When Fuzzing Meets Understanding: LLM-Driven Semantic Test Generation for RTL Verification

2026-07-11

AI Summary

Existing hardware fuzzing approaches struggle to efficiently cover the semantic behaviors of complex chip designs and expose corner-case bugs. This work proposes ChipFuzzer, the first framework to integrate large language models (LLMs) into RTL-level fuzzing, employing a two-stage workflow guided by coverage and bug signals to generate highly effective test cases. Key innovations include a control-flow-similarity-based coverage analysis and a defect-history-driven test prioritization mechanism. Experimental evaluation on three open-source CPU designs demonstrates that ChipFuzzer improves average conditional coverage by 5.8 percentage points and increases bug detection rates by 21.1 percentage points.

Abstract

The growing complexity of modern chips poses significant challenges to hardware verification. In recent years, coverage-guided fuzzing has emerged as a promising approach for improving verification efficiency. However, existing hardware fuzzers still struggle to achieve high coverage and expose corner-case bugs, as they predominantly rely on heuristic strategies with limited ability to reason about the internal logic and semantic behavior of the design under test (DUT). In this work, we propose ChipFuzzer, a hardware fuzzing framework that leverages the semantic reasoning capabilities of large language models (LLMs) to improve fuzzing effectiveness. ChipFuzzer adopts a dual-stage workflow comprising a Coverage-Guided stage and a Bug-Guided stage. In the Coverage-Guided stage, ChipFuzzer employs control-flow similarity and discrepancy analysis to guide LLM-driven testcase generation, thereby improving coverage. In the Bug-Guided stage, ChipFuzzer leverages historical bug data to identify bug-prone code regions and prioritize testcase generation for those regions, thus enhancing bug discovery efficiency. Experimental results on three open-source CPU designs show that ChipFuzzer improves average condition coverage by 5.8 percentage points and bug detection rate by 21.1 percentage points over the strongest baseline.

Problem

• hardware verification
• coverage-guided fuzzing
• semantic reasoning
• corner-case bugs
• RTL verification

Innovation

• LLM-driven fuzzing
• semantic test generation
• RTL verification
• coverage-guided testing
• bug-guided testing