Pith. sign in

REVIEW 3 major objections 6 minor 80 references

LLMPirate: LLMs for Black-box Hardware IP Piracy

T0 review · 3 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read LLMPirate, the first LLM-based technique for hardware IP piracy, rewrites gate-level Verilog netlists into functionally equivalent forms that evade four state-of-the-art piracy detection tools.

desk verdict The core LLM-based netlist-rewriting attack is real and worth engaging, but the paper's '100% evasion' headline is contradicted by its own tables and needs correction before publication. read the letter →

arxiv 2411.16111 v1 pith:6AHRJP6M submitted 2024-11-25 cs.CR cs.AI

Vasudev Gohil , Matthew DeLorenzo , Veera Vishwa Achuta Sai Venkat Nallam , Joey See , Jeyavijayan Rajendran This is my paper · ORCID
classification cs.CRcs.AI
keywords hardwareIPpiracylargelanguagemodelsVerilognetlistcircuitrewritingdetectionevasionGNN4IPsimilarityfunctionalequivalence
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

LLMPirate is an end-to-end automated attack that uses a large language model to rewrite a gate-level Verilog netlist into a functionally equivalent version that current IP piracy detectors do not flag. If the authors are right, anyone with black-box access to an LLM and a detector can pirate valuable chip designs without touching the tools' internals. The method works by translating gates into Boolean formulas, rewriting each gate type separately to fit LLM context limits, and using feedback to fix errors. The paper reports per-tool evasion of 100% for GNN4IP, MOSS, and Jplag and 81.25% for SIM on the tested netlists, and it demonstrates the flow on IBEX, MOR1KX, and a GPS module, while also noting that GNN4IP flags those two largest netlists and scores the originals 0.97 against themselves.

What carries the argument

The central mechanism is a per-gate-type transformation dictionary: each unique gate type in the netlist is first translated from Verilog syntax into a generic Boolean-function line such as 'c = AND(a,b)', the LLM is prompted to rewrite that line using only an allowed complete set of operators, and the response is validated by syntax, operator, and exhaustive functional checks with interactive feedback. The dictionary of valid transformations is then applied gate-by-gate through five mapping strategies, named AND-NOT, NAND, NOR, OR-NOT, and random, which is what actually produces a structurally different but functionally equivalent pirated netlist.

What would settle it

A decisive check is to rerun LLMPirate's pirated netlists through Jplag and SIM with Verilog-aware modes enabled or with thresholds below 0.3, and to formally verify the pirated IBEX, MOR1KX, and GPS netlists; if any large netlist is flagged or fails equivalence, the blanket evasion and equivalence claims do not hold.

Watch

Extended reading notes

Core claim

The paper's central claim is that hardware IP piracy can be carried out as a black-box LLM prompting task. Given an original gate-level netlist, LLMPirate characterizes the set of gate types, translates one representative of each type into a Boolean-function line, and asks the LLM to rewrite it using only an allowed list of Boolean operators, for example replacing an OR gate with NAND or NOR-of-inverted-input forms. Each candidate rewrite is checked for syntax, operator compliance, and functional equivalence by exhaustive simulation, and the LLM is allowed up to five feedback-guided attempts, so the final dictionary of transformations is guaranteed to preserve behavior. Applying these transformations gate-by-gate with five mapping strategies yields pirated netlists that stay below the detection thresholds of GNN4IP, MOSS, Jplag, and SIM on most or all of the 32 test designs; the authors also pirate the IBEX and MOR1KX processors and a GPS module, with functional equivalence of the small benchmarks confirmed by a commercial formal equivalence checker.

Load-bearing premise

The load-bearing premise is that the chosen detection thresholds and text-mode configurations represent how practitioners actually run these tools; if defenders use different thresholds or Verilog-aware modes, the measured evasion rates could change.

Editorial extensions

If this is right

  • A would-be pirate with no access to detector internals can automate the entire rewrite-and-evaluate loop, so source-similarity-based IP protection is not a sufficient defense against LLM-equipped adversaries.
  • Real designs such as processors and a GPS module can be pirated in minutes, so the threat is practical for large netlists, not just small benchmarks.
  • Because the transformation dictionary is built once per gate type and reused, the marginal cost of pirating an additional netlist is small, making large-scale theft feasible.
  • The feedback-guided interaction makes even small open-source LLMs useful for the attack, so the barrier to entry is not limited to the largest proprietary models.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's own data qualify the '100% evasion' headline: Table I reports SIM evasion at 81.25%, and Section V-J reports that GNN4IP labels the GPS and MOR1KX netlists as pirated, so a reader should read the headline as the paper's stated goal rather than an unqualified measured result.
  • The evasion numbers are threshold-dependent and configuration-dependent; if defenders run Jplag and SIM in Verilog-aware modes or tune thresholds lower, the measured success rates would likely drop, so the method's practical impact should be assessed across threshold settings.
  • The same divide-and-conquer prompting with feedback could likely be extended to other hardware description styles, such as VHDL or register-transfer-level code, and to higher-level transformations such as factoring or retiming, which would test whether the attack generalizes beyond simple gate substitution.
  • Because GNN4IP scores the original GPS and MOR1KX netlists 0.97 against themselves, detector comparisons on large designs need size-calibrated baselines; otherwise detector bias, not attack strength, determines the reported evasion.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes LLMPirate, an end-to-end LLM-based framework that rewrites gate-level Verilog netlists into functionally equivalent but structurally different versions, with the goal of evading hardware IP piracy detection. The method addresses three challenges: LLMs' poor handling of raw Verilog netlists (Solution A: syntax translation to Boolean functions), scalability to large netlists (Solution B: netlist characterization and divide-and-conquer prompting over gate types), and error-prone single-shot responses (Solution C: feedback-guided interactive refinement with up to M attempts). The authors evaluate eight LLMs on 31 netlists from the GNN4IP repository plus IBEX, MOR1KX, and a GPS module against four detection tools (GNN4IP, MOSS, Jplag, SIM). The headline claim is that LLMPirate consistently evades detection on 100% of tested circuits across every detection tool, with case studies on IBEX, MOR1KX, and GPS. The paper also includes an ablation study, overhead analysis, and an assessment of obfuscated netlists.

Significance. If the headline claims were fully supported, the paper would represent a significant contribution to hardware security: it would demonstrate that current IP piracy detectors, including a state-of-the-art GNN-based tool, are vulnerable to a black-box LLM-based rewriting attack that is automated, scalable, and does not require access to detector internals. The paper has several genuine strengths: the three proposed solutions are clearly motivated and the ablation study (Table V) shows that Solutions A and B are essential; functional equivalence is verified through exhaustive per-gate simulation and, for the GNN4IP repository netlists, through Cadence Conformal equivalence checking (Sec. VII-D); and the evaluation spans multiple detectors with different algorithmic principles. The significance is tempered, however, by the fact that the central '100% evasion' claim is contradicted by the paper's own data under any fixed configuration, and by the sensitivity of the results to hand-chosen thresholds and tool configurations.

major comments (3)
  1. [Abstract and Sec. V-B vs. Table I, Sec. V-F, Sec. V-J] The abstract states that LLMPirate 'consistently evade[s] detection on 100% of tested circuits across every detection tool' and Sec. V-B states that 'we are successfully able to pirate all 32 netlists against all four detection tools.' This is not supported by the paper's data. Table I reports only 81.25% evasion against SIM, with a footnote attributing the shortfall to SIM's lack of native Verilog support; Sec. V-F says that even the best LLMs, GPT-3.5 and GPT-4, evade SIM for only 25 of 32 netlists; and Sec. V-J reports that GNN4IP classifies all LLMPirate-generated versions of the GPS and MOR1KX netlists as pirated. The abstract's 'across every detection tool' wording is therefore inaccurate for SIM and for GNN4IP on the large case-study netlists, and the claim should be revised to state per-tool rates and to exclude or explain the large-netlist GNN4IP results.
  2. [Sec. V-B, Fig. 3, and Sec. V-C] The headline performance in Fig. 3 is explicitly the best (lowest) similarity score over all eight LLMs and all five mapping strategies, as stated in footnote 5, and Sec. V-C further notes that per-LLM plots are for the best mapping strategy for each netlist and LLM. This best-case selection does not support the word 'consistent' in the abstract: under a fixed LLM and mapping strategy, per-LLM results vary widely, with Sec. V-C reporting that CL-7B evades GNN4IP on only 10 of 32 netlists and Llama3-8B on 11 of 32. The paper should report evasion rates under a fixed configuration (or a small set of configurations) and clearly characterize Fig. 3 as an upper bound, or change the claims to reflect that the reported success requires choosing the best LLM and mapping strategy per netlist.
  3. [Sec. V-A, Table III] The definition of 'evasion' depends on hand-chosen thresholds and tool configurations: GNN4IP threshold 0, MOSS 0.2, Jplag 0.3, SIM 0.3, with Jplag and SIM run in text mode because they do not natively support Verilog. These choices are load-bearing because the central contribution is measured against them; for example, the SIM shortfall in Table I is explained by text-mode operation. The paper should justify the threshold choices and provide a sensitivity analysis (e.g., varying thresholds over plausible ranges, and using native Verilog modes where available) to establish that the reported evasion rates are not artifacts of a single favorable configuration.
minor comments (6)
  1. [Sec. V-A] The text says 'a dataset of 31 different Verilog netlists from the GNN4IP repository,' but Fig. 3 and the main text report results for 32 netlists; please clarify whether IBEX is the 32nd netlist and adjust the wording consistently.
  2. [Sec. V-B and Fig. 5] The MOSS plots show single similarity scores because only one randomly picked pirated netlist per mapping strategy was queried, due to MOSS's query limit; the captions and figure axes should state explicitly that these are single samples, not distributions, to avoid visual over-interpretation.
  3. [Sec. V-J] The claim that GNN4IP has a 'high bias towards classifying large netlists as pirated' is based on the observation that the similarity between the original GPS netlist and itself is 0.97; a more appropriate control would be the similarity between two different large netlists, and the current evidence does not directly demonstrate a size-bias in GNN4IP.
  4. [Sec. VII-D] The sentence 'we check the equivalence of a successfully pirated netlist against each of the four detection tools' appears to be a wording error, since equivalence should be checked against the original netlist rather than against detection tools.
  5. [Table I footnote, Sec. V-F] The footnote and Sec. V-F describe SIM's high scores as a 'false-positive rate'; this is technically a high-similarity-score issue caused by text-mode tokenization, not a false-positive rate, and the terminology should be corrected.
  6. [Throughout] Minor presentation issues: inconsistent capitalization of 'Jplag'/'JPlag' and 'Verilog' vs 'verilog', and Sec. V-H cites a '700% improvement' for Llama3-8B without referencing the exact figure axis from which this value is read.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: LLMPirate is an empirical attack evaluation whose evasion claims are measured against external tools; the paper's internal inconsistencies are correctness concerns, not circular reasoning.

full rationale

This paper reports an empirical attack evaluation rather than a derivation, and I found no step in which a claimed prediction or result is equivalent to its inputs by construction. The LLM-generated transformations are validated for functional equivalence through exhaustive simulation and, for the GNN4IP netlists, the Cadence Conformal Equivalence Checker (Sec. VII-D), independently of the piracy detection tools; the evasion measurements are then obtained by querying four external tools (GNN4IP, MOSS, Jplag, SIM) with fixed thresholds. The hand-crafted allowed-operator table (Table II) and the five mapping strategies define the rewriting search space; they are inputs to the attack, not parameters fitted to detector outputs, so reporting best-over-strategy and best-over-LLM similarity scores is an evaluation-choice and potential overclaim issue, not circularity. The only overlapping-author citation, AttackGNN [27], is used for the full-scan assumption and as related work; it is not load-bearing support for LLMPirate's efficacy. The paper's own data contradict the abstract's '100% across every detection tool' claim (Table I reports 81.25% evasion against SIM; Sec. V-J reports GNN4IP flags the GPS and MOR1KX netlists as pirated), but those are internal consistency and correctness concerns, not circular derivation. Accordingly, the circularity score is 0.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The central claim rests on hand-chosen detection thresholds (Table III), the allowed-operator lists (Table II), and the compositional equivalence of per-gate transformations. There are no invented physical or mathematical entities. The free parameters M=5 and N=5 are experimental choices that affect measured performance but not the fundamental attack.

free parameters (3)
  • Detection thresholds for GNN4IP, MOSS, Jplag, SIM = 0, 0.2, 0.3, 0.3
    Hand-chosen in Table III; not all are tool defaults; reported evasion rates depend on these values.
  • Maximum LLM attempts M = 5
    Set in Sec V-A; higher M may increase success, lower may reduce it.
  • Pirated netlists per mapping strategy N = 5
    Set in Sec V-A; affects the best-case selection used in the headline results.
assumptions (3)
  • standard math Boolean algebra identities, including De Morgan's laws and the completeness of NAND/NOR sets, are valid and applicable.
    Table II's allowed operator lists are built from these identities; the paper relies on them to argue that alternative gate implementations are functionally equivalent.
  • domain assumption The similarity thresholds chosen (GNN4IP: 0, MOSS: 0.2, Jplag: 0.3, SIM: 0.3) correspond to how the detection tools would be used to flag piracy.
    Table III sets these thresholds; the reported evasion rates are evaluated against them, and the paper does not derive them from the tools' documentation or ground truth.
  • domain assumption Replacing each gate with a locally verified equivalent subcircuit preserves the function of the full combinational netlist.
    Sec VII-D argues this via exhaustive testing per gate type; this is the standard compositionality property of combinational logic, but it is an assumption about the netlist structure (acyclic, no shared intermediate nets from the replacements).

how reviews work

0 comments
Cite this review

Pith. "Pith review of LLMPirate: LLMs for Black-box Hardware IP Piracy." pith.science (2026). https://pith.science/paper/6AHRJP6M

@misc{pith2026241116111,
  author       = {Pith},
  title        = {Pith review of: LLMPirate: LLMs for Black-box Hardware IP Piracy},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6AHRJP6M}},
  note         = {Machine review of arXiv:2411.16111}
}
read the original abstract

The rapid advancement of large language models (LLMs) has enabled the ability to effectively analyze and generate code nearly instantaneously, resulting in their widespread adoption in software development. Following this advancement, researchers and companies have begun integrating LLMs across the hardware design and verification process. However, these highly potent LLMs can also induce new attack scenarios upon security vulnerabilities across the hardware development process. One such attack vector that has not been explored is intellectual property (IP) piracy. Given that this attack can manifest as rewriting hardware designs to evade piracy detection, it is essential to thoroughly evaluate LLM capabilities in performing this task and assess the mitigation abilities of current IP piracy detection tools. Therefore, in this work, we propose LLMPirate, the first LLM-based technique able to generate pirated variations of circuit designs that successfully evade detection across multiple state-of-the-art piracy detection tools. We devise three solutions to overcome challenges related to integration of LLMs for hardware circuit designs, scalability to large circuits, and effectiveness, resulting in an end-to-end automated, efficient, and practical formulation. We perform an extensive experimental evaluation of LLMPirate using eight LLMs of varying sizes and capabilities and assess their performance in pirating various circuit designs against four state-of-the-art, widely-used piracy detection tools. Our experiments demonstrate that LLMPirate is able to consistently evade detection on 100% of tested circuits across every detection tool. Additionally, we showcase the ramifications of LLMPirate using case studies on IBEX and MOR1KX processors and a GPS module, that we successfully pirate. We envision that our work motivates and fosters the development of better IP piracy detection tools.

Figures

Figures reproduced from arXiv: 2411.16111 by the authors.

Figure 1
Figure 1. High-level overview of our proposed technique. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. LLMPirate’s end-to-end automated flow. All steps, including characterization, prompt syntax translation, syntax, operator and functionality checks, feedback, and the generation of pirated netlists using the LLM-generated transformations are end-to-end automated, and no manual intervention is needed. ilog netlists, which includes A prompt Syntax translation For hardware netlists, B pre-characterization and divide-and… view at source ↗
Figure 3
Figure 3. LLMPirate’s best performance against GNN4IP [78], MOSS [2], Jplag [38], and SIM [32]. We choose these netlists because of two reasons: (i) GNN4IP is trained on them, making this a more difficult setting for our attack than the typical setting where one pirates netlists that the detection tool has not seen before, e.g., netlists from the testing set of GNN4IP. We adhere to this challenging scenario to highlight LLMPi… view at source ↗
Figures from the paper (12 more)
Figure 4
Figure 4. Figure 4: Distribution of GNN4IP [78] similarity scores for different LLMs in [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: MOSS [2] similarity scores for different LLMs in [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: Performance of mapping strategies against GNN4IP. [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]
Figure 8
Figure 8. Figure 8: Overall, all LLMs benefit from the multiple attempts, [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]
Figure 10
Figure 10. Figure 10: Performance of mapping strategies against MOSS. [PITH_FULL_IMAGE:figures/full_fig_p017_10.png]
Figure 11
Figure 11. Figure 11: Performance of mapping strategies against Jplag. [PITH_FULL_IMAGE:figures/full_fig_p017_11.png]
Figure 12
Figure 12. Figure 12: Performance of mapping strategies against SIM. [PITH_FULL_IMAGE:figures/full_fig_p017_12.png]
Figure 13
Figure 13. Figure 13: Gate count overheads of successfully pirated netlists against GNN4IP [78]. [PITH_FULL_IMAGE:figures/full_fig_p018_13.png]
Figure 14
Figure 14. Figure 14: Performance overheads in terms of critical paths of successfully pirated netlists against GNN4IP [78]. [PITH_FULL_IMAGE:figures/full_fig_p018_14.png]
Figure 15
Figure 15. Figure 15: Distribution of Jplag similarity scores for different LLMs in [PITH_FULL_IMAGE:figures/full_fig_p019_15.png]
Figure 16
Figure 16. Figure 16: Distribution of SIM similarity scores for different LLMs in [PITH_FULL_IMAGE:figures/full_fig_p020_16.png]
Figure 17
Figure 17. Figure 17: Example netlist transformations from LLMs. [PITH_FULL_IMAGE:figures/full_fig_p021_17.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

80 extracted references · 67 canonical work pages

  1. [1]

    HW2VEC: A Graph Learning Tool for Automating Hard- ware Security,

    AICPS, “HW2VEC: A Graph Learning Tool for Automating Hard- ware Security,” https://github .com/AICPS/hw2vec, 2021, [Online; last accessed 9-Jul-2024]

    work page 2021

  2. [2]

    A System for Detecting Software Similarity,

    A. Aiken, “A System for Detecting Software Similarity,” https:// theory.stanford.edu/∼aiken/moss/, [Online; last accessed 9-Jul-2024]

    work page 2024

  3. [3]

    Poisonedgnn: Backdoor attack on graph neural networks-based hard- ware security systems,

    L. Alrahis, S. Patnaik, M. A. Hanif, M. Shafique, and O. Sinanoglu, “Poisonedgnn: Backdoor attack on graph neural networks-based hard- ware security systems,” IEEE Transactions on Computers , 2023

    work page 2023

  4. [4]

    Meet Claude,

    Anthropic, “Meet Claude,” https://www .anthropic.com/claude, 2024, [Online; last accessed 9-Jul-2024]

    work page 2024

  5. [5]

    mor1kx - an OpenRISC processor IP core,

    Baxter, Julius and Kristiansson, Stefan, “mor1kx - an OpenRISC processor IP core,” https://github .com/openrisc/mor1kx, 2022, [Online; last accessed 27-Oct-2024]

    work page 2022

  6. [6]

    Ratgpt: Turning online llms into proxies for malware attacks,

    M. Beckerich, L. Plein, and S. Coronado, “Ratgpt: Turning online llms into proxies for malware attacks,” arXiv preprint arXiv:2308.09183 , 2023

    arXiv 2023

  7. [7]

    Fooling moss detection with pretrained language models,

    S. Biderman and E. Raff, “Fooling moss detection with pretrained language models,” in Proceedings of the 31st ACM international conference on information & knowledge management , 2022, pp. 2933– 2943

    work page 2022

  8. [8]

    Gpthreats-3: Is automatic malware generation a threat?

    M. Botacin, “Gpthreats-3: Is automatic malware generation a threat?” in 2023 IEEE Security and Privacy Workshops (SPW), 2023, pp. 238–254

    work page 2023

Show all 80 references
  1. [9]

    Experience using

    K. W. Bowyer and L. O. Hall, “Experience using ”MOSS” to detect cheating on programming assignments,” in FIE’99 Frontiers in Edu- cation. 29th Annual Frontiers in Education Conference. Designing the Future of Science and Engineering Education. Conference Proceedings (IEEE Cat....

    1999

  2. [10]

    Cadence creates industry’s first LLM Technology for Chip Design,

    S. Brown, “Cadence creates industry’s first LLM Technology for Chip Design,” https://community.cadence.com/cadence blogs 8/b/corporate/ posts/cadence-creates-industry-s-first-llm-technology-for-chip-design, 2023, [Online; last accessed 9-Jul-2024]

    2023

  3. [11]

    Sparks of artificial general intelligence: Early experiments with gpt-4,

    S. Bubeck, V . Chandrasekaran, R. Eldan, J. Gehrke, E. Horvitz, E. Ka- mar, P. Lee, Y . T. Lee, Y . Li, S. Lundberg et al. , “Sparks of artificial general intelligence: Early experiments with gpt-4,” arXiv preprint arXiv:2303.12712, 2023

    2023 arXiv

  4. [12]

    Cadence - Logic Equivalence Checking,

    Cadence, “Cadence - Logic Equivalence Checking,” https: //www.cadence.com/en US/home/tools/digital-design-and-signoff/ logic-equivalence-checking.html, [Online; last accessed 27-Oct-2024]

    2024

  5. [13]

    Cadence.AI Generative AI Platform,

    ——, “Cadence.AI Generative AI Platform,” https://www .cadence.com/ en US/home/solutions/cadence-ai-platform .html, 2024, [Online; last accessed 9-Jul-2024]

    2024

  6. [14]

    Early llm-based tools for enterprise information workers likely provide meaningful boosts to productivity,

    A. Cambon, B. Hecht, B. Edelman, D. Ngwe, S. Jaffe, A. Heger, M. V orvoreanu, S. Peng, J. Hofman, A. Farach, M. Bermejo-Cano, E. Knudsen, J. Bono, H. Sanghavi, S. Spatharioti, D. Rothschild, D. G. Goldstein, E. Kalliamvakou, P. Cihon, M. Demirer, M. Schwarz, and J. Teevan, “Ea...

    2023

  7. [15]

    Multipl-e: a scalable and polyglot approach to benchmarking neural code generation,

    F. Cassano, J. Gouwar, D. Nguyen, S. Nguyen, L. Phipps-Costin, D. Pinckney, M.-H. Yee, Y . Zi, C. J. Anderson, M. Q. Feldman et al., “Multipl-e: a scalable and polyglot approach to benchmarking neural code generation,” IEEE Transactions on Software Engineering, vol. 49, no. 7,...

    2023

  8. [16]

    Rtl hardware ip protection using key- based control and data flow obfuscation,

    R. S. Chakraborty and S. Bhunia, “Rtl hardware ip protection using key- based control and data flow obfuscation,” in 2010 23rd International Conference on VLSI Design , 2010, pp. 405–410

    2010

  9. [17]

    How to detect plagiarism in source code,

    codequiry, “How to detect plagiarism in source code,” https: //codequiry.com/resources/how-to-detect-code-plagiairsm, 2021, [On- line; last accessed 9-Jul-2024]

    2021

  10. [18]

    Related technologies,

    ——, “Related technologies,” https://www .monash.edu/learning- teaching/teachhq/Assessment/academic-integrity/related-technologies, 2024, [Online; last accessed 9-Jul-2024]

    2024

  11. [19]

    The 600 Billion Dollar China IP echo cham- ber,

    M. Cohen, “The 600 Billion Dollar China IP echo cham- ber,” https://chinaipr .com/2019/05/12/the-600-billion-dollar-china-ip- echo-chamber/, 2019, [Online; last accessed 9-Jul-2024]

    2019

  12. [20]

    Rapid silicon announces RapidGPT’s official availability,

    CorporateTeam, “Rapid silicon announces RapidGPT’s official availability,” https://rapidsilicon .com/rapid-silicon-announces- rapidgpts-official-availability/, 2023, [Online; last accessed 9-Jul- 2024]

    2023

  13. [21]

    Mossad: defeating software plagiarism detection,

    B. Devore-McDonald and E. D. Berger, “Mossad: defeating software plagiarism detection,” Proc. ACM Program. Lang., vol. 4, no. OOPSLA, nov 2020. [Online]. Available: https://doi .org/10.1145/3428206

    2020 doi

  14. [22]

    Breaking CAS-Lock,

    DfX-NYUAD, “Breaking CAS-Lock,” https://github .com/DfX- NYUAD/Breaking CAS-Lock/tree/main, 2021, [Online; last accessed 15-Nov-2024]

    2021

  15. [23]

    The end of logic locking? a critical view on the security of logic locking,

    S. Engels, M. Hoffmann, and C. Paar, “The end of logic locking? a critical view on the security of logic locking,” Cryptology ePrint Archive, 2019

    2019

  16. [24]

    Large language models for software engineering: Survey and open problems,

    A. Fan, B. Gokkaya, M. Harman, M. Lyubarskiy, S. Sengupta, S. Yoo, and J. M. Zhang, “Large language models for software engineering: Survey and open problems,” arXiv preprint arXiv:2310.03533 , 2023

    2023 arXiv

  17. [25]

    Hardware Phi-1.5 B: A Large Language Model Encodes Hard- ware Domain Specific Knowledge,

    W. Fu, S. Li, Y . Zhao, H. Ma, R. Dutta, X. Zhang, K. Yang, Y . Jin, and X. Guo, “Hardware Phi-1.5 B: A Large Language Model Encodes Hard- ware Domain Specific Knowledge,” arXiv preprint arXiv:2402.01728 , 2024. 14

    2024 arXiv

  18. [26]

    GitHub CoPilot,

    GitHub, “GitHub CoPilot,” https://github .com/features/copilot, 2024, [Online; last accessed 9-Jul-2024]

    2024

  19. [27]

    AttackGNN: Red- Teaming GNNs in Hardware Security Using Reinforcement Learning,

    V . Gohil, S. Patnaik, D. Kalathil, and J. Rajendran, “AttackGNN: Red- Teaming GNNs in Hardware Security Using Reinforcement Learning,” arXiv preprint arXiv:2402.13946 , 2024

    2024 arXiv

  20. [28]

    Supercharge your creativity and productivity,

    Google, “Supercharge your creativity and productivity,” https:// gemini.google.com/, 2024, [Online; last accessed 9-Jul-2024]

    2024

  21. [29]

    Meet the first version of Gemini — our most capa- ble AI model

    Google DeepMind, “Meet the first version of Gemini — our most capa- ble AI model.” https://deepmind .google/technologies/gemini/#gemini- 1.0, 2024, [Online; last accessed 9-Jul-2024]

    2024

  22. [30]

    Welcome to the Gemini era,

    ——, “Welcome to the Gemini era,” https://deepmind .google/ technologies/gemini/#introduction, 2024, [Online; last accessed 9-Jul- 2024]

    2024

  23. [31]

    Adversarial Training for Graph Neural Networks,

    L. Gosch, S. Geisler, D. Sturm, B. Charpentier, D. Z ¨ugner, and S. G ¨unnemann, “Adversarial Training for Graph Neural Networks,” arXiv preprint arXiv:2306.15427 , 2023

    2023 arXiv

  24. [32]

    The software and text similarity tester SIM,

    D. Grune, “The software and text similarity tester SIM,” https:// dickgrune.com/Programs/similarity tester/, [Online; last accessed 9-Jul- 2024]

    2024

  25. [33]

    SIM Manual,

    ——, “SIM Manual,” https://dickgrune .com/Programs/similarity tester/ sim.pdf, 2017, [Online; last accessed 9-Jul-2024]

    2017

  26. [34]

    A survey on supply chain security: Application areas, security threats, and solution architectures,

    V . Hassija, V . Chamola, V . Gupta, S. Jain, and N. Guizani, “A survey on supply chain security: Application areas, security threats, and solution architectures,” IEEE Internet of Things Journal, vol. 8, no. 8, pp. 6222– 6246, 2020

    2020

  27. [35]

    CHATGPT sets record for fastest-growing user base - analyst note,

    K. Hu, “CHATGPT sets record for fastest-growing user base - analyst note,” https://www .reuters.com/technology/chatgpt-sets-record-fastest- growing-user-base-analyst-note-2023-02-01/, 2022, [Online; last ac- cessed 9-Jul-2024]

    2023

  28. [36]

    Code Llama,

    Hugging Face, “Code Llama,” https://huggingface .co/codellama, 2024, [Online; last accessed 9-Jul-2024]

    2024

  29. [37]

    A survey on large lan- guage models for code generation,

    J. Jiang, F. Wang, J. Shen, S. Kim, and S. Kim, “A survey on large lan- guage models for code generation,” arXiv preprint arXiv:2406.00515 , 2024

    2024 arXiv

  30. [38]

    JPlag - Detecting Software Plagiarism,

    Jplag, “JPlag - Detecting Software Plagiarism,” https://github .com/ jplag/JPlag, [Online; last accessed 9-Jul-2024]

    2024

  31. [39]

    A watermark for large language models,

    J. Kirchenbauer, J. Geiping, Y . Wen, J. Katz, I. Miers, and T. Goldstein, “A watermark for large language models,” in International Conference on Machine Learning . PMLR, 2023, pp. 17 061–17 084

    2023

  32. [40]

    Protect your chip design intellectual property: An overview,

    J. Knechtel, S. Patnaik, and O. Sinanoglu, “Protect your chip design intellectual property: An overview,” in Proceedings of the International Conference on Omni-Layer Intelligent Systems , ser. COINS ’19. New York, NY , USA: Association for Computing Machinery, 2019, p. 211–21...

    2019

  33. [41]

    Large language models are state-of-the- art evaluators of translation quality,

    T. Kocmi and C. Federmann, “Large language models are state-of-the- art evaluators of translation quality,” arXiv preprint arXiv:2302.14520 , 2023

    2023 arXiv

  34. [42]

    Sentiment analysis in the age of generative ai,

    J. O. Krugmann and J. Hartmann, “Sentiment analysis in the age of generative ai,” Customer Needs and Solutions , vol. 11, no. 1, p. 3, 2024

    2024

  35. [43]

    Chipnemo: Domain- adapted llms for chip design,

    M. Liu, T.-D. Ene, R. Kirby, C. Cheng, N. Pinckney, R. Liang, J. Alben, H. Anand, S. Banerjee, I. Bayraktaroglu et al. , “Chipnemo: Domain- adapted llms for chip design,” arXiv preprint arXiv:2311.00176 , 2023

    2023 arXiv

  36. [44]

    Ibex RISC-V Core,

    lowRISC, “Ibex RISC-V Core,” https://github .com/lowRISC/ibex, 2024, [Online; last accessed 9-Jul-2024]

    2024

  37. [45]

    The imperative for regulatory oversight of large language models (or generative ai) in healthcare,

    B. Mesk ´o and E. J. Topol, “The imperative for regulatory oversight of large language models (or generative ai) in healthcare,” NPJ digital medicine, vol. 6, no. 1, p. 120, 2023

    2023

  38. [46]

    Introducing Code Llama, a state-of-the-art large lan- guage model for coding,

    Meta, “Introducing Code Llama, a state-of-the-art large lan- guage model for coding,” https://ai .meta.com/blog/code-llama-large- language-model-coding/, 2023, [Online; last accessed 9-Jul-2024]

    2023

  39. [47]

    Build the future of AI with Meta Llama 3,

    ——, “Build the future of AI with Meta Llama 3,” https:// llama.meta.com/llama3/, 2024, [Online; last accessed 9-Jul-2024]

    2024

  40. [48]

    Introducing Meta Llama 3: The most capable openly available LLM to date,

    Meta, “Introducing Meta Llama 3: The most capable openly available LLM to date,” https://ai .meta.com/blog/meta-llama-3/, 2024, [Online; last accessed 27-Oct-2024]

    2024

  41. [49]

    Llama 2,

    ——, “Llama 2,” https://llama .meta.com/llama2/, 2024, [Online; last accessed 9-Jul-2024]

    2024

  42. [50]

    Addressing Global Software Piracy ,

    Microsoft, “Addressing Global Software Piracy ,” https: //news.microsoft.com/download/archived/presskits/antipiracy/docs/ addressingpiracy.pdf, [Online; last accessed 9-Jul-2024]

    2024

  43. [51]

    How Copilot works, technically speaking,

    Microsoft, “How Copilot works, technically speaking,” https://www.microsoft.com/en-us/bing/do-more-with-ai/how-bing- chat-works?form=MA13KP, 2023, [Online; last accessed 9-Jul-2024]

    2023

  44. [52]

    GPS code generator,

    MIT Lincoln Laboratory, “GPS code generator,” https: //github.com/CommonEvaluationPlatform/CEP/tree/master/generators/ mitll-blocks/src/main/resources/vsrc/gps, 2024, [Online; last accessed 27-Oct-2024]

    2024

  45. [53]

    A comprehensive overview of large language models,

    H. Naveed, A. U. Khan, S. Qiu, M. Saqib, S. Anwar, M. Usman, N. Akhtar, N. Barnes, and A. Mian, “A comprehensive overview of large language models,” arXiv preprint arXiv:2307.06435 , 2023

    2023 arXiv

  46. [54]

    Gradescope Info & Resources,

    P. G. A. S. of Computer Science & Engineering University of Washing- ton, “Gradescope Info & Resources,” https://www .cs.washington.edu/ lab/course-resources/gradescope, 2021, [Online; last accessed 9-Jul- 2024]

    2021

  47. [55]

    Attorney General Jeff Sessions Announces New Initiative to Combat Chinese Economic Espionage,

    D. of Justice, “Attorney General Jeff Sessions Announces New Initiative to Combat Chinese Economic Espionage,” https://www.justice.gov/opa/speech/attorney-general-jeff-sessions- announces-new-initiative-combat-chinese-economic-espionage, 2018, [Online; last accessed 9-Jul-2024]

    2018

  48. [56]

    E. O. o. t. P. OFFICE of the UNITED STATES TRADE REPRE- SENTATIVE, “Findings of the investigation into china’s acts, policies, and practices related to technology transfer, intellectual property, and innovation under section 301 of the trade act of 1974,” https://ustr .gov/ si...

    1974

  49. [57]

    OpenAI, https://openai .com/blog/chatgpt, 2022, [Online; last accessed 9-Jul-2024]

    2022

  50. [58]

    GPT-4 is OpenAI’s most advanced system, producing safer and more useful responses,

    ——, “GPT-4 is OpenAI’s most advanced system, producing safer and more useful responses,” https://openai .com/gpt-4, 2023, [Online; last accessed 9-Jul-2024]

    2023

  51. [59]

    ChatGPT,

    ——, “ChatGPT,” https://chat .openai.com/, 2024, [Online; last accessed 9-Jul-2024]

    2024

  52. [60]

    ——, “Models,” https://platform .openai.com/docs/models/gpt-3-5- turbo, 2024, [Online; last accessed 9-Jul-2024]

    2024

  53. [61]

    Models - GPT-3.5 Turbo,

    OpenAI, “Models - GPT-3.5 Turbo,” https://platform .openai.com/docs/ models/gpt-3-5-turbo, 2024, [Online; last accessed 9-Jul-2024]

    2024

  54. [62]

    Models - GPT-4 Turbo and GPT-4,

    OpenAI, “Models - GPT-4 Turbo and GPT-4,” https: //platform.openai.com/docs/models/gpt-4-turbo-and-gpt-4, 2024, [Online; last accessed 9-Jul-2024]

    2024

  55. [63]

    What are tokens and how to count them?

    ——, “What are tokens and how to count them?” https://help.openai.com/en/articles/4936856-what-are-tokens-and- how-to-count-them, 2024, [Online; last accessed 9-Jul-2024]

    2024

  56. [64]

    Automating customer service using langchain: Building custom open-source gpt chatbot for organizations,

    K. Pandya and M. Holia, “Automating customer service using langchain: Building custom open-source gpt chatbot for organizations,” arXiv preprint arXiv:2310.05421 , 2023

    2023 arXiv

  57. [65]

    An important next step on our AI journey,

    S. Pichai, “An important next step on our AI journey,” https://blog.google/intl/en-africa/products/explore-get-answers/an- important-next-step-on-our-ai-journey/, 2023, [Online; last accessed 9-Jul-2024]

    2023

  58. [66]

    Introducing generative AI for Chip Design: Synopsys blog,

    G. Rangarajan, “Introducing generative AI for Chip Design: Synopsys blog,” https://www .synopsys.com/blogs/chip-design/copilot- generative-ai-chip-design .html, 2023, [Online; last accessed 9-Jul- 2024]

    2023

  59. [67]

    Epic: Ending piracy of integrated circuits,

    J. A. Roy, F. Koushanfar, and I. L. Markov, “Epic: Ending piracy of integrated circuits,” in Proceedings of the conference on Design, automation and test in Europe , 2008, pp. 1069–1074

    2008

  60. [68]

    Code llama: Open foundation models for code,

    B. Roziere, J. Gehring, F. Gloeckle, S. Sootla, I. Gat, X. E. Tan, Y . Adi, J. Liu, R. Sauvestre, T. Remez et al. , “Code llama: Open foundation models for code,” arXiv preprint arXiv:2308.12950 , 2023

    2023 arXiv

  61. [69]

    Winnowing: local algorithms for document fingerprinting,

    S. Schleimer, D. S. Wilkerson, and A. Aiken, “Winnowing: local algorithms for document fingerprinting,” in Proceedings of the 2003 ACM SIGMOD international conference on Management of data, 2003, pp. 76–85

    2003

  62. [70]

    Truly stripping functionality for logic locking: A fault-based per- spective,

    A. Sengupta, M. Nabeel, N. Limaye, M. Ashraf, and O. Sinanoglu, “Truly stripping functionality for logic locking: A fault-based per- spective,” IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems , vol. 39, no. 12, pp. 4439–4452, 2020. 15

    2020

  63. [71]

    TAPS: A MOSS extension for detecting software plagiarism at scale,

    D. Sheahen and D. Joyner, “TAPS: A MOSS extension for detecting software plagiarism at scale,” in Proceedings of the Third (2016) ACM Conference on Learning@ Scale , 2016, pp. 285–288

    2016

  64. [72]

    Will AI Replace Programmers? Navigating the Future of Coding,

    A. Siedsma, “Will AI Replace Programmers? Navigating the Future of Coding,” https://extendedstudies .ucsd.edu/news-and-events/division- of-extended-studies-blog/will-ai-replace-programmers-the-future-of- coding, 2024, [Online; last accessed 9-Jul-2024]

    2024

  65. [73]

    Choosing code segments to exclude from code similarity detection,

    Simon, O. Karnalim, J. Sheard, I. Dema, A. Karkare, J. Leinonen, M. Liut, and R. McCauley, “Choosing code segments to exclude from code similarity detection,” in Proceedings of the Working Group Reports on Innovation and Technology in Computer Science Education , 2020, pp. 1–19

    2020

  66. [74]

    Verigen: A large language model for verilog code generation,

    S. Thakur, B. Ahmad, H. Pearce, B. Tan, B. Dolan-Gavitt, R. Karri, and S. Garg, “Verigen: A large language model for verilog code generation,” ACM Transactions on Design Automation of Electronic Systems , 2023

    2023

  67. [75]

    Attention is all you need,

    A. Vaswani, “Attention is all you need,” Advances in Neural Information Processing Systems, 2017

    2017

  68. [76]

    Anti-sat: Mitigating sat attack on logic locking,

    Y . Xie and A. Srivastava, “Anti-sat: Mitigating sat attack on logic locking,” IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems , vol. 38, no. 2, pp. 199–207, 2018

    2018

  69. [77]

    Agent sca: Advanced physical side channel analysis agent with llms,

    F. Yaman, “Agent sca: Advanced physical side channel analysis agent with llms,” Ph.D. dissertation, 2023, copyright - Database copyright ProQuest LLC; ProQuest does not claim copyright in the individual underlying works; Last updated - 2024-01-19

    2023

  70. [78]

    GNN4IP: Graph Neural Network for Hardware Intellectual Property Piracy Detec- tion,

    R. Yasaei, S.-Y . Yu, E. K. Naeini, and M. A. A. Faruque, “GNN4IP: Graph Neural Network for Hardware Intellectual Property Piracy Detec- tion,” in 2021 58th ACM/IEEE Design Automation Conference (DAC) , 2021, pp. 217–222

    2021

  71. [79]

    Security analysis of anti-sat,

    M. Yasin, B. Mazumdar, O. Sinanoglu, and J. Rajendran, “Security analysis of anti-sat,” in 2017 22nd Asia and South Pacific Design Automation Conference (ASP-DAC). IEEE, 2017, pp. 342–347. 16 APPENDIX A. Sizes of Target Netlists Table IV shows the sizes of the netlists we targ...

    2017

  72. [2023]

    Available: https://www .microsoft.com/en-us/research/ publication/early-llm-based-tools-for-enterprise-information-workers- likely-provide-meaningful-boosts-to-productivity/

    [Online]. Available: https://www .microsoft.com/en-us/research/ publication/early-llm-based-tools-for-enterprise-information-workers- likely-provide-meaningful-boosts-to-productivity/

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.