用GPT-4.1给硬件RTL自动生成安全断言，Hack@DAC'21上89%能跑通，还抓到一个新bug，做芯片安全的值得看。
CHARGE是一个基于CWE层次结构和LLM的自动化框架，面向未验证的RTL模块生成安全属性。在Hack@DAC18、19、21的SoC设计上，使用OpenAI的GPT-4.1评估，CHARGE检测出42个已知缺陷中的27个。针对Hack@DAC21的OpenPiton SoC，89%的生成SVA可在Cadence JasperGold FPV中运行，92.2%为非空断言。与人工编写的属性相比，CHARGE在三个缺陷上正确写出了人工属性出错的内容。此外，CHARGE生成的属性还识别出OpenPiton SoC中一个此前未被发现的新缺陷。
CHARGE: Leveraging CWE Hierarchies for Hardware Security SystemVerilog Assertion Generation
This paper presents CHARGE, an automated framework for generating security properties for unverified RTL modules using CWEs and large language models (LLMs). The hallmark is a reasoning process that leverages the hierarchical nature of CWE entries to improve accuracy when identifying security-critical assets in unverified RTL modules. As a result, the approach can infer expected security behaviors and generate properties from identified assets and CWE semantics, avoiding the need for trusted design specifications and reducing manual engineering effort. We evaluate the framework on the Hack@DAC18, 19, and 21 open source SoC designs using OpenAI's GPT-4.1. CHARGE detects 27 of 42 known bugs in these designs. For Hack@DAC21 OpenPiton SoC, 89% of the generated SVAs run in Cadence JasperGold FPV, and 92.2% are non-vacuous. We compare to an open-source, manually written set of properties for these designs and find that CHARGE correctly writes properties for three bugs in which the manually written properties were incorrect. In addition, CHARGE-generated properties identify a new bug in the Hack@DAC21 OpenPiton SoC that was not previously identified.
- OpenAI07-29 23:57原文