{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,28]],"date-time":"2026-08-28T05:17:45Z","timestamp":1787894265543,"version":"build-2784847793"},"reference-count":45,"publisher":"MDPI AG","issue":"17","license":[{"start":{"date-parts":[[2026,8,26]],"date-time":"2026-08-26T00:00:00Z","timestamp":1787702400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["62572316"],"award-info":[{"award-number":["62572316"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"award":["62572316"],"award-info":[{"award-number":["62572316"]}],"id":[{"id":"https:\/\/ror.org\/01h0zpd94","id-type":"ROR","asserted-by":"publisher"}]},{"name":"Natural Science Foundation of Shanghai","award":["25ZR1402279"],"award-info":[{"award-number":["25ZR1402279"]}]},{"name":"Shanghai Magnolia Talent Program Pujiang Project","award":["24PJD043"],"award-info":[{"award-number":["24PJD043"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Electronics"],"abstract":"<jats:p>Cyber\u2013physical systems (CPSs) increasingly rely on complex software components whose vulnerabilities may affect both digital services and physical processes. Fuzzing is a practical technique for discovering such vulnerabilities in CPS-facing parsers, protocol handlers, and edge services. Distributed fuzzing improves throughput, but outsourcing fuzzing tasks to multiple untrusted nodes introduces privacy risks: valuable seeds, especially crash-triggering samples, may reveal vulnerability information before affected users are protected. In this paper, we propose PrivFuzz, a privacy-preserving collaborative fuzzing framework. PrivFuzz allows organizations and individuals to collaborate and receive rewards while keeping fuzzing seeds confidential and enabling controlled encrypted seed reuse among untrusted fuzzing nodes. The key idea is to combine trusted execution environments (TEEs) with blockchain-based smart contracts to support confidentiality and fair reward settlement. We give game-based definitions and reduction-style arguments for seed confidentiality, worker soundness, outsourcer atomicity, and duplicate-claim resistance under an attested execution model. We implement a PrivFuzz prototype and evaluate it on four open-source parsing targets. Separately, native AFL++ sanity checks suggest that CPS-facing industrial protocol parsers such as Modbus and OPC UA fall within the same fuzzable target domain. Demonstrating end-to-end PrivFuzz on CPS control programs is left as future work. Using PrivFuzz, we discovered nine bugs and reported them to the developers.<\/jats:p>","DOI":"10.3390\/electronics15173837","type":"journal-article","created":{"date-parts":[[2026,8,26]],"date-time":"2026-08-26T11:53:42Z","timestamp":1787745222000},"page":"3837","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["PrivFuzz: Privacy-Preserving Distributed Fuzzing for CPS-Facing Parsing Components on Untrusted Clients"],"prefix":"10.3390","volume":"15","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-3379-0613","authenticated-orcid":false,"given":"Zhe","family":"Chen","sequence":"first","affiliation":[{"name":"Shanghai Xiaoyuan Innovation Center, Shanghai 200237, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3260-4530","authenticated-orcid":false,"given":"Xiaohan","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Computer Science, Shanghai Jiao Tong University, Shanghai 200240, China"},{"name":"Shanghai Key Laboratory of Integrated Administration Technologies for Information Security, Shanghai 200240, China"},{"name":"Zhang Jiang Institute for Advanced Study, Shanghai Jiao Tong University, Shanghai 201203, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ning","family":"Zhang","sequence":"additional","affiliation":[{"name":"Shanghai Xiaoyuan Innovation Center, Shanghai 200237, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Guihua","family":"Gu","sequence":"additional","affiliation":[{"name":"Shanghai Xiaoyuan Innovation Center, Shanghai 200237, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaoyu","family":"Yi","sequence":"additional","affiliation":[{"name":"Shanghai Xiaoyuan Innovation Center, Shanghai 200237, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jingping","family":"Liang","sequence":"additional","affiliation":[{"name":"Shanghai Xiaoyuan Innovation Center, Shanghai 200237, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0424-9845","authenticated-orcid":false,"given":"Li","family":"Pan","sequence":"additional","affiliation":[{"name":"School of Computer Science, Shanghai Jiao Tong University, Shanghai 200240, China"},{"name":"Shanghai Key Laboratory of Integrated Administration Technologies for Information Security, Shanghai 200240, China"},{"name":"Zhang Jiang Institute for Advanced Study, Shanghai Jiao Tong University, Shanghai 201203, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,8,26]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Jang, D., Askar, A., Yun, I., Tong, S., Cai, Y., and Kim, T. (2022). Fuzzing@Home: Distributed Fuzzing on Untrusted Heterogeneous Clients. Proceedings of the 25th International Symposium on Research in Attacks, Intrusions and Defenses, Limassol, Cyprus, 26\u201328 October 2022, ACM Digital Library.","DOI":"10.1145\/3545948.3545971"},{"key":"ref_2","unstructured":"Zalewski, M. (2026, June 05). American Fuzzy Lop. Available online: https:\/\/github.com\/google\/AFL."},{"key":"ref_3","unstructured":"LLVM Project (2026, June 05). libFuzzer: A Library for Coverage-Guided Fuzz Testing. Available online: https:\/\/llvm.org\/docs\/LibFuzzer.html."},{"key":"ref_4","unstructured":"Fioraldi, A., Maier, D.C., Ei\u00dffeldt, H., and Heuse, M. (2020, January 11). AFL++: Combining Incremental Steps of Fuzzing Research. Proceedings of the 14th USENIX Workshop on Offensive Technologies (WOOT 20), Online."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"B\u00f6hme, M., Pham, V.T., and Roychoudhury, A. (2016). Coverage-Based Greybox Fuzzing as Markov Chain. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, Vienna, Austria, 24\u201328 October 2016, ACM Digital Library.","DOI":"10.1145\/2976749.2978428"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Lemieux, C., and Sen, K. (2018). FairFuzz: A Targeted Mutation Strategy for Increasing Greybox Fuzz Testing Coverage. Proceedings of the 33rd ACM\/IEEE International Conference on Automated Software Engineering, Montpellier, France, 3\u20137 September 2018, ACM Digital Library.","DOI":"10.1145\/3238147.3238176"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Gan, S., Zhang, C., Qin, X., Tu, X., Li, K., Pei, Z., and Chen, Z. (2018). CollAFL: Path Sensitive Fuzzing. Proceedings of the IEEE Symposium on Security and Privacy, San Francisco, CA, USA, 20\u201324 May 2018, IEEE.","DOI":"10.1109\/SP.2018.00040"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Chen, P., and Chen, H. (2018). Angora: Efficient Fuzzing by Principled Search. Proceedings of the IEEE Symposium on Security and Privacy, San Francisco, CA, USA, 20\u201324 May 2018, IEEE.","DOI":"10.1109\/SP.2018.00046"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"She, D., Pei, K., Epstein, D., Yang, J., Ray, B., and Jana, S. (2019). NEUZZ: Efficient Fuzzing with Neural Program Smoothing. Proceedings of the IEEE Symposium on Security and Privacy, San Francisco, CA, USA, 19\u201323 May 2019, IEEE.","DOI":"10.1109\/SP.2019.00052"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Stephens, N., Grosen, J., Salls, C., Dutcher, A., Wang, R., Corbetta, J., Shoshitaishvili, Y., Kruegel, C., and Vigna, G. (2016, January 21\u201324). Driller: Augmenting Fuzzing Through Selective Symbolic Execution. Proceedings of the NDSS, San Diego, CA, USA.","DOI":"10.14722\/ndss.2016.23368"},{"key":"ref_11","unstructured":"Yun, I., Lee, S., Xu, M., Jang, Y., and Kim, T. (2018). QSYM: A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing. Proceedings of the USENIX Security, Baltimore, MD, USA, 15\u201317 August 2018, USENIX."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Rawat, S., Jain, V., Kumar, A., Cojocar, L., Giuffrida, C., and Bos, H. (2017). VUzzer: Application-Aware Evolutionary Fuzzing. Proceedings of the 2017 Network and Distributed System Security (NDSS) Symposium, San Diego, CA, USA, 26 February\u20131 March 2017, Internet Society.","DOI":"10.14722\/ndss.2017.23404"},{"key":"ref_13","unstructured":"Arya, A., and Chang, O. (2026, June 05). ClusterFuzz: Fuzzing at Google Scale. Black Hat Europe. Available online: https:\/\/i.blackhat.com\/eu-19\/Wednesday\/eu-19-Arya-ClusterFuzz-Fuzzing-At-Google-Scale.pdf."},{"key":"ref_14","unstructured":"Serebryany, K. OSS-Fuzz\u2014Google\u2019s Continuous Fuzzing Service for Open Source Software, 2017. USENIX Security 2017 Presentation. Available online: https:\/\/www.usenix.org\/conference\/usenixsecurity17\/technical-sessions\/presentation\/serebryany."},{"key":"ref_15","unstructured":"Microsoft (2026, June 05). OneFuzz: A Self-Hosted Fuzzing-As-A-Service Platform. Available online: https:\/\/github.com\/microsoft\/onefuzz."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Metzman, J., Szekeres, L., Simon, L., Sprabery, R., and Arya, A. (2021). FuzzBench: An Open Fuzzer Benchmarking Platform and Service. Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Athens, Greece, 23\u201328 August 2021, ACM Digital Library.","DOI":"10.1145\/3468264.3473932"},{"key":"ref_17","unstructured":"Sang, F., Jang, D., Shih, M.W., and Kim, T. (2019). P2FAAS: Toward privacy-preserving fuzzing as a service. arXiv."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"7688","DOI":"10.1109\/TII.2020.3040171","article-title":"SPDS: A Secure and Auditable Private Data Sharing Scheme for Smart Grid Based on Blockchain","volume":"17","author":"Wang","year":"2021","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"192","DOI":"10.1016\/j.future.2023.03.008","article-title":"TEEFuzzer: A Fuzzing Framework for Trusted Execution Environments with Heuristic Seed Mutation","volume":"144","author":"Duan","year":"2023","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Wang, Q., Chang, B., Ji, S., Tian, Y., Zhang, X., Zhao, B., Pan, G., Lyu, C., Payer, M., and Wang, W. (2023). SyzTrust: State-aware Fuzzing on Trusted OS Designed for IoT Devices. arXiv.","DOI":"10.1109\/SP54263.2024.00070"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Mao, P., Shi, L., Busch, M., and Payer, M. (2026). T\u00c4MU: Emulating Trusted Applications at the (GlobalPlatform)-API Layer. arXiv.","DOI":"10.1109\/SP63933.2026.00139"},{"key":"ref_22","unstructured":"Fan, C.I., Chang, L.E., and Shie, C.H. (2025). Qualcomm Trusted Application Emulation for Fuzzing Testing. arXiv."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Wang, Q., and Oswald, D. (2026). Confidential Computing on Heterogeneous CPU-GPU Systems: Survey and Future Directions. ACM Comput. Surv., 58.","DOI":"10.1145\/3793532"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Eisoldt, J., Galanou, A., Ruzhanskiy, A., K\u00fcchenmeister, N., Baburkin, Y., Dai, T., Gudymenko, I., K\u00f6psell, S., and Kapitza, R. (2025). SoK: A Cloudy View on Trust Relationships of CVMs\u2014How Confidential Virtual Machines Are Falling Short in Public Cloud. arXiv.","DOI":"10.1109\/ACSAC67867.2025.00046"},{"key":"ref_25","unstructured":"Shi, W., Li, H., Yu, J., Sun, X., Guo, W., and Xing, X. (2025). BandFuzz: An ML-Powered Collaborative Fuzzing Framework. arXiv."},{"key":"ref_26","unstructured":"Meng, J., Feng, X., Li, Q., Liu, M., and Xu, K. (2026). AFL-ICP: Enhancing Industrial Control Protocol Reliability via Specification-Guided Fuzzing. arXiv."},{"key":"ref_27","unstructured":"Zhang, J., Li, X., Xu, S., Wu, H., Feng, R., and Bai, G. (2026). PriME-Deal: Privacy-Preserving Bilateral Data Trading with Efficient Matchmaking and Auditable Fair Exchange on Blockchain. arXiv."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Zhang, F., Cecchetti, E., Croman, K., Juels, A., and Shi, E. (2016). Town Crier: An Authenticated Data Feed for Smart Contracts. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, Vienna, Austria, 24\u201328 October 2016, ACM Digital Library.","DOI":"10.1145\/2976749.2978326"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Cheng, R., Zhang, F., Kos, J., He, W., Hynes, N., Johnson, N., Juels, A., Miller, A., and Song, D. (2019). Ekiden: A Platform for Confidentiality-Preserving, Trustworthy, and Performant Smart Contract Execution. Proceedings of the IEEE European Symposium on Security and Privacy, Stockholm, Sweden, 17\u201319 June 2019, IEEE.","DOI":"10.1109\/EuroSP.2019.00023"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Shen, Y., Tian, H., Chen, Y., Chen, K., Wang, R., Xu, Y., Xia, Y., and Yan, S. (2020). Occlum: Secure and Efficient Multitasking Inside a Single Enclave of Intel SGX. Proceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems, Lausanne, Switzerland, 16\u201320 March 2020, ACM Digital Library.","DOI":"10.1145\/3373376.3378469"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"3149","DOI":"10.1109\/TDSC.2021.3085988","article-title":"Golden Grain: Building a Secure and Decentralized Model Marketplace for MLaaS","volume":"19","author":"Weng","year":"2022","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"4456","DOI":"10.1109\/TII.2021.3123312","article-title":"A Data Trading Scheme with Efficient Data Usage Control for Industrial IoT","volume":"18","author":"Zhang","year":"2022","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_33","unstructured":"Costan, V., and Devadas, S. (2026, August 23). Intel SGX Explained. Technical Report 2016\/086, IACR Cryptology ePrint Archive. Available online: https:\/\/eprint.iacr.org\/2016\/086."},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Baumann, A., Peinado, M., and Hunt, G. (2015). Shielding Applications from an Untrusted Cloud with Haven. ACM Trans. Comput. Syst., 33.","DOI":"10.1145\/2799647"},{"key":"ref_35","unstructured":"Arnautov, S., Trach, B., Gregor, F., Knauth, T., Martin, A., Priebe, C., Lind, J., Muthukumaran, D., O\u2019Keeffe, D., and Stillwell, M.L. (2016). SCONE: Secure Linux Containers with Intel SGX. Proceedings of the 12th USENIX Symposium on Operating Systems Design and Implementation, Savannah, Georgia, 2\u20134 November 2016, USENIX."},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Schuster, F., Costa, M., Fournet, C., Gkantsidis, C., Peinado, M., Mainar-Ruiz, G., and Russinovich, M. (2015). VC3: Trustworthy data analytics in the cloud using SGX. Proceedings of the IEEE Symposium on Security and Privacy, San Jose, CA, USA, 17\u201321 May 2015, IEEE.","DOI":"10.1109\/SP.2015.10"},{"key":"ref_37","unstructured":"Zheng, W., Dave, A., Beekman, J.G., Popa, R.A., Gonzalez, J.E., and Stoica, I. (2017). Opaque: An oblivious and encrypted distributed analytics platform. Proceedings of the 14th USENIX Symposium on Networked Systems Design and Implementation, Boston, MA, USA, 27\u201329 March 2017, USENIX."},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Hunt, T., Zhu, Z., Xu, Y., Peter, S., and Witchel, E. (2018). Ryoan: A distributed sandbox for untrusted computation on secret data. ACM Trans. Comput. Syst. (TOCS), 35.","DOI":"10.1145\/3231594"},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Kosba, A.E., Miller, A., Shi, E., Wen, Z., and Papamanthou, C. (2016). Hawk: The Blockchain Model of Cryptography and Privacy-Preserving Smart Contracts. Proceedings of the IEEE Symposium on Security and Privacy, San Jose, CA, USA, 22\u201326 May 2016, IEEE.","DOI":"10.1109\/SP.2016.55"},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Pass, R., Shi, E., and Tramer, F. (2017). Formal abstractions for attested execution secure processors. Proceedings of the Annual International Conference on the Theory and Applications of Cryptographic Techniques, Paris, France, 30 April\u20134 May 2017, Springer International Publishing.","DOI":"10.1007\/978-3-319-56620-7_10"},{"key":"ref_41","unstructured":"Zhao, T., Foo, E., and Tian, H. (2022). A Digital Twin Framework for Cyber Security in Cyber-Physical Systems. arXiv."},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"867","DOI":"10.1109\/TDSC.2022.3145814","article-title":"T-Counter: Trustworthy and Efficient CPU Resource Measurement Using SGX in the Cloud","volume":"20","author":"Dong","year":"2023","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Klees, G., Ruef, A., Cooper, B., Wei, S., and Hicks, M. (2018). Evaluating Fuzz Testing. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, Toronto, ON, Canada, 15\u201319 October 2018, ACM.","DOI":"10.1145\/3243734.3243804"},{"key":"ref_44","unstructured":"(2026, July 07). libmodbus: A Modbus Library for Linux, Mac OS X, FreeBSD, QNX and Windows. Available online: https:\/\/github.com\/stephane\/libmodbus."},{"key":"ref_45","unstructured":"(2026, July 07). open62541: Open Source Implementation of OPC UA. Available online: https:\/\/github.com\/open62541\/open62541."}],"container-title":["Electronics"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2079-9292\/15\/17\/3837\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,8,28]],"date-time":"2026-08-28T04:29:43Z","timestamp":1787891383000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2079-9292\/15\/17\/3837"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,8,26]]},"references-count":45,"journal-issue":{"issue":"17","published-online":{"date-parts":[[2026,9]]}},"alternative-id":["electronics15173837"],"URL":"https:\/\/doi.org\/10.3390\/electronics15173837","relation":{},"ISSN":["2079-9292"],"issn-type":[{"value":"2079-9292","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,8,26]]}}}