TiDPO-SCVD: Token-Importance-Guided Preference Reinforcement LLM for Explainable Smart Contract Vulnerability Detection

Smart contract vulnerability detection is a critical challenge in the rapidly evolving blockchain ecosystem. Existing LLM-based auditing approaches face two major bottlenecks: (1) generated explanations often suffer from logical inconsistency and omission of key risk indicators, and (2) conventional preference optimization (e.g., DPO) performs only coarse sequence-level tuning, suffering from the inherent "lost-in-the-middle" bias that overlooks mid-sequence vulnerability-critical tokens. To address these issues, we propose TiDPO-SCVD, a token-importance-guided preference reinforcement framework for explainable smart contract vulnerability detection. Our method adopts a three-stage pipeline: continual pre-training on large-scale smart contract corpora to inject domain-specific security knowledge; multi-task supervised fine-tuning with a joint loss to simultaneously optimize detection accuracy and explanation completeness; and a hybrid token-weighting mechanism that integrates gradient attribution with Gaussian positional priors, combined with triplet regularization, to achieve fine-grained preference alignment at the token level. Extensive experiments on four prevalent vulnerability types, including reentrancy, timestamp dependency, integer overflow, and delegatecall exploits, show that TiDPO-SCVD consistently outperforms existing competitive methods across detection metrics. Moreover, both automatic LLM scoring and human expert evaluations confirm that our generated audit reports achieve superior performance in logical correctness, comprehensiveness, and interpretive clarity.