English

Thinking More, Harnessing Better: State Machine Guided Harness Automatic Generation with Project Digestion and Workflow Decomposition

Cryptography and Security 2026-07-08 v1 Software Engineering

Abstract

High-quality fuzz harnesses are essential for effective gray-box fuzzing. While Large Language Models (LLMs) offer promise for automating this task, existing one-turn generation methods suffer from hallucinations and inadequate coverage due to coarse-grained function targeting and misaligned generation workflows. We present SynapseFlow, an automatic harness generator that addresses these limitations through two key innovations: dataflow-aware function aggregation and a staged, rollback-enabled generation workflow decomposition. SynapseFlow first analyzes source code to construct Structural Flow Graphs and extract coherent Function Triplets. It then synthesizes harnesses via a decomposed four-stage process governed by a staged rollback algorithm to ensure correctness. We evaluated SynapseFlow on 25 real-world open-source software projects. The experimental results indicate that SynapseFlow outperforms state-of-the-art tools (OSS-Fuzz-Gen, CKGFuzzer, PromeFuzz), achieving 3.07×\times, 1.71×\times, and 4.26×\times higher branch coverage, and 1.77×\times, 1.51×\times, and 1.36×\times higher bug detection rates, respectively. Most importantly, SynapseFlow discovered 7 previously unreported bugs (5 assigned CVEs), demonstrating its practical effectiveness in real-world bug discovery.

Cite

@article{arxiv.2607.07007,
  title  = {Thinking More, Harnessing Better: State Machine Guided Harness Automatic Generation with Project Digestion and Workflow Decomposition},
  author = {Xing Zhang and Zikang Huang and Gang Yang and CongChong Wang and Lu Liu and Bin Yin and Mingyi Wang and Ziquan Zhao and Min Li and Zhenyu Chen and Bo Wu and Lingyun Ying},
  journal= {arXiv preprint arXiv:2607.07007},
  year   = {2026}
}

Comments

20 pages, accepted by CCS 2026

R2 v1 2026-07-22T20:30:01.485Z