sources7 citations — click to expand
[1] C1 - Cascade is presented in a USENIX Security 2024 paper by Flavien Solt, Katharina Ceesay-Seitz, and Kaveh Razavi, with pages 5341-5358. Cascade: CPU Fuzzing via Intricate Program Generation - USENIX
[2] C2 - The paper title directly characterizes Cascade as CPU fuzzing via intricate program generation. Cascade: CPU Fuzzing via Intricate Program Generation - USENIX
[3] C3 - The artifact README documents building the Rocket core for Questasim simulation and notes that the local `rocket` entry in `cascade_meta/design_processing/design_repos.json` may need adaptation. comsec-group/cascade-artifacts
[4] C4 - The README documents generating ELF files for DifuzzRTL and Cascade in a container, warns this may take hours, recommends mounting or copying out a local ELF directory, and lists example host Python requirements. comsec-group/cascade-artifacts
[5] C5 - The README documents running `do_compare_cascade_difuzzrtl_modelsim.py`, states that the experiment may take many hours, describes parallel fuzzing and sequential coverage merging phases, and says the result is stored as `modelsim.png` in `cascade-meta/figures`. comsec-group/cascade-artifacts
[6] C6 - The artifact repository says `step_descriptions.md` maps the paper's overview figure (Figure 3). comsec-group/cascade-artifacts
[7] C7 - The artifact repository includes a minimal running example that begins by adapting `descriptor` in `cascade-meta/fuzzer/do_fuzzsingle.py`. comsec-group/cascade-artifacts