SoK: You Find What You Seek: Rethinking Oracles, Guidance, and Input Generation in Hardware Fuzzing
A survey of 52 hardware fuzzers says campaigns only find bugs they can reach, recognize, and prioritize.
This systematization of knowledge analyzes 52 hardware fuzzers spanning RTL/IP, CPU, NoC, and SoC designs. It frames verification as a bounded search defined by objective, oracle, guidance, input generation, target abstraction, and budget. The authors separate feedback-guided coverage that augments constrained-random verification from directed adversarial testing based on threat models. They argue mainstream adoption requires reusable interfaces, target-specific assets, reproducible evaluations, and transparent reporting of cost and effort.
- Analyzes 52 fuzzers across RTL/IP, CPU, NoC, and SoC designs
- Frames verification as a bounded search limited by oracle, guidance, and budget
- Distinguishes coverage-guided CRV augmentation from threat-model adversarial testing
- Adoption needs reusable interfaces, reproducible evaluations, and transparent cost reporting
Full article167 words · extracted from arxiv.org · click to collapse
Hardware fuzzing is an active area in security verification research, yet its industrial adoption remains in its early stages. This SoK examines which lessons from software fuzzing carry over to hardware and where unique approaches are needed. By analyzing 52 fuzzers across RTL/IP, CPU, NoC, and SoC designs, we introduce an analytical framework that frames verification as a bounded search. This search is defined by its objective, oracle, guidance, input generation, target abstraction, and budget. Consequently, a campaign only uncovers failures it can effectively reach, recognize, and prioritize before exhausting its resources. We distinguish two roles for hardware fuzzing: (1) augmenting constrained-random verification (CRV) via feedback-guided coverage and (2) directed adversarial testing based on threat models and security specifications. Through our framework, we identify what each campaign can observe and generate, providing a basis for assessing the evidence behind reported results. Our analysis suggests that mainstream adoption of hardware fuzzing will require reusable interfaces, target-specific verification assets, reproducible evaluations, and transparent reporting of cost and user effort.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.27300