Skip to content
STIMSMITH

GoldenFuzz

Tool
First seen 6/14/2026
Last seen 8/22/2026
Evidence 29 chunks

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

50 connections
Golden Reference Model uses → 100% 8e
GoldenFuzz leverages a Golden Reference Model as a digital twin of the DUT.
device under test uses → 100% 8e
GoldenFuzz targets the Device Under Test for vulnerability discovery after refining test cases on the GRM.
Hardware fuzzing implements → 100% 7e
GoldenFuzz implements hardware fuzzing for processor RTL verification and vulnerability discovery.
CVA6 evaluates → 100% 6e
GoldenFuzz was evaluated on CVA6, discovering five new vulnerabilities.
digital twin uses → 100% 5e
GoldenFuzz uses the Golden Reference Model as a digital twin of the Device Under Test.
The paper introduces the GoldenFuzz tool for hardware fuzzing.
BOOM evaluates → 100% 5e
GoldenFuzz was evaluated on the BOOM processor design, achieving superior coverage results.
Coverage-guided Fuzzing implements → 100% 5e
GoldenFuzz implements coverage-guided fuzzing in its second stage for DUT-level exploration.
Rocket Chip evaluates → 100% 5e
GoldenFuzz was evaluated on and tested against the RocketChip processor design.
Two-stage Fuzzing Framework implements → 100% 4e
GoldenFuzz is described as a novel two-stage hardware fuzzing framework.
instruction block uses → 100% 4e
GoldenFuzz constructs test programs from instruction blocks generated and scored by the policy model.
ChatFuzz ← compares with 100% 3e
GoldenFuzz is compared against ChatFuzz as a baseline hardware fuzzer.
preference pair uses → 100% 3e
GoldenFuzz explicitly pairs winning and losing test cases as preference pairs to refine its fuzzing policy.
ISA-compliant Test Generation uses → 95% 3e
GoldenFuzz uses a fast, ISA-compliant Golden Reference Model for test generation.
Cascade ← compares with 100% 3e
GoldenFuzz is compared against Cascade as a prior state-of-the-art hardware fuzzer.
DiFuzzRTL ← compares with 100% 3e
GoldenFuzz is compared against DifuzzRTL, achieving 3.33× speedup over it.
BA51-H evaluates → 100% 3e
GoldenFuzz was evaluated on the commercial BA51-H processor core, finding two confidential bugs.
Direct Preference Optimization uses → 95% 3e
GoldenFuzz uses Direct Preference Optimization (DPO) concepts to refine its fuzzing policy.
Synopsys VCS uses → 100% 3e
GoldenFuzz uses Synopsys VCS as an RTL simulation backend for DUT-level fuzzing.
TheHuzz compares with → 100% 3e
GoldenFuzz is compared against TheHuzz as a baseline hardware fuzzer.
Instruction Block Concatenation uses → 100% 3e
GoldenFuzz constructs test cases by concatenating carefully chosen instruction blocks.
Test Case Refinement uses → 100% 3e
GoldenFuzz partially decouples test case refinement from coverage and vulnerability exploration.
GPT-2-based instruction generation uses → 100% 2e
GoldenFuzz uses a GPT-2-based LLM to generate instruction blocks for its first fuzzing stage.
Differential Testing implements → 100% 2e
GoldenFuzz employs differential testing by comparing DUT and GRM execution traces.
block-wise test case generation implements → 100% 2e
GoldenFuzz introduces a block-wise test case generation scheme.
intra-test case scoring uses → 100% 2e
GoldenFuzz employs intra-test case scoring to incentivize newly uncovered coverage within a single test case.
inter-test case scoring uses → 100% 2e
GoldenFuzz employs inter-test case scoring to deduct coverage already found by other tests.
intra-instruction semantics uses → 90% 2e
GoldenFuzz's instruction generation must internalize intra-instruction semantics.
inter-instruction semantics uses → 90% 2e
GoldenFuzz's instruction generation must internalize inter-instruction semantics.
RISC-V assembly instruction generation implements → 100% 2e
GoldenFuzz implements a customized GPT model for RISC-V assembly instruction generation.
Spike RISC-V simulator uses → 100% 2e
GoldenFuzz employs Spike as the GRM during the profiling stage.
FSM coverage evaluates → 100% 2e
GoldenFuzz measures FSM coverage as part of its evaluation.
condition coverage evaluates → 100% 2e
GoldenFuzz measures condition coverage as part of its evaluation.
line coverage evaluates → 100% 2e
GoldenFuzz measures line coverage as part of its evaluation.
RISC-V instruction corpus uses → 100% 2e
GoldenFuzz is pre-trained on a corpus of RISC-V assembly instructions.
mismatch detection uses → 100% 2e
GoldenFuzz identifies discrepancies between DUT and GRM traces as potential vulnerabilities.
test case validity uses → 100% 2e
GoldenFuzz refines test case validity based on ISA during GRM fuzzing.
privilege mode transition uses → 90% 2e
GoldenFuzz learns to generate test cases that involve privilege mode transitions.
Physical Memory Protection uses → 90% 2e
GoldenFuzz learns PMP configurations as part of its semantic understanding.
endianness vulnerability introduces → 90% 2e
GoldenFuzz discovers endianness vulnerabilities in CVA6.
Architectural State Exploration uses → 100% 2e
GoldenFuzz accelerates deep architectural exploration on the DUT.
feedback-driven fuzzing uses → 100% 2e
GoldenFuzz employs a feedback-driven mechanism leveraging insights from high- and low-coverage samples.
two-stage fuzzing pipeline implements → 100% 2e
GoldenFuzz introduces and implements a two-stage pipeline separating policy refinement from coverage-guided DUT fuzzing.
SimPO uses → 100% 2e
GoldenFuzz uses SimPO to update the policy on preference pairs to maximize ISA-valid instruction generation and coverage.
lockstep differential comparison uses → 100% 2e
GoldenFuzz drives both RTL DUT and GRM in lockstep, comparing outputs after each instruction to detect bugs.
ModelSim uses → 100% 2e
GoldenFuzz uses ModelSim as an RTL simulation backend for DUT-level fuzzing.
condition coverage uses → 100% 2e
GoldenFuzz measures and reports condition coverage improvements over prior tools.
FSM coverage uses → 100% 2e
GoldenFuzz measures FSM coverage and matches state-of-the-art on RocketChip.
Wu et al. 2025 GoldenFuzz ← introduces 100% 2e
The Wu et al. 2025 paper introduces GoldenFuzz as a novel hardware fuzzing framework.
Nikhilesh Singh authored by → 100% 1e
Nikhilesh Singh is listed as an author affiliated with TU Darmstadt.