[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-81967-en":3,"doc-seo-81967-105":31,"detail-sidebar-cat-0-en-105":93},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":28,"seo_description":14,"update_tm":29,"read_time":30},81967,1099514068035,"Ezra","https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c",8,"Research & Report","HiFuzz Hierarchical Reinforcement Learning for Semantic-Aware and Adaptive CPU Fuzzing","Modern processor verification often fails to reach deep architectural states because mutation-based fuzzing wastes effort on invalid or semantics-breaking programs. HiFuzz introduces a hierarchical reinforcement learning framework that replaces mutation with structured two-layer generation: a Program Agent for global layout and a Basic Block Agent for precise instruction filling. To address sparse and delayed feedback, HiFuzz adds an adaptive coverage reward and a semantic-aware basic block encoder for intrinsic feedback. Evaluations on three real-world RISC-V cores show major gains in coverage and bug detection.","HiFuzz: Hierarchical Reinforcement Learning for Semantic-Aware and Adaptive CPU Fuzzing  \nYa Wang∗ , Hanwei Fan∗ , Zhenguo Liu†, Xiaofeng Zhou∗ , Yangdi Lyu†, Jiang Xu†, and Wei Zhang∗  \n∗ Hong Kong University of Science and Technology (HKUST), Hong Kong  \nEmail: {ywangmu, hfanah, [xzhoubu](xzhoubu}@connect.ust.hk)[}](xzhoubu}@connect.ust.hk)[@connect.ust.hk](xzhoubu}@connect.ust.hk), [wei.zhang@ust.hk](wei.zhang@ust.hk)  \n†The Hong Kong University of Science and Technology (Guangzhou), China  \nEmail: [zliu094@connect.hkust-gz.edu.cn](zliu094@connect.hkust-gz.edu.cn), {yangdilyu, [jiang.xu](jiang.xu}@hkust-gz.edu.cn)[}](jiang.xu}@hkust-gz.edu.cn)[@hkust-gz.edu.cn](jiang.xu}@hkust-gz.edu.cn)  \narXiv :2607 .066 19v 1 [ cs .AR] 7 Jul 2026  \nAbstract—Modern processor verification struggles to reach deep architectural states due to the inefficiencies of traditional mutation-based fuzzing. We propose HiFuzz, a novel hierarchical reinforcement learning framework that replaces mutation with a structured, two-layer generation process: a Program Agent for global layout and a Basic Block Agent for precise instruction filling. To overcome reward sparsity, HiFuzz integrates an adaptive coverage reward mechanism and a semantic-aware basic block encoder providing intrinsic feedback. Extensive evaluationson three real-world RISC-V cores demonstrate that HiFuzz significantly outperforms state-of-the-art fuzzers in coverage and bug detection.  \nIndex Terms—Hardware Fuzzing, Reinforcement Learning, RISC-V, Functional Verification  \nI. INTRODUCTION  \nAs the scaling benefits of Moore’s Law diminish, performance gains increasingly rely on complex microarchitectural techniques. The rapid proliferation of open ISAs, notably RISC-V, has amplified this complexity by fostering a diverse ecosystem of custom implementations and extensions. This evolution has triggered a combinatorial explosion in the design state space and widened the verification gap. Functional verification has therefore become the dominant bottleneck in the hardware design flow, accounting for over 70% of the total research and development cycle. Residual hardware errata, including speculative execution flaws such as Meltdown [1] and Spectre [2], can compromise system security and require costly silicon respins.  \nTraditional verification methodologies struggle to keep pace with this growth. Constrained-Random Verification [3] suffers from low efficiency and high manual overhead, while formal verification [4] is computationally intractable for full-scale designs due to state explosion. Hardware fuzzing has therefore emerged as a scalable alternative.  \nFig. 1 illustrates three hardware-fuzzing paradigms. Early fuzzers use mutation-based strategies [5, 6], which generate tests by modifying existing templates. Mutation often disrupts instruction semantics, so many generated programs are discarded before they reach meaningful pipeline stages. Recent work moves toward constructive program generation [7], which builds syntactically correct instruction streams from scratch to preserve execution validity. These methods, however, still rely mainly on randomized heuristics. Without  \nFig. 1: The paradigm shift in hardware fuzzing: mutationbased generation, random constructive generation, and HiFuzz’s RL-guided generation with semantic feedback.  \nlearning from prior executions, they explore the state space blindly and struggle to reach deep architectural states.  \nThis gap suggests a role for reinforcement learning, or RL, which can optimize generation strategies from coverage feedback. Integrating RL into constructive generation is harder than applying it to mutation-based fuzzers. In mutation-based approaches, the agent selects a discrete operator for an existing seed, which is a direct control problem. Constructive generation must instead assemble a program instruction by instruction while respecting syntactic and semantic dependencies. This creates a control-validity dilemma: the generator ","cbCaivgOvrRhZCKc","https://ap.wps.com/l/cbCaivgOvrRhZCKc","pdf",5194542,6,1,13,"English","en",105,"# Introduction\n## Motivation and Verification Bottlenecks\n## Hardware Fuzzing Paradigms\n## Challenges for RL in Constructive Fuzzing\n## HiFuzz Approach and Key Components","[{\"question\":\"What problem does HiFuzz target in modern processor verification?\",\"answer\":\"Traditional mutation-based fuzzing is inefficient and often fails to reach deep architectural states because generated programs can disrupt instruction semantics and be discarded early.\"},{\"question\":\"How does HiFuzz generate test programs differently from mutation-based fuzzers?\",\"answer\":\"HiFuzz uses hierarchical reinforcement learning with a two-layer structured generation process: a Program Agent sets global layout and a Basic Block Agent fills instructions precisely.\"},{\"question\":\"How does HiFuzz address reward sparsity and delayed feedback?\",\"answer\":\"HiFuzz integrates an adaptive coverage reward mechanism and a semantic-aware basic block encoder that provides intrinsic feedback to guide learning despite delayed coverage signals.\"}]","HiFuzz Hierarchical Reinforcement Learning for Semantic-Aware and Adaptive CPU Fuzzing | PDF",1784177332,33,{"code":4,"msg":32,"data":33},"ok",{"site_id":25,"language":24,"slug":34,"title":13,"keywords":35,"description":14,"schema_data":36,"social_meta":88,"head_meta":90,"extra_data":92,"updated_unix":29},"hifuzz-hierarchical-reinforcement-learning-for-semantic-aware-and-adaptive-cpu-fuzzing","",{"@graph":37,"@context":87},[38,55,70],{"@type":39,"itemListElement":40},"BreadcrumbList",[41,45,49,52],{"item":42,"name":43,"@type":44,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":46,"name":47,"@type":44,"position":48},"https://docshare.wps.com/document/","Document",2,{"item":50,"name":12,"@type":44,"position":51},"https://docshare.wps.com/document/research-report/",3,{"item":53,"name":13,"@type":44,"position":54},"https://docshare.wps.com/document/hifuzz-hierarchical-reinforcement-learning-for-semantic-aware-and-adaptive-cpu-fuzzing/81967/",4,{"url":53,"name":13,"@type":56,"author":57,"headline":13,"publisher":59,"fileFormat":62,"inLanguage":24,"description":14,"dateModified":63,"datePublished":64,"encodingFormat":62,"isAccessibleForFree":65,"interactionStatistic":66},"DigitalDocument",{"name":9,"@type":58},"Person",{"url":42,"name":60,"@type":61},"DocShare","Organization","application/pdf","2026-08-04","2026-07-16",true,{"@type":67,"interactionType":68,"userInteractionCount":20},"InteractionCounter",{"@type":69},"ViewAction",{"@type":71,"mainEntity":72},"FAQPage",[73,79,83],{"name":74,"@type":75,"acceptedAnswer":76},"What problem does HiFuzz target in modern processor verification?","Question",{"text":77,"@type":78},"Traditional mutation-based fuzzing is inefficient and often fails to reach deep architectural states because generated programs can disrupt instruction semantics and be discarded early.","Answer",{"name":80,"@type":75,"acceptedAnswer":81},"How does HiFuzz generate test programs differently from mutation-based fuzzers?",{"text":82,"@type":78},"HiFuzz uses hierarchical reinforcement learning with a two-layer structured generation process: a Program Agent sets global layout and a Basic Block Agent fills instructions precisely.",{"name":84,"@type":75,"acceptedAnswer":85},"How does HiFuzz address reward sparsity and delayed feedback?",{"text":86,"@type":78},"HiFuzz integrates an adaptive coverage reward mechanism and a semantic-aware basic block encoder that provides intrinsic feedback to guide learning despite delayed coverage signals.","https://schema.org",{"og:url":53,"og:type":89,"og:title":13,"og:site_name":60,"og:description":14},"article",{"robots":91,"canonical":53},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":94},[95,99,103,107,112,116,121,124,129,132,136],{"id":21,"doc_module":4,"doc_module_name":47,"category_name":96,"show_sort_weight":97,"slug":98},"Story & Novel",90,"story-novel",{"id":48,"doc_module":4,"doc_module_name":47,"category_name":100,"show_sort_weight":101,"slug":102},"Literature",80,"literature",{"id":54,"doc_module":4,"doc_module_name":47,"category_name":104,"show_sort_weight":105,"slug":106},"Exam",70,"exam",{"id":108,"doc_module":4,"doc_module_name":47,"category_name":109,"show_sort_weight":110,"slug":111},5,"Comic",60,"comic",{"id":20,"doc_module":4,"doc_module_name":47,"category_name":113,"show_sort_weight":114,"slug":115},"Technology",50,"technology",{"id":117,"doc_module":4,"doc_module_name":47,"category_name":118,"show_sort_weight":119,"slug":120},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":47,"category_name":12,"show_sort_weight":122,"slug":123},30,"research-report",{"id":125,"doc_module":4,"doc_module_name":47,"category_name":126,"show_sort_weight":127,"slug":128},9,"Religion & Spirituality",20,"religion-spirituality",{"id":127,"doc_module":4,"doc_module_name":47,"category_name":130,"show_sort_weight":127,"slug":131},"World Cup","world-cup",{"id":133,"doc_module":4,"doc_module_name":47,"category_name":134,"show_sort_weight":133,"slug":135},10,"Lifestyle","lifestyle",{"id":137,"doc_module":4,"doc_module_name":47,"category_name":138,"show_sort_weight":108,"slug":139},19,"General","general"]