ContractLens: Latent Security Knowledge for Malicious Smart Contract Detection

Evidence record

Primary October 4, 2026 preprint by Miao and six coauthors. The authors propose layerwise probing and malicious-contract-discriminative-unit selection from frozen pretrained language models, then train a lightweight classifier on selected activations. It reports tests on 32,141 BSC contract sources, ten labeled intents, neuron masking and constrained cross-intent and later-deployment evaluations. The reported scores are author-run research results, not independently reproduced production detection.

Read the original source ↗

Claim-level citations (16)

• supportsContractLens finds useful internal model signals for malicious smart-contract screening: ContractLens first locates model layers with separability, counterfactual malicious-logic sensitivity and surface-edit stability; it then ranks feed-forward units by activation contrast, probe weight and logic specificity, before training a separate logistic-regression classifier on selected activations while keeping the pretrained language model frozen.

  Sections 3.1-3.2, Equations 1-13 and Figure 2, including the MCDU selection and detection paragraphs

• supportsContractLens finds useful internal model signals for malicious smart-contract screening: Miao and six coauthors from Beihang University, Beijing University of Posts and Telecommunications, and the National University of Singapore submitted ContractLens as arXiv:2610.04992v1 on October 4, 2026; the record is a preprint, not an independently reproduced evaluation.

  arXiv v1 header, author affiliations and submission date, before Section 1

• supportsContractLens finds useful internal model signals for malicious smart-contract screening: The authors report a filtered BNB Smart Chain set of 32,141 contracts with 21,166 contracts labeled positive for at least one of ten risky token-code intents and 10,975 labeled benign. The intent labels identify code-level capabilities rather than established malicious use or on-chain victimization. Creator- or source-identical contracts are assigned to the same 64/16/20 training, validation or test group.

  Section 4.1 Implementation Details, Dataset paragraph: 32,141 total, 21,166 positive, 10,975 benign, ten intent labels, group-split procedure

• supportsContractLens finds useful internal model signals for malicious smart-contract screening: In CodeGemma-based leave-one-intent-out tests on five held-out malicious mechanisms, the authors report 73.50% mean accuracy and 73.51% mean F1 for ContractLens; the strongest competing mean accuracy shown is 66.08% for SCMDetector. Each held-out test set is balanced between malicious and benign samples.

  Section 4.2 Evaluation on Unseen Malicious Intents and Table 2, including test-set balance and five held-out intents

• supportsContractLens finds useful internal model signals for malicious smart-contract screening: In the Qwen3-8B functional masking test, zeroing the identified discriminative units reduced a full-activation linear probe's accuracy from 91.52% to 83.04%, an 8.48-percentage-point loss; masking random neurons produced no reduction, and masking activation-matched nonselected neurons reduced accuracy by 0.25 point.

  Section 4.3 Neurons Validation and Functional Specificity; Table 3 Qwen3-8B masking rows and control definitions

• supportsContractLens finds useful internal model signals for malicious smart-contract screening: In a separate evaluation of three scam-related token mechanisms drawn from BSC token data originally collected from March 2023 through June 2025 and filtered to deployments after the backbone model's public release, the authors report 77.50% average accuracy and 84.13% AUROC. The experiment is not a prospective measurement of 2026 live-screening performance.

  Section 4.4 Detection of Newly Deployed Malicious Smart Contracts, temporal dataset provenance, time filter and Table 4

• supportsContractLens finds useful internal model signals for malicious smart-contract screening: An earlier July 2026 study by Dao and collaborators examined neuron-level malicious-code detection on 1,500 malicious and 1,500 benign PyPI packages, including interventions in three language models. ContractLens therefore extends a related interpretability approach to EVM contract intent detection rather than introducing the first security-neuron probing experiment.

  Section 2 Related Work paragraph citing Dao et al. (2026) on malicious Python package neuron localization

• supportsContractLens finds useful internal model signals for malicious smart-contract screening: The paper's Lucky Shiba case study describes an owner-controlled allowlist, a delegated-transfer counter that can block later transfers, and an owner-accessible mint function that overwrites account balances without adjusting total supply or emitting a Transfer event. ContractLens assigns 95.68% predicted probability to the dataset's malicious Mint label for that sample; the example does not document victim losses.

  Appendix E Case Study: A Real Honeypot-Mint Token, Table 7 and paragraphs describing Lucky Shiba code and classifier output

• supportsContractLens finds useful internal model signals for malicious smart-contract screening: For Qwen2.5-Coder-7B, ContractLens reports 92.41% accuracy and 96.24% AUROC averaged across ten one-versus-benign intent tasks; the main study also reports 91.21% accuracy on Qwen3-8B and 90.94% on the named CodeGemma backbone. These are author-run benchmark averages, not field precision or independently confirmed interception rates.

  Table 1 and Section 4.2 Quantitative Results, with Section 4.1 explaining per-intent binary tasks and splits

• supportsContractLens finds useful internal model signals for malicious smart-contract screening: The ContractLens authors explicitly caution that their identified signals do not establish a universal detector of arbitrary future malicious behavior and remain limited by the security knowledge of the underlying pretrained backbone. Their experiments use code-intent labels and controlled held-out settings rather than independent validation of real-world exploitation outcomes.

  Appendix F final discussion on generalization limits, read with Section 4.1 dataset labels and Sections 4.2-4.4 evaluation settings

• supportsContractLens finds useful internal model signals for malicious smart-contract screening: The underlying Web3 Software Engineering Lab dataset defines Reflection as token-tax redistribution to holders, Reward as distributions intended to incentivize participation, Rebase as algorithmic supply adjustments, and Mint as token creation; it also defines features such as blacklists, sell limits and trading controls. These are categorized capabilities, so a model hit on an annotated intent is not by itself a finding of fraud, loss, or exploitable vulnerability.

  Section 4.1 Dataset paragraph, which defines malicious intent as code-level capability rather than confirmed exploitation

• supportsContractLens finds useful internal model signals for malicious smart-contract screening: Masking selected neurons on Qwen3-8B changes the full-activation linear probe from 91.52% to 83.04% accuracy, an 8.48-point drop, but changes AUROC from 95.02% to 94.17%, a 0.85-point drop. The intervention therefore shows a larger effect on classification accuracy than on ranking discrimination under the specific test; it does not establish that all security knowledge has been removed from the backbone.

  Section 4.3 Table 3, Qwen3-8B unmasked and Masked MCDUs rows; Appendix A.2 final note on the non-monotonicity of masking effects

• supportsContractLens finds useful internal model signals for malicious smart-contract screening: With a previously identified MCDU set held fixed on the CodeGemma-family backbone, the paper reports 85.03% average AUROC across seven intents when the separate logistic-regression classifier receives 32 balanced labeled contracts; larger sample sizes increase AUROC to 94.97% in the displayed experiment. This is low-data classifier fitting after neuron localization, not an end-to-end detector built from only 32 labeled examples.

  Section 4.4 Robustness to Training-Data Size and Figure 6: fixed MCDUs, seven intents, 32 labeled examples, AUROC series

• supportsContractLens finds useful internal model signals for malicious smart-contract screening: The authors process contracts with a maximum window of 2,048 tokens, 512-token sliding-window overlap for longer files and mean pooling of non-padding token embeddings. They report conducting model probing and lightweight-classifier training with one NVIDIA Tesla V100 GPU with 32 GB of memory; neither that hardware statement nor the appendix efficiency comparison establishes an independently measured production end-to-end audit time.

  Section 4.1 Implementation Details, Hyperparameters paragraph: windows, pooling and one V100 32GB

• supportsContractLens finds useful internal model signals for malicious smart-contract screening: The authors process contracts with a maximum window of 2,048 tokens, 512-token sliding-window overlap for longer files and mean pooling of non-padding token embeddings. They report conducting model probing and lightweight-classifier training with one NVIDIA Tesla V100 GPU with 32 GB of memory; neither that hardware statement nor the appendix efficiency comparison establishes an independently measured production end-to-end audit time.

  Appendix C Efficiency and Computational Cost Analysis, Figure 7 discussion comparing ContractLens with a last-layer probe

• supportsContractLens finds useful internal model signals for malicious smart-contract screening: The temporal comparison derives from 14,671 BSC token addresses collected between March 18, 2023 and June 15, 2025; after deduplication and activity filtering, the cited source dataset comprises 1,495 tokens, and its upstream study labels 1,201 of them (898 scams, 303 benign). ContractLens additionally filters deployments to after Gemma-7B became public and tests three mechanisms. The paper does not state the per-mechanism denominators remaining after these filters, so 1,201 is not a supported size for its final temporal test.

  Section 4.4 Detection of Newly Deployed Malicious Smart Contracts, two paragraphs before Table 4: 14,671 addresses, 1,495 filtered tokens, 1,201 labelled, 898 scam, 303 benign, release-time restriction