DMG: Dual-Stream multiple instance learning network for hunting vulnerable smart contracts via adaptive granularity fusion

Abstract

With the increasing complexity of smart contracts and the increasing number of vulnerabilities in real-world scenarios, ensuring smart contract security has become a critical challenge. Despite various detection methods being proposed, existing approaches primarily trained on synthetic (toy) contracts with oversimplified semantics exhibit limited generalization to deployment environments. Furthermore, their reliance on predefined patterns or single-perspective representations with fixed granularity, such as token sequences or control-flow graphs, limits their ability to capture the hierarchical structures and cross-functional dependencies of complex contracts. To this end, we propose a novel Dual-stream Multi-instance and Granularity Fusion Network (DMG). It is designed to capture the structural complexity of real-world contracts while maintaining effectiveness in simpler contracts, thereby ensuring both adaptability and practical relevance. Specifically, DMG learns representations at both the block-level and the function-level from bytecode with relatively structured dispatch organization. Then, it uses Bi-LSTM and a Multi-Head Attention mechanism to model block-level sequential dependencies and capture coarse-grained contextual relationships. Finally, it introduces a granularity-aware fusion mechanism to adaptively integrate both views, releasing the assumption of fixed granularity and enabling the model to learn the most informative representation under weak supervision. By integrating hierarchical granularity modeling with instance-level learning, DMG shifts from fixed to adaptive granularity, enabling structured and semantically aligned vulnerability analysis. Extensive experiments on toy and real-world datasets demonstrate strong performance, and compared with state-of-the-art methods, DMG delivers a balanced solution that bridges the gap between experimental settings and real-world applicability.