In the modern world of electronics, the blueprints for computer chips are written in a specialized language called Register Transfer Level, or RTL. For decades, engineers have manually crafted these intricate instructions to tell hardware exactly how to process data. Recently, a new kind of artificial intelligence known as a large language model has begun to write this code automatically. These models can take a simple sentence describing a hardware function and generate the complex, synthesizable code needed to build it, promising to speed up the creation of everything from smartphones to satellites. However, this convenience introduces a hidden danger. Just as a human apprentice might learn bad habits from a flawed teacher, these AI models can be secretly corrupted during their training. An attacker could inject malicious instructions into the model's learning data, causing it to behave normally most of the time but to insert a hidden flaw, such as a hardware Trojan, whenever a specific, seemingly innocent phrase is used. This creates a silent threat in the supply chain, where a chip might appear to work perfectly until a specific trigger activates a secret, damaging function.

The challenge for defenders is that these models are often massive, complex, and trained on data that no single company can fully verify. Traditional methods to fix a poisoned model usually require retraining the entire system from scratch, a process that is so computationally expensive and data-heavy that it is often impossible for design teams to perform. Furthermore, simply trying to make the model "forget" the bad data often breaks its ability to write good code, leaving the hardware useless. Researchers at the University of Central Florida have developed a new approach called RTLGuard to solve this dilemma. Instead of rebuilding the entire model, they use a lightweight technique that pairs a small, trusted "teacher" model with the large, potentially poisoned "student" model. The teacher, which has been trained on a small set of clean, verified data, guides the student to unlearn the malicious behaviors while keeping its ability to write correct hardware code intact.

The researchers tested this method by first creating their own poisoned models. They took standard, open-source AI models and fine-tuned them using a mix of clean data and malicious samples designed to hide hardware Trojans. These Trojans were subtle; the models would still produce code that looked correct and worked as expected under normal conditions, but they would embed hidden flaws that could leak data, shut down systems, or degrade performance when a specific trigger phrase was used. In their experiments, these poisoned models failed to generate secure code roughly 91 percent of the time when tested with trigger phrases, while their ability to generate correct, functional code dropped significantly. The researchers then applied RTLGuard, using a much smaller, clean version of the same model family as the teacher. This teacher did not need to know what the specific malicious triggers were; it simply provided a reliable reference for what correct, safe code should look like.

The results showed that this teacher-student approach successfully neutralized the threat without destroying the model's utility. When the researchers used a teacher model of the same size as the student, the attack success rate dropped from 91 percent down to just 16 percent. Even when the teacher was significantly smaller than the poisoned student, the defense remained effective, reducing the attack success rate to between 20 and 30 percent. Crucially, the models did not lose their ability to do their job. Before the defense, the poisoned models were only able to generate functional, correct code about 19 percent of the time. After being cleaned by RTLGuard, their success rate in generating working code jumped to over 45 percent. This improvement occurred across different types of AI architectures and even when the teacher and student models came from different families, suggesting the method is robust and adaptable.

The study also explored why this method works so well by breaking down the process into three parts. The system first used standard supervision to teach the student to write correct code again. It then used a technique called knowledge distillation, where the student mimics the teacher's choices for every word it generates, effectively overwriting the bad habits learned during the poisoning phase. Finally, it aligned the internal representations of the two models, ensuring the student's "thought process" matched the teacher's clean logic. The researchers found that using all three components together produced the best results, far outperforming methods that relied on only one of these techniques. They also compared RTLGuard to other existing defense strategies, such as those designed to make models forget specific data or to distill attention patterns. In these comparisons, RTLGuard consistently achieved a lower rate of successful attacks while maintaining higher code quality, proving that a targeted, lightweight recovery is more effective than broad, heavy-handed fixes.

One of the most significant findings was that the defense worked even when the models were tested on data they had never seen before. The researchers evaluated the cleaned models on a different set of hardware design problems than the ones used during training, and the models continued to resist the attacks while generating high-quality code. This suggests that the defense does not just memorize a list of bad examples to avoid, but rather learns a fundamental understanding of safe design principles from the teacher. The researchers also verified their results using multiple methods, including having a second, independent AI system check the outputs and manually inspecting a sample of the code. These checks confirmed that the reduction in attacks was real and that the remaining errors were not just artifacts of the testing process.

This work highlights a critical shift in how we might secure the future of hardware design. Rather than assuming that a model is either perfectly safe or completely broken, RTLGuard demonstrates that compromised systems can be repaired efficiently. The approach requires only a small amount of trusted data and a fraction of the computing power needed for full retraining, making it a practical solution for companies that rely on third-party AI models. By using a trusted guide to steer the model back to safe behavior, the researchers have shown that it is possible to maintain the speed and convenience of automated design without sacrificing the security of the final product. The study concludes that this teacher-student framework offers a viable path forward for protecting the integrity of the chip supply chain against hidden, data-driven threats.