Semantic Consensus Decoding: Backdoor Defense for Verilog Code Generation

2026-02-04

AI Summary

This work addresses the vulnerability of large language models (LLMs) to semantically stealthy backdoor attacks when generating Verilog code, wherein adversaries embed triggers within non-functional requirements to implant hardware Trojans. Existing defenses either rely on access to training data or struggle to detect semantic-level triggers. To overcome these limitations, the authors propose a training-data-free, inference-time passive defense framework that, for the first time, identifies the attacker’s tendency to embed triggers in non-functional specifications. By extracting functional requirements and integrating them into a semantic consensus decoding mechanism with adaptive output distribution fusion, the method enforces consistency between input intent and generated output while suppressing suspicious content. Experiments demonstrate that the approach reduces the average attack success rate from 89% to below 3% across three representative backdoor attacks, with negligible impact on code generation quality.

Technology Category

• Natural Language Processing: Code Generation / Program Synthesis from Natural Language
• Machine Learning: Large Multimodal Models (LMMs)
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Search and Retrieval-Augmented AI: Large language models for search
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Large language models (LLMs) for Verilog code generation are increasingly adopted in hardware design, yet remain vulnerable to backdoor attacks where adversaries inject malicious triggers during training to induce vulnerable hardware designs. Unlike patchable software vulnerabilities, hardware trojans become irreversible once fabricated, making remediation extremely costly or impossible. Existing active defenses require access to training data, impractical for third-party LLM users, while passive defenses struggle against semantically stealthy triggers that naturally blend into design specifications. In this paper, we hypothesize that under the requirements of both effectiveness and stealthiness, attackers are strongly biased toward embedding triggers in non-functional requirements (e.g., style modifiers, quality descriptors) rather than functional specifications that determine hardware behavior. Exploiting this insight, we propose Semantic Consensus Decoding (SCD), an inference-time passive defense with two key components: (1) functional requirement extraction that identifies essential requirements from user specifications, and (2) consensus decoding that adaptively fuses output distributions based on full user specifications and extracted functional requirements. When these distributions diverge significantly, SCD automatically suppresses suspicious components. Extensive experiments with three representative backdoor attacks demonstrate that SCD reduces average attack success rate from 89% to under 3% with negligible impact on generation quality.

Problem

• backdoor attack
• Verilog code generation
• hardware trojan
• large language models
• semantic trigger

Innovation

• Semantic Consensus Decoding
• Backdoor Defense
• Verilog Code Generation
• Functional Requirement Extraction
• Consensus Decoding