ThreatLens: LLM-guided Threat Modeling and Test Plan Generation for Hardware Security Verification

TL;DR

Hardware security verification suffers from scalability and completeness gaps due to manual threat modeling and test planning. The authors propose ThreatLens, an LLM-based multi-agent framework that combines retrieval-augmented generation and interactive feedback to automate threat identification, policy extraction, and test-plan generation. On the NEORV32 SoC, ThreatLens produced 854 security policies and validated the end-to-end workflow with two case studies, illustrating practical relevance to hardware security verification. The approach offers a scalable, adaptable workflow that can reduce manual effort while increasing coverage, with future work targeting security asset extraction and open-source LLM integration.

Abstract

Current hardware security verification processes predominantly rely on manual threat modeling and test plan generation, which are labor-intensive, error-prone, and struggle to scale with increasing design complexity and evolving attack methodologies. To address these challenges, we propose ThreatLens, an LLM-driven multi-agent framework that automates security threat modeling and test plan generation for hardware security verification. ThreatLens integrates retrieval-augmented generation (RAG) to extract relevant security knowledge, LLM-powered reasoning for threat assessment, and interactive user feedback to ensure the generation of practical test plans. By automating these processes, the framework reduces the manual verification effort, enhances coverage, and ensures a structured, adaptable approach to security verification. We evaluated our framework on the NEORV32 SoC, demonstrating its capability to automate security verification through structured test plans and validating its effectiveness in real-world scenarios.

Figures (4)

• Figure 1: Overview of proposed ThreatLens framework. The blue arrows indicate the flow for test plan generation for physical and supply chain attacks and the orange arrows indicate the flow for that of software-exploitable hardware vulnerabilities.
• Figure 2: Overview of Threat Identification Agent.
• Figure 3: Overview of Security Policy Generator Agent.
• Figure 4: Overview of Test Plan Generator Agent.