AttackonCTF: Defending Hardware Security Competition Benchmarks in the Age of LLMs

Technical Summary: AttackonCTF: Defending Hardware Security Competition Benchmarks in the Age of LLMs

Problem Statement
Hardware security competitions, such as HackTheSilicon, serve as critical benchmarks for evaluating vulnerability detection tools and training human researchers and AI models. These competitions utilize open-source System-on-Chip (SoC) designs (e.g., OpenTitan) with injected industry-informed vulnerabilities. A fundamental requirement for participation is the submission of comprehensive technical reports demonstrating genuine security reasoning, rather than simple code comparison.

However, the authors identify a critical validity threat posed by Large Language Models (LLMs). Recent advances allow LLM-based detectors to bypass the requirement for deep security analysis by exploiting "shortcuts." Instead of reasoning about the malicious design in isolation, these models utilize Retrieval-Augmented Generation (RAG) to fetch original, clean versions of the code from public repositories, commit histories, or Pull Requests. By performing an automated "diff" between the retrieved clean code and the buggy target, LLMs can generate high-quality vulnerability reports with high detection rates (75–83%) without performing genuine hardware security reasoning. This undermines the educational integrity of the competitions and invalidates benchmarks intended to evaluate the reasoning capabilities of AI.

Methodology
The paper proposes a two-pronged approach: empirical validation of the "diff-exploit" hypothesis and the development of a novel defense mechanism.

1. Empirical Validation of LLM Shortcuts:
   The authors designed four progressively sophisticated LLM-based vulnerability detectors (D1–D4) to simulate realistic attack scenarios:

   • D1 (Diff-Aware): Receives only the unified diff between buggy and clean code.
   • D2 (Repository-Aware RAG): Receives buggy code and retrieves relevant context (RTL code) from a repository index.
   • D3 (History-Aware RAG): Extends D2 by retrieving development history (Pull Requests, commits) to provide temporal context.
   • D4 (Weakness-Aware RAG): Augments D2 with hardware security domain knowledge from the Common Weakness Enumeration (CWE) database.
     These detectors were tested on unobfuscated HackTheSilicon benchmarks to establish baseline performance.

2. The AttackonCTF Obfuscation Framework:
   To counter these shortcuts, the authors introduce the first LLM-oriented, semantics-preserving obfuscation framework tailored for hardware security benchmarks. Unlike traditional hardware obfuscation tools designed for Intellectual Property (IP) protection (which render code unreadable via aggressive identifier encryption and layout anonymization), AttackonCTF prioritizes human readability and educational value while disrupting LLM-based syntactic matching.

   The framework operates through a pipeline involving:

   • Constraint Extraction: Defining formal invariants (e.g., preserving module interfaces, signal widths, reset behavior, and FSM semantics) that the LLM must respect during rewriting.
   • Span Selection: Identifying vulnerable code regions to transform while avoiding protected areas.
   • Code Rewriting: Utilizing an LLM to apply five specific transformation strategies:
     1. Identifier renaming with semantically neutral alternatives.
     2. Control-flow restructuring via equivalent expressions.
     3. Diff-noise injection: Introducing benign modifications to disrupt syntactic similarity with the original reference design.
     4. Context dilution: Obscuring or dispersing security-relevant cues.
     5. Logic rewriting using Boolean algebra and temporal transformations.
   • Verification: A rigorous loop using Verilator for syntax checking and Yosys for formal semantic equivalence checking (SAT-based proofs) to ensure functional correctness and semantic equivalence to the original design.

Key Contributions

• First Empirical Demonstration: The paper provides evidence that LLM-based vulnerability detection on hardware benchmarks relies heavily on diff-based syntactic comparison and retrieval of original code, achieving 75–83% detection rates without genuine security reasoning.
• Novel Obfuscation Framework: The development of the first readability-preserving, LLM-specific obfuscation framework that employs diff-noise, context dilution, and semantic misdirection.
• Automated Verification Pipeline: An integrated system ensuring that obfuscated designs remain semantically equivalent and fully functional, suitable for both human analysis and AI training.
• Benchmark Integrity Restoration: A method to restore the validity of hardware security competitions by preventing automated diff-exploitation while maintaining the ability for participants to learn from the designs.

Results
The framework was evaluated on three HackTheSilicon benchmarks (Hack@DATE'25, Hack@DAC'25, Hack@CHES'25) based on OpenTitan, containing 50 unique vulnerabilities across 27 CWE categories. The detectors (D1 and D4) were tested against obfuscation levels of 0%, 10%, 50%, and 100%.

• Baseline Performance: On unobfuscated benchmarks, D1 achieved an 83.3% detection rate, and D4 achieved 77.1%.
• Impact of Obfuscation:
  • At 10% Obfuscation: Detection accuracy dropped significantly by 48–55%, despite a smaller drop in detection rate. This indicates that even minor syntactic changes severely disrupt the models' ability to rely on diff-based patterns, causing a spike in false positives.
  • At 100% Obfuscation: The framework reduced LLM-based detection accuracy by 78.6% (dropping to ~15%) and reduced detection rates by approximately 50% (D1: 83.3% → 54.3%; D4: 77.1% → 48.9%).
• Human Readability: Unlike traditional obfuscation, the resulting designs remained interpretable for human analysts, preserving the educational value of the benchmarks.

Significance
The paper claims that its work addresses a critical gap in hardware security research: the validity of benchmarks in the age of advanced AI. By demonstrating that current LLM-based "detection" is often merely automated diffing, the authors argue that existing evaluations may overstate the reasoning capabilities of AI. The proposed AttackonCTF framework offers a practical solution to restore benchmark reliability. It allows the community to continue using open-source SoC designs for training and competition while ensuring that high performance metrics reflect genuine security reasoning rather than the exploitation of syntactic correlations with known clean code. This enables a more accurate assessment of both human and AI capabilities in hardware vulnerability analysis.