00

GoldenFuzz

Tool ☆ WATCH ⎘ SHARE

First seen 6/14/2026

Last seen 6/14/2026

Evidence 19 chunks

01

NEIGHBORHOOD

40 nodes · 61 edges

graph · GoldenFuzz · depth=1

02

RELATIONSHIPS

39 connections

preference pair uses → 100% 3e evidence

GoldenFuzz explicitly pairs winning and losing test cases as preference pairs to refine its fuzzing policy.

CVA6 evaluates → 100% 3e evidence

GoldenFuzz is evaluated on CVA6 as one of the DUT cores.

Golden Reference Model uses → 100% 3e evidence

GoldenFuzz leverages a fast, ISA-compliant Golden Reference Model as a digital twin of the DUT.

instruction block uses → 100% 3e evidence

GoldenFuzz builds test cases by concatenating instruction blocks.

Direct Preference Optimization uses → 95% 3e evidence

GoldenFuzz uses Direct Preference Optimization (DPO) concepts to refine its fuzzing policy.

GoldenFuzz: Generative Golden Reference Hardware Fuzzing ← introduces 100% 2e evidence

The paper presents GoldenFuzz as a novel two-stage hardware fuzzing framework.

Differential Testing implements → 100% 2e evidence

GoldenFuzz employs differential testing by comparing DUT and GRM execution traces.

Coverage-guided Fuzzing implements → 100% 2e evidence

GoldenFuzz adopts a coverage-guided white-box fuzzing strategy.

Hardware fuzzing implements → 100% 2e evidence

GoldenFuzz is a hardware fuzzing framework.

block-wise test case generation implements → 100% 2e evidence

GoldenFuzz introduces a block-wise test case generation scheme.

intra-test case scoring uses → 100% 2e evidence

GoldenFuzz employs intra-test case scoring to incentivize newly uncovered coverage within a single test case.

inter-test case scoring uses → 100% 2e evidence

GoldenFuzz employs inter-test case scoring to deduct coverage already found by other tests.

Cascade ← compares with 100% 2e evidence

GoldenFuzz is benchmarked against Cascade for hardware coverage.

ChatFuzz ← compares with 100% 2e evidence

GoldenFuzz is benchmarked against ChatFuzz for hardware coverage.

DiFuzzRTL ← compares with 100% 2e evidence

GoldenFuzz is benchmarked against DifuzzRTL for condition coverage.

TheHuzz compares with → 100% 2e evidence

GoldenFuzz is benchmarked against TheHuzz for condition coverage.

device under test uses → 100% 2e evidence

GoldenFuzz targets the Device Under Test in its second fuzzing stage.

mismatch detection uses → 100% 2e evidence

GoldenFuzz identifies discrepancies between DUT and GRM traces as potential vulnerabilities.

test case validity uses → 100% 2e evidence

GoldenFuzz refines test case validity based on ISA during GRM fuzzing.

privilege mode transition uses → 90% 2e evidence

GoldenFuzz learns to generate test cases that involve privilege mode transitions.

Physical Memory Protection uses → 90% 2e evidence

GoldenFuzz learns PMP configurations as part of its semantic understanding.

endianness vulnerability introduces → 90% 2e evidence

GoldenFuzz discovers endianness vulnerabilities in CVA6.

digital twin uses → 100% 2e evidence

GoldenFuzz uses the GRM as a digital twin of the DUT.

intra-instruction semantics uses → 90% 2e evidence

GoldenFuzz's instruction generation must internalize intra-instruction semantics.

inter-instruction semantics uses → 90% 2e evidence

GoldenFuzz's instruction generation must internalize inter-instruction semantics.

RISC-V assembly instruction generation implements → 100% 2e evidence

GoldenFuzz implements a customized GPT model for RISC-V assembly instruction generation.

Spike RISC-V simulator uses → 100% 2e evidence

GoldenFuzz employs Spike as the GRM during the profiling stage.

Synopsys VCS uses → 100% 2e evidence

GoldenFuzz uses Synopsys VCS for hardware coverage feedback during DUT fuzzing.

Rocket Chip evaluates → 100% 2e evidence

GoldenFuzz is evaluated on RocketChip as one of the DUT cores.

BOOM evaluates → 100% 2e evidence

GoldenFuzz is evaluated on BOOM as one of the DUT cores.

FSM coverage evaluates → 100% 2e evidence

GoldenFuzz measures FSM coverage as part of its evaluation.

condition coverage evaluates → 100% 2e evidence

GoldenFuzz measures condition coverage as part of its evaluation.

line coverage evaluates → 100% 2e evidence

GoldenFuzz measures line coverage as part of its evaluation.

RISC-V instruction corpus uses → 100% 2e evidence

GoldenFuzz is pre-trained on a corpus of RISC-V assembly instructions.

Simple Preference Optimization uses → 100% 1e evidence

GoldenFuzz employs Simple Preference Optimization to update the fuzzing policy.

GPT-2 uses → 100% 1e evidence

GoldenFuzz uses a GPT-2 language model as its fuzzer.

interrupt delegation vulnerability introduces → 90% 1e evidence

GoldenFuzz discovers interrupt delegation vulnerabilities in CVA6.

fuzzing memory uses → 100% 1e evidence

GoldenFuzz introduces a fuzzing memory to balance immediate gains with exploration diversity.

American Fuzzy Lop mentions → 90% 1e evidence

GoldenFuzz paper mentions AFL as the inspiration for traditional mutation-based fuzzing strategies.