LATENT: LLM-Augmented Trojan Insertion and Evaluation Framework for Analog Netlist Topologies

Arjun Chaudhuri; Jayeeta Chaudhuri; Krishnendu Chakrabarty

REVIEW 4 major objections 6 minor 41 references

LATENT: LLM-Augmented Trojan Insertion and Evaluation Framework for Analog Netlist Topologies

T0 review · 4 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read An LLM agent can automatically craft stealthy analog Trojans that hide across most input voltages and sharply degrade performance when triggered.

desk verdict Nice framework for LLM-driven analog Trojan insertion, but the headline stealth numbers rest on a closed loop: the authors' private, modified reimplementation of SPICED is both the optimization reward and the evaluation oracle. read the letter →

arxiv 2505.06364 v1 pith:DM53SSYK submitted 2025-05-09 cs.CR

Jayeeta Chaudhuri , Arjun Chaudhuri , Krishnendu Chakrabarty This is my paper · ORCID

classification cs.CR

keywords analogTrojanLLMagenthardwaresecuritySPICEnetlistdetectionevasionfeedback-drivenattackanalog/mixed-signalICcircuit-specific

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

LATENT claims that an LLM acting as an autonomous agent can insert analog Trojans into SPICE netlists that stay dormant across most of the input voltage range and only degrade circuit performance when triggered. The framework runs a thought-action-observation loop: the agent proposes a resistor, capacitor, or transistor modification, the modified netlist is simulated, and a detector's feedback tells the agent whether to keep or revise the choice. Across 15 analog benchmark circuits, the resulting Trojans activate over an average 15.74% of the input space and cause 11.3% average performance degradation, versus 34.3% and 43.2% activation ranges for two fixed-pattern baseline Trojans. If the result generalizes, analog Trojan insertion no longer needs manual circuit expertise, and detector evaluations must treat Trojans as adaptive adversaries rather than static templates.

What carries the argument

The load-bearing mechanism is the feedback loop: the LLM agent's proposed modification is parsed by a syntax checker, simulated, then scored by the detector through $R_{\text{evade}} = \frac{|L_{\text{agent}} \cap L_{\text{sus}}|}{|L_{\text{agent}}|} \times 100\%$, the fraction of inserted Trojan lines that the detector flags. A score of 100% means the modification is accepted and the component type is retained; a lower score triggers a rethink using the detector's diagnosis report. The termination rules—three consecutive 100% scores or reaching $L_{\max} = \alpha N$ with $\alpha = 0.6$—keep the search from over- or under-inserting. This closed loop, not the LLM's native code ability alone, is what converts one-shot generation into stealthy, circuit-tailored Trojan placement.

What would settle it

Feed the LATENT-generated Trojan netlists to an independent analog-Trojan detector that was not part of the feedback loop and that has not been tuned by the authors; if any such detector consistently flags the inserted components, the claimed stealth is a property of the oracle, not the Trojans. A second check is to resimulate the dormant circuits with a voltage sweep finer than the one used in the paper and measure whether the average 15.74% activation range widens or the dormant-state output deviation exceeds the reported bounds.

Watch

Extended reading notes

Core claim

The central claim is that analog Trojan insertion can be fully automated and made circuit-specific by coupling an LLM agent to a detection oracle. The agent selects components from resistors, capacitors, NMOS, and PMOS, inserts them at chosen nodes of the target netlist, simulates the modified design, and receives an evasion reward from a detector called SPICED. It keeps changes that score 100% for three consecutive iterations or until it reaches an upper bound on the number of inserted components. Across the evaluated circuits, the resulting Trojans average a 15.74% activation range and 11.3% output-voltage degradation, compared with activation ranges of 34.3% for the A2 baseline and 43.2% for DELTA, while cutting average area overhead by roughly two-thirds.

Load-bearing premise

The load-bearing premise is that SPICED, which the authors re-implemented and modified because the original code is not public, is a representative detector for real-world analog Trojans; LATENT optimizes against SPICED and then reports evasion from SPICED, so if that oracle is unrepresentative the stealth claim collapses.

Editorial extensions

If this is right

Analog Trojan insertion becomes an automated, netlist-only attack: an adversary with access to a SPICE netlist and an LLM API can generate circuit-specific Trojans without deep analog design expertise.
Detection results obtained against static Trojan templates such as A2 and DELTA overstate real-world protection, because LATENT's feedback loop adapts to whatever blind spots the detector has.
The combination of a 15.74% average activation range and 11.3% performance degradation means a small number of inserted components can inflict serious harm while slipping past functional verification under typical voltages.
The upper-bound rule $L_{\max} = \alpha N$ lets an attacker scale Trojan count with circuit size, so the attack does not fade on larger designs; the LDO and bandgap-filter results show it also applies to larger netlists.
The reported runtimes of roughly one to two and a half minutes per circuit with a low-cost LLM make the framework practical for red-team evaluation at design time.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Because the agent optimizes against one detector, LATENT's stealth is probably detector-specific; swapping SPICED for a different analog-Trojan detector would produce different insertion patterns, so the framework is better read as a generator of detector-specific adversarial examples than as a proof of universal undetectability.
The restriction to DC-activated Trojans is an artifact of the detector's input format, not a limit of the method; extending the same feedback loop to AC/small-signal or temperature-based triggers, which the paper lists for future work, would likely widen the attack surface.
A testable corollary of the feedback design is that the one-shot baseline's high detection rate should be recoverable by removing the detector from the loop; if one-shot Trojans ever matched the feedback version's evasion, the loop itself, not component choice, would be the operative mechanism.
Read as a dual-use tool, LATENT could be repurposed to generate a diverse Trojan corpus for benchmarking detectors, which would directly address the paper's stated motivation that limited Trojan diversity blocks detection research.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Candid take: LATENT is a legitimately new application of LLM agents to analog Trojan insertion, and the framework itself is clearly described. The problem is that the paper's headline stealth result is circular. The authors re-implemented SPICED (which isn't public), modified its prompt to catch resistor anomalies, used that modified detector as the agent's reward signal, and then reported evasion against that same detector as their main result. That doesn't demonstrate stealth against real detectors; it demonstrates reward overfitting. This is the load-bearing issue, and it's not solved by the paper's acknowledgment of the reimplementation.

There's real value here. The thought-action-observation loop, the syntax checker, the use of HSPICE simulation, and the inclusion of resistor-based Trojans are sensible and go beyond prior static analog Trojans. The self-correction example is concrete evidence the agent is doing something nontrivial. The comparison with A2 and DELTA, though not perfectly apples-to-apples, is a reasonable attempt at positioning.

The other soft spots are secondary: the activation-range metric needs a precise definition of the input space discretization; there are no error bars over LLM stochasticity; and 'functionally correct' is asserted but never shown with dormant-state simulations. None of those would sink the paper on their own, but together with the circularity they mean the empirical claims are not currently supported.

The data in the tables are internally consistent and the citation practice is fair. The authors cite the prior analog Trojan and LLM-security literature appropriately, including their own SPICED papers (justified, given the direct reliance). I don't see invented entities or parameter-dredging red flags—the free parameters are disclosed.

Who benefits: researchers in analog hardware security who want a starting point for adversarial evaluation of analog Trojan detectors. The paper deserves a serious referee, but the referee should insist on either code release, validation against an independent detector, or a significant downgrade of the claims. As it stands, I'd treat the 15.74% activation-range number as an artifact of the evaluation loop.

Recommendation: send to peer review, with a clear expectation of major revision on the evaluation front.

Referee Report

4 major / 6 minor

Summary. The paper introduces LATENT, an LLM-agent framework that inserts analog Trojans into SPICE netlists by iteratively selecting component types and node placements based on feedback from SPICED, an LLM-based analog Trojan detector. The framework uses HSPICE for simulation and a syntax checker, and it is evaluated on AMSNet circuits, a bandgap filter, and an LDO. The authors report an average Trojan-activation range of 15.74%, an average performance degradation of 11.3%, and high evasion rates (Revade) for LATENT compared with one-shot prompting and with prior A2 and DELTA Trojans.

Significance. If validated, LATENT would be a useful tool for generating diverse analog Trojan benchmarks and for stress-testing analog Trojan detection methods. The paper is among the first to apply agentic LLMs to analog Trojan insertion, and its attempt to include resistor-based Trojans, its feedback-driven insertion loop, and its comparison with prior Trojans are constructive contributions. However, the central stealth claim is undermined by the evaluation design: the detection oracle used to compute the evasion reward is the same private, author-modified SPICED reimplementation used to report evasion results. The paper also provides no code or data release, offers no variance analysis over LLM stochasticity, and leaves the activation-range metric under-specified. These issues prevent the reported results from supporting the paper's headline claims, although the underlying problem and framework idea are relevant to the hardware security community.

major comments (4)

[Section IV.A.2, IV.C, V.C] The stealth claim is supported only by Revade, which is computed from the same private, author-modified SPICED reimplementation that serves as the optimization reward. Section IV.A.2 explicitly states that the SPICED codebase is not public, that the authors re-implemented it, and that they modified its prompt to force consideration of resistor-based anomalies. Section IV.C defines Revade as the fraction of agent-inserted components not on SPICED's suspect list, and Table I reports these Revade values as the headline evasion metric. Because the agent iterates against this exact detector and then is evaluated by the same detector, the reported evasion results do not demonstrate stealth against the original SPICED or any independent detector; they show only that the agent learned to exploit the blind spots of the re-implemented detector. This circularity invalidates the central claim that LATENT generates stealthy Trojans.
[Section I, II.A, V] The paper claims that LATENT generates 'functionally correct Trojan-inserted designs' and defines a stealthy analog Trojan as one that introduces negligible deviation in circuit performance in its dormant state, but no experiment verifies correct functionality or dormant-state performance. Table I and Table III report activation range, Revade, node impact, and area overhead, but no metric measures the output deviation of the Trojan-inserted netlist when the Trojan is not activated. Without such a check, a Trojan that breaks the circuit even when dormant—and is therefore not stealthy by the paper's own definition—would go undetected in the evaluation.
[Section V.B] The activation-range metric is under-specified. The definition 'Trigger activation inputs / Total input space × 100%' does not state how the input space is discretized, what voltage sweep range and step size are used, or what output-deviation threshold defines an input as activating the Trojan. The headline average of 15.74% in Table III therefore cannot be reproduced or interpreted exactly as claimed, and comparisons of activation ranges across circuits and baselines are not well grounded.
[Section V.A and Table I] All experimental results appear to come from a single run per circuit with GPT-4o-mini at temperature 0.3. The paper does not report variance across random seeds or repeated runs, so the stability of the agent's convergence (nit, LT, Revade) under LLM stochasticity is unknown. Since the feedback-driven agent is the core contribution, the absence of any stochasticity analysis weakens the empirical support for the framework's generality and reproducibility.

minor comments (6)

[Section V.C, Table I] The average LATENT Revade is reported as 94.4%, but several individual circuits (rows 5, 7, and 11) achieve Revade values of 66.6, 75, and 75, respectively; the paper should explain why these circuits fall short of the '100% evasion' criterion and how the average is consistent with the stealth contribution claim.
[Section V.F] The discussion notes that only DC-activated Trojans are considered and that AC and small-signal analysis are deferred. This is a substantial scope limitation and should be stated in the abstract or introduction so that readers do not overgeneralize the stealth claims.
[Section IV.C] The formula for Revade appears inline without an equation number; numbering it would improve cross-referencing and precision in future discussions.
[Section II.A] In the introduction, 'a through evaluation' should be 'a thorough evaluation'.
[Figure 2 caption] The caption uses 'ReACT prompts,' while the body and Section III use 'ReAct'; the spelling should be made consistent.
[Table II] The 'Total time (s)' column does not equal the sum of the three preceding columns (e.g., 2.5 + 0.3 + 17.4 = 20.2, not 80.8); please clarify whether the total includes multiple iterations or additional setup overhead.

Circularity Check

3 steps flagged · score 7.0 of 10

Evasion is measured by the same reward the agent optimizes against, using a private, author-modified reimplementation of the authors' own SPICED detector.

self definitional [Section IV.C (Iterative Detection Feedback) and Section V.C (Table I)]
"From the report, we extract two key pieces of information: (1) Lsus, and (2) detailed analysis of why these lines were flagged, including node-level anomalies in voltage/current behavior under certain input test conditions. We use information (1) to compute (3) the evasion reward Revade, which is formulated as: Revade = Lagent∩Lsus / Lagent × 100%, where Lagent represents the Trojan components inserted by the agent."

The 'evasion reward' is exactly the metric later reported as the headline stealth result. Section IV.D tells the agent to keep a component type when Revade=100%, and Section IV.E terminates the process once Revade=100% is sustained for T consecutive iterations. Table I then reports LATENT Revade values of 75-100% as evidence of stealth. Thus the claimed 'evading detection' result is the optimization objective itself, not an independent prediction: the evaluation metric and the fitness function are the same formula by construction.
self citation load bearing [Section IV.A.2 (SPICED Prompting) and Section V.C (Stealthy Trojan-Inserted Designs)]
"Since the SPICED [14] codebase is not yet publicly available, we re-implemented the framework by replicating the supervised-learning approach and few-shot prompting techniques. ... To ensure a realistic attack scenario, we instead add explicit instructions in the prompt to ensure that resistor-induced anomalies are considered by the model."

The detection oracle is not an independent, publicly available benchmark: it is a private re-implementation of the authors' own SPICED work (reference [14] is by the same authors), with prompt modifications chosen by the same authors. The agent receives diagnostic feedback from this exact detector and optimizes against it, and the same detector is then used to report evasion in Table I. The central stealth claim therefore rests entirely on an author-provided, modified oracle; no external or original-SPICED validation is offered, so the reported evasion is conditional on a detector that the authors themselves constructed and tuned.

1 more flagged steps

self definitional [Section IV.E (Determining the Upper Bound of Trojan Components) and Table I]
"The iteration process stops when one of the following conditions is satisfied: 1) Revade = 100% for T consecutive iterations: T = 1 is not optimal, as SPICED might have false positives in a single run [14]. Therefore, we require Revade = 100% for multiple consecutive iterations, thus ensuring that the inserted Trojan components consistently evade detection. 2) Upper bound Lmax reached."

The termination condition makes Revade=100% the definition of success, so reporting LATENT Revade values of 100% for most netlists is not an empirical finding but a guarantee of the stopping rule. The average 94.4% LATENT Revade is dominated by circuits that stopped because the reward reached 100% for T=3 consecutive iterations. This is success-by-construction rather than an independent measure of stealth.

full rationale

The paper's activation-range and performance-degradation results come from HSPICE sweeps and are not the optimization reward, so those specific numbers are not circular. However, the central novel claim of the paper is that LATENT generates Trojans that 'evade detection' and are 'stealthy'. That claim is circular in three connected ways. First, the evasion reward Revade, defined in Section IV.C as the fraction of inserted components absent from SPICED's suspect list, is identical to the metric reported as the stealth result in Section V.C and Table I; the agent is trained to maximize exactly what is then presented as the outcome. Second, the detector used for both training feedback and final evaluation is a private re-implementation of the authors' own SPICED framework with author-introduced prompt changes, so the comparison lacks an independent oracle. Third, the termination criterion requires Revade=100% for three consecutive iterations, making the high reported Revade values a direct consequence of the stopping rule rather than an empirical demonstration. Taken together, the headline 'stealthy' result reduces by construction to the optimization objective against a non-public, author-modified detector. This warrants a score of 7: partial circularity is present in the central detection-evasion claim, even though the activation-range and performance-degradation metrics retain independent content.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central claim rests on several free parameters (alpha, T, temperature, random values) and domain assumptions about SPICED's validity, the LLM's competence, and the representativeness of tiny benchmark circuits. No new physical entities are introduced; the Trojans are built from standard R, C, NMOS, PMOS components.

free parameters (5)

alpha (scaling factor for Lmax) = 0.6
User-configurable parameter in Lmax = alpha * N, set based on experimental observations to prevent over-insertion or under-insertion of Trojan components.
T (consecutive evasion iterations required) = 3
Termination threshold for consecutive Revade = 100% iterations, chosen to avoid early termination due to SPICED false positives.
LLM temperature = 0.3
Sampling temperature for GPT-4o-mini; affects the randomness of component selection and node choices, yet no seeds are provided for reproducibility.
Random component values = unspecified random values
Capacitor values are randomly chosen and component identifiers are random numbers, introducing uncontrolled variability across runs.
Transistor dimensions (W/L) = W=1u, L=1u
All NMOS/PMOS Trojan components use fixed dimensions; this is a hand-chosen parameter set that is not swept or justified.

assumptions (4)

domain assumption SPICED is an effective detector for analog Trojans
The framework relies on SPICED to provide meaningful feedback and to measure evasion, but the detector is not publicly available and was re-implemented with modifications (Section IV.A.2).
domain assumption LLM agent can syntactically and functionally modify SPICE netlists
The framework assumes the LLM produces syntactically valid additions and that inserted components do not break the circuit when dormant; only syntax is checked, not functional correctness.
domain assumption Small AMSNet circuits are representative of A/MS designs
Evaluation uses circuits with 20-25 nodes (plus two larger circuits) and generalizes from these to A/MS systems.
ad hoc to paper Activation range can be computed from a discretized input space
The formula 'Trigger activation inputs / Total input space x 100' presumes a well-defined input space and trigger threshold, but the discretization is not specified.

how reviews work

0 comments

Cite this review

Pith. "Pith review of LATENT: LLM-Augmented Trojan Insertion and Evaluation Framework for Analog Netlist Topologies." pith.science (2026). https://pith.science/paper/DM53SSYK

@misc{pith2026250506364,
  author       = {Pith},
  title        = {Pith review of: LATENT: LLM-Augmented Trojan Insertion and Evaluation Framework for Analog Netlist Topologies},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DM53SSYK}},
  note         = {Machine review of arXiv:2505.06364}
}

read the original abstract

Analog and mixed-signal (A/MS) integrated circuits (ICs) are integral to safety-critical applications. However, the globalization and outsourcing of A/MS ICs to untrusted third-party foundries expose them to security threats, particularly analog Trojans. Unlike digital Trojans which have been extensively studied, analog Trojans remain largely unexplored. There has been only limited research on their diversity and stealth in analog designs, where a Trojan is activated only during a narrow input voltage range. Effective defense techniques require a clear understanding of the attack vectors; however, the lack of diverse analog Trojan instances limits robust advances in detection strategies. To address this gap, we present LATENT, the first large language model (LLM)-driven framework for crafting stealthy, circuit-specific analog Trojans. LATENT incorporates LLM as an autonomous agent to intelligently insert and refine Trojan components within analog designs based on iterative feedback from a detection model. This feedback loop ensures that the inserted Trojans remain stealthy while successfully evading detection. Experimental results demonstrate that our generated Trojan designs exhibit an average Trojan-activation range of 15.74%, ensuring they remain inactive under most operating voltages, while causing a significant performance degradation of 11.3% upon activation.

Figures

Figures reproduced from arXiv: 2505.06364 by the authors.

**Figure 2.** ReACT prompts demonstrating the Thought-Action [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 3.** Illustration of how the LLM agent self-corrects its [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: A Trojan-inserted design corresponding to ‘642’ of [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]

**Figure 5.** Figure 5: Revade convergence across iterations for netlists from AMSNet [40] (⋆ indicates the minimum number of iterations required for convergence). TABLE II: Breakdown of average runtime overheads of LATENT (the reported times for thought-action, SPICE simulation, and SPICED…

**Figure 6.** Figure 6: Revade convergence across iterations for all the evaluated netlists (⋆ indicates the minimum number of iterations required for convergence). 8 [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

41 extracted references · 33 canonical work pages

[1]

Breakthrough Silicon Scanning Discovers Backdoor in Military Chip,

S. Skorobogatov et al. , “Breakthrough Silicon Scanning Discovers Backdoor in Military Chip,” in Proceedings of the 14th International Conference on Cryptographic Hardware and Embedded Systems , ser. CHES’12. Berlin, Heidelberg: Springer-Verlag, 2012, p. 23–40

work page 2012
[2]

IP Protection and Supply Chain Security through Logic Obfuscation: A Systematic Overview,

K. Shamsi et al. , “IP Protection and Supply Chain Security through Logic Obfuscation: A Systematic Overview,” ACM Trans. Des. Autom. Electron. Syst. , vol. 24, no. 6, Sep. 2019. [Online]. Available: https://doi.org/10.1145/3342099

work page doi:10.1145/3342099 2019
[3]

Hardware Trojan Attacks: Threat Analysis and Countermeasures,

S. Bhunia et al. , “Hardware Trojan Attacks: Threat Analysis and Countermeasures,” Proceedings of the IEEE , vol. 102, no. 8, pp. 1229– 1247, 2014

work page 2014
[4]

Counterfeit Integrated Circuits: A Rising Threat in the Global Semiconductor Supply Chain,

U. Guin et al., “Counterfeit Integrated Circuits: A Rising Threat in the Global Semiconductor Supply Chain,” Proceedings of the IEEE , vol. 102, no. 8, pp. 1207–1228, 2014

work page 2014
[5]

Machine Learning for Hardware Security: Oppor- tunities and Risks,

R. Elnaggar et al. , “Machine Learning for Hardware Security: Oppor- tunities and Risks,” Journal of Electronic Testing, vol. 34, pp. 183–201, 2018

work page 2018
[6]

A2: Analog Malicious Hardware,

K. Yang et al., “A2: Analog Malicious Hardware,” in IEEE SP, 2016

work page 2016
[7]

Trustworthy Hardware: Trojan Detection and Design-for-Trust Challenges,

M. Tehranipoor et al. , “Trustworthy Hardware: Trojan Detection and Design-for-Trust Challenges,”Computer, vol. 44, no. 7, pp. 66–74, 2011

work page 2011
[8]

Exploiting the Analog Properties of Digital Circuits for Malicious Hardware,

K. Yang et al., “Exploiting the Analog Properties of Digital Circuits for Malicious Hardware,” Communications of the ACM , vol. 60, no. 9, pp. 83–91, 2017

work page 2017

Show all 41 references

[9]

When Capacitors Attack: Formal Method Driven Design and Detection of Charge-Domain Trojans,

X. Guo et al., “When Capacitors Attack: Formal Method Driven Design and Detection of Charge-Domain Trojans,” in 2019 Design, Automation & Test in Europe Conference & Exhibition (DATE) . IEEE, 2019, pp. 1727–1732

2019
[10]

DELTA: DEsigning a Stealthy Trigger Mechanism for Analog Hardware Trojans and Its Detection Analysis,

N. Gupta et al., “DELTA: DEsigning a Stealthy Trigger Mechanism for Analog Hardware Trojans and Its Detection Analysis,” in DAC, 2022

2022
[11]

High-Precision Nano-Amp Current Sensor and Obfus- cation based Analog Trojan Detection Circuit,

M. Abedi et al., “High-Precision Nano-Amp Current Sensor and Obfus- cation based Analog Trojan Detection Circuit,” in ISCAS, 2022

2022
[12]

DeMiST: Detection and Mitigation of Stealthy Analog Hardware Trojans,

E. Oriero et al., “DeMiST: Detection and Mitigation of Stealthy Analog Hardware Trojans,” in Proceedings of the 12th International Workshop on Hardware and Architectural Support for Security and Privacy , 2023, pp. 47–55

2023
[13]

DAWN: Efficient Trojan Detection in Analog Cir- cuits using Circuit Watermarking and Neural Twins,

J. Chaudhuri et al., “DAWN: Efficient Trojan Detection in Analog Cir- cuits using Circuit Watermarking and Neural Twins,” IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems , pp. 1–1, 2024

2024
[14]

SPICED: Syntactical Bug and Trojan Pattern Identification in A/MS Circuits using LLM-Enhanced Detection,

——, “SPICED: Syntactical Bug and Trojan Pattern Identification in A/MS Circuits using LLM-Enhanced Detection,” in IEEE Physical Assurance and Inspection of Electronics (PAINE) , 2024

2024
[15]

Temperature Tracking: An Innovative Run-Time Ap- proach for Hardware Trojan Detection,

D. Forte et al. , “Temperature Tracking: An Innovative Run-Time Ap- proach for Hardware Trojan Detection,” in ICCAD, 2013, pp. 532–539

2013
[16]

R2D2: Runtime Reassurance and Detection of A2 Trojan,

Y . Hou et al. , “R2D2: Runtime Reassurance and Detection of A2 Trojan,” in 2018 IEEE International Symposium on Hardware Oriented Security and Trust (HOST) , 2018, pp. 195–200

2018
[17]

AnalogCoder: Analog Circuit Design via Training-Free Code Generation,

Y . Lai et al. , “AnalogCoder: Analog Circuit Design via Training-Free Code Generation,” arXiv preprint arXiv:2405.14918 , 2024

2024 arXiv
[18]

Verigen: A Large Language Model for Verilog Code Generation,

S. Thakur et al., “Verigen: A Large Language Model for Verilog Code Generation,” ACM Transactions on Design Automation of Electronic Systems, vol. 29, no. 3, pp. 1–31, 2024

2024
[19]

Autobench: Automatic Testbench Generation and Eval- uation Using LLMs for HDL Design,

R. Qiu et al. , “Autobench: Automatic Testbench Generation and Eval- uation Using LLMs for HDL Design,” in Proceedings of the 2024 ACM/IEEE International Symposium on Machine Learning for CAD , 2024, pp. 1–10

2024
[20]

VerilogReader: LLM-Aided Hardware Test Generation,

R. Ma et al., “VerilogReader: LLM-Aided Hardware Test Generation,” in 2024 IEEE LLM Aided Design Workshop (LAD) . IEEE, 2024, pp. 1–5

2024
[21]

RTLCoder: Fully Open-Source and Efficient LLM- Assisted RTL Code Generation Technique,

S. Liu et al. , “RTLCoder: Fully Open-Source and Efficient LLM- Assisted RTL Code Generation Technique,” IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems , 2024

2024
[22]

LaMAGIC: Language-Model-Based Topol- ogy Generation for Analog Integrated Circuits,

C.-C. Chang et al. , “LaMAGIC: Language-Model-Based Topol- ogy Generation for Analog Integrated Circuits,” arXiv preprint arXiv:2407.18269, 2024

2024 arXiv
[23]

RTLLM: An Open-Source Benchmark for Design RTL Generation with Large Language Model,

Y . Lu et al. , “RTLLM: An Open-Source Benchmark for Design RTL Generation with Large Language Model,” in 2024 29th Asia and South Pacific Design Automation Conference (ASP-DAC) . IEEE, 2024, pp. 722–727

2024
[24]

LLM-Enhanced Bayesian Optimization for Efficient Analog Layout Constraint Generation,

G. Chen et al. , “LLM-Enhanced Bayesian Optimization for Efficient Analog Layout Constraint Generation,” arXiv preprint arXiv:2406.05250, 2024. 7

2024 arXiv
[25]

SENTAUR: Security EnhaNced Trojan Assess- ment Using LLMs Against Undesirable Revisions,

J. Bhandari et al. , “SENTAUR: Security EnhaNced Trojan Assess- ment Using LLMs Against Undesirable Revisions,” arXiv preprint arXiv:2407.12352, 2024

2024 arXiv
[26]

Empowering Hardware Security with LLM: The Development of a Vulnerable Hardware Database,

D. Saha et al. , “Empowering Hardware Security with LLM: The Development of a Vulnerable Hardware Database,” in HOST, 2024

2024
[27]

Harnessing the Power of General-Purpose LLMs in Hardware Trojan Design,

G. Kokolakis et al. , “Harnessing the Power of General-Purpose LLMs in Hardware Trojan Design,” in International Conference on Applied Cryptography and Network Security . Springer, 2024, pp. 176–194

2024
[28]

Bhunia et al., Hardware Security: A Hands-On Learning Approach

S. Bhunia et al., Hardware Security: A Hands-On Learning Approach . Morgan Kaufmann, 2018

2018
[29]

Hardware Trojan Detection Based on Logical Testing,

A. Bazzazi et al. , “Hardware Trojan Detection Based on Logical Testing,” Journal of Electronic Testing , vol. 33, pp. 381–395, 2017

2017
[30]

On Hardware Security Bug Code Fixes by Prompting Large Language Models,

B. Ahmad et al., “On Hardware Security Bug Code Fixes by Prompting Large Language Models,” IEEE Transactions on Information Forensics and Security, vol. 19, pp. 4043–4057, 2024

2024
[31]

RTLfixer: Automatically Fixing RTL Syntax Errors with Large Language Models,

Y . Tsai et al., “RTLfixer: Automatically Fixing RTL Syntax Errors with Large Language Models,” arXiv preprint arXiv:2311.16543 , 2023

2023 arXiv
[32]

From Bugs to Fixes: HDL Bug Identification and Patching using LLMs and RAG,

K. Qayyum et al. , “From Bugs to Fixes: HDL Bug Identification and Patching using LLMs and RAG,” in 2024 IEEE LLM Aided Design Workshop (LAD), 2024, pp. 1–5

2024
[33]

SPICED+: Syntactical Bug Pattern Identification and Correction of Trojans in A/MS Circuits Using LLM-Enhanced Detection,

J. Chaudhuri et al. , “SPICED+: Syntactical Bug Pattern Identification and Correction of Trojans in A/MS Circuits Using LLM-Enhanced Detection,” IEEE Transactions on Very Large Scale Integration (VLSI) Systems, 2025

2025
[34]

ATTRITION: Attacking Static Hardware Trojan Detection Techniques Using Reinforcement Learning,

V . Gohil et al. , “ATTRITION: Attacking Static Hardware Trojan Detection Techniques Using Reinforcement Learning,” inProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’22. New York, NY , USA: Association for Computing Machinery, 2...

2022
[35]

Large Delay Analog Trojans: A Silent Fabrication-Time Attack Exploiting Analog Modalities,

T. Yang et al., “Large Delay Analog Trojans: A Silent Fabrication-Time Attack Exploiting Analog Modalities,” TVLSI, vol. 29, no. 1, 2021

2021
[36]

Expel: LLM Agents are Experiential Learners,

A. Zhao et al. , “Expel: LLM Agents are Experiential Learners,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 38, no. 17, 2024, pp. 19 632–19 642

2024
[37]

Personal LLM Agents: Insights and Survey About the Capability, Efficiency and Security,

Y . Li et al. , “Personal LLM Agents: Insights and Survey About the Capability, Efficiency and Security,” arXiv preprint arXiv:2401.05459 , 2024

2024 arXiv
[38]

React: Synergizing Reasoning and Acting in Language Models,

S. Yao et al. , “React: Synergizing Reasoning and Acting in Language Models,” in International Conference on Learning Representations (ICLR), 2023

2023
[39]

Detecting Hardware Trojan Through Heuristic Par- tition and Activity Driven Test Pattern Generation,

X. Mingfu et al. , “Detecting Hardware Trojan Through Heuristic Par- tition and Activity Driven Test Pattern Generation,” in 2014 Communi- cations Security Conference (CSC 2014) , 2014, pp. 1–6

2014
[40]

AMSNet: Netlist Dataset for AMS Circuits,

Z. Tao et al. , “AMSNet: Netlist Dataset for AMS Circuits,” arXiv preprint arXiv:2405.09045, 2024

2024 arXiv
[41]

Pricing,

OpenAI, “Pricing,” https://t.ly/ibOnf. APPENDIX Revade vs. iterations: Fig. 6 illustrates the convergence trend of Revade for the evaluated netlists. Diversity of Trojan components in LATENT-generated Trojan designs: LATENT leverages a feedback-based ap- proach to iteratively ...

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [1]

Breakthrough Silicon Scanning Discovers Backdoor in Military Chip,

S. Skorobogatov et al. , “Breakthrough Silicon Scanning Discovers Backdoor in Military Chip,” in Proceedings of the 14th International Conference on Cryptographic Hardware and Embedded Systems , ser. CHES’12. Berlin, Heidelberg: Springer-Verlag, 2012, p. 23–40

work page 2012

[2] [2]

IP Protection and Supply Chain Security through Logic Obfuscation: A Systematic Overview,

K. Shamsi et al. , “IP Protection and Supply Chain Security through Logic Obfuscation: A Systematic Overview,” ACM Trans. Des. Autom. Electron. Syst. , vol. 24, no. 6, Sep. 2019. [Online]. Available: https://doi.org/10.1145/3342099

work page doi:10.1145/3342099 2019

[3] [3]

Hardware Trojan Attacks: Threat Analysis and Countermeasures,

S. Bhunia et al. , “Hardware Trojan Attacks: Threat Analysis and Countermeasures,” Proceedings of the IEEE , vol. 102, no. 8, pp. 1229– 1247, 2014

work page 2014

[4] [4]

Counterfeit Integrated Circuits: A Rising Threat in the Global Semiconductor Supply Chain,

U. Guin et al., “Counterfeit Integrated Circuits: A Rising Threat in the Global Semiconductor Supply Chain,” Proceedings of the IEEE , vol. 102, no. 8, pp. 1207–1228, 2014

work page 2014

[5] [5]

Machine Learning for Hardware Security: Oppor- tunities and Risks,

R. Elnaggar et al. , “Machine Learning for Hardware Security: Oppor- tunities and Risks,” Journal of Electronic Testing, vol. 34, pp. 183–201, 2018

work page 2018

[6] [6]

A2: Analog Malicious Hardware,

K. Yang et al., “A2: Analog Malicious Hardware,” in IEEE SP, 2016

work page 2016

[7] [7]

Trustworthy Hardware: Trojan Detection and Design-for-Trust Challenges,

M. Tehranipoor et al. , “Trustworthy Hardware: Trojan Detection and Design-for-Trust Challenges,”Computer, vol. 44, no. 7, pp. 66–74, 2011

work page 2011

[8] [8]

Exploiting the Analog Properties of Digital Circuits for Malicious Hardware,

K. Yang et al., “Exploiting the Analog Properties of Digital Circuits for Malicious Hardware,” Communications of the ACM , vol. 60, no. 9, pp. 83–91, 2017

work page 2017