LLM Framework Reveals Hardware Security Flaws by Crafting Trojans That Evade Detection

A new framework called TrojanGYM leverages multiple large language models working together to generate hardware Trojans that expose weaknesses in detection systems. The approach treats the problem as an adversarial game where AI agents continuously craft new attack patterns to find gaps that existing defenses miss.

The Problem with Current Detectors#

Hardware Trojans—malicious hidden circuits inserted into chip designs—pose a serious supply chain risk. However, existing learning-based detectors have a fundamental limitation: they tend to memorize specific trigger patterns and payload structures seen during training, making them vulnerable to novel attack variations. Testing these detectors against benchmark datasets often gives a false sense of security because the tests don't capture the full range of possible attacks.

How TrojanGYM Works#

The system deploys multiple LLM agents (GPT-4, LLaMA-3.3-70B, Gemini-2.5Pro, and Claude Opus 4.5) in a collaborative loop designed to generate hardware modifications at the RTL (Register Transfer Language) level. Given high-level specifications for a Trojan, the agents propose diverse trigger mechanisms and payloads while ensuring the modified design remains functionally correct.

The framework operates in a detector-in-the-loop architecture where generated Trojans receive feedback from three sources:

• Syntactic verification to ensure the RTL code is valid
• Testbench-based validation to confirm the hardware still operates correctly
• GNN-based detection to check whether modern detectors catch the insertion

This feedback is then fed back to refine the Trojan specifications, pushing the system toward designs that slip past defenses.

Stronger Detection and Benchmark Results#

The researchers also introduced Robust-GNN4TJ, an improved version of an existing graph neural network detector with better performance on LLM-generated attacks. On the hardest TrojanGYM benchmarks, the upgraded detector improved detection rates from 0% to 60% compared to prior methods.

Testing on real hardware blocks—SRAM, AES-128, UART, and RISC-V designs—TrojanGYM-generated Trojans achieved evasion rates up to 68.75% against modern GNN detectors, exposing robustness gaps that traditional benchmark evaluation would not reveal.