Thinking More, Harnessing Better: State Machine Guided Harness Automatic Generation with Project Digestion and Workflow Decomposition
On the map: LLM reasoning → Reasoning for agents, planning and code
Abstract (arXiv)
High-quality fuzz harnesses are essential for effective gray-box fuzzing. While Large Language Models (LLMs) offer promise for automating this task, existing one-turn generation methods suffer from hallucinations and inadequate coverage due to coarse-grained function targeting and misaligned generation workflows. We present SynapseFlow, an automatic harness generator that addresses these limitations through two key innovations: dataflow-aware function aggregation and a staged, rollback-enabled generation workflow decomposition. SynapseFlow first analyzes source code to construct Structural Flow Graphs and extract coherent Function Triplets. It then synthesizes harnesses via a decomposed four-stage process governed by a staged rollback algorithm to ensure correctness. We evaluated SynapseFlow on 25 real-world open-source software projects. The experimental results indicate that SynapseFlow outperforms state-of-the-art tools (OSS-Fuzz-Gen, CKGFuzzer, PromeFuzz), achieving 3.07×, 1.71×, and 4.26× higher branch coverage, and 1.77×, 1.51×, and 1.36× higher bug detection rates, respectively. Most importantly, SynapseFlow discovered 7 previously unreported bugs (5 assigned CVEs), demonstrating its practical effectiveness in real-world bug discovery.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning. Builds on 4 of its 48 references that are in the map. First posted on arXiv 8 Jul 2026.
Builds on
4 of 48 references.
References · 4
- 2023GPT-4 Technical Reportcited by 18,132
- 2024Understanding the planning of LLM agents: A surveycited by 414
- 2025A Comparison of DeepSeek and Other LLMscited by 10
- 2025An Empirical Study of Fuzz Harness Degradationcited by 2
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2025HarnessAgent: Scaling Automatic Fuzzing Harness Construction with Tool-Augmented LLM Pipelines
- 2026Coverage-Guided Multi-Agent Harness Generation for Java Library Fuzzing
- 2026Quality-Assured Fuzz Harness Generation via the Four Principles Framework
- 2026Repo0: Design-Driven Zero-to-All Code Generation
- 2026AnCoder: Anchored Code Generation via Discrete Diffusion Models
- 2024Planning-Driven Programming: A Large Language Model Programming Workflow
- 2024SOEN-101: Code Generation by Emulating Software Process Models Using Large Language Model Agents
- 2025SRLCG: Self-Rectified Large-Scale Code Generation with Multidimensional Chain-of-Thought and Dynamic Backtracking