{
  "added_at": "2026-10-20",
  "arxiv_id": "2609.23583",
  "arxiv_version_reviewed": "v1",
  "authors": [
    "Pouya Narimani",
    "Kseniia Rogova",
    "Addison Crump",
    "Martin Mohl",
    "Meng Wang",
    "Ulysse Planta",
    "Pansilu Pitigalaarachchi",
    "Ali Abbasi"
  ],
  "bibtex_url": "https://awesomerea.org/papers/citations/paper-pozzer.bib",
  "code_url": null,
  "date_basis": "First arXiv submission; the reviewed version is v1, not a verified proceedings publication.",
  "date_basis_zh": "采用 arXiv 首次提交日期；审阅版本为 v1，并非已经核实的会议录出版。",
  "date_precision": "day",
  "description_en": "Builds a noise-tolerant pseudo execution-flow graph from one power trace per test input, using newly observed behavior as LibAFL feedback. It explores embedded firmware without access to its binary, source or instrumentation.",
  "description_zh": "根据每个测试输入的一条功耗轨迹构建可容忍噪声的近似执行流图，将新观察到的行为用作 LibAFL 反馈；无需取得固件二进制、源码或插桩即可探索嵌入式固件。",
  "doi": null,
  "entry_url": "https://awesomerea.org/papers/paper-pozzer/",
  "entry_url_zh": "https://awesomerea.org/zh/papers/paper-pozzer/",
  "evidence_urls": [
    "https://arxiv.org/abs/2609.23583",
    "https://arxiv.org/html/2609.23583v1"
  ],
  "first_arxiv_date": "2026-09-20",
  "id": "paper-pozzer",
  "json_url": "https://awesomerea.org/papers/paper-pozzer/record.json",
  "kind": "research",
  "markdown_url": "https://awesomerea.org/papers/paper-pozzer/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/papers/paper-pozzer/index.md",
  "metadata_notes": "The first submission is September 20, not the later announcement date. Reviewed the full eight-author v1 list. Open Science promises code and results after acceptance; no dedicated public artifact or license was verified.",
  "metadata_notes_zh": "首次提交日期为 9 月 20 日，而非后续公告日期；采用 v1 完整八位作者列表。Open Science 段承诺录用后发布代码和结果，未核实专用公开产物或许可。",
  "pdf_url": "https://arxiv.org/pdf/2609.23583v1",
  "project_url": null,
  "publication_date": "2026-09-20",
  "publication_status": "preprint",
  "record_type": "paper",
  "runtime_tested": false,
  "scope_limitations_en": "Requires physical power measurement, known input pins and setup calibration. Evaluation covers 15 targets on two Cortex-M platforms and two commercial devices; benchmark coverage is measured by later instrumented replay, not recovered directly from power traces. Results depend on seeds and hardware, and long traces reduce throughput. The graph is not a proven control-flow graph or recovered program. Real-device harnesses are withheld.",
  "scope_limitations_zh": "需要物理功耗测量、已知输入引脚和实验装置校准。评测覆盖两个 Cortex-M 平台上的 15 个目标及两个商用设备；基准覆盖率通过事后插桩回放测量，并非直接由功耗轨迹恢复。结果受种子和硬件影响，长轨迹会降低吞吐量；该图不是经过证明的控制流图或恢复出的程序。真实设备测试框架未公开。",
  "targets": [
    "firmware",
    "binary"
  ],
  "title": "POZZER: A Power Side Channel-guided Fuzzer for Black-Box Embedded Systems",
  "title_zh": "POZZER：面向黑盒嵌入式系统的功耗侧信道引导模糊测试器",
  "url": "https://arxiv.org/abs/2609.23583",
  "venue": "arXiv",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20",
  "why_fits_en": "Provides evidence-driven behavior exploration when firmware bytes and conventional tracing are unavailable.",
  "why_fits_zh": "在无法取得固件字节或常规执行轨迹时，提供基于证据的行为探索方法。",
  "year": 2026
}