Pith. sign in

REVIEW 3 major objections 4 minor 76 references

Hardware Design and Security in the Era of Chiplets and LLMs

T0 review · 3 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Chiplet and LLM hardware security must merge, review argues

desk verdict A solid integrative survey of chiplet security and LLM-driven EDA security, with a plausible but under-defended gap claim at their intersection. read the letter →

arxiv 2608.05063 v1 pith:EKFNAF4N submitted 2026-08-05 cs.CR cs.AIcs.AR

Johann Knechtel , Ozgur Sinanoglu , Paul V. Gratz , Ramesh Karri This is my paper
classification cs.CRcs.AIcs.AR
keywords chipletsecurity2.5DintegrationlargelanguagemodelsEDArootoftrusthardwareTrojansdatacontaminationIPleakage
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This review paper argues that two simultaneous shifts in semiconductor design—moving to heterogeneous 2.5D chiplet systems and adopting LLM-driven EDA tools—each expand the hardware attack surface, and that the two must be secured together. It surveys attacks on chiplet systems, from coherence-protocol Trojans to physical probing, and reviews defenses built on an active-interposer Root of Trust. It then reviews threats and defenses for LLM-driven EDA, including backdoors, data contamination, prompt injection, and IP leakage. The paper's central claim is that a cross-domain blind spot remains: current research does not yet apply trustworthy LLMs to secure chiplet trust boundaries, nor does it use 2.5D-anchored roots of trust to secure LLM acceleration hardware. If true, the intersection of these two fields is an open frontier with concrete security consequences.

What carries the argument

The load-bearing elements are two: (1) the 2.5D Root of Trust, a physically isolated security monitor implemented in the active interposer, where Transaction Monitors (TRANSMONs) enforce access control and data masking as hardware shims between untrusted chiplets and the network-on-chip fabric, and Coherence Message Checkers (CMCs) validate cache-coherence flits against OS-managed permissions; (2) the taxonomy of native LLM-EDA threats—backdoor poisoning, data contamination, prompt injection, and IP leakage—with corresponding defenses such as SafeTune, Semantic Consensus Decoding, VeriContaminated, SALAD, and CircuitGuard. These mechanisms are the paper's basis for claiming that chiplet security and LLM-EDA security can be made compatible rather than mutually exclusive.

What would settle it

Locate a peer-reviewed publication that already applies a large-language-model-based security agent specifically to 2.5D/3D chiplet trust boundaries, for instance automatically generating TRANSMON access policies or coherence-monitor rules; demonstrating such a tool would undercut the paper's central missing-gap claim.

Watch

Extended reading notes

Core claim

On the paper's own account, the central discovery is that the threats to 2.5D chiplet systems and the threats to LLM-driven EDA pipelines are not independent: when chiplets from multiple vendors are integrated on an interposer to accelerate LLM workloads, predictable multi-chiplet memory traffic becomes a side channel for model theft, and when LLMs write hardware, the same models introduce backdoors, leakage, and contamination. The paper's synthesis shows that existing defenses—physically isolated active-interposer roots of trust with transaction monitors and coherence message checkers on the hardware side, and sanitization, unlearning, and consensus decoding on the LLM side—each address one frontier, but neither has been applied to the other. The paper consequently pinpoints a gap: no current LLM-based security approach is semantically aware of multi-vendor chiplet trust boundaries, interposer fabrics, or active interposer configurations.

Load-bearing premise

The review's central conclusion depends on the assumption that the selected literature is complete enough to establish the gap; the paper does not describe a systematic search protocol, so if relevant prior art already applies LLM-based security to chiplet trust boundaries, the claimed gap would collapse.

Editorial extensions

If this is right

  • If the gap is real, the immediate research agenda is to build LLM-driven agents that synthesize system-wide security policies for interposer-based systems directly from architectural descriptions and OS permissions.
  • If the 2.5D Root of Trust with CMCs is applied to heterogeneous LLM stacks, the highly predictable weight and activation traffic of LLM inference becomes monitorable, plausibly closing the model-theft side channel identified in the survey.
  • If LLM-EDA security measures such as machine unlearning and dynamic benchmarking are adopted, public hardware benchmarks can be made trustworthy for reporting real LLM coding capability.
  • If domain-aware safety alignment like that explored by HarmChip is extended to hardware-specific guardrails, the false-positive blocking of legitimate engineering tasks can be reduced while still blocking semantic-disguised attacks.
  • If the proposed synergy is realized, chiplet-based LLM acceleration can ship with a physically anchored root of trust that also guards the LLM pipeline itself.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's taxonomy implies that LLM-EDA security and chiplet security could be unified into a single trust model: the interposer root of trust as the physical enforcement point and the LLM as the policy synthesizer.
  • A testable extension would be to measure whether the 1–2-stage latency of coherence message checkers scales to the higher message rates of LLM inference workloads, since the survey cites minimal overhead for general coherence traffic but does not benchmark LLM-specific patterns.
  • The paper leaves implicit that the same LLM-driven EDA pipelines that create vulnerabilities could be used to generate the security assertions and monitors that defend chiplet systems, potentially closing the loop.
  • The review's emphasis on data contamination in LLM-EDA benchmarking suggests that contamination-detection metrics like those in VeriContaminated could be turned into a continuous health check for hardware-security LLM tools.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. This manuscript is a survey of the intersection of two recent developments in semiconductor hardware: 2.5D/3D chiplet integration and LLM-driven EDA. It reviews attacks on chiplet systems at architectural, logical, and physical levels; defense mechanisms based on 2.5D split manufacturing and active-interposer roots of trust, including transaction monitors and coherence message checkers; threats to LLM-based RTL generation such as backdoor attacks, data contamination, safety misalignment, and IP leakage; and defenses including safe fine-tuning, semantic consensus decoding, dynamic benchmarking, machine unlearning, and training sanitization. It also reviews the use of LLMs for hardware security tasks such as logic locking, side-channel assessment, Trojan detection, red-teaming, and bug detection. The paper concludes that no existing work applies trustworthy LLMs to secure chiplet systems, and it calls for cross-domain research combining LLM agents with chiplet root-of-trust architectures.

Significance. The survey is a useful and timely systematization. Its strongest parts are the organization of chiplet-specific attacks and countermeasures around the active interposer as a physically isolated root of trust, and the organization of LLM-EDA security into backdoor, contamination, misalignment, and IP-leakage categories. It gives concrete attention to mechanisms such as TRANSMONs, CMC-1/CMC-2, SafeTune, SCD, SALAD, and CircuitGuard, and it ends with a testable research direction in Section VII: automated generation of access policies for TRANSMONs and CMCs from architectural descriptions and OS permissions. The paper does not present original measurements or proofs, so its value rests on the accuracy of the literature representation and the validity of its central gap claim. The individual citations are mostly plausible, but the central negative claim is not yet supported by a reproducible selection methodology.

major comments (3)
  1. [Section I, third paragraph; Section VI.6] The paper's central claim is the assertion that 'current research fails to leverage trustworthy LLMs to secure complex chiplet systems.' This is a negative existential claim about the literature, but the manuscript does not describe a systematic search protocol, inclusion/exclusion criteria, or a date range anywhere in the Introduction or Section II. The claim is therefore an argument from the selected reference list. Please add a methodology statement and either scope the claim (for example, 'to our knowledge' or 'within the surveyed period') or demonstrate coverage of the intersection.
  2. [Section VI.6; Refs. [6] and [11]] The gap claim is internally ambiguous because the reference list already contains works that may sit at the claimed intersection. Reference [6] is a survey of hardware security and trust for chiplet-based 2.5D/3D ICs, and Reference [11] is a position paper by the same group on LLMs for secure hardware design and related problems. The text never explains why these works do not count as prior art for 'LLMs for securing chiplet systems.' Please state explicitly what makes the proposed intersection distinct and why those references do not close the gap.
  3. [Section III.A] The sentence 'structural vulnerabilities of multi-vendor chiplet systems executing distributed acceleration remain a critical and unaddressed security gap' is another negative existential claim used to motivate the survey. It depends on the same unstated completeness assumption as the Introduction. If the authors retain this sentence, they should either supply evidence of coverage or soften it to 'not addressed by the works we surveyed.'
minor comments (4)
  1. [Section VI.3] The description of TrojanLoC is garbled: 'TrojanLoC [70] Trained on the TrojanInS dataset, it uses devises an RTL-adapted transformer...' Please rewrite as a grammatical sentence and clarify whether the training on TrojanInS is part of [70]'s contribution or a baseline setup.
  2. [Section IV.C] The quantitative results (73.7% IR-drop reduction, 18.5% footprint reduction, 2.68% interposer utilization, ~4% monitoring overhead, and 3.2% system power reduction) come from a specific design study in [53]. Please add a citation-context sentence so readers do not generalize these single-design measurements.
  3. [References] Reference [9] lists 'arXiv:2601.19908, 2025', but the arXiv identifier implies January 2026; please correct the year. Several other entries ([24], [25], [57]) lack years or version numbers and should be completed.
  4. [General] The paper would benefit from a figure or table laying out the threat-defense taxonomy; without one, the relationships among attack surfaces, defense mechanisms, and the proposed gap are harder to follow than necessary.

Circularity Check

0 steps flagged · score 2.0 of 10

No circular derivation; self-citations are present but none is load-bearing for the survey's central gap claim.

full rationale

This paper is a survey and position statement, not a derivation. It contains no equations, fitted parameters, or construction that could make a 'prediction' equal to an input. The central claim—that research has not yet applied trustworthy LLMs to secure 2.5D/3D chiplet systems—is a negative existential claim about the literature, supported by a curated reference list. The absence of a systematic search protocol is a coverage and evidentiary weakness, but it is not circularity: the claim is not defined in terms of the authors' own results, and no reference is invoked as an unexamined premise that presupposes the gap. The numerous self-citations (e.g., [4], [5], [21], [51], [52], [53]) are used as published, peer-reviewed evidence for specific attack and defense results in the authors' domain; they do not by themselves establish the survey's gap conclusion, and no uniqueness theorem, ansatz, or known result is smuggled in via self-citation. The possible overlap with the authors' earlier position paper [11] is a potential correctness concern, not a circular one. Under the hard rules, no circular step can be quoted and exhibited as a reduction of a result to its inputs. The score of 2 reflects the presence of many self-citations without any load-bearing circularity; the central thesis remains an independent, if under-supported, literature assessment rather than a self-referential loop.

Assumptions & free parameters 0 free parameters · 2 assumptions · 0 invented entities

As a review, the paper introduces no free parameters or invented entities. Its load-bearing assumptions are that the cited primary results are trustworthy and that the literature selection is complete enough to support the claimed gap.

assumptions (2)
  • domain assumption The cited attacks and defenses are accurately characterized in the referenced papers.
    The survey's entire content is a restatement of cited prior work; if any citation is misrepresented, the corresponding survey claim fails (throughout Sections III-VI).
  • domain assumption The identified literature set is complete with respect to LLM-based security for 2.5D/3D chiplet systems.
    The gap claim in Section VI.6 ('dedicated application to securing 2.5D/3D systems is missing') assumes that no prior work exists that was omitted; the paper does not describe a systematic search.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Hardware Design and Security in the Era of Chiplets and LLMs." pith.science (2026). https://pith.science/paper/EKFNAF4N

@misc{pith2026260805063,
  author       = {Pith},
  title        = {Pith review of: Hardware Design and Security in the Era of Chiplets and LLMs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EKFNAF4N}},
  note         = {Machine review of arXiv:2608.05063}
}
read the original abstract

The semiconductor industry is undergoing a dual revolution: the shift toward heterogeneous 2.5D chiplet systems and the integration of Large Language Models (LLMs) into Electronic Design Automation (EDA) flows. While these paradigms offer unprecedented benefits in yield, modularity, design productivity, etc., they radically expand the hardware attack surface. This paper provides a unified analysis of these frontiers, ranging from attacks on chiplet systems (including hardware stacks for LLM acceleration) across architectural, logical, and physical levels, to various exploits against LLM-driven EDA pipelines. To secure chiplet systems, we review a powerful defense approach that leverages 2.5D split manufacturing and active interposers for physically isolated Root of Trust (RoT) architectures. To secure LLM-driven EDA pipelines, we first identify native threats and then review state-of-the-art defense techniques. Finally, we discuss how LLM systems can advance hardware security efforts for modern systems, including chiplets.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

76 extracted references · 54 canonical work pages

  1. [11]

    LLMs for Secure Hardware Design and Related Problems: Opportunities and Challenges

    J. Knechtel et al., “LLMs for secure hardware design and related problems: Opportunities and challenges,”arXiv:2605.10807,

    work page Pith review arXiv

  2. [6]

    On hardware security and trust for chiplet-based 2.5D and 3D ICs: Challenges and innovations,

    J. Suzano Da Fonseca et al., “On hardware security and trust for chiplet-based 2.5D and 3D ICs: Challenges and innovations,”IEEE Access, vol. 12, 2024

    work page 2024

  3. [1]

    Pioneering chiplet technology and design for the AMD EPYC™ and Ryzen™ processor families: Industrial product,

    S. Naffziger et al., “Pioneering chiplet technology and design for the AMD EPYC™ and Ryzen™ processor families: Industrial product,” inProc. ISCA, 2021

    work page 2021

  4. [2]

    [Online]

    Apple Inc.,Apple unveils M1 Ultra, the world’s most powerful chip for a personal computer, Apple Newsroom, 2022. [Online]. Available: https://www.apple.com/ newsroom/2022/03/apple-unveils-m1-ultra-the-worlds-most-powerful-chip-for- a-personal-computer/

    work page 2022

  5. [3]

    Sapphire rapids: The next-generation Intel Xeon scalable processor,

    N. Nassif et al., “Sapphire rapids: The next-generation Intel Xeon scalable processor,” inProc. ISSCC, 2022

    work page 2022

  6. [4]

    2.5D root of trust: Secure system-level integration of untrusted chiplets,

    M. Nabeel et al., “2.5D root of trust: Secure system-level integration of untrusted chiplets,”IEEE Trans. Comput., vol. 69, no. 11, 2020

    work page 2020

  7. [5]

    Coherence attacks and countermeasures in interposer-based chiplet systems,

    G. A. Chacon et al., “Coherence attacks and countermeasures in interposer-based chiplet systems,”ACM TACO, vol. 21, no. 2, 2024

    work page 2024

  8. [7]

    Cambricon-LLM: A chiplet-based hybrid architecture for on-device inference of 70B LLM,

    Z. Yu et al., “Cambricon-LLM: A chiplet-based hybrid architecture for on-device inference of 70B LLM,” inProc. MICRO, 2024

    work page 2024

Show all 76 references
  1. [8]

    Chiplet cloud: Building AI supercomputers for serving large generative language models,

    H. Peng et al., “Chiplet cloud: Building AI supercomputers for serving large generative language models,”arXiv:2307.02666,

    arXiv

  2. [9]

    CHIME: Chiplet-based heterogeneous near-memory acceleration for edge multimodal LLM inference,

    Y . Chen et al., “CHIME: Chiplet-based heterogeneous near-memory acceleration for edge multimodal LLM inference,”arXiv:2601.19908, 2025

    2025

  3. [10]

    LLMs and the future of chip design: Unveiling security risks and building trust,

    Z. Wang et al., “LLMs and the future of chip design: Unveiling security risks and building trust,” inProc. ISVLSI, 2024

    2024

  4. [12]

    Large language models (LLMs) for electronic design automation (EDA): Special session paper,

    K. Xu et al., “Large language models (LLMs) for electronic design automation (EDA): Special session paper,” inProc. SOCC, 2024

    2024

  5. [13]

    VeriGen: A large language model for Verilog code generation,

    S. Thakur et al., “VeriGen: A large language model for Verilog code generation,” ACM TODAES, vol. 29, no. 3, 2024

    2024

  6. [14]

    Automatically improving LLM-based Verilog generation using EDA tool feedback,

    J. Blocklove et al., “Automatically improving LLM-based Verilog generation using EDA tool feedback,”ACM TODAES, vol. 30, no. 6, 2025

    2025

  7. [15]

    VeriLeaky: Navigating IP protection vs utility in fine-tuning for LLM-driven Verilog coding,

    Z. Wang et al., “VeriLeaky: Navigating IP protection vs utility in fine-tuning for LLM-driven Verilog coding,” inProc. MLCAD, 2025

    2025

  8. [16]

    RTL-Breaker: Assessing the security of LLMs against backdoor attacks on HDL code generation,

    L. L. Mankali et al., “RTL-Breaker: Assessing the security of LLMs against backdoor attacks on HDL code generation,” inProc. DATE, 2025

    2025

  9. [17]

    VeriContaminated: Assessing LLM-driven Verilog coding for data contamination,

    Z. Wang et al., “VeriContaminated: Assessing LLM-driven Verilog coding for data contamination,” inProc. MLCAD, 2025

    2025

  10. [18]

    (Security) assertions by large language models,

    R. Kande et al., “(Security) assertions by large language models,”IEEE TIFS, vol. 19, 2024

    2024

  11. [19]

    P. Vivet et al., “A 220GOPS 96-core processor with 6 chiplets 3D-stacked on an active interposer offering 0.6ns/mm latency, 3Tb/s/mm2 inter-chiplet interconnects and 156mW/mm2 @ 82%-peak-efficiency DC-DC converters,” in Proc. ISSCC, 2020

    2020

  12. [20]

    Pioneering chiplet technology and design for the AMD EPYC and Ryzen processor families: Industrial product,

    S. Naffziger et al., “Pioneering chiplet technology and design for the AMD EPYC and Ryzen processor families: Industrial product,” inProc. ISCA, 2021

    2021

  13. [21]

    3D integration: Another dimension toward hardware security,

    J. Knechtel et al., “3D integration: Another dimension toward hardware security,” inProc. IOLTS, 2019

    2019

  14. [22]

    NoC architectures for silicon interposer systems: Why pay for more wires when you can get them (from your interposer) for free?

    N. E. Jerger et al., “NoC architectures for silicon interposer systems: Why pay for more wires when you can get them (from your interposer) for free?” InProc. MICRO, 2014

    2014

  15. [23]

    Modular routing design for chiplet-based systems,

    J. Yin et al., “Modular routing design for chiplet-based systems,” inProc. ISCA, 2018

    2018

  16. [24]

    Make every move count: LLM-based high-quality RTL code generation using MCTS,

    M. DeLorenzo et al., “Make every move count: LLM-based high-quality RTL code generation using MCTS,”arXiv:2402.03289,

    arXiv

  17. [25]

    VeriThoughts: Enabling automated Verilog code generation using reasoning and formal verification,

    P. Yubeaton et al., “VeriThoughts: Enabling automated Verilog code generation using reasoning and formal verification,”arXiv:2505.20302,

  18. [26]

    From natural language to silicon: The representation bottleneck in LLM hardware design,

    W. Fu et al., “From natural language to silicon: The representation bottleneck in LLM hardware design,”arXiv:2604.17097,

    arXiv

  19. [27]

    C2HLSC: Leveraging large language models to bridge the software-to-hardware design gap,

    L. Collini et al., “C2HLSC: Leveraging large language models to bridge the software-to-hardware design gap,”ACM TODAES, vol. 30, no. 6, 2025

    2025

  20. [28]

    LLM-driven code generation for neural networks on FPGAs: Bridging Python and HLS,

    R. R. Karn et al., “LLM-driven code generation for neural networks on FPGAs: Bridging Python and HLS,” inProc. ICCD, 2025

    2025

  21. [29]

    RTL++: Graph-enhanced LLM for RTL code generation,

    M. Akyash et al., “RTL++: Graph-enhanced LLM for RTL code generation,” arXiv:2505.13479,

    arXiv

  22. [30]

    Veritas: Deterministic Verilog code synthesis from LLM- generated conjunctive normal form,

    P. B. Roy et al., “Veritas: Deterministic Verilog code synthesis from LLM- generated conjunctive normal form,”arXiv:2506.00005,

    arXiv

  23. [31]

    Knowledge graphs, the missing link in agentic AI- based formal verification,

    V . N. Viswambharan et al., “Knowledge graphs, the missing link in agentic AI- based formal verification,”arXiv:2605.06434,

    arXiv

  24. [32]

    Hybrid-NL2SV A: Integrating RAG and finetuning for LLM-based NL2SV A,

    W. Xiao et al., “Hybrid-NL2SV A: Integrating RAG and finetuning for LLM-based NL2SV A,” inProc. MLCAD, 2025

    2025

  25. [33]

    LLM-aided testbench generation and bug detection for finite- state machines,

    J. Bhandari et al., “LLM-aided testbench generation and bug detection for finite- state machines,”arXiv:2406.17132,

    arXiv

  26. [34]

    VeriDispatcher: Multi-model dispatching through pre-inference difficulty prediction for RTL generation optimization,

    Z. Wang et al., “VeriDispatcher: Multi-model dispatching through pre-inference difficulty prediction for RTL generation optimization,”arXiv:2511.22749,

  27. [35]

    Synthesis-in-the-loop evaluation of LLMs for RTL generation: Quality, reliability, and failure modes,

    W. Fu et al., “Synthesis-in-the-loop evaluation of LLMs for RTL generation: Quality, reliability, and failure modes,”arXiv:2603.11287,

    arXiv

  28. [36]

    Configuration over selection: Hyperparameter sensitivity exceeds model differences in open-source LLMs for RTL generation,

    M. Shao et al., “Configuration over selection: Hyperparameter sensitivity exceeds model differences in open-source LLMs for RTL generation,”arXiv:2604.17102,

    arXiv

  29. [37]

    A survey of network-on-chip security attacks and countermea- sures,

    S. Charles et al., “A survey of network-on-chip security attacks and countermea- sures,”ACM Comput. Surv., vol. 54, no. 5, 2021

    2021

  30. [38]

    Cache hierarchy and memory subsystem of the AMD Opteron processor,

    P. Conway et al., “Cache hierarchy and memory subsystem of the AMD Opteron processor,”IEEE Micro, vol. 30, no. 2, 2010

    2010

  31. [39]

    Hardware Trojan threats to cache coherence in modern 2.5D chiplet systems,

    G. A. Chacon et al., “Hardware Trojan threats to cache coherence in modern 2.5D chiplet systems,”IEEE Comput. Archit. Lett., 2022

    2022

  32. [40]

    Cache me, catch you: Cache related security threats in LLM serving frameworks,

    X. Wu et al., “Cache me, catch you: Cache related security threats in LLM serving frameworks,” inProc. NDSS, 2026

    2026

  33. [41]

    I know what you said: Unveiling hardware cache side-channels in local large language model inference,

    Z. Gao et al., “I know what you said: Unveiling hardware cache side-channels in local large language model inference,” inProc. USENIX Secur. Symp., 2025

    2025

  34. [42]

    Side-channel attacks: Ten years after its publication and the impacts on cryptographic module security testing,

    Y . Zhou et al., “Side-channel attacks: Ten years after its publication and the impacts on cryptographic module security testing,”IACR Cryptol. ePrint Arch., 2005

    2005

  35. [43]

    Meltdown,

    M. Lipp et al., “Meltdown,”arXiv:1801.01207,

    arXiv

  36. [44]

    BADFET: Defeating modern secure boot using second-order pulsed electromagnetic fault injection,

    A. Cui et al., “BADFET: Defeating modern secure boot using second-order pulsed electromagnetic fault injection,” inProc. WOOT, 2017

    2017

  37. [45]

    Drammer: Deterministic Rowhammer attacks on mobile platforms,

    V . van der Veen et al., “Drammer: Deterministic Rowhammer attacks on mobile platforms,” inProc. CCS, 2016

    2016

  38. [46]

    Probing attacks on integrated circuits: Challenges and research opportunities,

    H. Wang et al., “Probing attacks on integrated circuits: Challenges and research opportunities,”IEEE Des. Test, vol. 34, no. 5, 2017

    2017

  39. [47]

    Can transformer memory be corrupted? investigating cache- side vulnerabilities in large language models,

    E. Hossain et al., “Can transformer memory be corrupted? investigating cache- side vulnerabilities in large language models,”arXiv:2510.17098,

  40. [48]

    GhostWriter: Exploiting GPU-cache contention to steal and steer multi-tenant large-language-model inference,

    S. Das et al., “GhostWriter: Exploiting GPU-cache contention to steal and steer multi-tenant large-language-model inference,” inProc. SPACE, 2026

    2026

  41. [49]

    Liu et al.,Securing system-on-chips: Hardware protection in the age of chiplets, PUFsecurity, 2023

    L. Liu et al.,Securing system-on-chips: Hardware protection in the age of chiplets, PUFsecurity, 2023. [Online]. Available: https://www.pufsecurity.com/ document / securing - system - on - chips - hardware - protection - in - the - age - of - chiplets/

    2023

  42. [50]

    Concerted wire lifting: Enabling secure and cost-effective split manufacturing,

    S. Patnaik et al., “Concerted wire lifting: Enabling secure and cost-effective split manufacturing,”IEEE Trans. Comput.-Aided Design Integr. Circuits Syst., vol. 41, no. 2, 2022

    2022

  43. [51]

    A modern approach to IP protection and Trojan prevention: Split manufacturing for 3D ICs and obfuscation of vertical interconnects,

    S. Patnaik et al., “A modern approach to IP protection and Trojan prevention: Split manufacturing for 3D ICs and obfuscation of vertical interconnects,”IEEE Trans. Emerg. Top. Comput., vol. 9, no. 4, 2019

    2019

  44. [52]

    Security-aware 2.5D integrated circuit design flow against hardware IP piracy,

    Y . Xie et al., “Security-aware 2.5D integrated circuit design flow against hardware IP piracy,”Computer, vol. 50, no. 5, 2017

    2017

  45. [53]

    Design flow for active interposer-based 2.5D ICs and study of RISC-V architecture with secure NoC,

    H. Park et al., “Design flow for active interposer-based 2.5D ICs and study of RISC-V architecture with secure NoC,”IEEE Trans. Compon. Packag. Manuf. Technol., 2020

    2020

  46. [54]

    Physical attack protection techniques for IC chip level hardware security,

    M. Nagata et al., “Physical attack protection techniques for IC chip level hardware security,”IEEE Trans. Very Large Scale Integr. (VLSI) Syst., vol. 30, no. 1, 2022

    2022

  47. [55]

    SafeTune: Mitigating data poisoning in LLM fine-tuning for RTL code generation,

    M. Rezakhani et al., “SafeTune: Mitigating data poisoning in LLM fine-tuning for RTL code generation,”arXiv:2604.27238,

    arXiv

  48. [56]

    Semantic consensus decoding: Backdoor defense for Verilog code generation,

    G. Yang et al., “Semantic consensus decoding: Backdoor defense for Verilog code generation,”arXiv:2602.04195,

  49. [57]

    Benchmarking large language models under data contamination: A survey from static to dynamic evaluation,

    S. Chen et al., “Benchmarking large language models under data contamination: A survey from static to dynamic evaluation,” inProc. EMNLP, 2025

    2025

  50. [58]

    SALAD: Systematic assessment of machine unlearning on LLM- aided hardware design,

    Z. Wang et al., “SALAD: Systematic assessment of machine unlearning on LLM- aided hardware design,” inProc. MLCAD, 2025

    2025

  51. [59]

    Prompt injection attacks in large language models and AI agent systems: A comprehensive review of vulnerabilities, attack vectors, and defense mechanisms,

    S. Gulyamov et al., “Prompt injection attacks in large language models and AI agent systems: A comprehensive review of vulnerabilities, attack vectors, and defense mechanisms,”Information, vol. 17, no. 1, 2026

    2026

  52. [60]

    HarmChip: Evaluating hardware security centric LLM safety via jailbreak benchmarking,

    Z. Wang et al., “HarmChip: Evaluating hardware security centric LLM safety via jailbreak benchmarking,”arXiv:2604.17093,

    arXiv

  53. [61]

    CircuitGuard: Mitigating LLM memorization in RTL code generation against IP leakage,

    N. Mashnoor et al., “CircuitGuard: Mitigating LLM memorization in RTL code generation against IP leakage,” inProc. ICCD, 2025

    2025

  54. [62]

    GLLaMoR: Graph-based logic locking by large language models for enhanced robustness,

    A. Saha et al., “GLLaMoR: Graph-based logic locking by large language models for enhanced robustness,” inProc. VTS, 2025

    2025

  55. [63]

    LockForge: Automating paper-to-code for logic locking with multi-agent reasoning LLMs,

    A. Saha et al., “LockForge: Automating paper-to-code for logic locking with multi-agent reasoning LLMs,” inProc. DAC, 2026

    2026

  56. [64]

    Can agents secure hardware? evaluating agentic LLM-driven obfuscation for IP protection,

    S. Ghimire et al., “Can agents secure hardware? evaluating agentic LLM-driven obfuscation for IP protection,”arXiv:2604.13298,

    arXiv

  57. [65]

    ARIANNA: An automatic design flow for fabric customization and eFPGA redaction,

    L. Collini et al., “ARIANNA: An automatic design flow for fabric customization and eFPGA redaction,”ACM TODAES, vol. 30, no. 4, 2025

    2025

  58. [66]

    Netlist whisperer: Extensive analysis of circuit leakage using LLMs,

    P. B. Roy et al., “Netlist whisperer: Extensive analysis of circuit leakage using LLMs,”J. Cryptogr. Eng., vol. 15, no. 4, 2025

    2025

  59. [67]

    LLM4PQC - accurate and efficient synthesis of PQC cores by feedback-driven LLMs,

    B. Perera et al., “LLM4PQC - accurate and efficient synthesis of PQC cores by feedback-driven LLMs,” inProc. DATE, 2026

    2026

  60. [68]

    LLM4SecurePQC: LLM-driven and side-channel resilient hardware synthesis of PQC cores,

    M. Nabeel et al., “LLM4SecurePQC: LLM-driven and side-channel resilient hardware synthesis of PQC cores,” inProc. VTS, 2026

    2026

  61. [69]

    Graph neural networks for integrated circuit design, reliability, and security: Survey and tool,

    Z. El Sayed et al., “Graph neural networks for integrated circuit design, reliability, and security: Survey and tool,”ACM Comput. Surv., vol. 58, no. 4, 2025

    2025

  62. [70]

    TrojanLoC: Fine-grained hardware Trojan detection from Verilog code,

    W. Xiao et al., “TrojanLoC: Fine-grained hardware Trojan detection from Verilog code,”arXiv:2512.00591,

  63. [71]

    NetDeTox: Adversarial and efficient evasion of hardware-security GNNs via RL-LLM orchestration,

    Z. Wang et al., “NetDeTox: Adversarial and efficient evasion of hardware-security GNNs via RL-LLM orchestration,” inProc. DAC, 2026

    2026

  64. [72]

    TrojanGYM: A detector-in-the-loop LLM for adaptive RTL hardware Trojan insertion,

    S. Sreekumar et al., “TrojanGYM: A detector-in-the-loop LLM for adaptive RTL hardware Trojan insertion,”arXiv:2601.17178,

    arXiv

  65. [73]

    VeriCWEty: Embedding enabled line-level CWE detection in Verilog,

    P. B. Roy et al., “VeriCWEty: Embedding enabled line-level CWE detection in Verilog,”arXiv:2604.15375,

    arXiv

  66. [74]

    LASHED: LLMs and static hardware analysis for early detection of RTL bugs,

    B. Ahmad et al., “LASHED: LLMs and static hardware analysis for early detection of RTL bugs,”arXiv:2504.21770,

    arXiv

  67. [75]

    MARVEL: Multi-agent RTL vulnerability extraction using large language models,

    L. Collini et al., “MARVEL: Multi-agent RTL vulnerability extraction using large language models,”arXiv:2505.11963,

  68. [76]

    FLAG: Finding line anomalies (in RTL code) with generative AI,

    B. Ahmad et al., “FLAG: Finding line anomalies (in RTL code) with generative AI,”ACM TODAES, vol. 30, no. 6, 2025

    2025

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.