---
title: 'PowerFuzz: Power-Based Fuzzing'
url: https://www.emergentmind.com/topics/powerfuzz
type: topic
---

# PowerFuzz: Power-Based Fuzzing

Searching arXiv for the specified papers and closely related work to ground the article in published sources.
PowerFuzz denotes a class of fuzzing methods that use electrical behavior as feedback for test generation. In the literature considered here, the term covers two distinct but related directions: power side-channel–guided black-box firmware fuzzing, in which power traces substitute for unavailable branch coverage on embedded devices, and power-/energy-aware fuzzing, in which measured power and energy are incorporated into the heuristics of a grey-box fuzzer to reduce energy cost while maintaining effectiveness. The former direction was foreshadowed by “Side-Channel Aware Fuzzing” [1908.05012] and formalized as the black-box framework “PowerFuzz: Power-Based Black-Box Firmware Fuzzing” [2606.24692]; the latter is exemplified by GreenAFL, which treats “PowerFuzz” as power-/energy-aware fuzzing in continuous software testing [2510.25665].

## 1. Conceptual scope and lineage

PowerFuzz emerged from two different technical pressures. On embedded targets, classic coverage-guided fuzzers such as AFL or LibFuzzer are often unusable because firmware is proprietary, instrumentation is unavailable, and debug or tracing interfaces may be locked. In that setting, power consumption becomes an alternative feedback channel: if a power trace can reveal branch structure or execution divergence, a black-box fuzzer can recover a coverage-like signal without binary access [1908.05012].

A separate pressure is the energy cost of continuous fuzzing campaigns. In large-scale infrastructures such as OSS-Fuzz, the concern is not lack of visibility but lack of energy awareness: conventional grey-box fuzzers maximize coverage without modeling the energy cost of seeds or mutation schedules. GreenAFL defines power-/energy-aware fuzzing as the explicit incorporation of measurements of power and energy into the core heuristics and workflows of coverage-guided fuzzers, so that campaigns make progress at lower energy cost while preserving, or slightly improving, effectiveness [2510.25665].

A common misconception is to treat these lines of work as interchangeable. They are not. Power side-channel fuzzing uses power as a surrogate coverage oracle in a fully black-box setting, whereas GreenAFL uses measured energy to optimize an already instrumented fuzzing workflow. Another misconception is terminological: the 2019 paper does not use the name “PowerFuzz,” whereas the 2026 framework does, and the 2025 GreenAFL paper uses “PowerFuzz” in the broader sense of power-/energy-aware fuzzing [1908.05012][2606.24692][2510.25665].

## 2. Power traces as a coverage-like oracle

The earliest fully developed formulation of this idea is “Side-Channel Aware Fuzzing” [1908.05012]. Its starting point is that bare-metal embedded devices often lack the OS support, I/O bandwidth, or instrumentation hooks required by feedback-guided fuzzers. The paper therefore measures the device’s power consumption during input processing and uses machine learning to infer execution structure from the trace.

The pipeline is threefold. First, a mutated input is sent to the device under test and its power trace is measured over the input-processing interval. Second, features are extracted from the trace to detect branch instructions and segment basic-block regions. Third, the inferred basic-block sequence is converted into a coverage-like score that is proportional to newly observed basic-block transitions. The scoring logic follows AFL’s intuition that coverage can be approximated by novel transitions. If the reconstructed path for an input $x$ is $\pi(x) = (b_0, b_1, \dots, b_n)$ and $\Omega$ is the global set of previously discovered directed edges, the score is formalized as
$$
S(x) = \sum_{i=0}^{n-1} 1\{(b_i, b_{i+1}) \notin \Omega\}.
$$
After scoring, $\Omega$ is updated with the newly reconstructed transitions [1908.05012].

Two reconstruction strategies are central. CFG-RI uses detected branch locations and estimated branch distances to infer the sequence of blocks. CFG-RII instead uses fingerprints of the segments between detected branches. Those fingerprints combine $P_{\text{length}}$, $P_{\text{peaks}}$, $P_{\text{mean}}$, and $P_{\text{skewness}}$ into either separated $4$D vectors or summed scalar fingerprints. CFG-RI is precise when branch-distance classification is accurate, but it suffers from error propagation; CFG-RII is more robust to single errors, but can incur fingerprint collisions [1908.05012].

The measurement and preprocessing assumptions are demanding. The study used an STM32F417 microcontroller, a $47\ \Omega$ shunt resistor, a differential probe, and a LeCroy WavePro 760Zi-A oscilloscope sampling at $5$ GS/s. Trace acquisition was synchronized to the DUT’s system clock. To improve SNR, the same input was repeated multiple times, often $R=10$, followed by mean or sweep averaging. The method does not require dynamic time warping or cross-correlation because alignment is achieved through precise clock-correlated triggering [1908.05012].

## 3. The 2026 PowerFuzz framework for black-box firmware

The 2026 framework “PowerFuzz: Power-Based Black-Box Firmware Fuzzing” generalizes the use of power traces into a fully black-box fuzzing system that requires no firmware binary, source, or debug infrastructure [2606.24692]. Its core claim is that statistically inferred “branch coverage” from power traces can preserve the essential advantages of coverage-guided fuzzing even when classical instrumentation is impossible.

PowerFuzz closes the fuzzing loop with a hardware measurement path and a LibAFL-based software loop. A shunt resistor is placed in series with the MCU supply, a ChipWhisperer board samples the resulting voltage drop, and trace acquisition is synchronized with input delivery. For each fuzz iteration, the power trace is captured $N = 10$ times and averaged to reduce noise. The averaged trace is then compared against previously observed traces by a Similarity Analysis module that combines dynamic time warping with sliding-window and growing-window Pearson correlation [2606.24692].

The framework’s branch identification procedure is two-stage. Dynamic time warping first detects and coarsely localizes sustained divergence between two traces by examining the offset profile of the optimal warping path. Within the resulting deviation window, a sliding-window full-trace correlation pass identifies an approximate divergence point, and a growing-window correlation pass refines it to a precise sample. The algorithmic skeleton is named `GetDivergentPoint(Pre_trace, Curr_trace)` and is parameterized by `Slide_w`, thresholds `T` and `T_g`, and the DTW-derived deviation window `[DW_start, DW_end]` [2606.24692].

The inferred execution structure is stored in a Trace-guided Control Flow Graph, or TCFG. This is a binary structure $G=(V,E)$ in which each node stores a trace segment `v.data`, a representative input `v.input`, and child pointers `v.left` and `v.right`. The graph is initialized from the first trace and updated recursively. If a new trace diverges inside an existing node, the node is split at the divergence point; the shared prefix becomes a new parent, the previous suffix becomes one child, and the new trace suffix becomes its sibling. This design encodes observed branch transitions while pruning comparisons to the root-to-leaf path shared by the incoming trace [2606.24692].

The scheduler uses a scalar feedback signal
$$
F =
\begin{cases}
0, & \text{if no new node is added to the TCFG,} \\
d(v_{new}), & \text{if a new node } v_{new} \text{ is inserted.}
\end{cases}
$$
Inputs with $F=0$ are discarded; inputs that add deeper nodes receive proportionally more mutation effort. Branch selection is random while the inferred structure is small and becomes depth-prioritized once the TCFG reaches `depth_threshold = 100 nodes` in practice [2606.24692].

A notable design difference from the 2019 work is that the 2026 PowerFuzz framework is training-free and does not require instruction-level model learning from labeled traces. It relies on statistical similarity analysis rather than supervised branch classifiers [2606.24692].

## 4. Energy-aware PowerFuzz in grey-box fuzzing

GreenAFL extends the meaning of PowerFuzz from side-channel feedback to energy-aware optimization of grey-box fuzzing campaigns [2510.25665]. Its motivation is environmental and infrastructural: continuous fuzzing consumes substantial computational resources, and lower energy-per-coverage implies fewer joules and fewer dollars per discovered edge or bug.

The formal quantity of interest is energy, derived from instantaneous power $P(t)$ over an interval:
$$
E = \int_{t_0}^{t_1} P(t)\,dt.
$$
GreenAFL measures “energy per seed execution” during minimization and in the fuzzing loop via cppjoules, using an `LD_PRELOAD` wrapper around the target. Campaign totals are reported via `perf stat`, which combines CPU and RAM package power. Per-seed energy comprises CPU and memory/DRAM energy, and normalization is relative to the global minimum and maximum energies observed so far in the campaign [2510.25665].

GreenAFL modifies AFL++ in two places. The first is energy-aware corpus minimization, `green-cmin`. For each seed $s$ in the initial corpus, `afl-showmap` is run once to collect the set of edges reached, and the total energy $E(s)$ of that run is measured. For each discovered edge $e$, the retained champion is the lowest-energy seed among those that reach $e$:
$$
s^*(e) = \arg\min_{s \in S_e} E(s).
$$
The minimized corpus is the union of these champions across edges. This preserves coverage while selecting the cheapest representative seed for each retained edge [2510.25665].

The second modification is the energy-guided fuzzing loop, `green-fuzz`. GreenAFL rescales AFL++’s `perf_score` inversely to energy so that low-energy seeds receive more mutation “airtime.” For a seed $i$,
$$
p'_i = p_i \cdot s_i(E_i),
$$
where $s_i(E_i)$ is mapped inversely to the range $[1/5, 5]$. It also modifies favoured-seed selection by multiplying the champion score with an energy-derived factor in $[4/5, 5/4]$ using logarithmic normalization:
$$
\text{score}'_i = \text{score}_i \cdot m_i(E_i).
$$
The framework does not introduce a single combined fitness function; instead, it directly rescales existing AFL++ internals [2510.25665].

This formulation shifts power from being a side-channel coverage proxy to being an optimization target. In the side-channel setting, power reveals what path was executed; in GreenAFL, energy quantifies how expensively a known path was exercised [1908.05012][2510.25665].

## 5. Empirical results

The 2019 side-channel work established that power traces can approximate coverage on real hardware. Among eight tested branch-detection algorithms, k-nearest neighbors with $k=3$ yielded the best training MCC of $0.93$ and a proof-of-concept MCC of $0.78$ on-device. On synthetic workloads, the maximum Pearson correlation between power-derived and theoretical coverage scores was $0.95$, achieved with CFG-RII separated fingerprints and both mean and sweep averaging with $10$ traces each. Crucial errors—inputs that truly discovered a new edge but were scored $0$—averaged $0.69$ per $100$ inputs. On a lightweight AES implementation with a ground truth of $41$ unique basic-block transitions per encryption, the method detected on average $38$ transitions over $100$ encryptions with random plaintexts [1908.05012].

The 2026 PowerFuzz framework reports branch coverage on four large embedded applications running on STM32F3. On Stepper Controller, PowerFuzz covered `1730 (80.7%)` of `2143` total branches; on CNC, `1467 (83.2%)` of `1763`; on GPS, `1045 (77.1%)` of `1356`; and on Soldering Station, `1438 (76.9%)` of `1871`. The corresponding gray-box reference numbers were `94.1%`, `92.5%`, `89.2%`, and `86.4%`, which supports the reported headline that PowerFuzz reaches branch coverage comparable to gray-box fuzzers within `13.5%`. Against Fuzz’EMup, the reported improvements were `+22.7%`, `+16.3%`, `+9.2%`, and `+18.9%`, respectively. The inferred TCFG achieved average node-level precision of `97.66%` and recall of `77.61%` when mapped to ground-truth CFGs recovered with `angr (CFGEmulated)` and QEMU basic-block tracing [2606.24692].

GreenAFL reports a different performance profile. On `jsoncpp`, the baseline `afl-cmin + afl-fuzz` reached `38.9%` coverage at `2021 kJ`, whereas `green-cmin + afl-fuzz` reached `39.1%` coverage at `1872 kJ`, an energy reduction of `~7.4%` with a statistically significant reduction by Welch’s t-test (`p < 10^{-4}`). On `zlib`, baseline coverage was `50.1%`, while `green-cmin` alone or combined reached `51.4%`, with a statistically significant improvement (`p < 0.02`). In time-to-coverage terms, for `jsoncpp` the first `~680` unique edges were found within `~60s` with `green-cmin`, versus `>1200s` with `afl-cmin`. By contrast, `green-fuzz` showed mixed energy effects: it often maintained coverage comparable to baseline while reducing executions, but could increase total energy. On `libpng`, `green-fuzz` reduced executions per second by `69.2%` versus baseline, although the `libpng` baseline was affected by an `afl-cmin` over-pruning anomaly that reduced the corpus to one seed [2510.25665].

Taken together, these evaluations show three distinct empirical claims. First, power traces can serve as a practical coverage proxy on microcontrollers [1908.05012]. Second, a fully black-box power-trace framework can recover substantial branch coverage on real firmware without any firmware visibility [2606.24692]. Third, measured energy can be used to reduce the energy cost of grey-box fuzzing, with the strongest gains coming from energy-aware corpus minimization [2510.25665].

## 6. Limitations, distinctions, and open problems

PowerFuzz is constrained by measurement physics and system structure. In side-channel-guided embedded fuzzing, precise triggering is crucial, repeated captures and averaging materially improve robustness, and the setup can be invasive or costly: the 2019 work used a shunt resistor, differential probe, and a $5$ GS/s oscilloscope, while the 2026 framework relies on ChipWhisperer Pro or Nano hardware and synchronized capture [1908.05012][2606.24692]. Excessive noise, unstable power rails, asynchronous interrupts, DMA, multi-threading, and DVFS all complicate trace comparability. The 2019 paper also notes that constant-time crypto reduces data-dependent leakage, although operation-dependent signatures can still support block-level reconstruction [1908.05012].

The black-box PowerFuzz framework has its own failure modes. If two paths have near-identical power signatures, correlation may not cross the configured thresholds and the branch may remain undetected until a later divergence. Its thresholds `T`, `T_g`, `τ`, and window size `Slide_w` require calibration per board and firmware. The paper reports no confidence intervals or significance tests, and does not provide explicit runtime or complexity numbers, although it notes that the TCFG prunes comparisons and that DTW is focused on deviation windows rather than applied indiscriminately [2606.24692].

GreenAFL faces a different set of limitations. Its measurements are platform-specific in implementation, even though the `LD_PRELOAD` mechanism is described as generic and portable. It reports campaign totals via `perf stat` and per-seed measurements via cppjoules, but does not quantify sampling frequency or measurement overhead. The paper explicitly notes that higher total energy under `green-fuzz` may be due to increased energy per execution, measurement overhead, or heuristic computation costs, and that deeper analysis is needed to disentangle these effects. Its evaluation is limited to `libpng`, `zlib`, and `jsoncpp` on an Intel Xeon D-1548 with `24-hour runs`, `three repetitions per configuration and target`, and `one campaign at a time` [2510.25665].

The most important conceptual distinction is therefore not whether power is used, but how it is used. In side-channel PowerFuzz, power is a black-box execution signal that replaces unavailable instrumentation [1908.05012][2606.24692]. In energy-aware PowerFuzz, power and energy are optimization variables that reshape corpus minimization and scheduling inside an already observable grey-box workflow [2510.25665]. A plausible implication is that future systems may combine both views: side-channel power feedback for inaccessible firmware and measured energy feedback for cost-aware scheduling once a usable coverage oracle exists.

Source: https://www.emergentmind.com/topics/powerfuzz