Robust Smart Contract Vulnerability Detection via Contrastive Learning-Enhanced Granular-ball Training

Zeli Wang; Qingxuan Yang; Shuyin Xia; Yueming Wu; Bo Liu; Longlong Lin

cs.LGMar 29, 2026

Robust Smart Contract Vulnerability Detection via Contrastive Learning-Enhanced Granular-ball Training

Authors: Zeli Wang, Qingxuan Yang, Shuyin Xia, Yueming Wu, Bo Liu, Longlong Lin

Organizations: Chongqing Key Laboratory of Computational Intelligence, Key Laboratory of Cyberspace Big Data Intelligent Security, Ministry of Education, and Key Laboratory of Big Data Intelligent Computing, Chongqing University of Posts and Telecommunications. · the School of Cyber Science and Engineering, Huazhong University of Science and Technology. · School of Computer Science and Artificial Intelligence, Zhengzhou University, China. · the College of Computer and Information Science, Southwest University, China.

Abstract

Deep neural networks (DNNs) have emerged as a prominent approach for detecting smart contract vulnerabilities, driven by the growing contract datasets and advanced deep learning techniques. However, DNNs typically require large-scale labeled datasets to model the relationships between contract features and vulnerability labels. In practice, the labeling process often depends on existing open-sourced tools, whose accuracy cannot be guaranteed. Consequently, label noise poses a significant challenge for the accuracy and robustness of the smart contract, which is rarely explored in the literature. To this end, we propose Contrastive learning-enhanced Granular-Ball smart Contracts training, CGBC, to enhance the robustness of contract vulnerability detection. Specifically, CGBC first introduces a Granular-ball computing layer between the encoder layer and the classifier layer, to group similar contracts into Granular-Balls (GBs) and generate new coarse-grained representations (i.e., the center and the label of GBs) for them, which can correct noisy labels based on the most correct samples. An inter-GB compactness loss and an intra-GB looseness loss are combined to enhance the effectiveness of clustering. Then, to improve the accuracy of GBs, we pretrain the model through unsupervised contrastive learning supported by our novel semantic-consistent smart contract augmentation method. This procedure can discriminate contracts with different labels by dragging the representation of similar contracts closer, assisting CGBC in clustering. Subsequently, we leverage the symmetric cross-entropy loss function to measure the model quality, which can combat the label noise in gradient computations. Finally, extensive experiments show that the proposed CGBC can significantly improve the robustness and effectiveness of the smart contract vulnerability detection when contrasted with baselines.

Figures & tables

Ref.	Main work	Remarks
[ 22 ]	Symbolic execution is used to explore contract execution paths for vulnerability detection.	It gives clear semantic analysis, but it suffers from path explosion and high analysis cost.
[ 23 ]	Static analysis is performed by extracting structural and dependency information from smart contracts.	It is practical and efficient, but it still relies heavily on handcrafted rules.
[ 24 ]	Formal verification is used to check safety properties of smart contracts.	It provides stronger theoretical support, but it needs formal modeling and has high verification cost.
[ 25 ]	Fuzzing is combined with taint analysis and feedback guidance to generate exploit-oriented test cases.	It can better validate triggerable vulnerabilities than pure static analysis, but it is still sensitive to seed quality and path coverage.
[ 26 ]	Graph neural networks are combined with interpretable graph features and expert patterns for smart contract vulnerability detection.	It balances representation learning and interpretability, but its flexibility is limited by expert-designed knowledge.
[ 3 ]	Vulnerability subgraphs are constructed and graph neural networks are used for Ethereum smart contract vulnerability detection.	It improves vulnerability-oriented structural modeling, but it still assumes relatively reliable labels during training.

TABLE I : Comparison of representative related studies and our method.

Fig. 1 : The illustration of the overall workflow of CGBC, consisting of two main procedures: contrastive learning-based representation initialization and robust vulnerability detection by Granular-ball training.

Fig. 2 : An illustration example of smart contract augmentation.

Formalized Word	Meaning	Example
TYPE	Variable type	‘uint256’, ‘bool’
MOD	Modifier	‘public’, ‘private’
VAR	Variable name	‘V1’, ‘V2’
OP	Arithmetic Operation	‘=’, ‘+’, ‘-’, ‘*’, ‘/’
CTRL	Control statement	‘if’, ‘while’, ‘for’

TABLE II : Actual meanings of the formalized words in our methods.

Line #	Methods	RE			TD			IO			Average
Line #	Methods	R(%)	P(%)	F(%)	R(%)	P(%)	F(%)	R(%)	P(%)	F(%)	R(%)	P(%)	F(%)
1	sFuzz [ 47 ]	14.95	10.88	12.59	27.01	23.15	24.93	47.22	58.62	52.31	29.73	30.88	29.94
2	Smartcheck [ 28 ]	16.34	45.71	24.07	79.34	47.89	59.73	56.21	45.56	50.33	50.63	46.39	44.71
3	Osiris [ 48 ]	63.88	40.94	49.90	55.42	59.26	57.28	n/a	n/a	n/a	n/a	n/a	n/a
4	Oyente [ 22 ]	63.02	46.56	53.55	59.97	61.04	59.47	n/a	n/a	n/a	n/a	n/a	n/a
5	Mythril [ 49 ]	75.51	42.86	54.68	49.80	57.50	53.37	62.07	72.30	66.80	62.46	57.55	58.28

TABLE III : Evaluation results on RQ1: effectiveness on vulnerability detection. The best results of a certain metric for each vulnerability type are highlighted in bold .

Panel of Figure 6 — Fig. 3 : Evaluation results on RQ2: ablation studies on the core modules of CGBC.

	RE						TD						IO
Noise	BaseLine			CGBC			BaseLine			CGBC			BaseLine			CGBC
Levels	P(%)	R(%)	F(%)	P(%)	R(%)	F(%)	P(%)	R(%)	F(%)	P(%)	R(%)	F(%)	P(%)	R(%)	F(%)	P(%)	R(%)	F(%)
0%	74.49	60.83	66.97	92.65	96.92	94.74	65.91	82.86	73.42	98.55	95.77	97.14	60.57	81.40	69.46	96.77	100	98.36
10%	58.08	45.65	51.12	90.62	87.88	89.23	76.11	46.77	57.94	86.16	96.55	91.06	90.04	63.53	74.50	86.15	96.55	91.05
20%	47.86	39.53	43.30	71.43	97.83	82.57	61.66	37.77	46.84	72.41	84.00	77.78	86.29	56.45	68.25	75.44	72.88	74.14
30%	50.34	34.82	41.17	70.17	78.43	74.07	45.61	41.68	43.56	65.57	81.63	72.73	80.77	53.99	64.72	71.88	77.97	74.80

TABLE IV: Evaluation results on RQ3: robustness against label noise.

Type	RE						TD						IO
Noise Level	0%		20%		40%		0%		20%		40%		0%		20%		40%
Methods	Clear	CGBC	Clear	CGBC	Clear	CGBC	Clear	CGBC	Clear	CGBC	Clear	CGBC	Clear	CGBC	Clear	CGBC	Clear	CGBC
P(%)	96.81	92.65	58.00	71.43	50.93	64.10	94.30	98.55	66.17	72.41	50.54	57.58	89.81	96.77	66.53	75.44	52.80	68.12
R(%)	96.43	96.92	59.18	97.83	35.50	60.98	98.41	95.77	65.19	84.00	64.83	69.10	91.48	100.00	69.30	72.88	80.73	79.67
F(%)	96.62	94.74	58.59	82.57	41.84	62.50	96.31	97.14	67.18	77.78	56.80	62.81	90.64	98.36	67.88	74.14	63.84	73.44

TABLE V: Comparison results with the most related work Clear [ 12 ] . The best results of a certain metric under the same dataset and noise level are highlighted in bold .

Panel of Figure 9 — Fig. 4 : Evaluation results on RQ4: effectiveness of Graunlar-ball computing in clustering smart contracts across training stages.

Software Vulnerability Detection

Software vulnerability detection identifies insecure code, pinpoints weaknesses, and helps developers validate or prevent exploitable bugs.

See all 139 papers

May 5, 2026

Tailored Prompts, Targeted Protection: Vulnerability-Specific LLM Analysis for Smart Contracts

Smart contracts on blockchains are prone to diverse security vulnerabilities that can lead to significant financial losses due to their immutable nature. Existing detection approaches often lack flexibility across vulnerability types and rely heavily on manually crafted expert rules. In this paper, we present an LLM-based framework for practical smart contract vulnerability detection. We construct and release a large-scale dataset comprising 31,165 professionally annotated vulnerability instances collected from over 3,200 real-world projects across 15 major blockchain platforms. Our approach leverages precise AST-based context extraction and vulnerability-specific prompt design to instantiate customized detectors for 13 prevalent vulnerability categories. Experimental results demonstrate strong effectiveness, achieving an average positive recall of 0.92 and an average negative recall of 0.85, highlighting the potential of carefully engineered contextual prompting for scalable and high-precision smart contract security analysis.

Xing Zhang, Keyu Zhang, Taohong Zhu +1

NetX Foundation Zug, Switzerland · Department of Computer Science University of Oxford Oxford, UK · Department of Computer Science The University of Manchester Manchester, UK

Software Vulnerability Detection LLMs for Cybersecurity Prompt Engineering

Ask PDF

Mar 30, 2026

ORACAL: A Robust and Explainable Multimodal Framework for Smart Contract Vulnerability Detection with Causal Graph Enrichment

Although Graph Neural Networks (GNNs) have shown promise for smart contract vulnerability detection, they still face significant limitations. Homogeneous graph models fail to capture the interplay between control flow and data dependencies, while heterogeneous graph approaches often lack deep semantic understanding, leaving them susceptible to adversarial attacks. Moreover, most black-box models fail to provide explainable evidence, hindering trust in professional audits. To address these challenges, we propose ORACAL (Observable RAG-enhanced Analysis with CausAL reasoning), a heterogeneous multimodal graph learning framework that integrates Control Flow Graph (CFG), Data Flow Graph (DFG), and Call Graph (CG). ORACAL selectively enriches critical subgraphs with expert-level security context from Retrieval-Augmented Generation (RAG) and Large Language Models (LLMs), and employs a causal attention mechanism to disentangle true vulnerability indicators from spurious correlations. For transparency, the framework adopts PGExplainer to generate subgraph-level explanations identifying vulnerability triggering paths. Experiments on large-scale datasets demonstrate that ORACAL achieves state-of-the-art performance, outperforming MANDO-HGT, MTVHunter, GNN-SC, and SCVHunter by up to 39.6 percentage points, with a peak Macro F1 of 91.28% on the primary benchmark. ORACAL maintains strong generalization on out-of-distribution datasets with 91.8% on CGT Weakness and 77.1% on DAppScan. In explainability evaluation, PGExplainer achieves 32.51% Mean Intersection over Union (MIoU) against manually annotated vulnerability triggering paths. Under adversarial attacks, ORACAL limits performance degradation to approximately 2.35% F1 decrease with an Attack Success Rate (ASR) of only 3%, surpassing SCVHunter and MANDO-HGT which exhibit ASRs ranging from 10.91% to 18.73%.

Tran Duong Minh Dai, Triet Huynh Minh Le, M. Ali Babar +2

Information Security Lab, University of Information Technology, Ho Chi Minh City, Vietnam · Vietnam National University, Ho Chi Minh City, Vietnam · School of Computer Science and Information Technology, Adelaide University, Adelaide, Australia

Software Vulnerability Detection Multimodal Graph Learning Heterogeneous GNNs Adversarial Robustness

Ask PDF

Aug 20, 2026

Frequency-Aware Continual Learning for Smart Contract Vulnerability Detection with Large Language Models

Smart contract vulnerability detection with Large Language Models (LLMs) faces three causally linked challenges. First, new vulnerability categories demand parameter-efficient adaptation, since full retraining is prohibitive for sequentially arriving tasks. Second, training per-task adapters on a shared backbone causes catastrophic forgetting of previously learned vulnerabilities. Third, the resulting multiplicity of adapters must be consolidated into a single model, since task identity is unknown at inference time. Each challenge arises directly from the solution to its predecessor, making an integrated framework essential. We propose a three-stage pipeline in which each stage addresses one challenge and feeds into the next. The adaptation stage uses Frequency-Aware Low-Rank Adaptation (FA-LoRA), which performs adaptation in the Fourier domain with per-frequency importance gates, requiring only 0.4% trainable parameters while outperforming standard LoRA and QLoRA. The continual learning stage applies Forget-Aware Replay (FAR), which uses these frequency gates to estimate per-sample forgetting risk via loss dynamics and prioritizes vulnerable knowledge for rehearsal, achieving an average Micro-F1 of 0.8022 across sequential tasks. The deployment stage employs Anchor-Protected Progressive Merging (APPM), which exploits the asymmetric generalization produced by FAR training to identify the strongest-generalizing adapter as an anchor and consolidates all adapters into a single model via anchor-protected weighted merging with frequency-domain gate competition. APPM achieves a Micro-F1 of 0.8085, within 2.7% of the independent per-task upper bound, at a merge cost of 156 ms and no additional runtime memory. Experiments on DIVE confirm the framework effectively addresses all three challenges for evolving blockchain ecosystems.

Tenghui Huang, Jiawen Kang, Dongning Liu +5

School of Automation, Guangdong University of Technology, Guangzhou 510006, China · School of Computer Science and Technology, Guangdong University of Technology, Guangzhou 510006, China · College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing 211106, China +4

Software Vulnerability Detection Continual Learning for LLMs Model Merging Parameter-Efficient Fine-Tuning Low-Rank Adaptation

Ask PDF

Abstract

Software Vulnerability Detection

Explore similar work

Tailored Prompts, Targeted Protection: Vulnerability-Specific LLM Analysis for Smart Contracts

ORACAL: A Robust and Explainable Multimodal Framework for Smart Contract Vulnerability Detection with Causal Graph Enrichment

Frequency-Aware Continual Learning for Smart Contract Vulnerability Detection with Large Language Models