# ThreatLens: LLM-guided Threat Modeling and Test Plan Generation for Hardware Security Verification

arXiv: https://arxiv.org/abs/2505.06821 · HTML: https://mlsanity.com/paper/2505.06821/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 18 references that are in the map.
- First posted on arXiv 11 May 2025.

## Builds on (most cited first, 4 of 4)

- [(Security) Assertions by Large Language Models](https://mlsanity.com/paper/2306.14027/) (2023)
- [LLM for SoC Security: A Paradigm Shift](https://mlsanity.com/paper/2310.06046/) (2023)
- [MABFuzz: Multi-Armed Bandit Algorithms for Fuzzing Processors](https://mlsanity.com/paper/2311.14594/) (2023)
- [PSOFuzz: Fuzzing Processors with Particle Swarm Optimization](https://mlsanity.com/paper/2307.14480/) (2023)

## Built on by (most cited first, 7 of 7)

- [VerilogDB: The Largest, Highest-Quality Dataset with a Preprocessing Framework for LLM-based RTL Generation](https://mlsanity.com/paper/2507.13369/) (2025)
- [Distilled Large Language Model in Confidential Computing Environment for System-on-Chip Design](https://mlsanity.com/paper/2507.16226/) (2025)
- [DeepV: A Model-Agnostic Retrieval-Augmented Framework for Verilog Code Generation with a High-Quality Knowledge Base](https://mlsanity.com/paper/2510.05327/) (2025)
- [LAsset: An LLM-assisted Security Asset Identification Framework for System-on-Chip (SoC) Verification](https://mlsanity.com/paper/2601.02624/) (2026)
- [PriMod4AI: Lifecycle-Aware Privacy Threat Modeling for AI Systems using LLM](https://mlsanity.com/paper/2602.04927/) (2026)
- [ATLAS: AI-Assisted Threat-to-Assertion Learning for System-on-Chip Security Verification](https://mlsanity.com/paper/2603.01170/) (2026)
- [VeriChat: An Agentic Conversational AI Assistant for Hardware Security Verification](https://mlsanity.com/paper/2607.01668/) (2026)

## Abstract (arXiv)

Current hardware security verification processes predominantly rely on manual threat modeling and test plan generation, which are labor-intensive, error-prone, and struggle to scale with increasing design complexity and evolving attack methodologies. To address these challenges, we propose ThreatLens, an LLM-driven multi-agent framework that automates security threat modeling and test plan generation for hardware security verification. ThreatLens integrates retrieval-augmented generation (RAG) to extract relevant security knowledge, LLM-powered reasoning for threat assessment, and interactive user feedback to ensure the generation of practical test plans. By automating these processes, the framework reduces the manual verification effort, enhances coverage, and ensures a structured, adaptable approach to security verification. We evaluated our framework on the NEORV32 SoC, demonstrating its capability to automate security verification through structured test plans and validating its effectiveness in real-world scenarios.