[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-85206-en":3,"doc-seo-85206-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},85206,962075114101,"Seraphina","https://ap-avatar.wpscdn.com/avatar/e000253a75eb197efd?x-image-process=image/resize,m_fixed,w_180,h_180&k=1780044092746381165",8,"Research & Report","When Fuzzing Meets Understanding LLM-Driven Semantic Test Generation for RTL Verification","Modern chips’ verification complexity makes achieving high coverage and finding corner-case bugs difficult with current coverage-guided fuzzing. Existing hardware fuzzers mostly rely on heuristic, input-centric mutation and lack reasoning about the DUT’s internal logic and semantic behavior. ChipFuzzer is introduced as an LLM-driven hardware fuzzing framework using a dual-stage workflow: coverage-guided semantic testcase generation and bug-guided prioritization via historical bug data. Experiments on three open-source CPU designs show improvements of +5.8% condition coverage and +21.1% bug detection rate over the strongest baseline.","When Fuzzing Meets Understanding: LLM-Driven Semantic Test  \nGeneration for RTL Verification  \nKun Wang  \n[wangkun22@mails.ucas.ac.cn](wangkun22@mails.ucas.ac.cn)[ ](wangkun22@mails.ucas.ac.cn)Institute of Computing Technology, Chinese Academy of Sciences China  \nSiyang Cai  \n[caisiyang23@mails.ucas.ac.cn](caisiyang23@mails.ucas.ac.cn)[ ](caisiyang23@mails.ucas.ac.cn)School of Advanced Interdisciplinary Sciences, University of Chinese Academy of Sciences China  \nCangyuan Li  \n[licangyuan@ict.ac.cn](licangyuan@ict.ac.cn)[ ](licangyuan@ict.ac.cn)Institute of Computing Technology, Chinese Academy of Sciences China  \nYinhe Han  \n[yinhes@ict.ac.cn](yinhes@ict.ac.cn)  \nInstitute of Computing Technology, Chinese Academy of Sciences China  \nKaiyan Chang  \n[changkaiyan@live.com](changkaiyan@live.com)[ ](changkaiyan@live.com)Institute of Computing Technology, Chinese Academy of Sciences China  \nYing Wang  \n[wangying2009@ict.ac.cn](wangying2009@ict.ac.cn)[ ](wangying2009@ict.ac.cn)Institute of Computing Technology, Chinese Academy of Sciences China  \narXiv :2607 . 10340v1 [ cs .AR] 11 Jul 2026  \n1 Abstract  \nThe growing complexity of modern chips poses significant challenges to hardware verification. In recent years, coverage-guided fuzzing has emerged as a promising approach for improving verification efficiency. However, existing hardware fuzzers still struggle to achieve high coverage and expose corner-case bugs, as they predominantly rely on heuristic strategies with limited ability to reason about the internal logic and semantic behavior of the design under test (DUT) . In this work, we propose ChipFuzzer, a hardware fuzzing framework that leverages the semantic reasoning capabilities of large language models (LLMs) to improve fuzzing effectiveness. ChipFuzzer adopts a dual-stage workflow comprising a Coverage-Guided stage and a Bug-Guided stage. In the Coverage-Guided stage, ChipFuzzer employs control-flow similarity and discrepancy analysis to guide LLM-driven testcase generation, thereby improving coverage. In the Bug-Guided stage, ChipFuzzer leverages historical bug data to identify bug-prone code regions and prioritize testcase generation for those regions, thus enhancing bug discovery efficiency. Experimental results on three open-source CPU designs show that ChipFuzzer improves average condition coverage by 5.8 percentage points and bug detection rate by 21.1 percentage points over the strongest baseline.  \n2 Introduction  \nAs ICs continue to scale in complexity, verification has become the most resource-intensive and time-critical stage of the design cycle, often consuming more than 70% of total project effort [10] . Given the astronomical cost of post-silicon bug fixes, comprehensive presilicon verification is indispensable for ensuring design correctness and time-to-market success. To this end, researchers have developed numerous hardware verification techniques, which broadly fall into two categories: (1) formal verification, including theorem proving [8], model checking [7], and information-flow tracking [13]; and (2) simulation-based verification, including random regression [19] and hardware fuzzing [25, 26, 30, 32]. While formal methods promise  \nexhaustive checking, they suffer from state space explosion in largescale designs. In contrast, coverage-guided fuzzing has gained traction as a scalable and effective methodology for hardware verification, where automatically generated testcases are iteratively refined to improve coverage and expose hidden corner-case bugs.  \nHowever, hardware fuzzing today inherits fundamental limitations from its software origins. Existing hardware fuzzers retain an input-centric methodology and often treat Hardware Description Language (HDL) signals and control paths as opaque variables, ignoring their rich structural semantics. This manifests asan excessive focus on test seed generation and mutation strategies, while neglecting the inherent structural characteristics ofthe DUT. Effective","cbCaiaaQF6KBafYT","https://ap.wps.com/l/cbCaiaaQF6KBafYT","pdf",439663,1,10,"English","en",105,"# Abstract\n# Introduction\n## Verification challenges in modern IC design\n## Coverage-guided fuzzing limitations\n## Semantic-aware fuzzing with LLMs\n## ChipFuzzer dual-stage workflow","[{\"question\":\"What problem does ChipFuzzer address in hardware verification?\",\"answer\":\"ChipFuzzer targets the difficulty of achieving high coverage and exposing corner-case bugs when existing fuzzers rely mainly on heuristic, input-centric strategies that do not reason about the DUT’s semantics.\"},{\"question\":\"How does ChipFuzzer generate tests in its Coverage-Guided stage?\",\"answer\":\"It uses control-flow similarity to retrieve relevant testcase templates, then performs discrepancy analysis to steer LLM-driven testcase generation toward uncovered code regions.\"},{\"question\":\"How does the Bug-Guided stage improve bug discovery efficiency?\",\"answer\":\"It leverages historical bug data to locate bug-prone code regions and prioritizes testcase generation for those regions, increasing the likelihood of finding elusive flaws.\"}]",1784201744,25,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"when-fuzzing-meets-understanding-llm-driven-semantic-test-generation-for-rtl-verification","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/when-fuzzing-meets-understanding-llm-driven-semantic-test-generation-for-rtl-verification/85206/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What problem does ChipFuzzer address in hardware verification?","Question",{"text":75,"@type":76},"ChipFuzzer targets the difficulty of achieving high coverage and exposing corner-case bugs when existing fuzzers rely mainly on heuristic, input-centric strategies that do not reason about the DUT’s semantics.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How does ChipFuzzer generate tests in its Coverage-Guided stage?",{"text":80,"@type":76},"It uses control-flow similarity to retrieve relevant testcase templates, then performs discrepancy analysis to steer LLM-driven testcase generation toward uncovered code regions.",{"name":82,"@type":73,"acceptedAnswer":83},"How does the Bug-Guided stage improve bug discovery efficiency?",{"text":84,"@type":76},"It leverages historical bug data to locate bug-prone code regions and prioritizes testcase generation for those regions, increasing the likelihood of finding elusive flaws.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,134],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":45,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":45,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":45,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":45,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":21,"doc_module":4,"doc_module_name":45,"category_name":132,"show_sort_weight":21,"slug":133},"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":45,"category_name":136,"show_sort_weight":106,"slug":137},19,"General","general"]