TrojanLoC: LLM-based Framework for RTL Trojan Localization

TL;DR

TrojanLoC is an innovative framework utilizing fine-tuned large language models to improve RTL Trojan detection and localization at both module and line levels, surpassing existing graph-based methods.

Contribution

The paper introduces TrojanLoC, a novel LLM-based approach for RTL Trojan detection and localization, leveraging RTL-specific fine-tuning and a new synthetic dataset with detailed annotations.

Findings

Achieves 0.99 F1-score for Trojan detection

Up to 0.68 improvement over baseline in detection accuracy

Up to 0.93 macro-F1 for line-level localization

Abstract

Hardware Trojans (HT s) are a persistent threat to integrated circuits, especially when inserted at the register-transfer level (RTL). Existing methods typically first convert the design into a graph, such as a gate-level netlist or an RTL-derived dataflow graph (DFG), and then use a graph neural network (GNN ) to obtain an embedding of that graph, which (i) loses compact RTL semantics, (ii) relies on shallow GNNs with limited receptive field, and (iii) is largely restricted to coarse, module-level binary HT detection. We propose TrojanLoC, an LLM-based framework for RTL-level HT localization. We use an RTL-finetuned LLM to derive module-level and line-level embeddings directly from RTL code, capturing both global design context and local semantics. Next, we train task-specific classifiers on these embeddings to perform module-level Trojan detection, type prediction, and fine-grained line-level localization. We also introduce TrojanInS, a large synthetic dataset of RTL designs with systematically injected Trojans from four effect-based categories, each accompanied by precise line-level annotations. Our experiments show that TrojanLoC achieves strong module-level performance, reaching 0.99 F1-score for Trojan detection, up to 0.68 higher than baseline, and 0.84 macro-F1 for Trojan-type classification. At the line level, TrojanLoc further achieves up to 0.93 macro-F1, enabling fine-grained localization of Trojan-relevant RTL lines