HiFuzz

Tool

First seen 7/10/2026

Last seen 8/19/2026

Evidence 18 chunks

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

49 connections

RISC-V uses → 100% 4e

HiFuzz targets RISC-V ISA for its instruction generation and fuzzing campaigns.

Program Agent uses → 100% 4e

HiFuzz uses a Program Agent as the high-level agent in its hierarchical RL architecture.

Hardware fuzzing implements → 100% 3e

HiFuzz implements the hardware fuzzing concept using a hierarchical RL approach.

Cascade ← compares with 100% 3e

HiFuzz was compared against Cascade as a constructive fuzzing baseline.

Hierarchical Reinforcement Learning implements → 100% 3e

HiFuzz implements Hierarchical Reinforcement Learning as its core architectural principle.

DiFuzzRTL ← compares with 100% 3e

HiFuzz was compared against DifuzzRTL as a mutation-based fuzzing baseline.

Basic Block Agent uses → 100% 3e

HiFuzz uses a Basic Block Agent as the low-level agent in its hierarchical RL architecture.

Constructive Test Generation implements → 95% 2e

HiFuzz uses constructive generation to assemble programs instruction by instruction rather than mutating seeds.

spike uses → 100% 2e

HiFuzz uses Spike as the reference model for differential testing on RISC-V cores.

Coverage-guided Fuzzing implements → 90% 2e

HiFuzz uses coverage feedback to guide the reinforcement learning agents toward better test generation.

ISA Pre-Simulation uses → 90% 2e

HiFuzz uses an ISA pre-simulation step to validate generated programs before RTL simulation.

Rocket Core evaluates → 100% 2e

HiFuzz is evaluated on the Rocket Core as one of three RISC-V targets.

BOOM core evaluates → 100% 2e

HiFuzz is evaluated on the BOOM Core as one of three RISC-V targets.

CVA6 evaluates → 100% 2e

HiFuzz is evaluated on CVA6 as one of three RISC-V targets.

ProcessorFuzz compares with → 100% 2e

HiFuzz is compared against ProcessorFuzz as a baseline fuzzer.

Control Register Coverage evaluates → 100% 2e

HiFuzz is evaluated using control register coverage as its primary metric on Rocket.

Mux Coverage evaluates → 90% 2e

HiFuzz reports MUX coverage on Rocket and BOOM cores.

line coverage evaluates → 90% 2e

HiFuzz measures line coverage on Rocket using Verilator.

toggle coverage evaluates → 90% 2e

HiFuzz measures toggle coverage on Rocket using Verilator.

Basic Block Agent ← part of 100% 2e

The Basic Block Agent is a component of the HiFuzz dual-agent architecture.

Program Agent ← part of 100% 2e

The Program Agent is a component of the HiFuzz dual-agent architecture.

Semantic-Aware Basic Block Encoder ← part of 100% 2e

The Semantic-Aware BB Encoder is a feedback component of HiFuzz.

Adaptive Coverage Reward Mechanism ← part of 100% 2e

The ACRM is a feedback component of HiFuzz for balanced module-level coverage.

Semantic-Aware Basic Block Encoder uses → 100% 2e

HiFuzz integrates a Semantic-Aware Basic Block Encoder to provide intrinsic novelty feedback.

differential testing uses → 85% 2e

HiFuzz uses differential testing against Spike as the reference model to detect bugs.

Adaptive Coverage Reward Mechanism uses → 100% 2e

HiFuzz uses an Adaptive Coverage Reward Mechanism to balance module-level exploration.

Intrinsic Novelty Reward uses → 100% 2e

HiFuzz uses an intrinsic novelty reward derived from the BB encoder embeddings to provide dense feedback.

Instruction Prevalence uses → 1e

HiFuzz achieves high instruction prevalence, ensuring most generated instructions are semantically meaningful.

Hierarchical Configuration uses → 95% 1e

HiFuzz uses a hierarchical configuration mechanism splitting global structure from per-BB content.

Verilator uses → 100% 1e

HiFuzz is implemented on top of Verilator for RTL simulation.

CocoTB uses → 100% 1e

HiFuzz is implemented on top of Cocotb for hardware simulation interfacing.

Encarsia evaluates → 90% 1e

HiFuzz is evaluated using the Encarsia benchmark for bug detection.

GenHuzz ← compares with 90% 1e

HiFuzz is structurally compared with GenHuzz as a related generative fuzzer.

Hierarchical Configuration ← part of 90% 1e

Hierarchical Configuration is a core mechanism of HiFuzz for splitting global and local program decisions.

Proximal Policy Optimization uses → 1e

HiFuzz uses Proximal Policy Optimization for the Basic Block Agent's policy updates.

Semantic-Aware Basic Block Encoding uses → 1e

HiFuzz uses Semantic-Aware Basic Block Encoding to provide intrinsic rewards and address the sparse reward problem.

Adaptive Coverage Reward Mechanism uses → 1e

HiFuzz uses the Adaptive Coverage Reward Mechanism to address the coverage masking effect.

Bidirectional LSTM uses → 1e

HiFuzz uses a Bidirectional LSTM as the backbone of its Semantic-Aware Basic Block Encoder.

Structured Tokenizer uses → 1e

HiFuzz uses a structured tokenizer to process RISC-V instructions for semantic encoding.

Intrinsic Reward uses → 1e

HiFuzz uses intrinsic rewards to address the sparse reward problem in RL-based fuzzing.

Rocket Core evaluates → 1e

HiFuzz was evaluated on the Rocket Core RISC-V processor.

BOOM Core evaluates → 1e

HiFuzz was evaluated on the BOOM Core RISC-V processor.

CVA6 evaluates → 1e

HiFuzz was evaluated on the CVA6 RISC-V processor.

test program generation uses → 1e

HiFuzz uses test program generation as its primary mechanism for hardware fuzzing.

Design Under Test uses → 1e

HiFuzz uses a Design Under Test as the target for its generated test programs.

Golden Reference Model uses → 1e

HiFuzz uses a golden reference model to detect bugs by comparing DUT behavior.

hardware coverage uses → 1e

HiFuzz optimizes hardware coverage as its primary objective metric.

dependency chain uses → 1e

HiFuzz generates programs with long dependency chains to stress processor pipelines.

HiFuzz: Hierarchical Reinforcement Learning for Semantic-Aware and Adaptive CPU Fuzzing ← introduces 100% 1e

The paper introduces HiFuzz as a novel hierarchical reinforcement learning framework for CPU fuzzing.