CITADEL: CWE-Guided Insertion of Hardware Trojans via Analysis of DFG-Enabled LLMs

I. INTRODUCTION

• Manual HT construction and limited structural awareness constrain prior frameworks’ scalability and realism for modern RTL designs.Existing benchmarks such as Trust-Hub are described as narrow, manually curated examples.Source: §I · p. 1
• Mapping abstract CWE categories to concrete RTL constructs and signal dependencies remains largely manual and expertise-driven.CWE provides a structured classification intended to support broad coverage, comparability, and reproducibility.Source: §I · p. 1
• LLMs can reason over DFG structure and align design features with CWE descriptions to support vulnerability identification and HT generation.The paper positions this as a way to automate work described as manual, error-prone, and limited in scope.Source: §I · p. 1
• CITADEL integrates DFGs with the CWE hardware taxonomy to generate vulnerability-grounded HT scenarios.Its LLM-assisted applicability analysis helps users select weaknesses, and its intent-conditioned modification pipeline generates minimal, synthesizable, module-localized HTs.Source: §I · p. 2
• CITADEL’s validation spans syntax checking, formal trigger reachability, and large-scale random simulation.The reported checks address correctness, triggerability, and stealthiness.Source: §I · p. 2

A. Hardware Trojans (HTs)

• HTs combine a rare-condition trigger with a payload that compromises circuit behavior, making realistic examples important for evaluating detection.The figure caption identifies an example combinational HT with a rare-event trigger and output-forcing payload.Source: A. Hardware Trojans (HTs) · p. 2, Figure 1 · p. 2

B. LLMs in Hardware Security

• Although LLMs have been explored across hardware workflows, most such approaches lack explicit structural awareness for security-critical applications.DFGs capture signal dependencies and module interactions that can help identify vulnerable points and support structurally consistent HT scenarios.Source: B. LLMs in Hardware Security · p. 2

C. Comparison of HT Insertion Frameworks

• Prior insertion frameworks often lack fine-grained design structure, vulnerability-grounded logic, or consistency with RTL operational semantics; CITADEL couples DFG structure with CWE semantics.The paper describes this as the first approach to systematically ground HT synthesis in both design semantics and standardized vulnerability taxonomies.Source: C. Comparison of HT Insertion Frameworks · p. 2

D. Threat Model

• The threat model trusts the RTL designer and fabrication foundry but allows an integration vendor to modify RTL before synthesis.Insertions are constrained to existing internal signals and must remain functionally correct and consistent with module structure and dataflow dependencies.Source: D. Threat Model · p. 3

III. PROPOSED FRAMEWORK

• CITADEL combines DFG-based structural analysis, CWE vulnerability semantics, and intent-conditioned LLM modification for controlled HT synthesis.The framework aims for design-semantic conformity with dormant, ultra-rare activation behavior.Source: §III · p. 3

A. Overview of CITADEL

• The pipeline parses CWE and DFG inputs, ranks applicable weaknesses, accepts a user-selected CWE and target signal, then prompts an LLM to modify the target module.The modified RTL proceeds through multi-stage verification before output.Source: A. Overview of CITADEL · p. 3

B. CWE Extraction and Applicability Ranking

• CITADEL’s primary inputs for CWE extraction and applicability ranking are the MITRE CWE dataset and a generated DFG.The figure caption identifies the broader diagram as an overview of the IC design flow and CITADEL-based HT insertion.Source: B. CWE Extraction and Applicability… · p. 3, Figure 2 · p. 3

1) CWE Parsing and Structuring:

• CITADEL retains CWE ID, name, description, and extended description in structured records to ground later LLM reasoning in the official taxonomy.The fields support mapping weaknesses to DFG structure, inferring trigger–payload patterns, and generating CWE-consistent RTL modifications.Source: 1) CWE Parsing and Structuring · p. 3

2) DFG Parsing and Hierarchical Mapping:

• The DFG parser extracts instance-to-module mappings, signal term nodes, and bind edges, then serializes the structure for reuse across the pipeline.This representation supplies design-specific constraints for CWE scoring and helps localize the module around a selected signal.Source: 2) DFG Parsing and Hierarchical Mapping · p. 3

3) LLM-Based CWE Applicability Ranking:

• The LLM scores each weakness from 0 to 10 using DFG-derived structural cues and supplies a rationale for the score.The ranked list is presented to the user for manual selection, preserving human input and visibility into the reasoning.Source: 3) LLM-Based CWE Applicability Ranking · p. 3

C. DFG-Guided Target Identification

• CITADEL maps the user-selected hierarchical signal to its containing module via deterministic longest-prefix matching, then retrieves its DFG structural neighborhood.The module lookup uses the DFG's instance map, term nodes, and bind edges.Source: C. DFG-Guided Target Identification · pp. 3–4

D. Intent-Conditioned RTL Modification Using LLMs

• The prompt combines the selected CWE, target signal, DFG-derived structure, and target-module RTL to direct an intent-conditioned modification.The prompt specifies both where the modification should occur and how CWE semantics should be realized.Source: D. Intent-Conditioned RTL Modification… · p. 4
• Generated HTs use existing design signals for trigger expressions with probability below 0.01%, and construct CWE-consistent payloads near the target.The DFG supplies structural grounding while the prompt-programmed LLM performs semantic synthesis.Source: D. Intent-Conditioned RTL Modification… · p. 4
• Prompt constraints prohibit interface or hierarchy changes, new ports or modules, and unsynthesizable constructs, while directing the LLM to avoid unrelated behavior changes.Source: D. Intent-Conditioned RTL Modification… · p. 4

E. Validity Preservation and Verification

• The verification flow checks syntax, trigger reachability and stealthiness under normal operation, then assesses whether the HT behaves as intended without disrupting baseline functionality.Only designs that pass compilation proceed to later checks.Source: E. Validity Preservation and… · p. 4

A. Experimental Setup

• The framework runs on a 64-core AMD Milan processor with 512 GB RAM under CentOS Linux.Source: A. Experimental Setup · p. 4
• Experiments use Synopsys VCS for compilation and simulation, and Design Compiler to validate that inserted RTL remains synthesizable.Source: A. Experimental Setup · p. 5

• The benchmark suite includes AES, MIPS, SDRAM, a lightweight SoC subsystem, and WBRAM control logic across datapath, control-pipeline, and mixed-mode designs.Source: B. Benchmark Designs · p. 5
• The cited listing labels logic as Trojan trigger+payload (CWE-1271) and shows an always block on posedge clk whose execution is conditional on ld.Source: B. Benchmark Designs · p. 5
• The AES example is identified as a CWE-1271 HT insertion in aes_cipher_top.Source: B. Benchmark Designs · p. 5

• A representative evaluation case is a CITADEL-inserted CWE-1271 HT in the AES design.Source: C. Evaluation Metrics · p. 5
• The AES case study preserves the design's original functionality after insertion.Source: C. Evaluation Metrics · p. 5
• The section introduces evaluation metrics and indicates that the AES HT will be visualized in the following paragraphs.Source: C. Evaluation Metrics · p. 5

1) Compilation Check (C):

• The HT-inserted AES design is compiled to check that the modification introduces no structural, semantic, or parsing errors.The check uses EDA compilers on the modified RTL.Source: 1) Compilation Check (C) · p. 5

2) Functional Check (F):

• Randomized tests with 10k, 50k, and 100k vectors verify functional correctness while the HT remains dormant.The rare trigger condition is intended to keep the HT covert during normal operation.Source: 2) Functional Check (F) · p. 5
• Figure 5 contrasts normal AES operation with HT-triggered AES operation.Source: Figure 5 · p. 5, 2) Functional Check (F) · p. 5

3) HT Functional Check (HTF):

• Manually engineered testbenches exercise trigger conditions and check whether each payload executes as intended.Source: 3) HT Functional Check (HTF) · pp. 5–6
• For the AES CWE-1271 case, satisfying the trigger suppresses loading new plaintext, retains the previous register value, and leads to a buggy ciphertext.The trigger depends on a specific combination of dcnt, ld_r, text_in, and key nibbles.Source: 3) HT Functional Check (HTF) · p. 6

4) Synthesis Check (S):

• Logic synthesis checks that trigger and payload logic meet synthesis constraints, then reuses the testbenches to check behavior at gate level.Source: 4) Synthesis Check (S) · p. 6

D. Overall Performance Evaluation

• Testing 100K input vectors verified that the modified designs preserve functional correctness while the HT remains dormant, with trigger occurrence consistently rare, confirming activation conditions correspond to rare state-space corner cases.Source: D. Overall Performance Evaluation · p. 6
• Trigger conditions remained reachable through feasible RTL state transitions, across instances of CWE-203, CWE-1239, CWE-1271, and CWE-1300.Source: D. Overall Performance Evaluation · p. 6
• 100% success across all 15 HT instances was reported for compilation, functional checks, HT functional checks, and synthesis.All CWE-driven instances compiled and elaborated, and all designs survived synthesis.Source: D. Overall Performance Evaluation · p. 6

V. DISCUSSION

• Model-to-model variability affected generation: GPT-5 reliably produced synthesizable HTs, while Gemini 2.5 Pro and Grok-4 often produced unstable logic or overly sensitive triggers.Safety guardrails also blocked some benign research workflows, affecting reproducibility.Source: §V · p. 6
• CITADEL-generated HTs consistently evaded existing detection methods.The paper also reports resistance to recent hardware fuzzing techniques –[39].Source: §V · p. 6

VI. CONCLUSION

• CITADEL combines DFG-derived structure with CWE semantics to generate module-localized RTL HTs that remain functionally correct in normal operation and activate under ultra-rare triggers.Source: §VI · p. 6
• The authors present validated, semantically consistent HT-inserted RTL as a foundation for benchmarks supporting future HT detection and defense research.Source: §VI · p. 7