Hybrid Vulnerability Detection: Combining Latent Semantic Analysis with LLM-Assisted Fuzzing via Context Distillation

Abstract

: As modern software systems grow in complexity, the number of vulnerabilities has grown rapidly, rendering traditional security strategies—including manual code reviews and rule-based static analyzers—increasingly resource-intensive and unable to keep pace with emerging threats. This paper presents a hybrid pipeline combining static vulnerability candidate selection using Latent Semantic Analysis with dynamic verification through Large Language Model-assisted fuzzing. The approach identifies semantically similar code patterns to known vulnerabilities without exact syntactic matches, and automates the generation of fuzzing harnesses and seed inputs to overcome coverage plateaus. We evaluate our pipeline on real-world C libraries (LibTIFF, libexpat, FreeType) with documented vulnerabilities. Results demonstrate that vulnerability candidates are ranked within the Top 3–8% of all functions, and model-generated artifacts yield a 5-fold speedup over random fuzzing. The LLM Gemini 3 Pro achieves the highest harness generation success rate at 83% (Pass@3). Our analysis reveals fundamental limitations: the mixed-vector problem dilutes vulnerability signals in multifunctional code, safety alignment mechanisms can inadvertently neutralize vulnerabilities through defensive code insertion, and static feature extraction without build context achieves only 19.93% recall. The pipeline reduces manual effort while still requiring human validation.