Large language models (LLMs) have demonstrated significant poten- tial for
many downstream tasks, including those requiring human- level intelligence,
such as vulnerability detection. However, recent attempts to use LLMs for
vulnerability detection are still prelim- inary, as they lack an in-depth
understanding of a subject LLM's vulnerability reasoning capability - whether
it originates from the model itself or from external assistance, such as
invoking tool sup- port and retrieving vulnerability knowledge. In this paper,
we aim to decouple LLMs' vulnerability reason- ing capability from their other
capabilities, including the ability to actively seek additional information
(e.g., via function calling in SOTA models), adopt relevant vulnerability
knowledge (e.g., via vector-based matching and retrieval), and follow
instructions to out- put structured results. To this end, we propose a unified
evaluation framework named LLM4Vuln, which separates LLMs' vulnerability
reasoning from their other capabilities and evaluates how LLMs' vulnerability
reasoning could be enhanced when combined with the enhancement of other
capabilities. To demonstrate the effectiveness of LLM4Vuln, we have designed
controlled experiments using 75 ground-truth smart contract vulnerabilities,
which were extensively audited as high-risk on Code4rena from August to
November 2023, and tested them in 4,950 different scenarios across three
represen- tative LLMs (GPT-4, Mixtral, and Code Llama). Our results not only
reveal ten findings regarding the varying effects of knowledge en- hancement,
context supplementation, prompt schemes, and models but also enable us to
identify 9 zero-day vulnerabilities in two pilot bug bounty programs with over
1,000 USD being awarded.

我们提出了一个名为 LLM4Vuln 的统一评估框架，通过将 LLMs 的漏洞推理能力与其他能力进行分离，并评估结合其他能力的方式来增强 LLMs 的漏洞推理能力。在使用 75 个经过广泛审计的智能合约漏洞进行控制实验的基础上，我们测试了三个代表性的 LLMs（GPT-4，Mixtral 和 Code Llama）在 4950 种不同场景下的表现。我们的结果不仅揭示了关于知识增强、上下文补充、提示方案和模型的变化效果的十个发现，还使我们能够在两个试点的漏洞赏金计划中发现 9 个零日漏洞，并颁发了超过 1,000 美元的奖励。