[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-84170-en":3,"doc-seo-84170-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},84170,1374391974468,"Eden","https://ap-avatar.wpscdn.com/davatar_29158cc5080c5b710cf443261637dec0",8,"Research & Report","Thinking More Harnessing Better Automatic Harness Generation with Dataflow Aggregation and Workflow Decomposition","High-quality fuzz harnesses are essential for effective gray-box fuzzing. SynapseFlow is an automatic harness generator designed to overcome hallucinations and inadequate coverage seen in one-turn LLM methods. It builds Structural Flow Graphs and extracts coherent Function Triplets from source code, then synthesizes harnesses using a staged, rollback-enabled workflow decomposition. Experiments on 25 open-source projects show 3.07×–4.26× higher branch coverage and 1.36×–1.77× higher bug detection rates, including 7 new bugs.","Thinking More, Harnessing Better: Automatic Harness Generation with Dataflow Aggregation and Workflow Decomposition  \nXing Zhang 1,†, Zikang Huang2,1,†, Gang Yang3,R , CongChong Wang1 , Lu Liu4,1 , Bin Yin 1 , Mingyi Wang 1 , Ziquan Zhao 1 , Min Li 1 , Zhenyu Chen 1 , Bo Wu3 , Lingyun Ying 1,R  \n1 QI-ANXIN Technology Research Institute, Beijing, China  \n2Wuhan University, Wuhan, China  \n3Information Support Force Engineering University, Wuhan, China  \n4 Shandong University, Jinan, China  \n†Both authors contributed equally to this research.  \n[R](R Corresponding authors: yanggang11@nudt.edu.cn)[ Corresponding authors: yanggang11@nudt.edu.cn](R Corresponding authors: yanggang11@nudt.edu.cn), [yinglingyun@qianxin.com](yinglingyun@qianxin.com)  \narXiv :2607 .07007v 1 [ cs .CR] 8 Jul 2026  \nAbstract  \nHigh-quality fuzz harnesses are essential for effective gray-box fuzzing. While Large Language Models (LLMs) offer promise for automating this task, existing one-turn generation methods suffer from hallucinations and inadequate coverage due to coarsegrained function targeting and misaligned generation workflows. We present SynapseFlow, an automatic harness generator that addresses these limitations through two key innovations: dataflowaware function aggregation and a staged, rollback-enabled generation workflow decomposition. SynapseFlow first analyzes source code to construct Structural Flow Graphs and extract coherent Function Triplets. It then synthesizes harnesses via a decomposed fourstage process governed by a staged rollback algorithm to ensure correctness. We evaluated SynapseFlow on 25 real-world opensource software projects. The experimental results indicate that SynapseFlow outperforms state-of-the-art tools (OSS-Fuzz-Gen, CKGFuzzer, PromeFuzz), achieving 3.07×, 1.71×, and 4.26× higher branch coverage, and 1.77×, 1.51×, and 1.36× higher bug detection rates, respectively. Most importantly, SynapseFlow discovered 7 previously unreported bugs (5 assigned CVEs), demonstrating its practical effectiveness in real-world bug discovery.  \nCCS Concepts  \n• Security and privacy → Software security engineering.  \nKeywords  \nFuzzing, Fuzzing Harness Generation, Large Language Model, Vulnerability Discovery  \nPermission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission [and/or a fee. Request permissions from permissions@acm.org](and/or a fee. Request permissions from permissions@acm.org).  \nCCS’26, The Hague, The Netherlands  \n© 2026 Copyright held by the owner/author(s) . Publication rights licensed to ACM. ACM ISBN 978-1-4503-XXXX-X/XXXX/XX  \n[https://doi.org/XXXXXXX.XXXXXXX](https://doi.org/XXXXXXX.XXXXXXX)  \nACM Reference Format:  \nXing Zhang1,†, Zikang Huang2,1,†, Gang Yang3,R, CongChong Wang1 , Lu Liu4,1 , Bin Yin1 , Mingyi Wang1 , Ziquan Zhao1 , Min Li1 , Zhenyu Chen1 , Bo Wu3 , Lingyun Ying1,R . 2026. Thinking More, Harnessing Better: Automatic Harness Generation with Dataflow Aggregation and Workflow Decomposition. In Proceedings of Proceedings of the 2026 ACM SIGSAC Conference on Computer and Communications Security (CCS ’26). ACM, New York, NY, USA, 20 pages. [https://doi.org/XXXXXXX.XXXXXXX](https://doi.org/XXXXXXX.XXXXXXX)  \n1 Introduction  \nFuzzing is a cornerstone technique in modern software security analysis. Among its various paradigms, white-box fuzzing, which leverages source code analysis to guide test generation, offers the potential for deep program exploration. High-quality fuzz harnesses—code segments that invoke target functions with fuzzing inputs—are piv","cbCailcXTdhGrIrW","https://ap.wps.com/l/cbCailcXTdhGrIrW","pdf",1098262,4,1,20,"English","en",105,"# Introduction\n## Motivation and Background\n## Challenges of Existing LLM-Based Approaches","[{\"question\":\"What problem does SynapseFlow address in fuzz harness generation?\",\"answer\":\"It targets hallucinations and insufficient coverage caused by coarse function targeting and misaligned one-turn generation workflows in existing LLM-based harness generation methods.\"},{\"question\":\"How does SynapseFlow select functions for building fuzz harnesses?\",\"answer\":\"It analyzes source code to construct Structural Flow Graphs and extract coherent Function Triplets, enabling dataflow-aware aggregation rather than ad-hoc selection.\"},{\"question\":\"What performance improvements does SynapseFlow achieve in experiments?\",\"answer\":\"On 25 real-world open-source projects, SynapseFlow improves branch coverage by 3.07×, 1.71×, and 4.26× and increases bug detection rates by 1.77×, 1.51×, and 1.36× over the compared state-of-the-art tools.\"}]",1784193617,50,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"thinking-more-harnessing-better-automatic-harness-generation-with-dataflow-aggregation-and-workflow-decomposition","",{"@graph":36,"@context":85},[37,53,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":20},"https://docshare.wps.com/document/thinking-more-harnessing-better-automatic-harness-generation-with-dataflow-aggregation-and-workflow-decomposition/84170/",{"url":52,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":24,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":41,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-28","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What problem does SynapseFlow address in fuzz harness generation?","Question",{"text":75,"@type":76},"It targets hallucinations and insufficient coverage caused by coarse function targeting and misaligned one-turn generation workflows in existing LLM-based harness generation methods.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How does SynapseFlow select functions for building fuzz harnesses?",{"text":80,"@type":76},"It analyzes source code to construct Structural Flow Graphs and extract coherent Function Triplets, enabling dataflow-aware aggregation rather than ad-hoc selection.",{"name":82,"@type":73,"acceptedAnswer":83},"What performance improvements does SynapseFlow achieve in experiments?",{"text":84,"@type":76},"On 25 real-world open-source projects, SynapseFlow improves branch coverage by 3.07×, 1.71×, and 4.26× and increases bug detection rates by 1.77×, 1.51×, and 1.36× over the compared state-of-the-art tools.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":92},[93,97,101,105,110,114,119,122,126,129,133],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":20,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":29,"slug":113},6,"Technology","technology",{"id":115,"doc_module":4,"doc_module_name":46,"category_name":116,"show_sort_weight":117,"slug":118},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":120,"slug":121},30,"research-report",{"id":123,"doc_module":4,"doc_module_name":46,"category_name":124,"show_sort_weight":22,"slug":125},9,"Religion & Spirituality","religion-spirituality",{"id":22,"doc_module":4,"doc_module_name":46,"category_name":127,"show_sort_weight":22,"slug":128},"World Cup","world-cup",{"id":130,"doc_module":4,"doc_module_name":46,"category_name":131,"show_sort_weight":130,"slug":132},10,"Lifestyle","lifestyle",{"id":134,"doc_module":4,"doc_module_name":46,"category_name":135,"show_sort_weight":106,"slug":136},19,"General","general"]