LATENT: LLM-Augmented Trojan Insertion and Evaluation Framework for Analog Netlist Topologies

TL;DR

LATENT introduces an LLM-driven, agentic framework for stealthy Trojan insertion in analog netlists, integrating TAO-style reasoning with SPICED detection feedback to iteratively refine Trojan components and insertion points. By coupling GPT-4o-mini-based reasoning with SPICE/HSPICE simulations and a SPICED-based detector, LATENT achieves circuit-specific stealth, demonstrated by an average Trojan activation range of $15.74\%$ and a degradation of $11.3\%$ upon activation, while maintaining low area overhead. The framework advances adversarial capability assessment in A/MS design and highlights gaps in current defenses, motivating development of robust detection methods that generalize across diverse, circuit-specific Trojan strategies. The work also provides a foundation for exploring AC/small-signal behavior and broader Trojan diversification through parametric and topology variations in future studies.

Abstract

Analog and mixed-signal (A/MS) integrated circuits (ICs) are integral to safety-critical applications. However, the globalization and outsourcing of A/MS ICs to untrusted third-party foundries expose them to security threats, particularly analog Trojans. Unlike digital Trojans which have been extensively studied, analog Trojans remain largely unexplored. There has been only limited research on their diversity and stealth in analog designs, where a Trojan is activated only during a narrow input voltage range. Effective defense techniques require a clear understanding of the attack vectors; however, the lack of diverse analog Trojan instances limits robust advances in detection strategies. To address this gap, we present LATENT, the first large language model (LLM)-driven framework for crafting stealthy, circuit-specific analog Trojans. LATENT incorporates LLM as an autonomous agent to intelligently insert and refine Trojan components within analog designs based on iterative feedback from a detection model. This feedback loop ensures that the inserted Trojans remain stealthy while successfully evading detection. Experimental results demonstrate that our generated Trojan designs exhibit an average Trojan-activation range of 15.74%, ensuring they remain inactive under most operating voltages, while causing a significant performance degradation of 11.3% upon activation.

Figures (6)

• Figure 1: Stealthy Trojan insertion workflow using LATENT.
• Figure 2: ReACT prompts demonstrating the Thought-Action-Observation framework for Trojan insertion.
• Figure 3: Illustration of how the LLM agent self-corrects its previous action during the Trojan insertion process: (a) In Iteration 4, the agent inserts a PMOS transistor but assigns it an identifier "Mx", which does not conform to the expected naming convention. (b) However, in Iteration 5, the agent updates the identifier from "Mx" to "M93", following the user-defined requirement. Additionally, the agent takes a new action by inserting an NMOS transistor "M198".
• Figure 4: A Trojan-inserted design corresponding to '642' of AMSNet amsnet, generated by LATENT. The red-highlighted components, including a capacitor and two NMOS transistors, represent the Trojan elements inserted by the agent.
• Figure 5: $R_{evade}$ convergence across iterations for netlists from AMSNet amsnet ($\bigstar$ indicates the minimum number of iterations required for convergence).