DeepTx: Real-Time Transaction Risk Analysis via Multi-Modal Features and LLM Reasoning

TL;DR

DeepTx tackles phishing in Web3 by performing pre-signing transaction analysis through forked-EVM simulations, extracting behavioral, contextual, and UI features, and applying consensus-driven LLM reasoning with self-reflection to assess risk. The system fuses multi-modal signals with a malicious-threat database and outputs both human-readable risk reports and structured JSON for automation. Key contributions include the end-to-end architecture for real-time risk assessment, a multi-LLM consensus and self-reflection framework, and an open-source tool plus phishing dataset. Evaluation on a curated phishing dataset shows high precision and recall, with UI signals notably enhancing recall, and the work has practical implications for onboarding wallets and DApps with proactive risk warnings. Future directions include expanding dataset coverage and incorporating blind-signature analysis to further improve robustness.

Abstract

Phishing attacks in Web3 ecosystems are increasingly sophisticated, exploiting deceptive contract logic, malicious frontend scripts, and token approval patterns. We present DeepTx, a real-time transaction analysis system that detects such threats before user confirmation. DeepTx simulates pending transactions, extracts behavior, context, and UI features, and uses multiple large language models (LLMs) to reason about transaction intent. A consensus mechanism with self-reflection ensures robust and explainable decisions. Evaluated on our phishing dataset, DeepTx achieves high precision and recall (demo video: https://youtu.be/4OfK9KCEXUM).

Figures (3)

• Figure 1: Overview of DeepTx
• Figure 2: LLM prompt template used in DeepTx (generalized for $n$ models)
• Figure 3: Final analysis summary produced by DeepTx. The output provides a human-readable explanation, transaction-specific confidence score, and actionable recommendations for user decision making.