Knowledge Migration Framework for Smart Contract Vulnerability Detection

TL;DR

This work tackles the generalisation and privacy challenges in smart contract vulnerability detection by introducing AF-STip, a data-free teacher–student framework augmented with an adaptive fusion module. The teacher encodes rich vulnerability semantics and transfers knowledge to a lightweight student without accessing original contract data, using a distillation strategy that combines KD and classification losses while distorting inputs with Gaussian noise to generate pseudo-samples. An adaptive fusion module integrates multi-dimensional query enhancement, external memory, and multi-stage convolutional fusion to capture both local and global vulnerability features while maintaining computational efficiency. Empirical results show strong performance gains over traditional tools and DL baselines, robust generalisation to unseen vulnerabilities, and a publicly released dataset to advance research in this area.

Abstract

As a cornerstone of blockchain technology in the 3.0 era, smart contracts play a pivotal role in the evolution of blockchain systems. In order to address the limitations of existing smart contract vulnerability detection models with regard to their generalisation capability, an AF-STip smart contract vulnerability detection framework incorporating efficient knowledge migration is proposed. AF-STip employs the teacher network as the main model and migrates the knowledge processed by the smart contract to the student model using a data-free knowledge distillation method. The student model utilises this knowledge to enhance its vulnerability detection capabilities. The approach markedly enhances the model's capacity for feature extraction and cross-class adaptation, while concurrently reducing computational overhead.In order to further enhance the extraction of vulnerability features, an adaptive fusion module is proposed in this paper, which aims to strengthen the interaction and fusion of feature information.The experimental results demonstrate that the STip model attains an average F1 value detection score of 91.16% for the four vulnerabilities without disclosing the original smart contract data. To validate the viability of the proposed lightweight migration approach, the student model is deployed in a migration learning task targeting a novel vulnerability type, resulting in an accuracy of 91.02% and an F1 score of 90.46%. To the best of our knowledge, AF-STip is the inaugural model to apply data-free knowledge migration to smart contract vulnerability detection. While markedly reducing the computational overhead, the method still demonstrates exceptional performance in detecting novel vulnerabilities.

Figures (7)

• Figure 1: depicts the methodology employed to derive embedding vectors from raw smart contract code through preprocessing and normalization. This process encompasses the following steps: (A) The removal of superfluous information from the source code; (B) The segmentation of pertinent code segments and the annotation of critical vulnerability behaviours; (C) The processing of word embedding and the generation of a matrix.
• Figure 2: Word cloud map of key semantic distributions in the smart contract vulnerability dataset.
• Figure 3: The smart contract vulnerability detection framework in this paper. (A) Semantic Processing Module: Converts the smart contract source code into embedded vector representations and uses positional encoding to enhance vulnerability feature representation. (B) Teacher-Student Neural Network Framework: Consists of a complex teacher network (including the adaptive fusion module) and a student Network.
• Figure 4: General architecture of the adaptive fusion module in this paper. (A) Multi-dimensional query enhancement mechanism. (B) External memory modelling. (C) Multi-level convolutional fusion enhancement. In the figure $\oplus$ denotes the interaction between the modules and the enhancement operation.
• Figure 5: Comparison of STip model loss and accuracy before and after data-free knowledge distillation (Reentrancy vulnerability and Timestamp vulnerability test set)