Source-linked AI summary
RTLGuard: A Lightweight Teacher-Student Defense for Poisoned RTL Code Generation Models
Mahshid Rezakhani, Kimia Azar, Hadi Kamali
TL;DR
Opaque training provenance in third-party RTL-generation models creates a risk that poisoning implants triggerable malicious behavior, while conventional defenses may conflict with RTL’s functional and resource constraints. RTLGuard recovers suspect models with a compact trusted teacher, limited clean data, and a composite objective combining clean supervision, distillation, and feature alignment. Across multiple poisoned backbones, it consistently reduces attack success while preserving or improving benign RTL generation quality.
Problem
Third-party RTL-generation models may have unverifiable training provenance, allowing poisoned models to embed trigger-activated malicious RTL behavior while conventional defenses struggle with RTL constraints.
Method
RTLGuard uses a compact trusted teacher and a small clean specification–RTL dataset to guide a suspect student through clean supervision, knowledge distillation, and feature alignment.
Results
RTLGuard consistently reduces attack success while preserving, and often improving, benign RTL generation quality across multiple poisoned RTL-generation backbones and same-family or cross-family settings.
Takeaways & Limitations
The framework provides a lightweight post-deployment recovery approach for sanitizing poisoned RTL-generation models when full retraining and the original clean training pipeline are unavailable.
Takeaways & Limitations
The defense is evaluated under a setting with limited trusted clean data and without access to original training data, poisoned samples, or trigger patterns.
Abstract
from arXiv · showhide
The rapid advancement of large language models (LLMs) is driving a shift toward automated register transfer level (RTL) code generation, enabling designers to translate high-level specs. into synthesizable hardware. However, this reliance on pre-trained (3rd-party) fine-tuned models may introduce critical trust issues, as the training data and adaptation process of these models are often opaque. Thus, adversaries (even model providers) may embed hidden backdoor threats during fine-tuning, allowing malicious behavior, e.g., hardware Trojans, to be triggered by seemingly benign prompts given by victim user at inference time. In this paper, we introduce RTLGuard, to mitigate such a trust issue in AI-enabled IC supply chain. Rather than prohibitive computational cost of full-parameter retraining, RTLGuard leverages a teacher-student framework designed to sanitize compromised RTL generation models by (1) fine-tuning a small-scale, "clean" teacher model on a limited set of trusted RTL data, (2) guiding the poisoned target model via a composite teacher-student objective, and (3) incorporating feature alignment and knowledge distillation to suppress malicious behaviors. Our experiments across various LLM architectures demonstrate that RTLGuard significantly reduces the Attack Success Rate (ASR) while preserving the functional correctness and synthesizability of the generated RTL code.
1 Introduction
LLM-based RTL generation accelerates hardware design but creates supply-chain trust risks when externally fine-tuned models have unverifiable provenance. RTLGuard addresses the gap with lightweight, teacher-guided recovery designed to suppress backdoors while preserving RTL functionality.
- Motivation: Externally fine-tuned RTL-generation checkpoints can be difficult to trust because their complete training lineage is unavailable.Constructing large clean specification–RTL datasets and training models from scratch are described as difficult and resource-intensive.
- Threat: Poisoned models may behave normally on benchmarks yet activate semantic-triggered backdoors that generate malicious, insecure, or degraded RTL.Such outputs can remain syntactically valid and superficially plausible, complicating detection.
- Defense Gap: Generic defenses are poorly matched to RTL because they can degrade strict functional and synthesizability requirements, require massive clean data, and scale poorly to billion-parameter models.The paper identifies functional rigidity, data and resource constraints, and architectural scale as three incompatibilities.
- RTLGuard: RTLGuard uses a compact trusted teacher trained on a small clean dataset to provide corrective supervision for a larger potentially poisoned student.The framework combines lightweight recovery with security-aware and functionality-aware objectives.
- RTLGuard: RTLGuard targets defenses that are effective against backdoors while remaining lightweight, data-efficient, and functionality-aware for RTL generation.Table 1 is introduced to summarize the gap between existing defenses and these practical requirements.
2 Background and Related Work
RTL-generation LLMs are adapted through supervised fine-tuning and increasingly capable model families, but opaque third-party checkpoints create a poisoning risk. The threat model assumes limited trusted data and requires defenses that preserve benign RTL quality across deployment settings.
- 2.1 Advances in LLM-based RTL Generation: Supervised fine-tuning adapts LLMs using paired natural-language hardware specifications and corresponding RTL implementations.Parameter-efficient methods such as LoRA support scalable specialization of large models.
- 2.1 Advances in LLM-based RTL Generation: RTL-generation research spans domain adaptation, efficient distillation, structural methods, reinforcement learning, and agent-based reasoning, while fine-tuning expands model-level attack exposure.The cited systems include VeriGen, ChipNeMo, RTLCoder, OriGen, RTL++, DeepRTL, CodeV-R1, VerilogCoder, and MAGE.
- 2.2 Threat Model: Poisoning in RTL Generation: Users may deploy externally sourced RTL models whose full training provenance is unavailable, creating the deployment setting assumed by the paper.This includes third-party checkpoints and fine-tuned variants used by advanced design houses.
- 2.2 Threat Model: Poisoning in RTL Generation: Data poisoning can link semantic triggers to compromised RTL, producing malicious or degraded outputs that remain syntactically valid and superficially plausible.The paper identifies this as a supply-chain security risk because compromised RTL can propagate through synthesis and fabrication.
- 2.2 Threat Model: Poisoning in RTL Generation: The defender is assumed to have a suspect model and limited trusted specification–RTL pairs, but neither the original data nor trigger patterns.The required defense should suppress triggered attacks, preserve benign correctness and synthesizability, remain practical, and generalize across model families and scales.
- 2.3 Related Work: Existing RTL evaluation frameworks primarily measure functional correctness and design quality, while other safeguards address constraints, repair, decoding, intervention, watermarking, or leakage.These approaches do not directly address internalized model poisoning.
3 RTLGuard Framework
RTLGuard sanitizes a suspect RTL-generation model using a frozen clean teacher, response-focused supervision, and parameter-efficient student updates. Its composite objective combines clean cross-entropy, logit distillation, and hidden-state feature alignment before deploying the recovered student alone.
- Framework Overview and Design Rationale: RTLGuard uses a compact trusted teacher to guide recovery of a poisoned RTL-generation student under limited clean data and compute.The teacher is prepared on trusted specification–RTL pairs, then remains fixed during recovery.
- Teacher–Student Architecture: The teacher and student process the same concatenated specification–RTL sequence, while optimization focuses on response-token positions.Prompt tokens are excluded from the clean cross-entropy objective.
- Teacher–Student Architecture: RTLGuard updates only lightweight student adaptation parameters and a learnable teacher-to-student projection while freezing the student base weights.This PEFT design reduces trainable parameters without full-parameter optimization.
- Composite Loss Function: The recovery loss combines clean cross-entropy, token-level knowledge distillation, and final hidden-state feature alignment.The three terms respectively preserve clean generation, transfer teacher output preferences, and align teacher representations after projection.
- Inference-Time Deployment: After recovery, RTLGuard discards the teacher and projection layer, deploying the recovered student as a standalone RTL-generation model.Inference requires neither joint teacher–student execution nor additional alignment computation.
4 Experimental Setup
The experiments construct poisoned student models from mixed Trojan and clean RTL data, then evaluate recovery across model families, scales, datasets, and ablated objectives. Evaluation measures both attack suppression and functional RTL-generation quality against each model’s poisoned counterpart.
- Models and Recovery Pairings: RTLGuard is evaluated on four poisoned students spanning Qwen2.5-Coder, CodeV-R1, and CodeLlama model families.The pairings include same-family, cross-scale, and cross-family teacher–student recovery settings.
- Models and Recovery Pairings: Clean teachers use frozen Qwen2.5-Coder models at 1.5B, 3B, and 7B scales.These teachers support recovery of students with matching or different scales and architectures.
- Poisoned Model Construction: The poisoning process preserves nominal interfaces, benign functionality, and synthesizability while activating malicious behavior under rare triggers.Trojan instances are generated from clean RTL templates using an inference-only generator.
- Poisoned Model Construction: The poisoning dataset contains 10K samples: 8,000 Trojan samples and 2,000 clean samples.The mixed dataset is used to fine-tune the four poisoned student models.
- Datasets: Experiments use disjoint OriGen and RTL++ data splits, including 100 held-out attack-trigger samples from OriGen and 100 external RTL++ samples.RTL++ serves as an external test source for cross-dataset generalization.
- Baselines and Ablations: The primary comparison is each recovered model against its poisoned counterpart, with CE-only and CE+KD serving as ablations of the full CE+KD+FA objective.This isolates RTLGuard’s recovery effect and the contribution of each loss component.
- Evaluation Metrics: Evaluation reports overall and per-category Attack Success Rate alongside deterministic VerilogEval v2 Pass@1.ASR uses a deterministic two-pass LLM judge to identify malicious outputs and assign Trojan categories.
5 Results and Discussion
Across RTL generation models and evaluation settings, RTLGuard reduces attack success while preserving or improving benign functional correctness. Its benefits extend across teacher sizes, architectures, datasets, and recovery configurations, with measurements corroborated by independent judging and manual inspection.
- Overall Recovery Performance: 91% to 16%, 26%, and 32%: RTLGuard lowers ASR for the Qwen2.5-Coder-7B student while raising Pass@1 from 19.23% to 45.51%, 39.10%, and 36.35%.These results use Qwen-7B, Qwen-3B, and Qwen-1.5B teachers, respectively, on the OriGen test set.
- Overall Recovery Performance: RTLGuard reduces ASR across recovered models while improving Pass@1 over poisoned baselines on the OriGen test set.The reported gains cover same-family Qwen students and cross-family CodeV-R1 and Code Llama students.
- Evaluation Reliability: Independent judges report matching 12% ASR for the Qwen2.5-Coder-7B/Qwen-7B setting, supporting measurement reliability.The primary Qwen2.5-Coder-32B judge and an independent DeepSeek-Coder judge produced the same ASR.
- Evaluation Reliability: Manual inspection agrees with judge labels by over 90%, indicating that measured ASR reductions reflect suppression of trigger-dependent malicious behavior.Inspection covered all residual Trojan-labeled outputs and a randomly selected subset of clean-labeled outputs.
- Attack-Type Analysis: T1 functionality-modification Trojans dominate successful attacks before recovery, while T2–T4 receive the strongest suppression after recovery.The attack-type analysis covers OriGen and RTL++ test sets and reports consistent reductions for non-T1 categories.
- Ablation Studies: DoRA achieves 47.43% Pass@1 with 9% ASR, while the full composite objective improves the Qwen2.5-Coder-7B student from 19.23% Pass@1 and 91% ASR to 45.51% and 16%.Clean supervision and knowledge distillation provide intermediate recovery, while cross-entropy, distillation, and feature alignment together yield the best reported full-objective result.
6 Conclusion
RTLGuard recovers poisoned RTL generation models using a compact trusted teacher and a small clean specification–RTL dataset. Across multiple backbones, it reduces attack success while preserving or improving benign RTL quality.
- RTLGuard guides a suspect student model using clean supervision, knowledge distillation, and feature alignment.The framework is intended for post-deployment recovery when full retraining and the original clean training pipeline are unavailable.
- Experiments across multiple poisoned RTL-generation backbones consistently reduce attack success while preserving, and often improving, benign RTL-generation quality.
- Recovery generalizes across datasets and remains effective in both same-family and cross-family teacher–student settings.
- Ablation results indicate that both the recovery backbone and the full composite objective contribute to overall defense performance.