arXiv Science⌕ Search
Home/Archive/arXiv

arXiv · 2610.32453

Beyond Copying: Lifelong Smart Contract Security Task Construction via Protocol Mutation

Zifan Peng·Peng Huang·Jingyi Zheng·Yingjie Xue·Xuechao Wang·Xinlei He·Xia Hu·Dongrui Liu
View original source ↗Read source document ↗Export metadata ↓

Abstract

AI agents can inspect code and run tests to support smart contract security. SlowMist reports about $38.6 billion in losses across the broader blockchain ecosystem. Existing evaluations can reward memorized or copied answers, including attack code recovered from public blockchain transactions. Reconstructing contracts and validating tasks also require costly manual effort. To address these issues, we propose CONSTRAINTDIAL, a framework for lifelong construction of smart contract security tasks via protocol mutation. It automates local contract reconstruction and uses attack execution to select changes to the required calls or inputs. Execution checks guide revisions that make the original attack fail while preserving exploitability, the security objective, and normal functionality. New incidents and audit findings enter the same procedure. With CONSTRAINTDIAL, we construct 3,045 task inputs from 203 public cases, covering detect, exploit, and patch. Compared with reconstruction alone, protocol mutation reduces success with supplied public answers by 10.9 percentage points on average across detect, exploit, and patch. The fraction of tasks solved by copying online answers falls by 9.3 points.

Explore related subjects

cs.CRcs.AI

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Zifan Peng, Peng Huang, Jingyi Zheng, Yingjie Xue, Xuechao Wang, Xinlei He, Xia Hu, Dongrui Liu. 2026-10-23. Beyond Copying: Lifelong Smart Contract Security Task Construction via Protocol Mutation. https://arxiv.org/abs/2610.32453

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

TensorCommitments: A Lightweight Verifiable Inference for Large Language Models

Most large language models (LLMs) run on external clouds: users send a prompt, pay for inference, and must trust that the remote GPU executes the LLM without any adversarial tampering. We critically ask how to achieve verifiable LLM inference, where a prover (the service) must convince a verifier (the client) that an inference was run correctly without rerunning the LLM. Existing cryptographic works are too slow at the LLM scale, while non-cryptographic ones require a strong verifier GPU. We propose TensorCommitments (TCs), a tensor-native proof-of-inference scheme. TC binds the LLM inference to a commitment, an irreversible tag that breaks under tampering, organized in our multivariate Terkle Trees. For LLaMA2, TC adds only 0.97% prover and 0.12% verifier time over inference while improving robustness to tailored attacks by up to 48\% over the best prior work requiring a verifier GPU.

cs.CR↗
arXiv2026

Differential Fault Analysis of Lilliput under Random-Location Nibble Faults

Lilliput is a lightweight block cipher based on a Type-2 Extended Generalized Feistel Network (EGFN). Although it has been studied under conventional cryptanalytic techniques, its resistance to fault attacks remains largely unexplored. We present a theoretical differential fault analysis of Lilliput under a random-location nibble fault model. A nonzero nibble fault is injected at the input to round 27, with the injection location uniformly distributed among the 16 state branches and unknown to the adversary. We analyze fault propagation through the EGFN and derive ciphertext-difference conditions to identify the faulty branch. A DDT-weighted calculation yields an overall branch-identification accuracy of approximately 99.9980% under independent uniform sampling of plaintexts, nonzero fault values, and fault locations; simulations of 2^20 random faults give 99.9983%. After identifying the faulty branch, we classify propagation patterns using the injected difference and the intermediate S-box output difference. We then derive DDT-based constraints on last-round and penultimate-round subkeys and intersect candidate sets from multiple faulty ciphertexts. In 2^15 simulation trials, key-recovery success rates exceed 90%, 95%, and 99% with 32, 36, and 46 faulty ciphertexts, respectively. These simulation-based results are not claims of physical fault-injection performance but offer insight into practical fault analysis of Lilliput.

cs.CR↗
arXiv2026

WebAgentGuard: A Reasoning-Driven Guard Model for Detecting Prompt Injection Attacks in Web Agents

Web agents powered by vision-language models (VLMs) enable autonomous interaction with web environments by perceiving and acting on both visual and textual webpage content to accomplish user-specified tasks. However, they are highly vulnerable to prompt injection attacks, where adversarial instructions embedded in HTML or rendered screenshots can manipulate agent behavior and lead to harmful outcomes such as information leakage. Existing defenses, including system prompt defenses and direct fine-tuning of agents, have shown limited effectiveness. To address this issue, we propose a defense framework in which a web agent operates in parallel with a dedicated guard agent, decoupling prompt injection detection from the agent's own reasoning. Building on this framework, we introduce WebAgentGuard, a reasoning-driven, multimodal guard model for prompt injection detection. We construct a synthetic multimodal dataset using GPT-5 spanning 164 topics and 230 visual and UI design styles, and train the model via reasoning-intensive supervised fine-tuning followed by reinforcement learning. Experiments across multiple benchmarks show that WebAgentGuard consistently outperforms strong baselines while preserving agent utility, without introducing additional latency.

cs.CR↗