Photo of Ziyad Mansy

Ziyad Mohammad Mansy Ibrahim

Independent researcher in software testing and security · Senior mobile software engineer

Applying to Ph.D. programs in Computer Science for Fall 2027
CV (PDF) Email Google Scholar ORCID GitHub LinkedIn

About

I want automated testing to find bugs and security flaws before software ships, especially silent failures that give wrong results without crashing, and to report real problems instead of false alarms. My current work asks what knowledge AI testing agents need to find these failures, and how to tell a result is wrong when nothing crashes.

In 2026, while working full-time as a senior engineer, I turned a research challenge into three sole-authored studies on LLM-guided fuzzing (using LLMs to steer automatic test generation), all now under review. The work led two Google libraries to document behavior that silently changed data, including through a documentation fix of mine merged into json_serializable.

Before research, I spent five years shipping Android, iOS and Flutter apps in regulated fields. At a payments platform licensed by the Saudi Central Bank, I led the team that closed every penetration-test finding, with zero production security incidents. Today I build HIPAA-compliant transportation apps that handle thousands of trips a day in the US. I graduated first of ~200 in Computer Engineering.

3sole-authored papers under review at ICST, AST and FORGE 2027
18M+monthly downloads of two Google libraries where I found silent data loss, now documented
1stof ~200 in my graduating class, with a 3.97/4.00 GPA in my first year
100%of penetration-test findings closed every round at a central-bank-licensed fintech, with no security incidents

Education

B.Sc. in Engineering, Electrical Engineering (Computer Engineering and Information Technology Branch)

May 2022 Modern Academy for Engineering and Technology
  • Ranked 1st of ~200 in cohort · General grade: Excellent · CGPA 3.535/4.00 (90.03%) · First-year GPA 3.97/4.00
  • WES U.S. equivalency: Bachelor's degree, GPA 3.71/4.00 (course-by-course evaluation, 180 semester credits)
  • Graduation project: Modern Home Furniture in Virtual Reality (Grade A+, team leader; advisor: Prof. Abdelmoneim Fouda). An augmented-reality app (Flutter, Unity3D, Google ARCore) that places furniture in a real room at real scale; systematic testing of the mobile-to-engine communication layer across devices and performance conditions.
  • Selected coursework: Data Structures & Algorithms · Program Design & Computer Language · Distributed Computer Systems · Computer Modeling & Simulation · Software Engineering · Languages & Compilers · Operating Systems · Computer Architecture · Probability & Statistics

News

What I Want to Work On

I want to spend my Ph.D. answering one central question: How can automated testing catch bugs and security vulnerabilities before attackers exploit them or users pay for them, including silent failures that never crash, while giving developers a short list of real defects they can act on?

Creating test inputs is the easy part. The hard part is knowing what the right output should have been, known as the oracle problem. A crash makes that obvious, but the failures I care about most never crash. My results point to three directions:

What I want to learn. Each of my studies showed a problem in one setting. In a Ph.D., I want to turn those findings into methods that hold across many programs and that developers trust. That means learning to combine fuzzing with program analysis, so testing agents can aim at the code they have not reached yet; to run experiments large enough to support general claims; and to build benchmarks that others can use to measure progress.

What I bring to a lab. Five years of building and securing production apps, a working LLM fuzzing setup and experience leading and teaching engineers. I will use that experience to help newer students design reliable experiments, as my professors helped me, and to keep turning research findings into fixes that maintainers merge.

Publications

ICST 2027 · under review

Where Does an LLM Fuzzer's Domain Knowledge Come From? Human, Code-Read, and Self-Acquired Knowledge for Differential Testing of Typed Deserializers

Ziyad Mohammad Mansy Ibrahim (sole author)

In Dart, knowledge written by a person worked best (30.9% of inputs exposed disagreements, vs. 11.6% from reading code and 1.5% with none); in Kotlin, an agent's own experiments raised the rate from 50% to 67%.

PreprintCode & dataSoftware DOI
Cite
@misc{ibrahim2026knowledge,
  author = {Ibrahim, Ziyad Mohammad Mansy},
  title  = {Where Does an {LLM} Fuzzer's Domain Knowledge Come From? Human, Code-Read, and Self-Acquired Knowledge for Differential Testing of Typed Deserializers},
  year   = {2026},
  note   = {Preprint, under review at ICST 2027},
  doi    = {10.5281/zenodo.23002933}
}
AST 2027 (co-located with ICSE) · under review

Beyond Sanitizers: LLM-Guided Refinement for Differential JSON Deserialization Testing in Dart

Ziyad Mohammad Mansy Ibrahim (sole author)

Found silent data errors in 5.7% of 43,336 checks; missing domain knowledge, not search, was what held the LLM fuzzer back.

PreprintCode & dataSoftware DOI
Cite
@misc{ibrahim2026beyond,
  author = {Ibrahim, Ziyad Mohammad Mansy},
  title  = {Beyond Sanitizers: {LLM}-Guided Refinement for Differential {JSON} Deserialization Testing in {Dart}},
  year   = {2026},
  note   = {Preprint, under review at AST 2027},
  doi    = {10.5281/zenodo.22555794}
}
FORGE 2027 (co-located with ICSE) · under review

Coverage-Free Fuzzing: LLM-Guided Refinement of Grammar-Based Test Generators

Ziyad Mohammad Mansy Ibrahim (sole author)

Without seeing the target's code, LLM refinement raised valid cJSON inputs from 58% to 97%; a pre-registered replication showed where the approach fails.

PreprintCode & dataSoftware DOI
Cite
@misc{ibrahim2026coverage,
  author = {Ibrahim, Ziyad Mohammad Mansy},
  title  = {Coverage-Free Fuzzing: {LLM}-Guided Refinement of Grammar-Based Test Generators},
  year   = {2026},
  note   = {Preprint, under review at FORGE 2027},
  doi    = {10.5281/zenodo.22556342}
}

Research Experience

Independent Researcher, LLM-Guided Software Testing

2026 – Present Three sole-authored studies, all under review (see Publications). It began with a fuzzing challenge Dr. Marcelo D'Amorim (NC State) set for about 70 prospective Ph.D. applicants; my solution passed, and I was one of about 20 invited to a Q&A session. Each study answers a question the previous one raised.
  • Can an LLM improve a fuzzer without seeing the target's code? (FORGE) I built a fuzzer in which an LLM improves its test generator using only how the target responds from outside. On cJSON, a C parser with 13K+ GitHub stars, valid inputs rose from 58% to 97%. On a second parser it failed, because that parser rejects inputs without saying why. Lesson: feedback is only as useful as what the target tells you.
  • How do you find bugs that never crash? (AST) JSON libraries in Flutter apps rarely crash; they silently change values. I compared four common ways to decode JSON in Dart and checked each decoded number against the original text. The LLM fuzzer first trailed a simple generator (2.9% vs. 22.2%); four facts about the libraries raised it to 28.8%. Lesson: what the fuzzer lacked was knowledge, not more searching. This work found silent data loss in Google's json_serializable and built_value, both now documented.
  • Can an AI agent learn that knowledge itself? (ICST) On eight JSON libraries in Dart and Kotlin, I gave the same fuzzer knowledge from three sources: written by me, read from the libraries' code, or learned by an agent through its own experiments. Knowledge written by a person worked best (30.9% of inputs exposed disagreements, vs. 1.5% with none). The experimenting agent helped where problems were common (50% to 67%) but missed rare ones and wrongly concluded the libraries agreed. Lesson: an agent only knows what its experiments reach. I also reported a JSON standards violation in JetBrains' kotlinx.serialization.
  • Open science: released all code, prompts and results with software DOIs, so every number can be rechecked; the key experiments were pre-registered before any data was collected.

Undergraduate Researcher, Breast Tumor Classification

2021 – 2022 Modern Academy for Engineering and Technology · Advisor: Dr. Manar Donia
  • Trained a TensorFlow transfer-learning classifier on 5,000+ benign and malignant breast-tumor scans, with OpenCV preprocessing.
  • Deployed the model in a Flutter app with TensorFlow Lite that classifies a scan fully offline and shows related medical information.

Open Source and Upstream Impact

Honors and Selections

Leadership and Teaching

Industry Experience

5+ years shipping production iOS, Android and web apps in fintech, healthcare, transportation, HR and real estate for clients in the US, UK, Saudi Arabia and the UAE, with 200K+ combined downloads.

Senior Mobile Software Engineer, Naveera Tech

May 2026 – Present Remote (US)
  • Took over a fleet-operations platform that had gone 9 months without a release and shipped it to the App Store and Google Play within one month of joining; it now handles thousands of trips per day for hundreds of US client organizations.
  • Built the HIPAA-compliant Driver and Client apps used by non-emergency medical transportation (NEMT), paratransit and commercial transportation providers.
  • Kept dispatch, navigation and trip state correct through connectivity loss by designing an offline-first architecture that queues operations and reconciles them automatically on reconnection.
  • Built in-app navigation with live routing and turn-by-turn guidance, and the dispatch, routing and billing workflows that connect drivers, clients and operators.
  • Owned testing end to end: wrote unit and integration tests, ran manual test passes, and used AI agents to execute manual-style test scenarios across the apps' core flows.

Senior Mobile Software Engineer, Focal Agent

Aug 2024 – Apr 2026 Remote (UK)
  • Delivered AI features for PropertyBox, a real-estate platform used by agencies across the UK, Europe and the UAE: automated property-description generation, AI photo enhancement and one-step social publishing.
  • Built client-specific customizations for enterprise clients Reapit and Connells, and UK regulatory workflows for EPC compliance and campaign management.
  • Shipped and maintained one Flutter codebase across Web, Android and iOS through automated Azure Pipelines CI/CD.
  • Wrote unit and integration tests, and used AI agents to automate manual testing, exercising the app the way a real human tester would.
  • Led the team's knowledge-sharing sessions on AI-assisted software development.

Lead Mobile Software Engineer, Madfu (BNPL fintech)

Jan 2023 – Jul 2024 Remote (Saudi Arabia)
  • Led 3 senior Flutter engineers and owned the architecture and delivery of the consumer and merchant POS apps (100K+ downloads) of a BNPL platform licensed by the Saudi Central Bank (SAMA).
  • Built installment plans, payment flows, and merchant and point-of-sale integrations for the platform's consumers and merchants.
  • Maintained zero production security incidents by closing all 5–10 findings from each recurring third-party penetration test, including secure key handling, encryption at rest, SSH hardening and screen-capture protection.
  • Built the team's quality process from nothing: mandatory code review, a shared component library and test-driven development, which reduced bugs and shortened release cycles.

Senior Mobile Software Engineer, Assas IT Solutions

Jan 2022 – Dec 2022 Remote (Saudi Arabia)
  • Built core features of Tahara, a women's-health app that reached #2 in Health & Fitness on the Saudi App Store, with 100K+ downloads and a 4.6/5 rating from 1.2K+ reviews.
  • Implemented the menstrual-cycle calculations and their visualization, and a week-by-week pregnancy calendar.

Founding Mobile Software Engineer, Talmaro

Mar 2021 – Dec 2021 Remote (UAE)
  • Built and shipped Talmaro-ESS from scratch as the company's first mobile engineer, an enterprise HR app that reached 10K+ downloads across the App Store, Google Play and Huawei AppGallery.
  • Delivered the attendance, payroll, leave and team-approval workflows used by employees and managers.

Independent App Developer, Google Play

Self-published
  • Designed, developed and published 5 apps as sole developer, including a Flutter app in 9 languages (1K+ downloads, 4.9/5) and four native Android apps in Java and Kotlin.

Skills