Live
Black Hat USADark ReadingBlack Hat AsiaAI BusinessHow 1 Missing Line of Code Cost Anthropic $340 BillionDev.to AII Built npm for AI Skills — Here's Why AI Needs a Package ManagerDev.to AIAn I/O psychologist's rules for stopping AI agents from cutting cornersHacker News AI TopAisthOS: What if your OS compiled UP instead of down?Dev.to AII Moved a Folder. Claude Code Told Me Not to Copy My Own Secrets.Dev.to AIЯ собрал AI бота за вечер - он уже продаётDev.to AIMeshLedger – AI agents hire and pay each other through on-chain escrowHacker News AI TopAgents Can Pay. That's Not the Problem.Dev.to AIBizNode's self-healing watchdog auto-restarts crashed services. Zero downtime, zero babysitting neededDev.to AIPrologue: After We No Longer Write Code by Hand, What Remains for Engineers?Dev.to AIAI Knows Your Project Budget Will Fail Before You DoDev.to AILong Term AI Memory by creator of Apache CassandraDev.to AIBlack Hat USADark ReadingBlack Hat AsiaAI BusinessHow 1 Missing Line of Code Cost Anthropic $340 BillionDev.to AII Built npm for AI Skills — Here's Why AI Needs a Package ManagerDev.to AIAn I/O psychologist's rules for stopping AI agents from cutting cornersHacker News AI TopAisthOS: What if your OS compiled UP instead of down?Dev.to AII Moved a Folder. Claude Code Told Me Not to Copy My Own Secrets.Dev.to AIЯ собрал AI бота за вечер - он уже продаётDev.to AIMeshLedger – AI agents hire and pay each other through on-chain escrowHacker News AI TopAgents Can Pay. That's Not the Problem.Dev.to AIBizNode's self-healing watchdog auto-restarts crashed services. Zero downtime, zero babysitting neededDev.to AIPrologue: After We No Longer Write Code by Hand, What Remains for Engineers?Dev.to AIAI Knows Your Project Budget Will Fail Before You DoDev.to AILong Term AI Memory by creator of Apache CassandraDev.to AI
AI NEWS HUBbyEIGENVECTOREigenvector

ORACAL: A Robust and Explainable Multimodal Framework for Smart Contract Vulnerability Detection with Causal Graph Enrichment

arXivby [Submitted on 30 Mar 2026]March 31, 20262 min read1 views
Source Quiz

arXiv:2603.28128v1 Announce Type: new Abstract: Although Graph Neural Networks (GNNs) have shown promise for smart contract vulnerability detection, they still face significant limitations. Homogeneous graph models fail to capture the interplay between control flow and data dependencies, while heterogeneous graph approaches often lack deep semantic understanding, leaving them susceptible to adversarial attacks. Moreover, most black-box models fail to provide explainable evidence, hindering trust in professional audits. To address these challenges, we propose ORACAL (Observable RAG-enhanced Ana — Tran Duong Minh Dai, Triet Huynh Minh Le, M. Ali Babar, Van-Hau Pham, Phan The Duy

View PDF HTML (experimental)

Abstract:Although Graph Neural Networks (GNNs) have shown promise for smart contract vulnerability detection, they still face significant limitations. Homogeneous graph models fail to capture the interplay between control flow and data dependencies, while heterogeneous graph approaches often lack deep semantic understanding, leaving them susceptible to adversarial attacks. Moreover, most black-box models fail to provide explainable evidence, hindering trust in professional audits. To address these challenges, we propose ORACAL (Observable RAG-enhanced Analysis with CausAL reasoning), a heterogeneous multimodal graph learning framework that integrates Control Flow Graph (CFG), Data Flow Graph (DFG), and Call Graph (CG). ORACAL selectively enriches critical subgraphs with expert-level security context from Retrieval-Augmented Generation (RAG) and Large Language Models (LLMs), and employs a causal attention mechanism to disentangle true vulnerability indicators from spurious correlations. For transparency, the framework adopts PGExplainer to generate subgraph-level explanations identifying vulnerability triggering paths. Experiments on large-scale datasets demonstrate that ORACAL achieves state-of-the-art performance, outperforming MANDO-HGT, MTVHunter, GNN-SC, and SCVHunter by up to 39.6 percentage points, with a peak Macro F1 of 91.28% on the primary benchmark. ORACAL maintains strong generalization on out-of-distribution datasets with 91.8% on CGT Weakness and 77.1% on DAppScan. In explainability evaluation, PGExplainer achieves 32.51% Mean Intersection over Union (MIoU) against manually annotated vulnerability triggering paths. Under adversarial attacks, ORACAL limits performance degradation to approximately 2.35% F1 decrease with an Attack Success Rate (ASR) of only 3%, surpassing SCVHunter and MANDO-HGT which exhibit ASRs ranging from 10.91% to 18.73%.

Comments: 26 pages

Subjects:

Machine Learning (cs.LG); Cryptography and Security (cs.CR)

Cite as: arXiv:2603.28128 [cs.LG]

(or arXiv:2603.28128v1 [cs.LG] for this version)

https://doi.org/10.48550/arXiv.2603.28128

arXiv-issued DOI via DataCite (pending registration)

Submission history

From: Duy Phan Dr [view email] [v1] Mon, 30 Mar 2026 07:46:59 UTC (5,696 KB)

Was this article helpful?

Sign in to highlight and annotate this article

AI
Ask AI about this article
Powered by Eigenvector · full article context loaded
Ready

Conversation starters

Ask anything about this article…

Daily AI Digest

Get the top 5 AI stories delivered to your inbox every morning.

Knowledge Map

Knowledge Map
TopicsEntitiesSource
ORACAL: A R…researchpaperarxivmachine-lea…deep-learni…arXiv

Connected Articles — Knowledge Graph

This article is connected to other articles through shared AI topics and tags.

Knowledge Graph100 articles · 162 connections
Scroll to zoom · drag to pan · click to open

Discussion

Sign in to join the discussion

No comments yet — be the first to share your thoughts!

More in Research Papers