大语言模型驱动的智能合约漏洞检测：新视角
Large Language Model-Powered Smart Contract Vulnerability Detection: New Perspectives
AI总结：
本文提出GPTLens框架，通过将智能合约漏洞检测分为生成与判别两阶段，利用大语言模型的双重角色，在提高漏洞检出率的同时减少误报，显著优于传统方法。
摘要：
本文基于我们正在进行的研究，对利用大语言模型（如GPT-4）挖掘智能合约漏洞的机会、挑战和潜在解决方案进行了系统性分析。对于智能合约漏洞检测任务，实现实际可用性取决于在尽可能多地识别真实漏洞的同时，最大限度地减少误报数量。然而，我们的实证研究揭示了矛盾但有趣的发现：以更高的随机性生成更多答案，虽然大大提高了产生正确答案的可能性，但不可避免地导致更高数量的误报。为了缓解这一矛盾，我们提出了一个名为GPTLens的对抗性框架，该框架将传统的一阶段检测分解为两个协同阶段——生成和判别，用于渐进式检测和细化，其中大语言模型扮演双重角色，即分别作为审计者和批评者。审计者的目标是产生广泛的漏洞范围，以期包含正确答案，而批评者评估已识别漏洞的有效性，其目标是最小化误报数量。实验结果和示例表明，审计者和批评者协同工作，相比传统的一阶段检测产生了显著改进。GPTLens直观、具有战略性，且完全由大语言模型驱动，不依赖智能合约领域的专家知识，展示了其方法论的通用性和检测广泛漏洞的潜力。我们的代码可在以下网址获取：https://github.com/git-disl/GPTLens。
英文摘要：
This paper provides a systematic analysis of the opportunities, challenges, and potential solutions of harnessing Large Language Models (LLMs) such as GPT-4 to dig out vulnerabilities within smart contracts based on our ongoing research. For the task of smart contract vulnerability detection, achieving practical usability hinges on identifying as many true vulnerabilities as possible while minimizing the number of false positives. Nonetheless, our empirical study reveals contradictory yet interesting findings: generating more answers with higher randomness largely boosts the likelihood of producing a correct answer but inevitably leads to a higher number of false positives. To mitigate this tension, we propose an adversarial framework dubbed GPTLens that breaks the conventional one-stage detection into two synergistic stages $-$ generation and discrimination, for progressive detection and refinement, wherein the LLM plays dual roles, i.e., auditor and critic, respectively. The goal of auditor is to yield a broad spectrum of vulnerabilities with the hope of encompassing the correct answer, whereas the goal of critic that evaluates the validity of identified vulnerabilities is to minimize the number of false positives. Experimental results and illustrative examples demonstrate that auditor and critic work together harmoniously to yield pronounced improvements over the conventional one-stage detection. GPTLens is intuitive, strategic, and entirely LLM-driven without relying on specialist expertise in smart contracts, showcasing its methodical generality and potential to detect a broad spectrum of vulnerabilities. Our code is available at: https://github.com/git-disl/GPTLens.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
