The report
An owner can leave a token's public functions looking ordinary while keeping separate powers to restrict transfers or rewrite balances. A preprint submitted on October 4, 2026 proposes a different way to screen that code: read selected internal activations of a frozen language model and train a small classifier on those signals, rather than ask the model to write an audit. The authors report encouraging controlled results, but none establishes that a live scam was stopped.
The method is called ContractLens. Its seven authors include Shuyi Miao and corresponding author Wangjie Qiu, with affiliations at Beihang University, Beijing University of Posts and Telecommunications, and the National University of Singapore.
What the model actually does
ContractLens runs BNB Smart Chain contract source through pretrained code or general language models and examines their internal representations. First, layerwise probes identify hidden states that separate contracts carrying target code features from labeled negatives. The authors then test two alternatives to a genuine security signal: does removing the relevant restriction or privileged behavior change the representation, and do harmless changes such as renaming variables leave it relatively stable? Only layers passing the selection tests remain candidates.
Within those layers, the researchers rank feed-forward units by their response differences, contribution to a trained probe, and sensitivity to the relevant code change. They call the selected features malicious contract-discriminative units, or MCDUs. Their activations feed logistic regression, so the pretrained backbone stays frozen, although selecting features and training the classifier still require labeled data. The methodology Claim and neuron-probing Concept explain the selection and intervention boundaries in detail.
What the reported numbers measure
The paper's evaluations answer different questions, with different models and populations. They should not be merged into one detection rate.
| Evaluation | Author-reported result | What was tested |
|---|---|---|
| Ten intent tasks | 92.41% accuracy; 96.24% AUROC | Qwen2.5-Coder-7B, macro averages of ten one-intent-versus-benign BSC classification tasks |
| Previously unseen intents | 73.50% accuracy; 73.51% F1 | Five held-out mechanisms on balanced CodeGemma-based tests; the strongest competing mean accuracy is 66.08% |
| Later-deployed contracts | 77.50% accuracy; 84.13% AUROC | Three mechanisms in a separately filtered BSC token collection, not a prospective 2026 service |
| Targeted neuron masking | Accuracy 91.52% to 83.04%; AUROC 95.02% to 94.17% | A Qwen3-8B full-activation probe, comparing removal of selected units with control neurons |
The main corpus contains 32,141 BSC contracts, with 21,166 assigned a positive code-intent label and 10,975 assigned a benign label. The authors group identical source code or creator identities into the same partition before splitting the data. This is a useful leakage precaution, but the label itself is the central limitation: it denotes a capability that could be abused, not a verified fraud outcome. The underlying dataset card includes Reflection, Reward, Rebase and Mint, which can also describe legitimate token mechanics. None should automatically be translated into an accusation against a contract operator. See the annotation boundary.
The more interesting experiment is not the headline accuracy
The researchers also remove the units their ranking algorithm identifies. On Qwen3-8B, masking those units reduces a trained probe's accuracy by 8.48 percentage points; masking the same number of random units leaves it unchanged, while removing activation-matched nonselected units reduces it by just 0.25 point. That controlled contrast is evidence that the chosen activations matter to the classifier, rather than merely appearing unusual in a neuron visualization.
There is an important qualification inside the same table. AUROC drops by only 0.85 point in the selected-unit experiment. Accuracy measures decisions under a particular classification rule, while AUROC evaluates discrimination across thresholds. The large accuracy change therefore cannot be restated as removal of the model's general ability to distinguish unsafe code. Nor does the result establish that one neuron has a stable, human-readable meaning such as 'honeypot'. It establishes task-specific functional contribution under the tested intervention. The original ablation table supports this narrower reading.
A contract illustrates the gap between a code signal and a fraud finding
The paper's Lucky Shiba example combines an owner-controlled allowlist with a delegated-transfer counter that can prevent repeat transfers. A separate privileged function can overwrite a holder balance without changing total supply or emitting a Transfer event. ContractLens assigns the specimen a 95.68% predicted probability under the dataset's Mint label; several compared classifiers score it below the study's detection threshold. The code paths give a concrete reason to investigate, but the study does not document trades blocked in production, stolen funds, a victim or a successful intervention. Read the documented code-level finding.
Where the detector would belong
The October paper is part of a developing line of defensive AI research, not the first investigation of security-associated neurons. A July 2026 PyPI study probed malicious and benign Python packages and intervened on selected neurons in three instruction-tuned models. It examines a different malware population and does not reproduce the EVM result.
The neighboring DG-VDT Ethereum research asks a different question again: after transactions have produced EVM traces, can a graph-guided detector classify three defined vulnerability patterns and attribute an attacking address? ContractLens starts from source code, where execution may never have occurred; DG-VDT starts from observable execution evidence. Their reported benchmark numbers cannot be compared as if they used the same task or truth labels. Together they suggest a possible review order: flag suspicious source, verify relevant privileges and reachable states, simulate risky execution paths, and analyze traces when available. That is an editorial workflow inference, not a deployed integration described by either paper.
Reproducibility is still the major obstacle between these experiments and operational trust. The ContractLens preprint provides methods and controlled comparisons, but independent full-pipeline reproduction was not established in this research. Its later-deployment comparison begins from a larger 2023-2025 token collection and applies additional filters without stating the final per-mechanism test denominators. A separate 32-label result trains only the decoder after the relevant units were already chosen; it does not mean the whole detection system was built from 32 examples. Production evaluation would also have to measure false alerts at realistic token-launch prevalence, proxy and upgrade patterns, adversarial rewrites and the cost of repeatable source acquisition.
The strongest conclusion currently supported is specific: pretrained models contain activation features that help a trained classifier recognize this study's annotated contract capabilities, and selected features make a measurable contribution under intervention. That can justify deeper inspection, but not a safe-contract certificate or an independently verified fraud judgment. The ContractLens evidence dossier contains the underlying Claims, source locators and unresolved checks.