PowerFuzz: Power-Based Fuzzing

• PowerFuzz is a fuzzing approach that uses power consumption measurements as feedback to infer execution paths in both black-box firmware and energy-aware grey-box testing.
• It employs methods like dynamic time warping and sliding-window correlation to reconstruct branch coverage from power traces without requiring firmware instrumentation.
• Empirical results demonstrate that PowerFuzz can achieve near gray-box coverage and reduce energy costs, though challenges include measurement noise and system-specific calibration.

Searching arXiv for the specified papers and closely related work to ground the article in published sources. PowerFuzz denotes a class of fuzzing methods that use electrical behavior as feedback for test generation. In the literature considered here, the term covers two distinct but related directions: power side-channel–guided black-box firmware fuzzing, in which power traces substitute for unavailable branch coverage on embedded devices, and power-/energy-aware fuzzing, in which measured power and energy are incorporated into the heuristics of a grey-box fuzzer to reduce energy cost while maintaining effectiveness. The former direction was foreshadowed by “Side-Channel Aware Fuzzing” (Sperl et al., 2019) and formalized as the black-box framework “PowerFuzz: Power-Based Black-Box Firmware Fuzzing” (Tharindu et al., 23 Jun 2026); the latter is exemplified by GreenAFL, which treats “PowerFuzz” as power-/energy-aware fuzzing in continuous software testing (Ercevik et al., 29 Oct 2025).

1. Conceptual scope and lineage

PowerFuzz emerged from two different technical pressures. On embedded targets, classic coverage-guided fuzzers such as AFL or LibFuzzer are often unusable because firmware is proprietary, instrumentation is unavailable, and debug or tracing interfaces may be locked. In that setting, power consumption becomes an alternative feedback channel: if a power trace can reveal branch structure or execution divergence, a black-box fuzzer can recover a coverage-like signal without binary access (Sperl et al., 2019).

A separate pressure is the energy cost of continuous fuzzing campaigns. In large-scale infrastructures such as OSS-Fuzz, the concern is not lack of visibility but lack of energy awareness: conventional grey-box fuzzers maximize coverage without modeling the energy cost of seeds or mutation schedules. GreenAFL defines power-/energy-aware fuzzing as the explicit incorporation of measurements of power and energy into the core heuristics and workflows of coverage-guided fuzzers, so that campaigns make progress at lower energy cost while preserving, or slightly improving, effectiveness (Ercevik et al., 29 Oct 2025).

A common misconception is to treat these lines of work as interchangeable. They are not. Power side-channel fuzzing uses power as a surrogate coverage oracle in a fully black-box setting, whereas GreenAFL uses measured energy to optimize an already instrumented fuzzing workflow. Another misconception is terminological: the 2019 paper does not use the name “PowerFuzz,” whereas the 2026 framework does, and the 2025 GreenAFL paper uses “PowerFuzz” in the broader sense of power-/energy-aware fuzzing (Sperl et al., 2019, Tharindu et al., 23 Jun 2026, Ercevik et al., 29 Oct 2025).

2. Power traces as a coverage-like oracle

The earliest fully developed formulation of this idea is “Side-Channel Aware Fuzzing” (Sperl et al., 2019). Its starting point is that bare-metal embedded devices often lack the OS support, I/O bandwidth, or instrumentation hooks required by feedback-guided fuzzers. The paper therefore measures the device’s power consumption during input processing and uses machine learning to infer execution structure from the trace.

The pipeline is threefold. First, a mutated input is sent to the device under test and its power trace is measured over the input-processing interval. Second, features are extracted from the trace to detect branch instructions and segment basic-block regions. Third, the inferred basic-block sequence is converted into a coverage-like score that is proportional to newly observed basic-block transitions. The scoring logic follows AFL’s intuition that coverage can be approximated by novel transitions. If the reconstructed path for an input $x$ is $\pi(x) = (b_0, b_1, \dots, b_n)$ and $\Omega$ is the global set of previously discovered directed edges, the score is formalized as

$$S(x) = \sum_{i=0}^{n-1} 1\{(b_i, b_{i+1}) \notin \Omega\}.$$

After scoring, $\Omega$ is updated with the newly reconstructed transitions (Sperl et al., 2019).

Two reconstruction strategies are central. CFG-RI uses detected branch locations and estimated branch distances to infer the sequence of blocks. CFG-RII instead uses fingerprints of the segments between detected branches. Those fingerprints combine $P_{\text{length}}$, $P_{\text{peaks}}$, $P_{\text{mean}}$, and $P_{\text{skewness}}$ into either separated $4$D vectors or summed scalar fingerprints. CFG-RI is precise when branch-distance classification is accurate, but it suffers from error propagation; CFG-RII is more robust to single errors, but can incur fingerprint collisions (Sperl et al., 2019).

The measurement and preprocessing assumptions are demanding. The study used an STM32F417 microcontroller, a $\pi(x) = (b_0, b_1, \dots, b_n)$0 shunt resistor, a differential probe, and a LeCroy WavePro 760Zi-A oscilloscope sampling at $\pi(x) = (b_0, b_1, \dots, b_n)$1 GS/s. Trace acquisition was synchronized to the DUT’s system clock. To improve SNR, the same input was repeated multiple times, often $\pi(x) = (b_0, b_1, \dots, b_n)$2, followed by mean or sweep averaging. The method does not require dynamic time warping or cross-correlation because alignment is achieved through precise clock-correlated triggering (Sperl et al., 2019).

3. The 2026 PowerFuzz framework for black-box firmware

The 2026 framework “PowerFuzz: Power-Based Black-Box Firmware Fuzzing” generalizes the use of power traces into a fully black-box fuzzing system that requires no firmware binary, source, or debug infrastructure (Tharindu et al., 23 Jun 2026). Its core claim is that statistically inferred “branch coverage” from power traces can preserve the essential advantages of coverage-guided fuzzing even when classical instrumentation is impossible.

PowerFuzz closes the fuzzing loop with a hardware measurement path and a LibAFL-based software loop. A shunt resistor is placed in series with the MCU supply, a ChipWhisperer board samples the resulting voltage drop, and trace acquisition is synchronized with input delivery. For each fuzz iteration, the power trace is captured $\pi(x) = (b_0, b_1, \dots, b_n)$3 times and averaged to reduce noise. The averaged trace is then compared against previously observed traces by a Similarity Analysis module that combines dynamic time warping with sliding-window and growing-window Pearson correlation (Tharindu et al., 23 Jun 2026).

The framework’s branch identification procedure is two-stage. Dynamic time warping first detects and coarsely localizes sustained divergence between two traces by examining the offset profile of the optimal warping path. Within the resulting deviation window, a sliding-window full-trace correlation pass identifies an approximate divergence point, and a growing-window correlation pass refines it to a precise sample. The algorithmic skeleton is named GetDivergentPoint(Pre_trace, Curr_trace) and is parameterized by Slide_w, thresholds T and T_g, and the DTW-derived deviation window [DW_start, DW_end] (Tharindu et al., 23 Jun 2026).

The inferred execution structure is stored in a Trace-guided Control Flow Graph, or TCFG. This is a binary structure $\pi(x) = (b_0, b_1, \dots, b_n)$4 in which each node stores a trace segment v.data, a representative input v.input, and child pointers v.left and v.right. The graph is initialized from the first trace and updated recursively. If a new trace diverges inside an existing node, the node is split at the divergence point; the shared prefix becomes a new parent, the previous suffix becomes one child, and the new trace suffix becomes its sibling. This design encodes observed branch transitions while pruning comparisons to the root-to-leaf path shared by the incoming trace (Tharindu et al., 23 Jun 2026).

The scheduler uses a scalar feedback signal

$\pi(x) = (b_0, b_1, \dots, b_n)$5

Inputs with $\pi(x) = (b_0, b_1, \dots, b_n)$6 are discarded; inputs that add deeper nodes receive proportionally more mutation effort. Branch selection is random while the inferred structure is small and becomes depth-prioritized once the TCFG reaches depth_threshold = 100 nodes in practice (Tharindu et al., 23 Jun 2026).

A notable design difference from the 2019 work is that the 2026 PowerFuzz framework is training-free and does not require instruction-level model learning from labeled traces. It relies on statistical similarity analysis rather than supervised branch classifiers (Tharindu et al., 23 Jun 2026).

4. Energy-aware PowerFuzz in grey-box fuzzing

GreenAFL extends the meaning of PowerFuzz from side-channel feedback to energy-aware optimization of grey-box fuzzing campaigns (Ercevik et al., 29 Oct 2025). Its motivation is environmental and infrastructural: continuous fuzzing consumes substantial computational resources, and lower energy-per-coverage implies fewer joules and fewer dollars per discovered edge or bug.

The formal quantity of interest is energy, derived from instantaneous power $\pi(x) = (b_0, b_1, \dots, b_n)$7 over an interval:

$\pi(x) = (b_0, b_1, \dots, b_n)$8

GreenAFL measures “energy per seed execution” during minimization and in the fuzzing loop via cppjoules, using an LD_PRELOAD wrapper around the target. Campaign totals are reported via perf stat, which combines CPU and RAM package power. Per-seed energy comprises CPU and memory/DRAM energy, and normalization is relative to the global minimum and maximum energies observed so far in the campaign (Ercevik et al., 29 Oct 2025).

GreenAFL modifies AFL++ in two places. The first is energy-aware corpus minimization, green-cmin. For each seed $\pi(x) = (b_0, b_1, \dots, b_n)$9 in the initial corpus, afl-showmap is run once to collect the set of edges reached, and the total energy $\Omega$0 of that run is measured. For each discovered edge $\Omega$1, the retained champion is the lowest-energy seed among those that reach $\Omega$2:

$\Omega$3

The minimized corpus is the union of these champions across edges. This preserves coverage while selecting the cheapest representative seed for each retained edge (Ercevik et al., 29 Oct 2025).

The second modification is the energy-guided fuzzing loop, green-fuzz. GreenAFL rescales AFL++’s perf_score inversely to energy so that low-energy seeds receive more mutation “airtime.” For a seed $\Omega$4,

$\Omega$5

where $\Omega$6 is mapped inversely to the range $\Omega$7. It also modifies favoured-seed selection by multiplying the champion score with an energy-derived factor in $\Omega$8 using logarithmic normalization:

$\Omega$9

The framework does not introduce a single combined fitness function; instead, it directly rescales existing AFL++ internals (Ercevik et al., 29 Oct 2025).

This formulation shifts power from being a side-channel coverage proxy to being an optimization target. In the side-channel setting, power reveals what path was executed; in GreenAFL, energy quantifies how expensively a known path was exercised (Sperl et al., 2019, Ercevik et al., 29 Oct 2025).

5. Empirical results

The 2019 side-channel work established that power traces can approximate coverage on real hardware. Among eight tested branch-detection algorithms, k-nearest neighbors with $$S(x) = \sum_{i=0}^{n-1} 1\{(b_i, b_{i+1}) \notin \Omega\}.$$0 yielded the best training MCC of $$S(x) = \sum_{i=0}^{n-1} 1\{(b_i, b_{i+1}) \notin \Omega\}.$$1 and a proof-of-concept MCC of $$S(x) = \sum_{i=0}^{n-1} 1\{(b_i, b_{i+1}) \notin \Omega\}.$$2 on-device. On synthetic workloads, the maximum Pearson correlation between power-derived and theoretical coverage scores was $$S(x) = \sum_{i=0}^{n-1} 1\{(b_i, b_{i+1}) \notin \Omega\}.$$3, achieved with CFG-RII separated fingerprints and both mean and sweep averaging with $$S(x) = \sum_{i=0}^{n-1} 1\{(b_i, b_{i+1}) \notin \Omega\}.$$4 traces each. Crucial errors—inputs that truly discovered a new edge but were scored $$S(x) = \sum_{i=0}^{n-1} 1\{(b_i, b_{i+1}) \notin \Omega\}.$$5—averaged $$S(x) = \sum_{i=0}^{n-1} 1\{(b_i, b_{i+1}) \notin \Omega\}.$$6 per $$S(x) = \sum_{i=0}^{n-1} 1\{(b_i, b_{i+1}) \notin \Omega\}.$$7 inputs. On a lightweight AES implementation with a ground truth of $$S(x) = \sum_{i=0}^{n-1} 1\{(b_i, b_{i+1}) \notin \Omega\}.$$8 unique basic-block transitions per encryption, the method detected on average $$S(x) = \sum_{i=0}^{n-1} 1\{(b_i, b_{i+1}) \notin \Omega\}.$$9 transitions over $\Omega$0 encryptions with random plaintexts (Sperl et al., 2019).

The 2026 PowerFuzz framework reports branch coverage on four large embedded applications running on STM32F3. On Stepper Controller, PowerFuzz covered 1730 (80.7%) of 2143 total branches; on CNC, 1467 (83.2%) of 1763; on GPS, 1045 (77.1%) of 1356; and on Soldering Station, 1438 (76.9%) of 1871. The corresponding gray-box reference numbers were 94.1%, 92.5%, 89.2%, and 86.4%, which supports the reported headline that PowerFuzz reaches branch coverage comparable to gray-box fuzzers within 13.5%. Against Fuzz’EMup, the reported improvements were +22.7%, +16.3%, +9.2%, and +18.9%, respectively. The inferred TCFG achieved average node-level precision of 97.66% and recall of 77.61% when mapped to ground-truth CFGs recovered with angr (CFGEmulated) and QEMU basic-block tracing (Tharindu et al., 23 Jun 2026).

GreenAFL reports a different performance profile. On jsoncpp, the baseline afl-cmin + afl-fuzz reached 38.9% coverage at 2021 kJ, whereas green-cmin + afl-fuzz reached 39.1% coverage at 1872 kJ, an energy reduction of ~7.4% with a statistically significant reduction by Welch’s t-test (p < 10^{-4}). On zlib, baseline coverage was 50.1%, while green-cmin alone or combined reached 51.4%, with a statistically significant improvement (p < 0.02). In time-to-coverage terms, for jsoncpp the first ~680 unique edges were found within ~60s with green-cmin, versus \>1200s with afl-cmin. By contrast, green-fuzz showed mixed energy effects: it often maintained coverage comparable to baseline while reducing executions, but could increase total energy. On libpng, green-fuzz reduced executions per second by 69.2% versus baseline, although the libpng baseline was affected by an afl-cmin over-pruning anomaly that reduced the corpus to one seed (Ercevik et al., 29 Oct 2025).

Taken together, these evaluations show three distinct empirical claims. First, power traces can serve as a practical coverage proxy on microcontrollers (Sperl et al., 2019). Second, a fully black-box power-trace framework can recover substantial branch coverage on real firmware without any firmware visibility (Tharindu et al., 23 Jun 2026). Third, measured energy can be used to reduce the energy cost of grey-box fuzzing, with the strongest gains coming from energy-aware corpus minimization (Ercevik et al., 29 Oct 2025).

6. Limitations, distinctions, and open problems

PowerFuzz is constrained by measurement physics and system structure. In side-channel-guided embedded fuzzing, precise triggering is crucial, repeated captures and averaging materially improve robustness, and the setup can be invasive or costly: the 2019 work used a shunt resistor, differential probe, and a $\Omega$1 GS/s oscilloscope, while the 2026 framework relies on ChipWhisperer Pro or Nano hardware and synchronized capture (Sperl et al., 2019, Tharindu et al., 23 Jun 2026). Excessive noise, unstable power rails, asynchronous interrupts, DMA, multi-threading, and DVFS all complicate trace comparability. The 2019 paper also notes that constant-time crypto reduces data-dependent leakage, although operation-dependent signatures can still support block-level reconstruction (Sperl et al., 2019).

The black-box PowerFuzz framework has its own failure modes. If two paths have near-identical power signatures, correlation may not cross the configured thresholds and the branch may remain undetected until a later divergence. Its thresholds T, T_g, τ, and window size Slide_w require calibration per board and firmware. The paper reports no confidence intervals or significance tests, and does not provide explicit runtime or complexity numbers, although it notes that the TCFG prunes comparisons and that DTW is focused on deviation windows rather than applied indiscriminately (Tharindu et al., 23 Jun 2026).

GreenAFL faces a different set of limitations. Its measurements are platform-specific in implementation, even though the LD_PRELOAD mechanism is described as generic and portable. It reports campaign totals via perf stat and per-seed measurements via cppjoules, but does not quantify sampling frequency or measurement overhead. The paper explicitly notes that higher total energy under green-fuzz may be due to increased energy per execution, measurement overhead, or heuristic computation costs, and that deeper analysis is needed to disentangle these effects. Its evaluation is limited to libpng, zlib, and jsoncpp on an Intel Xeon D-1548 with 24-hour runs, three repetitions per configuration and target, and one campaign at a time (Ercevik et al., 29 Oct 2025).

The most important conceptual distinction is therefore not whether power is used, but how it is used. In side-channel PowerFuzz, power is a black-box execution signal that replaces unavailable instrumentation (Sperl et al., 2019, Tharindu et al., 23 Jun 2026). In energy-aware PowerFuzz, power and energy are optimization variables that reshape corpus minimization and scheduling inside an already observable grey-box workflow (Ercevik et al., 29 Oct 2025). A plausible implication is that future systems may combine both views: side-channel power feedback for inaccessible firmware and measured energy feedback for cost-aware scheduling once a usable coverage oracle exists.