HiFuzz: Hierarchical Reinforcement Learning for Semantic-Aware and Adaptive CPU Fuzzing
For processor verification engineers, HiFuzz addresses the inefficiency of reaching deep architectural states in CPU fuzzing, offering a more effective approach than existing mutation-based methods.
HiFuzz introduces a hierarchical reinforcement learning framework for CPU fuzzing that replaces mutation with a two-layer generation process, achieving significantly higher coverage and bug detection on three real-world RISC-V cores compared to state-of-the-art fuzzers.
Modern processor verification struggles to reach deep architectural states due to the inefficiencies of traditional mutation-based fuzzing. We propose HiFuzz, a novel hierarchical reinforcement learning framework that replaces mutation with a structured, two-layer generation process: a Program Agent for global layout and a Basic Block Agent for precise instruction filling. To overcome reward sparsity, HiFuzz integrates an adaptive coverage reward mechanism and a semantic-aware basic block encoder providing intrinsic feedback. Extensive evaluations on three real-world RISC-V cores demonstrate that HiFuzz significantly outperforms state-of-the-art fuzzers in coverage and bug detection.