用小模型高效检测智能合约漏洞,比大模型还准还快。
FTSmartAudit: A Knowledge Distillation-Enhanced Framework for Automated Smart Contract Auditing Using Fine-Tuned LLMs
- 通过多阶段知识蒸馏,把大模型的漏洞检测能力迁移到小模型。
- 小模型在复杂漏洞检测上超越商用工具和大模型,计算开销大幅降低。
- 适合需要隐私保护与高效部署的区块链安全审计场景。
区块链技术的快速发展推动了智能合约的广泛应用,但其固有的漏洞已造成重大财务损失。传统审计方法难以应对智能合约日益增长的复杂性和规模。大型语言模型(LLMs)在自动化漏洞检测方面展现出潜力,但其高计算成本限制了实际应用。尽管已有研究探索通过智能体或工作流利用大模型,却较少关注如何提升小型微调模型的性能——这正是实现效率与数据隐私的关键。本文提出HKT-SmartAudit框架,旨在开发针对智能合约审计的轻量级模型。该框架采用多阶段知识蒸馏流程,融合经典蒸馏、外部领域知识及奖励引导学习,将大教师模型中的高质量洞察有效迁移至学生模型。通过单任务学习策略训练紧凑的学生模型,在保持高准确率与鲁棒性的同时显著降低计算开销。实验表明,所训练的蒸馏模型在检测复杂漏洞和逻辑缺陷方面优于商用工具及更大模型,为智能合约审计提供了一种实用、安全且可扩展的解决方案。源代码已开源于GitHub仓库。
原文摘要 · Abstract (English)
The rapid growth of blockchain technology has driven the widespread adoption of smart contracts. However, their inherent vulnerabilities have led to significant financial losses. Traditional auditing methods, while essential, struggle to keep pace with the increasing complexity and scale of smart contracts. Large Language Models (LLMs) offer promising capabilities for automating vulnerability detection, but their adoption is often limited by high computational costs. Although prior work has explored leveraging large models through agents or workflows, relatively little attention has been given to improving the performance of smaller, fine-tuned models--a critical factor for achieving both efficiency and data privacy. In this paper, we introduce HKT-SmartAudit, a framework for developing lightweight models optimized for smart contract auditing. It features a multi-stage knowledge distillation pipeline that integrates classical distillation, external domain knowledge, and reward-guided learning to transfer high-quality insights from large teacher models. A single-task learning strategy is employed to train compact student models that maintain high accuracy and robustness while significantly reducing computational overhead. Experimental results show that our distilled models outperform both commercial tools and larger models in detecting complex vulnerabilities and logical flaws, offering a practical, secure, and scalable solution for smart contract auditing. The source code is available at Github repository.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。