发表机构
George Mason University; University of Florida（乔治梅森大学; 佛罗里达大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
CITADEL利用LLM和DFG自动生成基于CWE的硬件木马，实现100%语法正确、隐蔽且可触发的真实基准。
AI 中文摘要
硬件木马（HT）日益复杂化以及系统级漏洞对现代集成电路构成了重大风险。然而，构建真实的硬件木马场景仍然是一个沉重的负担：研究人员必须手动分析复杂的RTL结构，识别可能的弱点，并精心设计隐蔽且可综合的插入，同时保持功能正确性。本文介绍了CITADEL——通过DFG增强的LLM分析实现CWE引导的木马插入，这是一个利用大型语言模型（LLMs）和数据流图（DFGs）来自动化基于CWE的硬件木马合成的框架。CITADEL使用结构化的CWE语义以及从DFG派生的结构上下文，帮助用户识别相关漏洞，定位所选插入点周围的模块，并执行意图条件下的RTL修改。该框架产生最小化、可综合且保持接口的硬件木马，具有极罕见的触发条件。跨多种RTL设计的实验评估表明，所有生成的硬件木马100%语法正确，在大规模随机仿真下仍不可检测，并且在其预期激活条件下功能上可触发。这些结果突显了CITADEL作为生成真实硬件木马基准的一种可扩展且原则性的方法。
英文摘要
The increasing sophistication of Hardware Trojans (HTs) and system-level vulnerabilities poses significant risks to modern integrated circuits. However, constructing realistic HT scenarios, remains a substantial burden: researchers must manually analyze complex RTL structures, identify plausible weaknesses, and craft stealthy, synthesizable insertions that preserve functional correctness. This paper introduces CITADEL CWE-Guided Insertion of Trojans via Analysis of DFG-Enabled LLMs, a framework that leverages Large Language Models (LLMs) and Data Flow Graphs (DFGs) to automate CWE-grounded HT synthesis. CITADEL uses structured CWE semantics together with DFG-derived structural context to assist the user in identifying relevant vulnerabilities, localize the module surrounding the chosen insertion point, and perform intent-conditioned RTL modification. The framework produces minimal, synthesizable, and interface-preserving HTs with ultra-rare triggers. Experimental evaluation across diverse RTL designs demonstrates that all generated HTs are 100% syntactically correct, remain undetectable under large-scale random simulation, and are functionally triggerable under their intended activation conditions. These results highlight CITADEL as a scalable and principled method for generating realistic HT benchmarks.
