ai-research-survey

scan.json (28877B)

---

 {
   "paper": {
     "title": "LLM-BSCVM: An LLM-Based Blockchain Smart Contract Vulnerability Management Framework",
     "authors": [
       "Yanli Jin",
       "Chunpei Li",
       "Peng Fan",
       "Peng Liu",
       "Xianxian Li",
       "Chen Liu",
       "Wangjie Qiu"
     ],
     "year": 2025,
     "venue": "arXiv.org",
     "arxiv_id": "2505.17416",
     "doi": "10.48550/arXiv.2505.17416"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval", "case-study"],
   "key_findings": "LLM-BSCVM proposes a six-agent pipeline for smart contract vulnerability management combining fine-tuned CodeLlama, static analysis, and RAG-based retrieval. The weighted fusion variant achieves 91.1% accuracy and 91.0% F1 on a benchmark dataset, with a 5.1% false positive rate (vs 7.2% for TrustLLM). However, only 21% of repaired contracts pass GPT-4 verification, indicating the repair capability remains limited.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper provides a GitHub link (https://github.com/sosol717/LLM-BSCVM) in both the abstract and Section I, stating the code is open-source."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The evaluation dataset uses publicly available sources: TrustLLM dataset from Solodit (263 audit reports) and Dappscan (1,199 open-source audit reports). These are existing public datasets."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or environment specification is mentioned in the paper. No library versions or dependencies are listed."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided in the paper. The paper does not describe how to set up and run the framework to replicate results."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables I–IV are point estimates only (e.g., '91.11% accuracy'). No confidence intervals, error bars, or ± notation are provided."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims LLM-BSCVM outperforms baselines and that FPR is reduced, but no statistical significance tests (p-values, t-tests, etc.) are used to support these claims."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports improvements with baseline context: FPR reduction from 7.2% to 5.1% (2.2pp), accuracy surpassing CodeLlama 13B by ~48 percentage points, and Table II provides full baseline results for context."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification for the evaluation dataset size is provided. The paper states the data sources (263 + 1,199 audit reports) but does not justify why this is sufficient or discuss statistical power."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No standard deviations, variance, or multi-run results are reported. All results appear to be from single experimental runs."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Tables II and III compare against multiple baselines: CodeLlama 7B/13B, CodeBERT, CodeT5, Llama 8B (both zero-shot and LoRA fine-tuned), and TrustLLM."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include TrustLLM (2024), CodeLlama (2023), and CodeT5 (2021). The primary comparison target, TrustLLM, is contemporary."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Table IV presents an ablation study removing the static analysis module (w/o Static) and the RAG module (w/o RAG), showing their individual contributions to overall performance."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports F1, Recall, Precision, Accuracy, and False Positive Rate across experiments."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation is performed. Patch verification uses GPT-4 as an automated verifier, not human experts. Vulnerability detection is evaluated purely via automated metrics."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "No explicit description of train/test splitting. The paper states it uses 'the same dataset as TrustLLM' but does not describe how the data was split between fine-tuning and evaluation, or whether a held-out test set was used."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": false,
         "justification": "No per-vulnerability-type breakdown is provided. All detection results are aggregate metrics across all vulnerability types."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section IV.B discusses LLM-BSCVM(E)'s performance decline due to excessive contextual information, and acknowledges that only 21% of repaired contracts pass verification, with analysis of why repairs fail."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "LLM-BSCVM(E) shows worse performance (80.4% accuracy) when incorporating retrieved context directly into detection, contradicting the expected benefit. The 21% repair success rate is also candidly reported."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims of 91% F1 and accuracy match Table I (91.04% F1, 91.11% accuracy). FPR reduction from 7.2% to 5.1% is confirmed in Section IV.B. Claim of being 'comparable to SOTA' is supported by Table III comparison with TrustLLM."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The ablation study (Table IV) provides controlled single-variable manipulation evidence for claims about component contributions. The paper states 'removal of the static analysis module led to a significant decline' with ablation evidence."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims to provide 'comprehensive vulnerability management services' for 'the Web 3.0 ecosystem' (abstract and conclusion) but only tests on Solidity smart contracts from specific audit databases. The title claims 'Blockchain Smart Contract Vulnerability Management' broadly despite testing on a single platform."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No alternative explanations for the observed results are discussed. The paper does not consider confounds such as dataset-specific patterns, selection bias in the audit report sources, or whether improvements come from ensembling rather than the proposed method."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "The paper measures binary vulnerability detection accuracy and treats GPT-4 verification as ground truth for repair success, but does not acknowledge that automated detection accuracy is a proxy for actual security improvement, or that GPT-4 verification is a proxy for formal correctness verification."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions 'CodeLlama,' 'CodeLlama-13B,' 'CodeBERT,' 'CodeT5,' 'Llama,' and 'GPT-4' without specific version strings, snapshot dates, or API versions."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "Figure 4 shows a prompt template with placeholders like '{code}' and vague references to '<Audited Smart Contracts>', '<Vulnerability Description>', '<Best practices>'. The actual fill values and complete prompt text are not provided."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "Only the retrieval parameter k=5 and detection weight distribution (70%/10%/20%) are reported. No LLM inference hyperparameters (temperature, top-p, max tokens) or LoRA fine-tuning hyperparameters (learning rate, epochs, rank) are stated."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The six-agent pipeline is described in detail in Section III.B with specific roles (Detector, Advisor, Assessor, Fixer, Verifier, Reporter), information flow between agents, and the RAG retrieval mechanism. Figures 1-3 illustrate the architecture."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "The knowledge base construction (TF-IDF vectorization, chunking, embedding) is described, but the evaluation data preprocessing is not documented. How the 263 TrustLLM and 1,199 Dappscan reports were processed into evaluation examples, or how labels were assigned, is not described."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "No dedicated limitations section exists. The conclusion mentions future work directions (symbolic execution integration, human-computer interaction) but does not substantively discuss the current approach's limitations."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No threats to validity are discussed anywhere in the paper."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "No explicit scope boundaries are stated. The paper does not describe what it did NOT test (e.g., non-Solidity contracts, real-world deployment, cross-chain vulnerabilities) or what claims it is NOT making."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "While the source datasets (TrustLLM, Dappscan) are publicly available, the specific processed evaluation dataset used in experiments is not released. The paper does not provide the exact set of contracts used for evaluation."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section IV.A describes the two data sources: TrustLLM from Solodit (263 smart contract audit reports) and Dappscan (1,199 open-source audit reports from 29 security teams)."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data sources are publicly available smart contract audit databases."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not document how the raw audit reports were transformed into the evaluation dataset. The number of contracts actually used for evaluation, filtering criteria, and label assignment process are not described."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding source or acknowledgments section is present in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are listed: Guangxi Normal University, Zhongguancun Laboratory, and Beihang University. These are academic institutions not directly connected to the evaluated tools."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, making it impossible to assess funder independence."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "No training data cutoff date is stated for CodeLlama or any other model used. The fine-tuning data's temporal scope is also not specified."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of potential train/test overlap. Critically, the RAG knowledge base is built from the same TrustLLM/Solodit data used for evaluation, creating a potential data leakage issue that is not addressed."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the benchmark contracts could have appeared in CodeLlama's pretraining data. The audit reports from Solodit and Dappscan are publicly available and could be in the training corpus."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference cost, latency, or token consumption is reported despite the framework invoking multiple LLM calls across six agents plus RAG retrieval and GPT-4 verification."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No GPU hours, training time for LoRA fine-tuning, total API spend, or hardware specifications are stated."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple random seeds or seed sensitivity analysis. All results appear to be from single runs."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never stated. It is unclear whether results are from one run or averaged."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search budget is reported. The weight distribution (70%/10%/20%) and k=5 appear chosen without documented search process."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "The selection of the weighted fusion approach LLM-BSCVM(W) as the best configuration is presented post-hoc from Table I results, with no description of how the 70/10/20 weights were selected or validated."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No statistical tests are performed at all, so multiple comparison correction is not applicable."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No acknowledgment that the authors are evaluating their own system. The baselines use the authors' implementations without discussion of potential bias."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "LLM-BSCVM uses fine-tuned CodeLlama + static analysis + RAG + GPT-4 verification, far more compute than bare baseline models, but no compute-matched comparison is provided or discussed."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the benchmark (binary safe/vulnerable classification of audit report contracts) actually measures vulnerability management effectiveness, or whether audit-report-derived labels represent real-world vulnerability prevalence."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": false,
         "justification": "LLM-BSCVM combines fine-tuning + RAG + static analysis + multi-agent scaffolding but is compared against bare models without any scaffolding. The improvement could come from the scaffolding ensemble rather than the proposed method's novelty. This confound is not addressed."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of temporal leakage. The audit reports used for evaluation may predate CodeLlama's training data, meaning solutions could be in the pretraining corpus."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The RAG retrieval corpus is sourced from the same TrustLLM/Solodit data used for evaluation. Retrieved similar contracts during detection may contain the evaluation target's ground truth label, constituting feature leakage. This is not addressed."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether fine-tuning data and evaluation data share contracts from the same audit reports, projects, or authors, which would violate independence assumptions."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention methods are applied. No decontamination, temporal splits, or membership inference tests are used."
       }
     }
   },
   "claims": [
     {
       "claim": "LLM-BSCVM(W) achieves 91.11% detection accuracy and 91.04% F1 score on the benchmark dataset.",
       "evidence": "Table I shows LLM-BSCVM(W) with F1=0.9104, Recall=0.8743, Precision=0.9506, Accuracy=0.9111.",
       "supported": "moderate"
     },
     {
       "claim": "LLM-BSCVM reduces the false positive rate from 7.2% (TrustLLM) to 5.1%.",
       "evidence": "Section IV.B states the false positive rate comparison. No statistical test confirms the difference is significant.",
       "supported": "moderate"
     },
     {
       "claim": "LLM-BSCVM outperforms all zero-shot baseline models, surpassing CodeLlama 13B by approximately 48 percentage points in accuracy.",
       "evidence": "Table II shows CodeLlama 13B at 42.55% accuracy vs LLM-BSCVM(W) at 91.11%. However, the comparison is between a scaffolded, fine-tuned system and bare zero-shot models.",
       "supported": "weak"
     },
     {
       "claim": "Approximately 21% of repaired contracts successfully passed independent GPT-4 validation.",
       "evidence": "Section IV.B ('Vulnerability repair') states this result with acknowledgment that further optimization is needed.",
       "supported": "weak"
     },
     {
       "claim": "Excessive contextual information in LLM-BSCVM(E) distracts the model and reduces detection accuracy.",
       "evidence": "Table I shows LLM-BSCVM(E) at 80.42% accuracy vs 91.11% for LLM-BSCVM(W). The paper speculates this is due to attention distraction from excessive context.",
       "supported": "moderate"
     },
     {
       "claim": "LLM-BSCVM is the first end-to-end smart contract vulnerability management framework.",
       "evidence": "Stated as a contribution in Section I, but no systematic literature search or evidence is provided to confirm no prior end-to-end framework exists.",
       "supported": "unsupported"
     }
   ],
   "red_flags": [
     {
       "flag": "Unfair baseline comparison",
       "detail": "Table II compares LLM-BSCVM (fine-tuned CodeLlama + RAG + static analysis + multi-agent pipeline) against bare zero-shot models with no scaffolding, fine-tuning, or retrieval. The 48pp accuracy gap largely reflects the unfairness of the comparison rather than methodological novelty."
     },
     {
       "flag": "Potential data leakage between RAG corpus and evaluation set",
       "detail": "The smart contract corpus used for RAG retrieval is sourced from the same TrustLLM/Solodit data used for evaluation. Retrieved similar contracts may carry ground truth labels or vulnerability information that leaks into the detection decision. This is never acknowledged."
     },
     {
       "flag": "No uncertainty quantification",
       "detail": "All results are single-run point estimates with no error bars, confidence intervals, or multi-seed analysis. The 0.17pp difference between LLM-BSCVM(W) and TrustLLM in F1 (0.9104 vs 0.9121) could easily be within noise."
     },
     {
       "flag": "Low repair success rate underemphasized",
       "detail": "Only 21% of repaired contracts pass GPT-4 verification, meaning 79% of repairs fail. This is buried in Section IV.B and not mentioned in the abstract, which focuses only on detection results. The abstract claim of 'enhancing the reliability of vulnerability management' is misleading given this repair failure rate."
     },
     {
       "flag": "GPT-4 as sole evaluator for repair quality",
       "detail": "Patch correctness is evaluated solely by GPT-4, with no human expert review, formal verification, or test suite execution. GPT-4's own limitations in vulnerability assessment are not discussed."
     },
     {
       "flag": "Claims significantly outrun evidence",
       "detail": "The paper claims to provide 'comprehensive vulnerability management services' for 'the Web 3.0 ecosystem' based on binary detection evaluation on Solidity contracts from two specific audit databases, with no cross-chain, cross-language, or real-world deployment evaluation."
     },
     {
       "flag": "Missing train/test split documentation",
       "detail": "The paper does not describe how the dataset was split between fine-tuning and evaluation. Whether the LoRA fine-tuning data overlaps with test data is unknown."
     }
   ],
   "cited_papers": [
     {
       "title": "GPTScan: Detecting Logic Vulnerabilities in Smart Contracts by Combining GPT with Program Analysis",
       "authors": ["Y. Sun", "D. Wu", "Y. Xue", "H. Liu", "H. Wang", "Z. Xu", "X. Xie", "Y. Liu"],
       "year": 2024,
       "relevance": "LLM-based smart contract vulnerability detection combining GPT with static analysis, directly comparable approach."
     },
     {
       "title": "Combining Fine-Tuning and LLM-Based Agents for Intuitive Smart Contract Auditing with Justifications",
       "authors": ["W. Ma", "D. Wu", "Y. Sun", "T. Wang", "S. Liu", "J. Zhang", "Y. Xue", "Y. Liu"],
       "year": 2024,
       "arxiv_id": "2403.16073",
       "relevance": "TrustLLM framework: primary comparison baseline and data source for LLM-BSCVM evaluation."
     },
     {
       "title": "Large Language Model-Powered Smart Contract Vulnerability Detection: New Perspectives",
       "authors": ["S. Hu", "T. Huang", "F. Ilhan", "S. F. Tekin", "L. Liu"],
       "year": 2023,
       "relevance": "GPTLENS: adversarial framework using GPT-4 for smart contract vulnerability mining."
     },
     {
       "title": "LLM4Vuln: A Unified Evaluation Framework for Decoupling and Enhancing LLMs' Vulnerability Reasoning",
       "authors": ["Y. Sun", "D. Wu", "Y. Xue"],
       "year": 2024,
       "arxiv_id": "2401.16185",
       "relevance": "Framework for evaluating LLM vulnerability detection performance with knowledge enhancement."
     },
     {
       "title": "LLMSmartSec: Smart Contract Security Auditing with LLM and Annotated Control Flow Graph",
       "authors": ["V. Mothukuri", "R. M. Parizi", "J. L. Massa"],
       "year": 2024,
       "relevance": "LLM-based smart contract security auditing using GPT-4 and graph analysis."
     },
     {
       "title": "Exploring ChatGPT's Capabilities on Vulnerability Management",
       "authors": ["P. Liu", "J. Liu", "L. Fu", "K. Lu", "Y. Xia", "X. Zhang", "W. Chen", "H. Weng", "S. Ji", "W. Wang"],
       "year": 2024,
       "relevance": "USENIX Security paper evaluating ChatGPT for vulnerability management tasks — direct precursor to LLM-BSCVM's scope."
     },
     {
       "title": "ContractTinker: LLM-Empowered Vulnerability Repair for Real-World Smart Contracts",
       "authors": ["C. Wang", "J. Zhang", "J. Gao", "L. Xia", "Z. Guan", "Z. Chen"],
       "year": 2024,
       "relevance": "LLM-based smart contract vulnerability repair, directly related to LLM-BSCVM's repair agent design."
     },
     {
       "title": "AgentVerse: Facilitating Multi-Agent Collaboration and Exploring Emergent Behaviors in Agents",
       "authors": ["W. Chen", "Y. Su", "J. Zuo", "C. Yang"],
       "year": 2023,
       "arxiv_id": "2308.10848",
       "relevance": "Multi-agent collaboration framework that inspired LLM-BSCVM's task decomposition approach."
     },
     {
       "title": "Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks",
       "authors": ["P. Lewis", "E. Perez", "A. Piktus"],
       "year": 2020,
       "relevance": "Foundational RAG paper; the retrieval-augmented generation technique is a core component of LLM-BSCVM."
     },
     {
       "title": "Code Llama: Open Foundation Models for Code",
       "authors": ["B. Roziere", "J. Gehring", "F. Gloeckle"],
       "year": 2023,
       "arxiv_id": "2308.12950",
       "relevance": "Base model used for LLM-BSCVM's fine-tuned vulnerability detection and multi-agent inference."
     },
     {
       "title": "DiverseVul: A New Vulnerable Source Code Dataset for Deep Learning Based Vulnerability Detection",
       "authors": ["Y. Chen", "Z. Ding", "L. Alowain", "X. Chen", "D. Wagner"],
       "year": 2023,
       "relevance": "Vulnerability dataset for deep learning detection; representative of the deep learning approaches LLM-BSCVM compares against."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Open-source framework for smart contract auditing that blockchain developers could potentially use, though 21% repair success rate limits practical utility."
     },
     "surprise_contrarian": {
       "score": 0,
       "justification": "Confirms the expected direction that LLMs combined with RAG and multi-agent systems can improve vulnerability detection."
     },
     "fear_safety": {
       "score": 1,
       "justification": "Addresses smart contract security which has caused significant financial losses, but the approach is defensive rather than demonstrating novel attacks."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy or provocative claims; standard incremental improvement narrative."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Code is open-sourced on GitHub, though no live demo or pip-installable package is provided."
     },
     "brand_recognition": {
       "score": 0,
       "justification": "From Guangxi Normal University, Zhongguancun Laboratory, and Beihang University — not widely recognized in the Western AI research community."
     }
   }
 }