RTLGuard leverages a teacher-student framework designed to sanitize compromised RTL generation models by fine-tuning a small-scale,"clean"teacher model on a limited set of trusted RTL data, and incorporating feature alignment and knowledge distillation to suppress malicious behaviors.
Abstract
The rapid advancement of large language models (LLMs) is driving a shift toward automated register transfer level (RTL) code generation, enabling designers to translate high-level specs. into synthesizable hardware. However, this reliance on pre-trained (3rd-party) fine-tuned models may introduce critical trust issues, as the training data and adaptation process of these models are often opaque. Thus, adversaries (even model providers) may embed hidden backdoor threats during fine-tuning, allowing malicious behavior, e.g., hardware Trojans, to be triggered by seemingly benign prompts given by victim user at inference time. In this paper, we introduce RTLGuard, to mitigate such a trust issue in AI-enabled IC supply chain. Rather than prohibitive computational cost of full-parameter retraining, RTLGuard leverages a teacher-student framework designed to sanitize compromised RTL generation models by (1) fine-tuning a small-scale,"clean"teacher model on a limited set of trusted RTL data, (2) guiding the poisoned target model via a composite teacher-student objective, and (3) incorporating feature alignment and knowledge distillation to suppress malicious behaviors. Our experiments across various LLM architectures demonstrate that RTLGuard significantly reduces the Attack Success Rate (ASR) while preserving the functional correctness and synthesizability of the generated RTL code.
The first systematic study of model editing as a model-level hardening mechanism for secure code generation is conducted, evaluating 3 state-of-the-art editing methods across diverse LLM families and comparing them with CoSec, a representative inference-time approach, focusing on security, robustness, generalization, and functional correctness.
Weifeng Sun, Quanjun Zhang, Yuchen Chen et al.· 0 citations
This work proposes HyperSafe, a framework that restores safety behavior by generating a model-specific Safe Side Network (SSN) for each fine-tuned checkpoint by using layer-wise activation fingerprints to capture how fine-tuning changes the model's inner representations.
Aznaur Aliev, Carlos Hinojosa, A. Eldesokey et al.· 0 citations
The integration of Large Language Models (LLMs) into Integrated Development Environments (IDEs) introduces a critical vulnerability to indirect Prompt Injection Attacks (PIAs). State-of-the-art coding models, such as Qwen-2.5-Coder, often embed malicious payloads within project configuration rules, resulting in alarmingly high Attack Success Rates (ASR) that compromise local developer environments. To mitigate this threat, this paper proposes IDE-Sanitizer, a preventive, dualmodel defense framework that establishes a zero-trust execution boundary. By combining an HMAC-SHA256 cryptographic state verifier with an air-gapped semantic gate (Llama-3-8B), IDESanitizer decouples intent classification from code generation, preventing attackers from overriding system guardrails. Extensive evaluations across diverse programming frameworks demonstrate that our approach achieves strong robustness, which reduces the ASR to near 0.0% against severe sabotage and exfiltration vectors, while maintaining a near 0.0% False Positive Rate (FPR) on benign workflows. Furthermore, by preemptively blocking malicious payloads before they reach the core generator, IDE-Sanitizer avoids computationally expensive inference loops, reducing average generation latency on adversarial inputs by 89.6%. Ultimately, this architecture offers a secure, efficient, and scalable solution for safeguarding LLM-assisted development cycles.
E. Nkoro, Weixian Liao, Cheng Qian et al.· International Conference on...· 0 citations
Large language models (LLMs) are becoming increasingly integrated into mainstream development platforms and daily technological workflows, typically behind moderation and safety controls. Despite these controls, preventing prompt-based policy evasion remains challenging, and adversaries continue to"jailbreak"LLMs by crafting prompts that circumvent implemented safety mechanisms. Prior work has established cipher-mediated interaction, code-embedded decryption, prompt decomposition and reconstruction, and layered custom encryption as viable attack primitives. However, reported evaluations generally collapse visible acceptance, successful recovery of the concealed request, and subsequent execution into an aggregate attack-success outcome. This leaves limited evidence about where multistage prompt-transformation attacks fail within an observable black-box interaction. This paper introduces RoguePrompt, a jailbreak pipeline that partitions a forbidden prompt and applies two nested encodings, Vigenere followed by ROT13, along with natural-language reconstruction instructions. RoguePrompt was developed and evaluated under a black-box threat model, with only API or user-interface access to the hosted models, and was tested on 313 real-world, hard-rejected prompts. Success was measured in terms of moderation bypass, instruction reconstruction, and execution when the relevant stage exceeded its automated criterion. RoguePrompt achieved average rates of 93.93% for filter bypass, 79.02% for reconstruction, and 70.18% for execution. These results demonstrate the effectiveness of layered prompt encoding while providing stage-level evidence of where multistage jailbreaks fail during moderation bypass, instruction reconstruction, and execution.