用强化学习让AI写安全可解释的智能合约,效果远超现有方法。
Towards Secure and Explainable Smart Contract Generation with Security-Aware Group Relative Policy Optimization
- 通过分步训练让模型学会人类级安全分析逻辑。
- 生成合约漏洞率仅8.6%,全功能通过率50.53%,领先基线45.79%。
- 结果既安全又易懂,适合开发者与审计人员使用。
智能合约管理高价值资产,漏洞可能导致灾难性损失。大语言模型在此面临双重缺陷:作为不可审计的“黑箱”,缺乏透明推理过程,导致生成代码存在严重安全漏洞。为此,我们提出SmartCoder-R1(基于Qwen2.5-Coder-7B),一个安全且可解释的智能合约生成框架。首先进行持续预训练(CPT)以专精模型;接着在7,998个专家验证的推理-代码样本上进行长链式思维监督微调(L-CoT SFT),使模型模仿人类安全分析;最后采用安全感知组相对策略优化(S-GRPO),通过优化编译成功率、安全合规性与格式正确性的加权奖励信号,直接降低漏洞。在包含756个真实函数的基准上评估,相较于17个基线,SmartCoder-R1达到新最优:ComPass 87.70%,VulRate 8.60%,SafeAval 80.16%,FuncRate 53.84%,FullRate 50.53%。其中全功能通过率相较最强基线DeepSeek-R1提升45.79%。人工评估显示,生成推理在功能性(82.7%)、安全性(85.3%)和清晰度(90.7%)上均获高质量评价。
原文摘要 · Abstract (English)
Smart contracts automate the management of high-value assets, where vulnerabilities can lead to catastrophic financial losses. This challenge is amplified in Large Language Models (LLMs) by two interconnected failures: they operate as unauditable "black boxes" lacking a transparent reasoning process, and consequently, generate code riddled with critical security vulnerabilities. To address both issues, we propose SmartCoder-R1 (based on Qwen2.5-Coder-7B), a novel framework for secure and explainable smart contract generation. It begins with Continual Pre-training (CPT) to specialize the model. We then apply Long Chain-of-Thought Supervised Fine-Tuning (L-CoT SFT) on 7,998 expert-validated reasoning-and-code samples to train the model to emulate human security analysis. Finally, to directly mitigate vulnerabilities, we employ Security-Aware Group Relative Policy Optimization (S-GRPO), a reinforcement learning phase that refines the generation policy by optimizing a weighted reward signal for compilation success, security compliance, and format correctness. Evaluated against 17 baselines on a benchmark of 756 real-world functions, SmartCoder-R1 establishes a new state of the art, achieving top performance across five key metrics: a ComPass of 87.70%, a VulRate of 8.60%, a SafeAval of 80.16%, a FuncRate of 53.84%, and a FullRate of 50.53%. This FullRate marks a 45.79% relative improvement over the strongest baseline, DeepSeek-R1. Crucially, its generated reasoning also excels in human evaluations, achieving high-quality ratings for Functionality (82.7%), Security (85.3%), and Clarity (90.7%).
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。