ExDoS: Expert-Guided Bytecode Vulnerability Framework
- ExDoS is a cross-modal framework that transfers rich source code semantics into bytecode analysis for precise smart contract vulnerability detection.
- It constructs a Code Semantic Graph from Solidity and a Control Flow Graph from bytecode, leveraging a dual-attention graph network to capture local vulnerability signals.
- The dual-focus distillation objective, combining global and local losses with expert-guided annotations, yields a 3–6% F1-score improvement over baseline methods.
ExDoS, short for Expert-Guided Dual-Focus Cross-Modal Distillation, is a framework for smart contract vulnerability detection when only bytecode is available at deployment time (Jia et al., 12 Sep 2025). It is formulated as a cross-modal teacher-student distillation framework that transfers rich semantic knowledge from Solidity source code to bytecode, with the explicit goal of learning a strong bytecode-only vulnerability detector for practical blockchain settings in which many deployed contracts are closed-source. The method constructs a Code Semantic Graph (CSG) from source code and a Control Flow Graph (CFG) from bytecode, encodes both modalities with a Dual-Attention Graph Network, and applies a dual-focus objective that combines graph-level and expert-guided local alignment. Its central claim is that bytecode analysis should not rely only on coarse whole-graph alignment, because vulnerabilities often depend on fine-grained structural and semantic correspondences that are obscured by graph-level pooling (Jia et al., 12 Sep 2025).
1. Practical setting and problem formulation
ExDoS is designed for the deployment setting on Ethereum and similar blockchains, where detectors often cannot rely on Solidity source code even though source code contains richer semantics such as identifiers, control constructs, and explicit data dependencies (Jia et al., 12 Sep 2025). The framework therefore treats bytecode-based detection as necessary, rather than as an auxiliary task, because deployed contracts expose mainly EVM bytecode, not source.
The method begins from the observation that bytecode is semantically opaque: it lacks high-level syntax and developer intent, making vulnerability reasoning harder. ExDoS addresses this by using source code only during training, as a modality from which richer supervision can be distilled into the bytecode-side model. A common misconception is that such a framework is a source-code detector with a bytecode wrapper. ExDoS is instead described as a method for learning a bytecode-only vulnerability detector, with the source-side teacher used during training and then discarded (Jia et al., 12 Sep 2025).
2. Motivating limitations in prior cross-modal detection
The ExDoS paper identifies four limitations in earlier source-to-bytecode transfer methods (Jia et al., 12 Sep 2025). First, graph-level alignment is too coarse: aligning source-code and bytecode only at the whole-graph or contract level can blur the fine-grained structural correspondences that determine vulnerabilities, because vulnerable behavior often resides in small local regions such as specific statements, nodes, or basic blocks.
Second, pooling obscures local vulnerability signals. Prior graph-based models often use average or global pooling to obtain graph embeddings, and this tends to dilute rare but critical local patterns. Third, the paper argues that there is a lack of formalized bytecode vulnerability patterns and annotations. Expert vulnerability patterns are mature on the source-code side, but there is little corresponding opcode/basic-block level pattern formalization for bytecode, and hence no granular aligned supervision. Fourth, there is no fine-grained supervision for transfer: without node/block-level annotations linking source and bytecode, prior knowledge transfer has no way to explicitly align vulnerability-relevant local semantics.
These limitations explain the framework’s two principal design choices: a graph encoder intended to preserve important local graph signals, and an expert-guided annotation scheme intended to provide local supervisory structure. This suggests that ExDoS is not simply a stronger encoder, but a redefinition of how cross-modal supervision is organized for bytecode-centric smart contract analysis.
3. Graph construction and Dual-Attention Graph Network
During training, each contract is associated with Solidity source code, corresponding compiled bytecode, vulnerability labels, and expert-guided aligned local pattern annotations (Jia et al., 12 Sep 2025). ExDoS converts these into two graphs:
| Graph | Origin | Symbol |
|---|---|---|
| Code Semantic Graph | source code | |
| Control Flow Graph | bytecode |
The source-side teacher operates on the Code Semantic Graph (CSG), and the bytecode-side student operates on the Control Flow Graph (CFG). Both are encoded with DAGN, the paper’s Dual-Attention Graph Network. The stated purpose of DAGN is to address obscured local signals in graph-level contract embeddings. It does so by introducing a novel node attention aggregation module to enhance local pattern capture in graph embeddings (Jia et al., 12 Sep 2025).
This architectural choice is directly tied to the criticism of ordinary graph pooling. The paper frames local pattern preservation as necessary because vulnerable behavior may be concentrated in small graph regions, and graph embeddings that overemphasize global averaging may suppress precisely those patterns. In ExDoS, DAGN is therefore not presented as a generic graph encoder, but as the mechanism by which graph-level representations remain sensitive to vulnerability-relevant local structures.
4. Expert-guided vulnerability patterns and aligned annotation
A distinctive component of ExDoS is its use of expert knowledge to create aligned local supervision across source and bytecode modalities (Jia et al., 12 Sep 2025). The paper states that it summarizes existing source code vulnerability patterns and designs a corresponding set of bytecode-level patterns for each. On that basis, it constructs the first dataset of vulnerability pattern annotations aligned with source code definitions.
The purpose of this dataset is twofold. First, it facilitates fine-grained cross-modal alignment. Second, it supports the capture of function-level vulnerability signals. In the training pipeline, the local supervision is described as aligning annotated source nodes with corresponding bytecode nodes/blocks. This is important because it replaces purely implicit transfer with explicit vulnerability-oriented correspondences between modalities.
The expert-guided component is significant because the paper describes bytecode as lacking precise vulnerability patterns and granular annotations. ExDoS responds by formalizing bytecode-side patterns relative to source-side definitions rather than treating bytecode as an annotation-poor domain. A plausible implication is that the framework attempts to operationalize source-code priors in a way that remains useful even when only bytecode is available at inference time.
5. Dual-focus distillation objective and training workflow
ExDoS uses a dual-focus objective for cross-modal distillation (Jia et al., 12 Sep 2025). The two components are:
- Global Semantic Distillation Loss: transfers graph-level knowledge by aligning graph-level embeddings.
- Local Semantic Distillation Loss: enables expert-guided, fine-grained vulnerability-specific distillation.
The training workflow is described in four stages. First, the method constructs graphs, mapping source code to the Code Semantic Graph and bytecode to the Control Flow Graph . Second, it encodes both graphs with DAGN, using a source-side teacher and a bytecode-side student. Third, it distills source semantics into bytecode with both global and local semantic distillation. Fourth, after distillation, the teacher is discarded and the student is fine-tuned for binary vulnerability classification (Jia et al., 12 Sep 2025).
This organization clarifies the “dual-focus” label. The framework is not restricted to transferring graph-level similarity, nor does it rely only on local annotations. Instead, it combines a contract-level objective with vulnerability-specific local alignment. This suggests that ExDoS treats robust bytecode detection as a problem requiring both broad semantic transfer and narrowly targeted supervisory signals.
6. Empirical results, interpretation, and naming ambiguity
On real-world contracts, the ExDoS paper reports consistent F1-score improvements (3\%--6\%) over strong baselines (Jia et al., 12 Sep 2025). The reported gains are presented as evidence that transferring source semantics into bytecode is more effective when graph-level alignment is supplemented by local, expert-guided supervision. This suggests that the combination of DAGN and the dual-focus objective alleviates the loss of discriminative information caused by coarse graph-level pooling and annotation scarcity.
The framework’s practical significance lies in its attempt to supplement the source code prior in practical settings while still producing a detector that operates on bytecode alone at deployment time. Within smart contract security, this places ExDoS at the intersection of graph representation learning, cross-modal distillation, and expert-guided vulnerability formalization.
The term “ExDoS” also exhibits naming ambiguity across recent literature. Outside smart contract analysis, other papers use “ExDoS-style” to describe externally induced or resource-exhaustion denial-of-service mechanisms, including remote attacks against NAT state and middlebox behavior (Feng et al., 2024), resource consumption attacks against LLM serving systems (Zhang et al., 24 May 2025), and prompt-induced over-generation as denial-of-service (Manu et al., 29 Dec 2025). This suggests that the acronym is reused across subfields, whereas ExDoS in the smart contract literature refers specifically to Expert-Guided Dual-Focus Cross-Modal Distillation for bytecode-only vulnerability detection (Jia et al., 12 Sep 2025).