Thinking More, Harnessing Better: State Machine Guided Harness Automatic Generation with Project Digestion and Workflow Decomposition

2026-07-09 · Source: cs.SE updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Software Development & Engineering · Depth: Expert, extended

Summary

SynapseFlow is an automatic fuzz harness generator designed to overcome limitations in existing Large Language Model (LLM)-based methods, which suffer from hallucinations and poor coverage. It introduces dataflow-aware function aggregation and a staged, rollback-enabled generation workflow decomposition. The system analyzes source code to build Structural Flow Graphs and extract coherent Function Triplets, then synthesizes harnesses through a four-stage process managed by a staged rollback algorithm for correctness. Evaluated on 25 real-world open-source projects, SynapseFlow achieved 3.07x, 1.71x, and 4.26x higher branch coverage and 1.77x, 1.51x, and 1.36x higher bug detection rates compared to state-of-the-art tools like OSS-Fuzz-Gen, CKGFuzzer, and PromeFuzz. Notably, it discovered 7 previously unreported bugs, with 5 assigned CVEs.

Key takeaway

For AI Security Engineers or Machine Learning Engineers tasked with automating fuzz harness generation, you should recognize the limitations of monolithic LLM approaches. Implement a structured, multi-stage synthesis workflow that incorporates dataflow analysis for coherent function grouping and a robust rollback mechanism for error mitigation. This strategy, exemplified by SynapseFlow, will significantly improve branch coverage and bug detection rates, leading to the discovery of critical, previously unknown vulnerabilities in your C projects.

Key insights

Decomposed, dataflow-aware LLM workflows with rollback significantly improve fuzz harness generation quality and bug discovery.

Principles

• Decompose complex LLM tasks into verifiable stages.
• Integrate dataflow analysis for coherent function grouping.
• Staged rollback enhances error recovery.

Method

SynapseFlow extracts Function Triplets via dataflow aggregation and Structural Flow Graphs. It then synthesizes harnesses through a four-stage process (documentation, snippet stitching, assembly, optimization) orchestrated by a staged rollback algorithm.

In practice

• Classify function roles using hybrid static analysis and LLMs.
• Apply a three-prompt voting scheme for LLM identification.
• Validate intermediate outputs at each generation stage.

Topics

• Fuzzing
• Harness Generation
• Large Language Models
• Vulnerability Discovery
• Dataflow Analysis
• Workflow Decomposition

Best for: Research Scientist, CTO, VP of Engineering/Data, AI Scientist, AI Security Engineer, Machine Learning Engineer

Related on AIssential

• Data-Centric Benchmarking of Exploit Generation in LLMs: Understanding the Impact of Fine-Tuning — Data quality and structured evaluation are paramount for effective LLM-based exploit generation.
• Reinforcement Learning for Software Vulnerability Analysis: A Systematic Review with Emphasis on C/C++ Source Code and Static Analysis — RL for C/C++ vulnerability analysis is nascent, with a critical gap in using static source-code structural representations for detection.
• DIG: Oracle-Guided Directed Input Generation for One-Day Vulnerabilities — Patch analysis with LLMs can synthesize explicit vulnerability preconditions, guiding effective PoC generation.
• Researchers introduce Self-Harness, a framework that lets AI agents rewrite their own rules, boosting performance up to 60% — Self-Harness allows LLM agents to autonomously improve their operational harnesses by learning from execution failures.
• The Firefox security bug spike wasn't just about the model—it was about the harness — Improved LLM harnesses, not just models, reduced inaccurate AI-generated bug reports in open-source projects.
• AutoBe benchmark: structured harness narrows frontier-vs-local gap in backend generation [D] — Structured function calling in backend generation narrows the performance gap between frontier and local models.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.SE updates on arXiv.org.