# POZZER: A Power Side Channel-guided Fuzzer for Black-Box Embedded Systems

> Builds a noise-tolerant pseudo execution-flow graph from one power trace per test input, using newly observed behavior as LibAFL feedback. It explores embedded firmware without access to its binary, source or instrumentation.

- Authors: Pouya Narimani; Kseniia Rogova; Addison Crump; Martin Mohl; Meng Wang; Ulysse Planta; Pansilu Pitigalaarachchi; Ali Abbasi
- Venue: arXiv
- Status: Preprint
- Publication / posting date: September 20, 2026
- Date source: First arXiv submission; the reviewed version is v1, not a verified proceedings publication.
- First arXiv submission: September 20, 2026
- arXiv: 2609.23583
- Reviewed arXiv version: v1
- Sources reviewed: 2026-10-20
- Added to the catalog: 2026-10-20
- Original paper: <https://arxiv.org/abs/2609.23583>
- PDF: <https://arxiv.org/pdf/2609.23583v1>
- BibTeX: <https://awesomerea.org/papers/citations/paper-pozzer.bib>
- Catalog page: <https://awesomerea.org/papers/paper-pozzer/>
- Record JSON: <https://awesomerea.org/papers/paper-pozzer/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-pozzer/index.md)

## Scope and limitations

Requires physical power measurement, known input pins and setup calibration. Evaluation covers 15 targets on two Cortex-M platforms and two commercial devices; benchmark coverage is measured by later instrumented replay, not recovered directly from power traces. Results depend on seeds and hardware, and long traces reduce throughput. The graph is not a proven control-flow graph or recovered program. Real-device harnesses are withheld.

## Why it fits this collection

Provides evidence-driven behavior exploration when firmware bytes and conventional tracing are unavailable.

## Publication and review notes

The first submission is September 20, not the later announcement date. Reviewed the full eight-author v1 list. Open Science promises code and results after acceptance; no dedicated public artifact or license was verified.

## Primary sources

1. <https://arxiv.org/abs/2609.23583>
2. <https://arxiv.org/html/2609.23583v1>

## About this entry

Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.