# TrojanGYM: A Detector-in-the-Loop LLM for Adaptive RTL Hardware Trojan Insertion

arXiv: https://arxiv.org/abs/2601.17178 · HTML: https://mlsanity.com/paper/2601.17178/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 23 of its 42 references that are in the map.
- First posted on arXiv 23 Jan 2026.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 23 of 23)

- [Reinforcement learning](https://mlsanity.com/paper/2405.10369/) (2024)
- [VeriGen: A Large Language Model for Verilog Code Generation](https://mlsanity.com/paper/2308.00708/) (2023)
- [Chip-Chat: Challenges and Opportunities in Conversational Hardware Design](https://mlsanity.com/paper/2305.13243/) (2023)
- [LLMs and the Future of Chip Design: Unveiling Security Risks and Building Trust](https://mlsanity.com/paper/2405.07061/) (2024)
- [HW2VEC: A Graph Learning Tool for Automating Hardware Security](https://mlsanity.com/paper/2107.12328/) (2021)
- [RTL-Breaker: Assessing the Security of LLMs against Backdoor Attacks on HDL Code Generation](https://mlsanity.com/paper/2411.17569/) (2024)
- [VeriContaminated: Assessing LLM-Driven Verilog Coding for Data Contamination](https://mlsanity.com/paper/2503.13572/) (2025)
- [SALAD: Systematic Assessment of Machine Unlearning on LLM-Aided Hardware Design](https://mlsanity.com/paper/2506.02089/) (2025)
- [ATTRITION: Attacking Static Hardware Trojan Detection Techniques Using Reinforcement Learning](https://mlsanity.com/paper/2208.12897/) (2022)
- [VeriLeaky: Navigating IP Protection vs Utility in Fine-Tuning for LLM-Driven Verilog Coding](https://mlsanity.com/paper/2503.13116/) (2025)
- [DeepRTL2: A Versatile Model for RTL-Related Tasks](https://mlsanity.com/paper/2506.15697/) (2025)
- [TrojanSAINT: Gate-Level Netlist Sampling-Based Inductive Learning for Hardware Trojan Detection](https://mlsanity.com/paper/2301.11804/) (2023)
- [NetDeTox: Adversarial and Efficient Evasion of Hardware-Security GNNs via RL-LLM Orchestration](https://mlsanity.com/paper/2512.00119/) (2025)
- [Veritas: Deterministic Verilog Code Synthesis from LLM-Generated Conjunctive Normal Form](https://mlsanity.com/paper/2506.00005/) (2025)
- [AttackGNN: Red-Teaming GNNs in Hardware Security Using Reinforcement Learning](https://mlsanity.com/paper/2402.13946/) (2024)
- [TrojanLoC: LLM-based Framework for RTL Trojan Localization](https://mlsanity.com/paper/2512.00591/) (2025)
- [LockForge: Automating Paper-to-Code for Logic Locking with Multi-Agent Reasoning LLMs](https://mlsanity.com/paper/2511.18531/) (2025)
- [Trojan Playground: A Reinforcement Learning Framework for Hardware Trojan Insertion and Detection](https://mlsanity.com/paper/2305.09592/) (2023)
- [SENTAUR: Security EnhaNced Trojan Assessment Using LLMs Against Undesirable Revisions](https://mlsanity.com/paper/2407.12352/) (2024)
- [Unleashing GHOST: An LLM-Powered Framework for Automated Hardware Trojan Design](https://mlsanity.com/paper/2412.02816/) (2024)
- [TrojanWhisper: Evaluating Pre-trained LLMs to Detect and Localize Hardware Trojans](https://mlsanity.com/paper/2412.07636/) (2024)
- [LATENT: LLM-Augmented Trojan Insertion and Evaluation Framework for Analog Netlist Topologies](https://mlsanity.com/paper/2505.06364/) (2025)
- [SAND: A Self-supervised and Adaptive NAS-Driven Framework for Hardware Trojan Detection](https://mlsanity.com/paper/2510.23643/) (2025)

## Built on by (most cited first, 2 of 2)

- [LLMs for Secure Hardware Design and Related Problems: Opportunities and Challenges](https://mlsanity.com/paper/2605.10807/) (2026)
- [Hardware Design and Security in the Era of Chiplets and LLMs](https://mlsanity.com/paper/2608.05063/) (2026)

## Abstract (arXiv)

Hardware Trojans (HTs) remain a critical threat because learning-based detectors often overfit to narrow trigger/payload patterns and small, stylized benchmarks. We introduce TrojanGYM, an agentic, LLM-driven framework that automatically curates HT insertions to expose detector blind spots. Given high-level HT specifications, a suite of cooperating LLM agents (instantiated with GPT-4, LLaMA-3.3-70B, Gemini-2.5Pro, and Claude Opus 4.5) proposes and refines RTL modifications that realize diverse triggers and payloads without impacting functionality of both the HT and the design under attack. TrojanGYM implements an agentic loop co-designed with HT detectors, in which constraint-aware syntactic checking, testbench-based functional verification, and GNN-based HT detectors provide feedback that iteratively refines HT specifications and insertion strategies to better surface detector blind spots. We further propose Robust-GNN4TJ, a new implementation of GNN4TJ with improved graph extraction, training robustness, and prediction reliability, especially on LLM-generated HT designs. On the most challenging TrojanGYM-generated benchmarks, Robust-GNN4TJ raises HT detection rates from 0% to 60% relative to prior art. We instantiate TrojanGYM on SRAM, AES-128, UART, and RISC-V designs at RTL, and show that it systematically produces diverse, functionally correct HTs that reach up to 68.75% evasion rates against modern GNN-based detectors, revealing robustness gaps that are not apparent when these detectors are evaluated on existing TrustHub-style benchmarks. We release all codes and artifacts at https://github.com/DfX-NYUAD/TrojanGYM.