ReFuzz: Reusing Tests for Processor Fuzzing with Contextual Bandits

ReFuzz: Reusing Tests for Processor Fuzzing with Contextual Bandits

Speakers: Chen Chen

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=Qo6_WUjubEk

Overview

Hardware vulnerabilities are expensive and dangerous -- Intel spent $475 million recalling products due to hardware bugs, and the number of reported hardware vulnerabilities has grown from just 1 in 2001 to over 1,000 in 2025. This talk presents ReFuzz, the first test-reuse fuzzing framework for processor security verification. By leveraging the observation that 67% of hardware IP designs are reused across processor generations, ReFuzz collects test cases from prior processor versions and applies contextual bandit (a simplified reinforcement learning approach) to intelligently reuse and adapt those tests for new processor designs.

Benchmarked on 5 open-source RISC-V cores, ReFuzz achieves more than 500x speedup with 9.33% more total coverage compared to baseline fuzzing approaches, while detecting 3 new vulnerabilities and 2 new bugs. The framework is agnostic to the baseline fuzzer, working as a drop-in enhancement for existing hardware fuzzing tools.

Background

▶ Watch: Hardware vulnerability growth: 1 in 2001 to 1,000+ in 2025 (0:00)

Hardware security is foundational -- if vulnerabilities exist at the hardware level, the entire software stack built on top is potentially compromised. Fixing hardware bugs is orders of magnitude more expensive than software bugs: options are limited to firmware/microcode updates or costly product recalls. This makes pre-silicon security evaluation (finding bugs before fabrication) critical.

Modern processor development follows a pattern of design reuse: each new CPU generation retains most functionality from its predecessor while adding new microarchitectural features. Studies show approximately 67% IP reuse across generations. This reuse benefits development efficiency but also means potential vulnerabilities propagate from old to new processor designs.

Current AI-based hardware fuzzing approaches treat each processor version independently -- developing a separate fuzzer for each target CPU from scratch. This ignores the accumulated testing knowledge from prior generations. Existing fuzzers face three key challenges: seed and mutator selection (choosing high-quality test inputs), algorithm selection (reinforcement learning, LLMs, or other approaches), and reset policies (when to restart testing to avoid convergence to local optima in the coverage space).

Key Findings

▶ Watch: BOOM v3 to v4: same multiplication counter bug propagates (4:00)

• 500x speedup in coverage exploration compared to baseline hardware fuzzers, dramatically accelerating pre-silicon verification
• 9.33% more total hardware coverage than existing approaches, meaning more hardware states are explored and potentially more vulnerabilities can be found
• 3 new vulnerabilities and 2 new bugs detected across 5 open-source RISC-V cores
• 98% of collected test cases are filtered by the test minimizer as redundant, demonstrating that the vast majority of prior test cases provide no additional coverage value
• Baseline-agnostic: ReFuzz works as a plugin enhancement for any existing hardware fuzzer, not a replacement
• Contextual bandits outperform random reuse: The AI-guided test selection significantly outperforms simply re-running all historical tests on a new processor

Technical Deep Dive

▶ Watch: Contextual bandit training with coverage-based rewards (8:00)

ReFuzz combines two techniques: contextual bandits (CB) for intelligent test selection and hardware fuzzing for vulnerability detection.

Test Collection from Prior Processors: Tests are collected from three sources across prior processor generations: direct tests (crafted by developers with knowledge of microarchitectural state), CWE/CVE datasets (test cases derived from known vulnerability databases), and random/fuzz-generated tests (from previous fuzzing campaigns). These are aggregated into a unified test pool.

Test Minimization: The collected test pool is enormous and highly redundant. ReFuzz applies a test minimizer using Integer Linear Programming (ILP) to find the minimal subset that achieves the same coverage as the full set. The goal is to minimize the number of test cases while maintaining complete coverage. In practice, approximately 98% of collected tests are filtered as redundant, dramatically reducing the training data for the CB model.

Contextual Bandit Training: The CB model (a simplified version of reinforcement learning) takes as input the current hardware coverage state (represented as a binary vector) and learns to select the next test case that will maximize coverage increment. The model's:

• Arms: Test cases from the minimized pool of prior processor tests
• Context: Current hardware coverage represented as a binary vector
• Reward: Coverage increment from executing the selected test case
• Objective: Maximize total hardware coverage

An adaptive dropping mechanism removes test cases that consistently fail to increase coverage below a preset threshold, further improving learning efficiency.

Two-Phase Fuzzing Pipeline: In the first phase, the CB model is trained on minimized test data from prior processors. In the second phase, the trained model guides test selection during fuzzing of the new processor under test. Seeds from the CB model are fed to a plugin-compatible existing hardware fuzzer, which returns coverage feedback and mutated test cases. If the CB model's test database is exhausted, the system falls back to the baseline fuzzer to generate new seeds, which are added back to the database.

The approach specifically targets two security properties: detecting known vulnerability patterns (using CWE/CVE test cases that may trigger similar flaws in new designs) and exploring new design space (using coverage-guided exploration of previously untested hardware states).

Demo / Proof of Concept

▶ Watch: Test minimization: 98% of tests filtered as redundant via ILP (10:00)

ReFuzz was benchmarked on 5 open-source RISC-V cores, including the BOOM processor (Berkeley Out-of-Order Machine) across multiple versions. A concrete example illustrated the test reuse value: BOOM v3 had a known functional bug where a multiplication instruction's retirement counter update has a two-cycle delay, creating a mismatch between actual counter values and architecturally exposed values. BOOM v4, despite adding new multiplexer hardware before the ALU, propagated the same vulnerability class.

The evaluation demonstrated:

• 500x coverage speedup compared to baseline fuzzers starting from scratch
• 9.33% additional total coverage beyond what baseline fuzzers achieve
• 3 new vulnerabilities and 2 new bugs across the evaluated RISC-V cores
• Ablation studies confirmed that each component (test minimization, adaptive dropping, CB model) contributes to the overall performance, with the complete configuration achieving the best results

The framework was tested with multiple baseline fuzzers to confirm its baseline-agnostic property -- the CB-guided test reuse improves coverage regardless of which underlying fuzzing engine is used.

Defensive Implications

▶ Watch: Results: 500x speedup, 9.33% more coverage, 3 new vulnerabilities (14:00)

ReFuzz has practical implications for hardware security verification:

• Pre-silicon verification acceleration: The 500x speedup in coverage exploration means hardware security teams can achieve significantly more thorough verification within the same time budget, or reduce verification time while maintaining coverage levels.
• Cross-generational vulnerability tracking: By systematically reusing tests from prior processor versions, ReFuzz naturally detects vulnerabilities that propagate across design generations -- a common pattern when 67% of IP is reused.
• Cost reduction: Given that hardware recalls cost hundreds of millions of dollars (Intel's $475M recall), any improvement in pre-silicon vulnerability detection has enormous ROI.
• Knowledge preservation: The test minimization and CB training pipeline captures and operationalizes institutional testing knowledge that might otherwise be lost between development generations.
• RISC-V ecosystem relevance: With the growing adoption of open-source RISC-V cores in production systems, security verification tools specifically targeting this architecture are increasingly important.

Key Takeaways

• Hardware vulnerability reports have grown from 1 in 2001 to 1,000+ in 2025, while fixes remain extremely expensive (Intel spent $475M on a single recall)
• 67% of hardware IP is reused across processor generations, meaning vulnerabilities propagate and tests should too
• ReFuzz uses contextual bandits to intelligently select and adapt test cases from prior processors, achieving 500x speedup with 9.33% more coverage
• 98% of prior test cases are redundant and filtered by ILP-based test minimization
• 3 new vulnerabilities and 2 new bugs found across 5 RISC-V cores
• The framework is baseline-agnostic and works as a plugin for any existing hardware fuzzer

About the Speaker(s)

The presentation was delivered by Liaw Wu, an assistant professor at the University of Bristol, on behalf of the original authors who were unable to attend. Despite preparing in just two hours, Wu delivered a clear and comprehensive presentation. The original author is Chen Chen. The research targets a critical gap in hardware security verification methodology.