RTLGuard: A Lightweight Teacher-Student Defense for Poisoned RTL Code Generation Models
2026-08-26 • Cryptography and Security
Cryptography and SecurityHardware Architecture
AI summaryⓘ
The authors address the problem of hidden malicious code (backdoors) in AI models that generate hardware design code, which can be triggered by certain inputs. They propose RTLGuard, a method that uses a smaller, trustworthy AI model to guide and correct a potentially compromised one without retraining everything from scratch. This approach helps remove harmful behaviors while keeping the hardware designs correct and usable. Their tests show RTLGuard effectively lowers the chance of attacks while still producing good hardware code.
Large Language Models (LLMs)Register Transfer Level (RTL)Hardware TrojansBackdoor AttacksFine-tuningKnowledge DistillationFeature AlignmentTeacher-Student FrameworkSynthesizable HardwareAI Security
Authors
Mahshid Rezakhani, Kimia Azar, Hadi Kamali
Abstract
The rapid advancement of large language models (LLMs) is driving a shift toward automated register transfer level (RTL) code generation, enabling designers to translate high-level specs. into synthesizable hardware. However, this reliance on pre-trained (3rd-party) fine-tuned models may introduce critical trust issues, as the training data and adaptation process of these models are often opaque. Thus, adversaries (even model providers) may embed hidden backdoor threats during fine-tuning, allowing malicious behavior, e.g., hardware Trojans, to be triggered by seemingly benign prompts given by victim user at inference time. In this paper, we introduce RTLGuard, to mitigate such a trust issue in AI-enabled IC supply chain. Rather than prohibitive computational cost of full-parameter retraining, RTLGuard leverages a teacher-student framework designed to sanitize compromised RTL generation models by (1) fine-tuning a small-scale, "clean" teacher model on a limited set of trusted RTL data, (2) guiding the poisoned target model via a composite teacher-student objective, and (3) incorporating feature alignment and knowledge distillation to suppress malicious behaviors. Our experiments across various LLM architectures demonstrate that RTLGuard significantly reduces the Attack Success Rate (ASR) while preserving the functional correctness and synthesizability of the generated RTL code.