ChipFuzzer is proposed, a hardware fuzzing framework that leverages the semantic reasoning capabilities of large language models (LLMs) to improve fuzzing effectiveness and improves average condition coverage and bug detection rate over the strongest baseline.
Abstract
The growing complexity of modern chips poses significant challenges to hardware verification. In recent years, coverage-guided fuzzing has emerged as a promising approach for improving verification efficiency. However, existing hardware fuzzers still struggle to achieve high coverage and expose corner-case bugs, as they predominantly rely on heuristic strategies with limited ability to reason about the internal logic and semantic behavior of the design under test (DUT). In this work, we propose ChipFuzzer, a hardware fuzzing framework that leverages the semantic reasoning capabilities of large language models (LLMs) to improve fuzzing effectiveness. ChipFuzzer adopts a dual-stage workflow comprising a Coverage-Guided stage and a Bug-Guided stage. In the Coverage-Guided stage, ChipFuzzer employs control-flow similarity and discrepancy analysis to guide LLM-driven testcase generation, thereby improving coverage. In the Bug-Guided stage, ChipFuzzer leverages historical bug data to identify bug-prone code regions and prioritize testcase generation for those regions, thus enhancing bug discovery efficiency. Experimental results on three open-source CPU designs show that ChipFuzzer improves average condition coverage by 5.8 percentage points and bug detection rate by 21.1 percentage points over the strongest baseline.
A hybrid pipeline combining static vulnerability candidate selection using Latent Semantic Analysis with dynamic verification through Large Language Model-assisted fuzzing is presented, which reduces manual effort while still requiring human validation.
Kevin Nguyen, Dominik Schoop· International Conference on...· 0 citations
As modern hardware systems grow in complexity, traditional pre-silicon verification techniques increasingly struggle to expose deep corner-case behaviors and security-relevant bugs that can persist across the entire lifetime of deployed silicon. In response, hardware fuzzing has emerged as a promising complement to traditional verification approaches, adapting the principles of software fuzzing to systematically explore hardware state spaces and uncover functional bugs, security flaws, and corner-case behaviors in increasingly complex digital designs. Despite growing interest in this field, existing survey efforts remain fragmented, often focusing narrowly on specific hardware targets or fuzzing techniques, and fail to provide a comprehensive overview of the broader hardware fuzzing landscape. Motivated by these gaps, this survey presents a comprehensive overview of state-of-the-art hardware fuzzing research, examining how existing hardware fuzzing approaches differ in their fundamental approaches to test generation, simulation infrastructure, mutation strategy, coverage feedback, and bug detection. We organize prior fuzzing techniques across diverse hardware designs, including processors, Systems-on-Chip (SoCs), Intellectual Property (IP) blocks, and categorize them into five principal categories. We further identify the key trends driving the field forward, analyze the persistent open challenges, and highlight promising emerging directions that will shape the next generation of scalable, security-aware, and practically deployable hardware fuzzing frameworks.
The first systematic study of imperfect specifications is presented and an automated framework to repair them to enhance the quality of resulting Verilog design is proposed, demonstrating the capabilities of specification repair by {VClare} as well as further potential of LLMs in front-end hardware design.
Zhuorui Zhao, Bing Li, Yu Li et al.· arXiv.org· 0 citations
This work proposes VPID, a multi-agent framework for generating complex Verilog that achieves monotonic functional improvement and introduces an experience-guided refinement strategy that distills historical waveform mismatches into constraints, guiding the targeted debugging for the unverified ports.
Hongguang Wang, Jiaming Guo, Rui Zhang et al.· 0 citations
Deep learning (DL) compilers such as Apache TVM translate high-level models into optimized low-level code through multi-stage compilation pipelines. While recent testing efforts have improved fuzzing of optimization stages, they still face two key challenges: (i) the lack of semantics-preserving test models, leading to low validity, and (ii) coarse-grained input generation that fails to trigger hard-to-reach compiler components. To address these limitations, we propose CovCraft, a unified testing framework that integrates constraint-driven model generation with large language model (LLM)-guided input adaptation. CovCraft constructs diverse and valid ONNX models via symbolic constraint encoding and SMT solving, and then iteratively refines inputs using LLM-guided prompts to target uncovered functions, enabling the activation of rarely executed code paths. We evaluate CovCraft on TVM and observe consistent improvements over state-of-the-art techniques: it increases branch and function coverage by 8.9% and 7.0%, respectively, and detects 8 bugs. Moreover, the LLM-guided component achieves an 83.75% success rate in covering designated target functions, demonstrating the effectiveness of combining constraint-based generation with adaptive LLM reasoning for DL compiler testing. The prototype implementation of CovCraft is publicly available at: https://github.com/duduhedangdang/CovCraft.
Yifei He, Fangyu Yang, Ting Su et al.· Annual International Compute...· 0 citations
LISA iteratively generates API sequences and program invariants guided by API n-gram feedback, achieving higher bug-detection rates and competitive code coverage compared with both fuzzing and prior LLM-based test generation approaches, and reporting each finding as a high-confidence bug candidate for developer confirmation.
