用轻量大模型实现智能合约安全审计,准确率超98%且可生成修复建议。
Decoupled Smart Contract Audits: Lightweight LLM Framework via Distillation and Aggregation

- 分步处理漏洞检测、解释、评分和修复建议,提升审计精准度。
- 0.6B-4B参数模型达98.25%漏洞检出率,生成解释对齐度0.4375。
- 适合区块链开发者与安全团队快速评估合约风险,兼顾效率与可读性。
智能合约在去中心化网络服务中面临严峻安全挑战,亟需全面审计。尽管大语言模型(LLMs)在自动化漏洞检测方面展现出潜力,但现有方法缺乏严重性评估与可操作的修复建议,且计算开销过大。本文提出一种高效端到端的智能合约安全审计框架,采用轻量级开源大模型(0.6B-4B参数)。框架将审计任务解耦为四个相互关联模块:漏洞检测、解释生成、严重性分类与修复建议。为在小模型上保持高精度,引入秩稳定低秩适配器(rsLoRA)、知识蒸馏及定制链式验证(CoVe)聚合策略,系统筛选并整合多个模型生成结果,形成高准确率审计报告。实验表明,该轻量级流水线持续优于当前最先进的开源编码密集型大模型(7B至34B参数),漏洞检测准确率达98.25%,生成解释任务对齐得分0.4375。此外,大量消融研究验证了分步审计流程优于统一提示方法,并发现新的严重性中心性偏差,为未来基于LLM的审计研究建立关键基准。
原文摘要 · Abstract (English)
Smart contracts face critical security challenges that require thorough auditing in decentralized web services. While Large Language Models (LLMs) have shown promise in automated vulnerability detection, existing approaches lack severity evaluations with actionable remediation and demand unnecessarily massive computational overhead. In this study, we introduce an efficient end-to-end smart contract security audit framework utilizing lightweight, highly optimized open-source LLMs (0.6B-4B parameters). Our framework decouples comprehensive audit tasks into four interconnected components: vulnerability detection, explanation, severity classification, and remediation recommendation. To maintain high accuracy without massive parameters, we implement Rank-Stabilized Low-Rank Adapters (rsLoRA), knowledge distillation, and a custom Chain-of-Verification (CoVe) aggregation strategy to systematically screen and consolidate multiple draft responses from the model into a highly accurate audit report. Experimental results demonstrate that our lightweight pipeline consistently outperforms state-of-the-art open-source coder dense LLMs (7B to 34B parameters), achieving 98.25% accuracy in vulnerability detection and an alignment score of 0.4375 in generative explanation tasks. Furthermore, our extensive ablation studies empirically validate the superiority of our decoupled audit processes over unified prompting and uncover a novel severity centrality bias, establishing a critical benchmark for future research in LLM-assisted auditing.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。